Slashdot Mirror


Using Spyware to Report Pirates?

An anonymous reader asks: "I have visibility to AUP complaints we receive at work, and we receive messages from a software vendor that make it obvious that their product is phoning home when it discovers it is running a cracked copy of itself." Apparently the software phones home, and then the publisher's legal department sends the administrator an e-mail. "The message goes on to detail the users IP, a timestamp, the product in question, the users PC name, username, and MAC address. This falls under -my- definition of 'spyware.' What are your thoughts?" Software has been making surreptitious checks for "piracy" for over a decade, yet these checks are usually limited to the software itself, and not data on the user's machine. Do you feel software publishers should have the right to peer into users data, if their software suspects foul play on the machine, or should it do the easy and intelligent thing and just stop working?

74 of 1,013 comments (clear)

  1. What we want to know... by Jeremiah+Cornelius · · Score: 5, Interesting

    Just WHO is this publisher?

    --
    "Flyin' in just a sweet place,
    Never been known to fail..."
    1. Re:What we want to know... by wo1verin3 · · Score: 5, Interesting

      I'd still like to know what publisher does this, and if my company is a customer of this company which decides to spy on our systems without permission then I would a) ensure we move to another software vendor and b) make the company aware of why we choose to move to another vendor.

    2. Re:What we want to know... by Anonymous Coward · · Score: 5, Insightful

      ...or C) the software thinks it's pirated and it isn't. After all, 100% of fully automated piracy detection methods are flawed. The only sure fire way to prove something is pirated is a BSA-style audit. And even those are flawed because of people who don't save original packaging/media.

      You are seriously deluded if you think that fact that a piece of software thinks it's pirated is de facto evidence that it is in fact pirated.

    3. Re:What we want to know... by Goldberg's+Pants · · Score: 3, Insightful

      It's still low. Spying on your data and sending info is like shooting people because they might be a criminal. Cracks do have perfectly legitimate uses, despite what the software companies try to tell you. (Just ask anyone who has installed the latest patch for Neverwinter Nights and can't run it due to the retarded Securom protection).

      This is why everyone should run a decent firewall. The amount of programs that phone home is alarming!

    4. Re:What we want to know... by Anonymous Coward · · Score: 3, Insightful

      I couldn't disagree more. That's not obnoxious that's an awesome feature!

      We bought one legal copy of Photoshop. We should have the right to run one copy, regardless of how many computers we own. This enforces that and makes us abide by the licenses we agreed to! It makes it impossible to violate their license!

      So what did we do when we got this error message more and more and more? We decided "hey, we really need two copies". And we got another license. This actually /saved/ us money, so we didn't have to go get 5 copies of Photoshop for 5 computers when two did just fine, thanks.

      Obnoxious? I guess so if your definition of obnoxious includes railings on ledges and lane turtles on roadways. To the rest of us, such things are considered useful.

    5. Re:What we want to know... by innosent · · Score: 4, Interesting

      That's a great idea, from all perspectives, but taking it one step further, when it checks for updates, the server should check the serial number against a list of known/suspected pirated numbers. If the serial number is bad, then send dummy updates, ones that force the program to say: "this program is not registered, please call 800-URF-CKED".

      If you do it this way, then the real license holder will call to find out why it doesn't work, at which point you can try to find out why their serial number is pirated. Something like this could have prevented the 112-1111111 M$ thing from ever happening, without screwing things up for the end user. Put reasonable limits on how many duplicate licenses you can have, and if you've seen too many, put that number on the list. You won't stop the first few pirated copies, but you'll stop the last 90,000, and you'll find out who leaked the number in the first place. As an extra feature, for corporate keys, you could restrict it to the corporation's IP block.

      Damn, maybe I should patent that... Oh well, consider it prior art.

      --
      --That's the point of being root, you can do anything you want, even if it's stupid.
    6. Re:What we want to know... by Tongo · · Score: 5, Interesting

      On my machines I run Sygate Personal Firewall. I have it set to block traffic based on application, not port number (although that MAY be possible also). If an application doesn't have defacto permission to access the internet it will ask me. The I set it to allow my most used applications through without prompting. Works quite well actually. It is amazing the amount of stuff that is trying to call out all the time.

    7. Re:What we want to know... by dolo666 · · Score: 5, Interesting

      What if it's wrong? What if you really paid for the software and someone *else* cracked it and passed it around?

      Some of the appz/games in stores get cracked and put back on shelves. It happens all the time. And how many of you keep your sales receipt, box or even CD? I have software running that is paid for but I don't have evidence that I bought some of it; I still have a right to run it.

