Slashdot Mirror

← Back to Stories (view on slashdot.org)

Using Spyware to Report Pirates?

Posted by Cliff on from the do-the-ends-justify-the-means dept.

An anonymous reader asks: "I have visibility to AUP complaints we receive at work, and we receive messages from a software vendor that make it obvious that their product is phoning home when it discovers it is running a cracked copy of itself." Apparently the software phones home, and then the publisher's legal department sends the administrator an e-mail. "The message goes on to detail the users IP, a timestamp, the product in question, the users PC name, username, and MAC address. This falls under -my- definition of 'spyware.' What are your thoughts?" Software has been making surreptitious checks for "piracy" for over a decade, yet these checks are usually limited to the software itself, and not data on the user's machine. Do you feel software publishers should have the right to peer into users data, if their software suspects foul play on the machine, or should it do the easy and intelligent thing and just stop working?

53 of 1,013 comments (clear)

  1. What we want to know... by Jeremiah+Cornelius · · Score: 5, Interesting

    Just WHO is this publisher?

    --
    "Flyin' in just a sweet place,
    Never been known to fail..."
    1. Re:What we want to know... by wo1verin3 · · Score: 5, Interesting

      I'd still like to know what publisher does this, and if my company is a customer of this company which decides to spy on our systems without permission then I would a) ensure we move to another software vendor and b) make the company aware of why we choose to move to another vendor.

    2. Re:What we want to know... by innosent · · Score: 4, Interesting

      That's a great idea, from all perspectives, but taking it one step further, when it checks for updates, the server should check the serial number against a list of known/suspected pirated numbers. If the serial number is bad, then send dummy updates, ones that force the program to say: "this program is not registered, please call 800-URF-CKED".

      If you do it this way, then the real license holder will call to find out why it doesn't work, at which point you can try to find out why their serial number is pirated. Something like this could have prevented the 112-1111111 M$ thing from ever happening, without screwing things up for the end user. Put reasonable limits on how many duplicate licenses you can have, and if you've seen too many, put that number on the list. You won't stop the first few pirated copies, but you'll stop the last 90,000, and you'll find out who leaked the number in the first place. As an extra feature, for corporate keys, you could restrict it to the corporation's IP block.

      Damn, maybe I should patent that... Oh well, consider it prior art.

      --
      --That's the point of being root, you can do anything you want, even if it's stupid.
    3. Re:What we want to know... by Tongo · · Score: 5, Interesting

      On my machines I run Sygate Personal Firewall. I have it set to block traffic based on application, not port number (although that MAY be possible also). If an application doesn't have defacto permission to access the internet it will ask me. The I set it to allow my most used applications through without prompting. Works quite well actually. It is amazing the amount of stuff that is trying to call out all the time.

    4. Re:What we want to know... by dolo666 · · Score: 5, Interesting

      What if it's wrong? What if you really paid for the software and someone *else* cracked it and passed it around?

      Some of the appz/games in stores get cracked and put back on shelves. It happens all the time. And how many of you keep your sales receipt, box or even CD? I have software running that is paid for but I don't have evidence that I bought some of it; I still have a right to run it.

      The problem is that while this monitoring is a good idea in theory, there are too many variables that would trigger reasonable doubt in court. This would tie up a court for quite some time with possibly unreliable evidence garnered as reasonable.

    5. Re:What we want to know... by DaCypher · · Score: 5, Interesting

      What if that application, say, an FTP client, requires access to the internet to do its job? So you allow it access to the internet for this purpose, but could it still sneak its connections in to its home server since the firewall assumes this is legitimate behavior?

    6. Re:What we want to know... by MrBlue+VT · · Score: 5, Interesting

      I run cracked versions of video games all the time. Why? Because I've stolen it? No, because I don't want to have to stick the damn CD in the drive everytime I want to play the game. Nothing is more annoying than the stupid "copy protection" that makes you hunt around for the particular game cd and then put it in your machine (heaven forbid you are using the cdrom at the same time to play music or burn a cd!).

    7. Re:What we want to know... by nolife · · Score: 3, Interesting

      I have used Zonealarm before and I set IE to ask everytime for access. I left IE the default browser but never actually used it for my browsing. Spurious requests for to start IE would be a red flag that something was trying something funny.

      --
      Bad boys rape our young girls but Violet gives willingly.
    8. Re:What we want to know... by Kleedrac2 · · Score: 2, Interesting

      Some games still have that old friend, check out Uplink, the great hacker game (and yes it's got the native Linux binaries on the disc) from Introversion Kleedrac

      --
      Sure we wang, can.
    9. Re:What we want to know... by _xeno_ · · Score: 5, Interesting
      I'm disappointed by the replys so far. I keep on getting these two conflicting vibes from people on Slashdot - some people who seem to really want Linux to succeed on the desktop and therefore have companies write software for it (like, say, games or video codecs...), and people who seem to want to keep the "non-free polution off their system."

      If Linux is to succeed on the desktop, then third parties must be allowed to write closed-source applications for Linux. (If, for no other reason, than to allow custom buisness software to continue to run on the systems.) In that case, a vendor very well could include spyware, and being able to block just that application would be very nice.

      Can Linux block net access by individual program? I don't know - I think netfilter may be able to be hacked to do it, but I'm not 100% sure. (It looks like it might be possible to write a netfilter module to do it, but it may require modifying the netfilter system itself, which would involve kernel hacking. When I wrote this, www.netfilter.org was not responding, so I'm guessing based on documentation on other sites and what was available through the Google cache.)

      Does this make Linux on the desktop less secure than Windows? Well, erm, not really. The Windows default firewall only exists in XP (or maybe some SP added it to previous versions, I dunno), and it blocks based on ports. Third-party firewalls like ZoneAlarm and the aforementioned Sygate Personal Firewall can block based on application.

      So Linux is no more secure than Windows on its own. Add in some more software, and it can be. The next question is: if Windows had this feature, and Linux did not, would Linux on the desktop be less secure than Windows? I think the answer is yes, based on the idea that Linux on the desktop must be capable of using closed-source software, and that such software would be prevelant on a successful Linux desktop, and that there would exist users for the software.

      Dismissing Linux as safe because there currently is no real spyware out for the Linux desktop does not really address the question. Assuming there were, it would be nice to be able to block just one application. Blocking a port would not be enough (since it could just use 80, then no web browsing for you...). Blocking an IP is the obvious "right way" but it still might not be the best solution if that cuts your off from the webpage or other important service.

      So being able to block by a given application is probably better than only by packet info (like IP, port, flags, etc.). If the question were simply "OS/A can block net access by application, is it more secure than OS/B that cannot" would people still say "OS/A is more secure because it's open source?" Or is this an emotional response based on the fact that it was Linux vs Windows?

      --
      You are in a maze of twisty little relative jumps, all alike.
    10. Re:What we want to know... by Lshmael · · Score: 5, Interesting

      That's the point. That conflicts with the entire practice of people being innocent until proving guilty. Since it is a former attorney general saying it, the poster was implying that the government does not care about trampling on civil rights in its relentless pursuit for "justice." Meese was saying, "If we think you did something wrong, you did. No questions. Stop talking. 2 + 2 = 5."

      Where does the madness stop? What is the publisher had disabled the computer or reformatted the hard drive? Would that be justified? What is the software was actually *NOT* pirated?

    11. Re:What we want to know... by Rich0 · · Score: 2, Interesting

      Too lazy to look up the docs...

      Will the --cmd-owner option allow a full path to the executable. I would like /usr/bin/mozilla-bin to be able to browse the web. However, /home/user2/fancygame/spytrojan/mozilla-bin probably shouldn't be able to. I can call anything I want mozilla-bin...

      It would be nice if somebody wrote a nice front-end (a la Tiny Personal Firewall) for getting application permissions set up initially. I don't have time to try to guess what applications on my workstation need to connect to where. Sure, there is netstat -tnp, but that doesn't show you the program that you only run once a week and aren't running at the moment...

    12. Re:What we want to know... by metamatic · · Score: 2, Interesting

      Norton Internet Security lets you block based on content. So you can, for example, block any TCP/IP connection which includes your MAC address.

      Of course, they could always encrypt it, but then you could block encrypted (i.e. not FTP-like) traffic.

      --
      GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
  2. Depends on how you look at it I suppose. by ShadowBlasko · · Score: 4, Interesting

    Its been going on for quite some time now.

    You use the illegal software, I don't see any reason why someone who's life work might involve *writing* said software would not want to catch you pirating/using is Illegally.

    I'n not all that sure how I feel about the users computer information being fired off in an email, but I have always considered that a possibility in the past. Seems like I was right.

    --
    There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order- Ed Howdershelt Via Tass
    1. Re:Depends on how you look at it I suppose. by Mistlefoot · · Score: 2, Interesting

      Many new vehicles have gps.

      Not an issue for most vehicle owners. But you steal it and you get caught easier.

      Is this spying? While I won't say the analogy is perfect this is still very similar....

    2. Re:Depends on how you look at it I suppose. by Anonymous Coward · · Score: 1, Interesting

      Not Necessarily.

      We have six machines in the office. I have gone back to WIN98. We have three Win98 Licensses, one WinME license, Two WIN2000 Licenses and two WINXP Professional licesnes. All licenses are backward ok, even Microsoft agrees on that point. I have only opened one of the WIN98 Packages and used the same disk and registration number for all six machines. More Convenient. No matter how you look at it, we are fully licensed. Even the BSA would not argue with that one.

      So I do not need spyware checking for duplcate registration numbers.