      The problem is that while this monitoring is a good idea in theory, there are too many variables that would trigger reasonable doubt in court. This would tie up a court for quite some time with possibly unreliable evidence garnered as reasonable.

    8. Re:What we want to know... by DaCypher · · Score: 5, Interesting

      What if that application, say, an FTP client, requires access to the internet to do its job? So you allow it access to the internet for this purpose, but could it still sneak its connections in to its home server since the firewall assumes this is legitimate behavior?

    9. Re:What we want to know... by MrBlue+VT · · Score: 5, Interesting

      I run cracked versions of video games all the time. Why? Because I've stolen it? No, because I don't want to have to stick the damn CD in the drive everytime I want to play the game. Nothing is more annoying than the stupid "copy protection" that makes you hunt around for the particular game cd and then put it in your machine (heaven forbid you are using the cdrom at the same time to play music or burn a cd!).

    10. Re:What we want to know... by wo1verin3 · · Score: 5, Funny

      Particular CD? Hah, I guess you're too young to remember having to check page 46, line 3, word 12 in the manual. :)

      More details on that old thing (+1 nostalgia) here:
      http://www-cse.stanford.edu/classes/cs201/projects -99-00/software-piracy/copyright.html

    11. Re:What we want to know... by alonsoac · · Score: 4, Insightful

      If a person is innocent of a crime, then he is not a suspect.

      So all suspects are guilty? That doesn't make any sense to me.

    12. Re:What we want to know... by LittleLebowskiUrbanA · · Score: 3, Insightful

      Can Linux do this?"

      Yes. Look into Firestarter. Look into iptables/ipchains.

      "If not, Windows is more secure than Linux for a desktop user."

      Thats flawed and uninformed reasoning. Amng many reasons why Linux is more secure for a desktop user is that a normal desktop user runing Linux has almost zero chance of double clicking on an atachment and hosing their system w/a virus.

    13. Re:What we want to know... by nolife · · Score: 3, Interesting

      I have used Zonealarm before and I set IE to ask everytime for access. I left IE the default browser but never actually used it for my browsing. Spurious requests for to start IE would be a red flag that something was trying something funny.

      --
      Bad boys rape our young girls but Violet gives willingly.
    14. Re:What we want to know... by The+Vulture · · Score: 4, Informative

      Yep, and then they started making the manuals with dark blue text on burgandy paper (well, the code number sections, anyway) so that you couldn't photocopy it. By the time you can actually read the code number to enter to play the game, you've completely screwed up your vision. :)

      I had two Konami games on the C64 that used this method. After about five times of going through this pain, I cracked the damn games. What was great was that the copy protection code in both games was the same, and they even ever so nicely made it easy to find the protection (the border color changed after the code was correctly validated). Three byte patch (JMP $XXXX) and hacked game.

      Ahhh, the days of 8-bit computing. :)

      -- Joe

    15. Re:What we want to know... by _xeno_ · · Score: 5, Interesting
      I'm disappointed by the replys so far. I keep on getting these two conflicting vibes from people on Slashdot - some people who seem to really want Linux to succeed on the desktop and therefore have companies write software for it (like, say, games or video codecs...), and people who seem to want to keep the "non-free polution off their system."

      If Linux is to succeed on the desktop, then third parties must be allowed to write closed-source applications for Linux. (If, for no other reason, than to allow custom buisness software to continue to run on the systems.) In that case, a vendor very well could include spyware, and being able to block just that application would be very nice.

      Can Linux block net access by individual program? I don't know - I think netfilter may be able to be hacked to do it, but I'm not 100% sure. (It looks like it might be possible to write a netfilter module to do it, but it may require modifying the netfilter system itself, which would involve kernel hacking. When I wrote this, www.netfilter.org was not responding, so I'm guessing based on documentation on other sites and what was available through the Google cache.)

      Does this make Linux on the desktop less secure than Windows? Well, erm, not really. The Windows default firewall only exists in XP (or maybe some SP added it to previous versions, I dunno), and it blocks based on ports. Third-party firewalls like ZoneAlarm and the aforementioned Sygate Personal Firewall can block based on application.

      So Linux is no more secure than Windows on its own. Add in some more software, and it can be. The next question is: if Windows had this feature, and Linux did not, would Linux on the desktop be less secure than Windows? I think the answer is yes, based on the idea that Linux on the desktop must be capable of using closed-source software, and that such software would be prevelant on a successful Linux desktop, and that there would exist users for the software.

      Dismissing Linux as safe because there currently is no real spyware out for the Linux desktop does not really address the question. Assuming there were, it would be nice to be able to block just one application. Blocking a port would not be enough (since it could just use 80, then no web browsing for you...). Blocking an IP is the obvious "right way" but it still might not be the best solution if that cuts your off from the webpage or other important service.