      Tom

    3. Re:Depends on how you look at it I suppose. by rizzo420 · · Score: 2, Interesting

      it is similar, but the software does more than just report where it is located (assuming the gps reports back to something, which is highly unlikely, because that gives dealers the ability to spy on legit owners). if the software only reported the the users IP, a timestamp, and the product in question, then there would be much less of a problem. what the software reports that is very questionable is the username of the account that's using the pirated software. this gives the company an easier ability to break into the network since they have a valid username and can use that to guess what the username of other known employees would be. the mac address and the machine name are also questionable because they are also not necessary. really all that is needed to prove wrongdoing is what i stated above. that doesn't break privacy if the IP is public since it's known information. the product in question is necessary for the obvious reasons, and a timestamp always helps anywyas.

      i also don't see how this can be legal unless it's listed in the EULA as being there, but that doesn't give them a right to send themselves the information that i said was unnecessary and could be used for wrongdoing by the publisher or any other script kiddie/hacker/cracker that gets ahold of it.

      --
      please me, have no regrets.
    4. Re:Depends on how you look at it I suppose. by Anonymous Coward · · Score: 1, Interesting

      > If the software license made it clear up front that the package could and would periodically check that its use was within the boundaries set by the license (eg, full licensing) then I don't see anything wrong with a publisher checking up on its users in this way.

      This ignores the fact that you don't have to agree to a software license to use it. You have a legal right to alter your copy of a copyrighted work and to use it. You also have the right to alter the work to not report to "home base". The problem is, these two components (especially the latter) are likely to be patched against a distributed copy anyways. The only "good" thing might be that a person attempting to crack the software might get caught during or after releasing the cracked software. Of course, announcing that the above happens is just going to make more crackers setup pseudo-internet networks and sniff outgoing packets to see what the software is doing. I guess it does make the crackers job harder and will see more charged, but the people really being punished are all the uber-legal folks who don't crack the software, agree to the license, and have their usage tracked.

    5. Re:Depends on how you look at it I suppose. by BiteMeFanboy · · Score: 2, Interesting
      This is almost like a Lojak system - the car is stolen, then the security system reports back to the police exactly where the car is. What if you stole the car and it's parked in your garage with the door closed? Yes, I understand that this example doesn't exactly parallel that of the article, but it is similar. The Lojak system doesn't check around the house to see if there are any other stolen things there...it's just concerned about one thing - the car. Much like the software that is described in this article.

      Except that it's using MY resources to do so. Not only is the software stealing from me, bandwidth, CPU, and memory, it's forcing me to incriminate myself. Guess what... that's un-constitutional.

  3. Another question... by Decaffeinated+Jedi · · Score: 5, Interesting
    Is it spyware if it's mentioned in the User Agreement that you accepted?

    DecafJedi

    --
    DecafJedi
    my weblog: apropos of something
  4. I thought DOD fought this years ago by Anonymous Coward · · Score: 2, Interesting

    I seem to remeber that a vendor did this to the Dod like in the early 80's. I also thought the DOD took them to court and won. I can't see how it is legal unless it is in the licensing agreement.

  5. Active copy protections... by Satan's+Librarian · · Score: 4, Interesting
    It's spyware. I think active copy protections such as that are stupid anyway - what happens if the user is legitimate, but either had a file corrupted or a virus infected it? I'd assume they are just doing an MD5 hash of their software at best for the check for cracks, and a parasitic .exe virus would set it off right away. So would some older methods of file innoculation, random disk/transfer corruption, and a whole lot of other things.

    There's a legend that Microsoft actually encountered this back with Microsoft Word 1.0 - it formatted the hard drive if the CRC of the program changed. Bad karma there, hosing innocent users if they got infected. (BTW - I've seen Vesselin Bontchev reference it here and other places, but it could just be he picked up a convenient rumor. Anyone have verification of this story?

    If it's not documented in the EULA for the product, it might even be a potential civil suit against the company. Doesn't Europe have fairly restrictive privacy laws that could come into effect here? Could be criminal there if so, especially if it misfired on an innocent user. Although of course - IANAL.

    BTW - what product?

    --
    I write code.
  6. windows ? by jacquesm · · Score: 3, Interesting

    How many packets does your machine send out that you have not looked at personally ? Mine does that *all* the time (I don't have the time nor the resources to check them all).

    This means that if say MS is checking the contents of my machine and starts harassing me over possibly illegal software that I would have no way of knowing that the info was retrieved using spyware. it's the stupidity of the 'presentation' that gives this one away, if they were a bit more clever about it you'd never have known that it was spyware related.

    The best way to avoid this kind of trouble is to go completely open source or make sure your licenses are paid up :)

    are you on the grapevine yet ?

    --
    MP3 Search Engine
  7. What if it was a legit version? by ad0gg · · Score: 4, Interesting

    With the game Black and White that I own, the cd copy protection gave my computer so much problems and the only solution the publisher gave me was to install a new cdrom, so I was forced to install the cd crack to actually play the game. I'd hate to be labeled a pirate and taken to court because I actually wanted to play a game I legally purchased(Hell I preorded).

    --

    Have you ever been to a turkish prison?

    1. Re:What if it was a legit version? by theskipper · · Score: 2, Interesting

      Or if the publisher doesn't allow an archival backup to be made.

      Case in point, my GTA Vice City CD was getting scratched up so, knowing that the play disk was copy protected, I decided to read the license agreement to see how this is handled:

      "Software Backup or Archiving. After You install the Software into the permanent memory of a computer, You may keep and use the original disk(s) and/or CD-ROM (the "Storage Media") only for backup or archival purposes."

      No mention of a single backup copy or any other solution.

      Of course the problem is that the CD is required to run the game. So there's lots of eventual wear and tear no matter how careful you are.

      To bring this back on topic, after searching the web for ways to burn a backup I gave up on the idea and found a cracked copy. It works great but it gives me the willies.

      So what happens if there's phone-home code in the executable? By using an obviously cracked exe, the chances are that I'd be assumed to be a pirate even though I am innocently trying to exercise my fair use rights. To take it a step further, what if the publisher is a member of the BSA?

      This is old hat stuff for /. but real life examples are what "brings it home" to the average Joe.

  8. Why are they sending you this information??? by GreenCrackBaby · · Score: 3, Interesting

    I can't tell, but I'm assuming that you work at an ISP (AUP complaint?). Why on earth would you care about this information?

    "Oh no! One of our users is doing something illegal and it has nothing to do with us! Quick, pull the plug on him!!!"

    Seriously...unless you are law enforcement, what could you possibly do with this information? If I wrote your ISP and told them I saw you smoking pot, should I expect them to pull the plug on your connection??? How is this any less rediculous?!?

    --

    "The market alone cannot provide sufficient constraints on corporation's penchant to cause harm." -- Joel Bakan
  9. Virus effects? by RonnyJ · · Score: 2, Interesting

    How exactly would a program go about detecting accurately whether it's cracked? I'd hate to get a virus infection, which changed the executable slightly, and then end up being accused of cracking the software.

  10. Re:The right? No. But does it matter? by fuzzybunny · · Score: 3, Interesting


    Erm...while I grant you that in a civil case the rules of evidence will be much more lenient than in a criminal one, there are statutes related to industrial espionage which you could cover yourself with.

    IANAL etc etc, but I am under the impression that, unless you explicitly agree to a function which is not arguably part of the 'core' raison d'etre of the software, things like collecting information without someone's consent on legitimately licensed PCs could be construed as breaking and entering, or the digital equivalent.

    If the software only does this for unlicensed copies, I wonder whether you couldn't use a similar strain of argument (license was not active for arcane technical reasons, whatever.)

    Admittedly, without starting an argument about it, I don't have strong moral qualms about piracy, and I do believe there are certain limits as to what's allowed in terms of evidence collection/snooping even if you are doing something legally "wrong".

    Frankly, I think companies should try to use free/open software anyway if they can, so this never even becomes an issue (ask SCO! :-)

    --
    Cole's Law: Thinly sliced cabbage
  11. Re:why not? by vDave420 · · Score: 5, Interesting
    Troll, but I will bite anyway.

    As someone who makes a living writing peer-to-peer software, I completely disagree that "STEALING IS STEALING" as you say.

    I don't want to get into semantics with you, but here goes:
    Stealing involves the deprivation of someone's property, removing thier ability to benefit from it. (paraphrase)

    Information "theft" is not really theft or stealing.

    Thousands of my users probably "steal" my software, but guess what! I DON'T CARE! It is information, which I CANNOT OWN!

    Noone, corporation or individual, has a right to profit.

    Everyone has a NATURAL right to consume and reproduce information. How do I know? Look how we are physically built, for crying out loud!

    Let me close with this somewhat fanatical thought: Every month new ground is broken in the attempt to produce objects by piecing them together molecule by molecule.

    Now, it will probably take longer than my lifetime to occur, but EVENTUALLY you all will be able build a generic THING from its component molecular pieces.

    Consider this "future" world for a moment: No more scarcity, no more hunger, no more epidemics caused by lack of medicines.

    Now consider the same world, with *your* "STEALING IS STEALING end of story" claim: Should the first person/company that creates a new molecular structure have a monopolistic control over said structure? Should you be able to produce (from scratch, not by "physically stealing") a replacement Brake Pad for your car without paying Ford for the privelidge? What about creating your very own "claritin-like" substance for your allergies? Should you have to pay Mosanto?

    I stated before, and firmly believe, that information wants to be worthless, in an economic sense. Information has no "owner" that I recognize, and, as such, I do not consider the "copying" of information to be "theft".