      So being able to block by a given application is probably better than only by packet info (like IP, port, flags, etc.). If the question were simply "OS/A can block net access by application, is it more secure than OS/B that cannot" would people still say "OS/A is more secure because it's open source?" Or is this an emotional response based on the fact that it was Linux vs Windows?

      --
      You are in a maze of twisty little relative jumps, all alike.
    16. Re:What we want to know... by Lshmael · · Score: 5, Interesting

      That's the point. That conflicts with the entire practice of people being innocent until proving guilty. Since it is a former attorney general saying it, the poster was implying that the government does not care about trampling on civil rights in its relentless pursuit for "justice." Meese was saying, "If we think you did something wrong, you did. No questions. Stop talking. 2 + 2 = 5."

      Where does the madness stop? What is the publisher had disabled the computer or reformatted the hard drive? Would that be justified? What is the software was actually *NOT* pirated?

    17. Re:What we want to know... by riko_at_anubics · · Score: 4, Informative

      iptables CAN create rules based on the application.
      --cmd-owner name is the option to do so.
      you can also make a rule based on uid.
      Of course you can mix things up, for example you can allow an app to connect to some ports rather than to some others.
      And of course an application cannot use port 80 (server socket) if it's not uid 0 or suid.
      For example
      iptables -A OUTPUT -p tcp --dport 80 -m owner --cmd-owner mozilla-bin -j ACCEPT
      iptables -A OUTPUT -p tcp --dport 80 -j DROP
      would let only mozilla connect to port 80 of a remote server.
      I can tell you: you have got no idea how powerfull is iptables!

      --
      I don't want to start any blasphemous rumors but I think that God's got a sick sense of humor. DM
    18. Re:What we want to know... by tf23 · · Score: 4, Funny

      If that's the case, and it' sending information back, then you need a better crack!

    19. Re:What we want to know... by xThinkx · · Score: 3, Informative

      You're wrong, for several reasons.

      "if they choose to contact the individual or institution and there was just a flaw in the code that made it think that it was cracked when it was infact legit, all the acused would have to do to clear their name is prove that they have a legaly purchased copy"

      In the US, we have a "innocent until proven guilty" court system, where the burden of proof is not on the accused to prove they are innocent, but on the accuser to prove that they are not. Secondly, it might not be that easy for a user to prove they have a legit copy. A few examples of this would be if the user's machine was compromised, and the key stolen and distributed, or if the user was part of a large corporation and had no idea of anything to do with the installation of the software, or if the user had bought a used computer with the software already on it.

      "it's not like it gives out top secret information"

      Again, wrong. RTFA, "The message goes on to detail the users IP, a timestamp, the product in question, the users PC name, username, and MAC address. " This information could be VERY harmful in the wrong hands. With a known IP, timestamp, PC name, username, and even MAC it is now very easy to locate a user's physical location within an organization. With some social engineering and a bit of luck, you can now do all sorts of nasty things (sneak a keystroke logger and BOOM, they're 0wn3d!) to someone. Also dangerous, since MACs are bound to the hardware, if someone could reverse lookup a certain piece of hardware bound to a MAC and then find a vulnerability in the hardware, they're in. And since I doubt this information is encrypted, and since it is obviously sent over the public internet, the right person sniffing the right packets can now grab all of it.

      More importantly, I doubt that this "feature", if you can call it that, is well publicized. This is very important because without knowledge of such practices it could be hard for a sys/netadmin to account for the grossly insecure transmissions.

      --
      Let's get one thing perfectly clear, I did not vote for George W Bush, and I do not endorse what he does or says.
      "
  2. SCO OpenServer by SHEENmaster · · Score: 5, Funny

    So that's why my copies of OpenServer and UNIXWARE keep pingflooding kernel.org...

    --
    You can't judge a book by the way it wears its hair.
    1. Re:SCO OpenServer by GigsVT · · Score: 5, Informative

      You're joking, but SCO OpenServer does actually scout your network for other unlicensed copies of OpenServer and other SCO products. As far as I know, it just causes an output to console every few minutes warning you of the unlicensed software.

      --
      I've had enough abrasive sigs. Kittens are cute and fuzzy.
  3. Depends on how you look at it I suppose. by ShadowBlasko · · Score: 4, Interesting

    Its been going on for quite some time now.

    You use the illegal software, I don't see any reason why someone who's life work might involve *writing* said software would not want to catch you pirating/using is Illegally.

    I'n not all that sure how I feel about the users computer information being fired off in an email, but I have always considered that a possibility in the past. Seems like I was right.