    If someone broke into my office and stole the computer I was writing my source code on, then THAT is theft of information, as it has deprived me of it.

    If someone copies (without my permission) my program and uses it without paying me, oh well! I haven't been deprived of anything! I still have my program! The only thing I *may* have lost is potential profits, but NOONE HAS A NATURAL RIGHT TO PROFIT! NOONE!
    (Thats why "Step 2: ???" is so common! heh)

    In the above "idealistic copying world" example above, noone could profit! There would be no object scarcity, therefore (almost) no intrinsic value to *ANYTHING*, let alone "strictly informational things."

    Time to end this rant, but PLEASE PLEASE consider:
    The end result of personal "posession & ownership" of information, combined with monopolistic control, and the added "Lets consider artificial entities with the stated goal of financial wealth accumulation (corporations) the same as people, with the same 'rights' to own information, etc, is a CORPORATE FEUDAL SYSTEM, not the (what I consider) ideallic, everything-copying society that we COULD have then.

    The road we are starting down today is leading us towards the scarier of the two, I believe.

    -vDave-

    {dave -at- bearshare -dotcom-}

    Help me out, and use BearShare for all of your p2p (INFORMATION COPYING) needs!

    --
    The pig browse. With Google. Sigh is to the chicken. Chicken is fool. Giggle. The DailyWTF giggle.
  12. Re:why not? by shepd · · Score: 2, Interesting

    >It is theft.

    No it isn't. If it were, pirating windows would get me a $100 fine and a weekend in jail.

    In fact, as far as the courts go, it SPECIFICALLY isn't theft because the crime of theft has a much more reasonable sentence. If I were to compare it (copyright infringement) to a similarly punished crime, it's like raping dead corpses.

    --
    If you could be told what you can see or read, then it follows that you could be told what to say or think - BoC
  13. Re:why not? by pla · · Score: 5, Interesting

    Seriously folks I think lately we've forgotten that stealing is stealing, and if you're stealing a piece of software you should be punnished for stealing a piece of software.

    And for those situations where stealing doesn't mean stealing?

    Two trivial examples that I suspect most us us could get "caught" for:

    First, a friend purchased (completely legal, nothing unkosher whatsoever, not even grey-market) a copy of Age of Empires - AoK. It has a rather annoying copy protection scheme, however, which annoys legitimate users (whereas pirates just run a cracked version with no hassles at all). So the solution? He uses a cracked copy of the game. A stupid software test for known program cracks would flag him as "stealing", yet he did no such thing.

    Second, and even more difficult to deal with - I have all of my CD collection on my HDD, since I only ever listen to them while at the computer. Legal format-shifting as allowed even by the DMCA. Yet, can I "prove" to some stupid spyware bot that yes, in fact, I really do own the CD? Nope. And even if I could, I shouldn't NEED to; my computer serves me, I do not serve my computer.


    More important than false positives, though, we should consider the issue of why we buy software in general. If I buy a game, I buy it to play that game. If nowhere in the documentation (or preferably, on the outside of the packaging) does it describe its "RIAA-friendly anti-piracy technology", it damn well better not have any. I don't buy software to spy on me, I buy it to do the task it describes itself as performing. Nothing more, and nothing less.

  14. Re:why not? by tomhudson · · Score: 4, Interesting
    Simple solutions:
    1. Unplug the phone jack/ethernet card
    2. Find out where its' sending packets to, and edit your hosts file on your proxy/firewall accordingly
    3. Remove the software (duh!)
    Or, to take the parent posters' idea of a virus (actually, a worm) to the next step, have it scout the net looking for legit copies, and installing the crack on their machines. So even legit customers would end up "phoning home".

    Seriously, just remove the software. If it does something you want/need, you have three choices:

    1. buy a legit copy
    2. develop a competing product
    3. put up with the knowledge that it is phoning home
    Mind you, if I wrote it, I wouldn't have it phone home, - I'd have it phone a (very) expensive 900 number (say, $50.00 a call) that I'd own, and you'd end up paying for your license when you got your next phone bill :-)
  15. Where is the crime in spyware? by mec · · Score: 4, Interesting

    So the (alleged) spyware sends copies of certain information about your computer back to the company that produced the software.

    The user still has all the information they started with. No one has been deprived of any information. All that has happened is that an additional copy of this information has been created and distributed.

    In order to object to this, you have to admit that some information does have owners, and also that it is wrong to copy information without the consent of the owner.

    Then, this being slashdot, you have to do a little song and dance, like this: "when other people create music and software and movies, and I make a copy of their stuff, it's fine. But when someone else makes a copy of information from me without my consent, that's wrong!"

    Your information wants to be free; my information wants to be private. See?

    My own beliefs are the same as Linus Torvalds: "He who writes the code chooses the license". If you don't like spyware, don't friggin run it. I don't.

  16. some more by ramzak2k · · Score: 2, Interesting

    Here are two more i have noticed that do the exact same thing :
    1. Admuncher http://www.admuncher.com/
    2. Evidence Eliminator http://www.evidence-eliminator.com/

    I found a quick (& better)replacement for Admuncher in the new google toolbar (http://toolbar.google.com/) to get rid of popups.

    Evidence eliminator is crap, dont need a replacement.

    In either of these cases they take you to a page showing your IP address with what they think is a scary message. If you do use a cracked version make sure your windows installation does not carry your Original Name / Location and that your IP address is dynamic.

    --

    Siggy Say, Siggy Do
  17. Re:Uh? by FauxReal · · Score: 2, Interesting

    And besides that... they'd probably rather track you down, catch you in the act and the sue your ass to make an example out of you.

    --
    Deltron 3030 - Virus (music video)
  18. Thoughts. by Anonymous Coward · · Score: 1, Interesting

    If I was a home user, I'd be using a firewall. Oops, trying to phone home, are we? (Quake3 Voice) DENIED (/Quake3 Voice).

    If I were in a corporate environment, I'd tell the creators of the software that I'd be more than happy to help them out in their search for pirated software. I'd also let them know that we'd be terminating our contract with them immediately, as, if they're sending out that information, who knows what else they might be sending back to themselves? I'd also inform them to expect a letter from the legal department due to the fact that they may be snatching private corporate information from our boxxen.

  19. Too easy for a false 'pirate' by YrWrstNtmr · · Score: 4, Interesting

    Say you're a small shop. You have need of 3 copies of s/w package X.
    You go down to BigBox store, and buy 3 copies of X.
    Back at the office, you use one CD to load all the machines. Leave the other 2 in the shrinkwrapped boxes, on the shelf. Perfectly normal...happens all the time.

    The running s/w sees 2 other copies of the same s/n on the LAN, and phones home. PIRATE! PIRATE!

    You're 'legal'. You have paid your fees for the 3 copies. But Company X, due to their incorrect reporting and intrusive networking, thinks you are in violation. They send the BSA after you, with all the attendant fees.

    At this point, you're guilty until you can prove your innocence.

    Absolute BS, I say.

  20. Sounds like you need a better cracker! by Anonymous Coward · · Score: 1, Interesting

    Personally, when I crack software to remove limitations, nags, or enable hidden functionality for proper evaluation purposes, I always have faith in my firewall to detect these sorts of 'protections'. If it reports that the software is trying to phone home, then I deny it that ability for the current session. After that, I fire up my port monitor, re-load the software and log what's going on. It's usually a simple matter to prevent the execution the offending code, and in the end I've produced another quality crack.

    My motto has always been: if a cracker is good enough to unlock the software without a serial number (or otherwise), then they should be good enough to circumvent the code that phones home.

  21. We've wanted to do this, too... by Tex+Bravado · · Score: 2, Interesting

    At the software company I work for, we have in the past had suggestions to employ similar phone-home schemes. Sometimes it's in the context of catching cheaters; more often it's a way to find what parts of the software do people most use. That kind of data can be priceless; the user often isn't really concious of what he uses, and only remembers the best and worst parts.

    We have always refrained. (But once at another job, a developer surreptitiously added a system call to email to himself a message everytime his library was used; QA caught it, and he had his hand spanked.)

  22. Re:why not? by Anonvmous+Coward · · Score: 4, Interesting

    "Seriously folks I think lately we've forgotten that stealing is stealing, and if you're stealing a piece of software you should be punnished for stealing a piece of software."

    That's fine provided due process is followed. Calling home and saying "I'm cracked" is not evidence of guilt. I have a piece of cracked software on my laptop. Am I guilty of piracy? Have I stolen anything? Absolutely not! I paid for the software. However, I cannot have a dongle sticking out of the back of my laptop. It's not worth risking breaking of the dongle, or worse, the laptop.

    End of story? Me thinks not. If somebody installs cracked software they haven't paid for simply to evaluate it, have they stolen it? Ethically speaking, no. The fact of the matter is that you cannot return software. The only people who are truely guilty of commiting theft are the people who acquire the software without paying for it, and make use of it.

    I would advise not trying to oversimplify this down to black and white. It is nowhere near as 'end of story' as you're making it out to be.

  23. Its not the same. by msimm · · Score: 2, Interesting

    Its not the same. When his spyware runs on my computer its using my resources, my electricity. If it causes problems (and it will) it causes them on my computer. Thats not even considering my privacy rights and concerns.

    My own beliefs are the same as Linus Torvalds: "He who writes the code chooses the license". If you don't like spyware, don't friggin run it. I don't.

    I don't think Linus was talking about either EULA's or spyware, so it's an irrelevant quote.

    You want to coerce me into running spyware? Don't bury it in a user agreement, come right out and make me click a radio button mentioning it directly, watch the popularity of the product drop and then decide if its worth it.

    It's simply dishonest. I don't care if its buried in some agreement, thats not good enough.

    --
    Quack, quack.
  24. Word story is not a legend by Tangurena · · Score: 2, Interesting

    Look at the old issues of Wired. It was a reporter for the NY Times that was nailed by the drive reformat. M$ support said it was a cracked copy, reporter got story on the front page. M$ quickly appologized and removed the misfeature.

  25. Hypocrite: Re:why not? by MrChuck · · Score: 2, Interesting
    The only thing I don't pay for is a second copy of MS software (windows/office)

    Dude, if you can't abide by the conditions that the authors have set: eg. price and license
    THEN DON'T USE THE FREAKING SOFTWARE

    I won't go into quality of the software, but I will touch on that fact that YOU CAN DO ALL OF THIS WITHOUT THEIR SOFTWARE.

    I read excel spreadsheets, I write lots of documents. I don't use Microsoft software in my life.

    I can afford it. I can't stand its LOW LOW quality (been writing milters to block today's virus/worm that our unix and macs won't get but it clogging up our servers.)

    You guys have postgresql, mysql, php, all the BSD and linux you can eat. Laptops that can run what our bigass VAX 780s struggled with. Jesus Freaking Christ. There's better software out there for FREE than was available 5 years ago commercially.
    And your whining about how you think XP costs too much.

    Don't use it if you can't buy it. You have options. Take them.

  26. How is this different... by TechnoWeenie · · Score: 2, Interesting

    How is the following senario any different from what this software is doing?

    I have a car. The car has a built in cell phone and GPS. If the car is stolen, the cell phone calls me and tells me the location of my car from the GPS. Am I now spying on the theif? Am I violating his right to privacy?

  27. What happened to respect for customers, privacy? by inkswamp · · Score: 2, Interesting

    I'm sure everyone here can sympathize with companies and individuals who are hurt by piracy and I feel that they have every right to pursue it in whatever way they legally can. But that's the problem. As soon as a company uses illegal or unethical methods to combat illegal and unethical abuse, they lose me as well as the moral upper-hand. There are plenty of ways to combat piracy without invading a customer's privacy and I think it behooves a company or developer to explore those avenues. Also, they need to accept that there is always going to be a segment of users who will use pirated software. And I'm not so sure that matters. I would assume that most people doing so wouldn't have paid for the software legitimately anyway, no matter what, so it's hard to say that any potential profit has been lost by anyone. Tactics like "phoning home" and convoluted registration methods, dongles and other nuissaances only irritate paying customers and likely don't stop any piracy at all.

    --
    --Rick "If it isn't broken, take it apart and find out why."
  28. Apple anyone? by stubear · · Score: 2, Interesting

    Apple has been doing something like this for years. If you run software on a network and you try to use the same copy of software on two different systems at the same time, something will have to give. In this case, MacOS informs you that person x is using a copy of the software and then it quits the application until you close down the other copy or log off the network. I don't see /. breaking out the hayforks over this though.

  29. The company is making some poor assumptions... by softspokenrevolution · · Score: 2, Interesting

    The first poor thing is that the admin won't be uncomfortalbe with all of his people being spied on (let alone all of the end users that threaten him with death).

    The second is the assumption that the Admin is unaware that a cracked copy of software is being used, seriously all of this stuff costs well into the ridiculous range and there are more than a few companies who just say to hell with it all and let's just pretend like our lone copy is a site lease. Then they have to go through all sorts of trouble like pretending they care and making sure it doesn't happen the next time around.

  30. Bypassing CD detection by arth1 · · Score: 2, Interesting

    There's another good reason to trick a product into not requiring a CD: Security.

    Once you put a CD drive on a Windows computer, it no longer is red book class C2 certified. The obvious reason is that you can boot from a CD.

    Obviously, you don't download a cracked version from Russia or China to improve security, but using virtual CD drives or modifying registry keys to look other places is quite normal.
    And this might be enough to trigger a program into thinking it is running a cracked version -- when in reality it's an attempt to work around the flaws of the program, mainly that it requires a CD to be present.

    Regards,
    --
    *Art

  31. Entrapment by Zerbey · · Score: 3, Interesting

    Doesn't this fall under Entrapment laws, or does that just apply to law enforcement agencies?

    1. Re:Entrapment by praksys · · Score: 2, Interesting

      ...or does that just apply to law enforcement agencies?

      Yes, and in any case it wouldn't be a good example of entrapment. In order to qualify as entrapment it has to be the case that the defendant would not have committed the crime in question if not for some sort of enticement or encouragement on the part of a law enforcement officer. There is no encouragement to pirate software here.

  32. Re:Was it VisualRoute? by computer_chacham · · Score: 2, Interesting
    Yeah, I got caught trying to use a serial number that wasn't mine. The software didn't even install, but the next day my school got the following email, and told me that I better stop or I'd be in trouble. Six months later I downloaded a demo (legitimately!!) but they must have kept my MAC address on file, because they sent another email to the school accusing me of piracy, and the school had to escalate it because it was my second offense. Ughh. I carefully explained that I didn't do anything wrong, and they believed me, but I wouldn't be surprised if another school would have done unpleasant things to me under those circumstances.

    >*** COMPLAINT *** >Delivered-To: xxxxxx.upenn.edu >Date: Wed, 26 Feb 2003 07:01:33 -0500 >To: dmca@isc.upenn.edu >From: piracy@visualware.com (Visualware Anti-Piracy) >Subject: Copyright Infringement #26764 (Software Piracy) -- >165.123.xxx.xxx (xxxxxxxx.xxx.resnet.group.upenn.edu) > >Someone within your network attempted to activate our software using a >product license key they did not legally obtain. Attempting to convert our >trial software into fully registered software without paying for the >license key is software piracy and is a violation of copyright laws and >international copyright treaties, as well as other intellectual property >laws and treaties -- a violation of most AUP (Acceptable Use Policy) and >TOS (Terms of Service). The full log detail of product activation attempts >by this individual: >ip address: xxx.xxx.xxx.xxx [xxxxxxxx.hrn.resnet.group.upenn.edu] >local ip address: xxx.xxx.xxx.xxx >date/time: Wed Feb 26 05:59:42 EST 2003 (26 Feb 2003 10:59:42 GMT) >ethernet mac: 0040450xxxxx >user name: xxxxxx >computer name: xxxxxx >license key: VR-V7C1-0gHYa6oNysjvP7SsCXxxxxxxxxxxxxxxxxxxxxxxxx xx >product: VisualRoute (build 1913) >zone: en_US-05:00 >This log information will enable you to track down the specific computer >used and many times the individual using the computer. For assistance in >interpreting this log information, important background / copyright >information, and tips on tracking down the individual responsible, please >refer to (consider this document included by reference): > >This document also includes (if applicable) DMCA notification information. >For more information about software piracy and copyright law, visit: > >We do not take anyone attempting to steal software licenses from us >lightly and would appreciate it if you would look into this software >piracy and take the appropriate corrective actions (have the responsible >party purchase a legal license or discipline the responsible party >according to your AUP/TOS). >Please let me know how this incident is resolved. >Jerry Jongerius >Chief Technology Officer >Visualware, Inc. >jerry.jongerius@visualware.com >[NOTE: piracy@visualware.com is an unattended mailbox. If you expect a >reply, send a plain text email to jerry.jongerius@visualware.com]

  33. Illegal in the UK by julesh · · Score: 2, Interesting
    From the Computer Misuse Act 1990:

    1.--(1) A person is guilty of an offence if--

    (a) he causes a computer to perform any function with intent to secure access to any program or data held in any computer;

    (b) the access he intends to secure is unauthorised; and

    (c) he knows at the time when he causes the computer to perform the function that that is the case.

    (2) The intent a person has to have to commit an offence under this section need not be directed at--

    (a) any particular program or data;

    (b) a program or data of any particular kind; or

    (c) a program or data held in any particular computer.

    (3) A person guilty of an offence under this section shall be liable on summary conviction to imprisonment for a term not exceeding six months or to a fine not exceeding level 5 on the standard scale or to both.


    It might be a bit tricky to prove condition 1.(1)(c), but I think a good barrister would get it with no question.

    So, unless you authorised the original vendor of the software to acquire the information from your computer that it sends back, they can be given 6 months in prison (or more likely just the fine).
  34. Impartiality? by shrikel · · Score: 2, Interesting
    Do you feel software publishers should have the right to peer into users data, if their software suspects foul play on the machine, or should it do the easy and intelligent thing and just stop working?

    <rant>

    That's a very loaded question. I don't purport that Slashdot needs to be impartial (like a good newspaper) or anything. But if opening questions are supposed to foster discussion and debate, shouldn't they allow two sides to enter the discussion ground on equal terms?

    I believe in privacy of data, and I usually agree with a good deal of what is said in these forums, but I'm not so zealous that I insist on absolute public anonymity (like some people who often post in these privacy-related topics). My view is unpopular, I know. But it seems like the system here is sometimes designed to (very subtly) push a certain agenda. And that's the editors' prerogative, I suppose, but I can't help but wonder if Slashdot would attract a slightly different crowd (and be somewhat more enjoyable to ME, at least) if it were more focused on expansion of awareness of other people's views than on railing on the same issues again and again with few new ideas ever finding a respected place in the discussion.

    That said, I DO agree in this case with the suggested opinion, but I still would like to hear what others might have to say.

    </rant>

    --
    Any sufficiently simple magic can be passed off as mere advanced technology.