    --
    There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order- Ed Howdershelt Via Tass
    1. Re:Depends on how you look at it I suppose. by Col.+Klink+(retired) · · Score: 5, Insightful

      > You use the illegal software

      But doesn't this imply owners of the legal software are also being spied upon?

      --

      -- Don't Tase me, bro!

    2. Re:Depends on how you look at it I suppose. by WIAKywbfatw · · Score: 4, Insightful

      > You use the illegal software

      But doesn't this imply owners of the legal software are also being spied upon?


      OK, I'll take serious stick for saying this but here goes (and there goes my karma).

      Sometimes, people observe/stake out/spy on others and their suspicions/paranoia prove to unfounded and sometimes they prove to be well-placed. Not everyone who's under police surveilance, has a background check run on them or gets asked for additional ID verification when using a credit card is going to be guilty of wrong-doing, but does that mean the cops, your kids' schools or Amex should never be allowed to verify basic details?

      If the software license made it clear up front that the package could and would periodically check that its use was within the boundaries set by the license (eg, full licensing) then I don't see anything wrong with a publisher checking up on its users in this way. After all, permission had been given, just as it had been given (implicitly or otherwise) in the real world examples I gave above.

      One thing you need to ask yourself before you potentially start bashing this company's spyware (or whatever you want to call it): am I in violation of a software license or any laws? Make damn sure that their aren't any illegal copies of the software floating around your organisation before kicking up a major fuss otherwise this could really backfire for you.

      --

      "Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
    3. Re:Depends on how you look at it I suppose. by NoMoreNicksLeft · · Score: 5, Insightful

      More like, the vehicle detects that you had it serviced at an independent mechanic, instead of at the dealership, and phones home to cancel the warranty.

    4. Re:Depends on how you look at it I suppose. by dasmegabyte · · Score: 4, Insightful

      Well...yeah. And some legal software (e.g. Gator, Kazaa, etc) spy on you in ways you might not like. But in the end it's all a trade off -- how much do you trust your software manufacturer?

      Some of them I do trust. If I find out Adobe is spying on me to be sure I bought my boxed copy of Photoshop 7, I'm not that worried, because I did. I see this in the same light as I see cameras in retail stores...sure, it's a little annoying that they might be laughing at my fat ass trying to squeeze into size 34 pants, but I can deal with that because I respect their right to stop shoplifters. When the guy who came to paint my house asked me to leave my garage open, I did so, because I was paying him scads of money and I trusted him not to walk out with my TV as well.

      Really, with proprietary software it's all a matter of trust. It always has been -- it's why my uncle wouldn't let my cousin use his Renegade pirated floppies in his c64, he was afraid of some stupid code going haywire and messing up his $500 machine.

      You worried about this spyware stuff? Go whole hog OSS, it's the only way to be sure. I happen to prefer the user interface and trustworthy behavior of some of my proprietary software and don't mind paying a little extra for it, money or privacy. Still, the day I catch ImageReady sending lists of my porn directories back home to corporate is the day i switch to (shudder, ew) The Gimp.

      --
      Hey freaks: now you're ju
    5. Re:Depends on how you look at it I suppose. by HardCase · · Score: 3, Insightful
      My computer should never do anything I don't want it to do. Plain and simple. If I don't want you to scan my network for illicit copies, then don't do it. I don't really care about any legal "right" software companies have to do it. I don't want them to do it; I'm their customer; they shouldn't do it unless they feel like pissing me off and losing me as a customer.


      I agree that I certainly wouldn't want the software to scan around my network looking for illicit copies of stuff. But that's not what we're talking about here. We're talking about a cracked program that, when started, determines that it is cracked, then reports that fact back to the publisher, along with information that will identify where the stolen property is.


      This is almost like a Lojak system - the car is stolen, then the security system reports back to the police exactly where the car is. What if you stole the car and it's parked in your garage with the door closed? Yes, I understand that this example doesn't exactly parallel that of the article, but it is similar. The Lojak system doesn't check around the house to see if there are any other stolen things there...it's just concerned about one thing - the car. Much like the software that is described in this article.


      Incidentally, neither I nor the article said anything about snooping around the network looking for stuff. And in the case of the software in question, it appears, at least from the limited information available to us in the article, that if this software is reporting information back to the "home office", it would be very hard to suggest that the user is anything remotely resembling a "customer". Unless you consider the guy who steals money from the bank to be a customer.


      -h-

  4. No Problem by Iron+Monkey543 · · Score: 4, Insightful

    I have no problem with this, as long as it is in the agreement box, or they make it clear that it till collect the user data and send it to the company if the software checks itself to be a crack.

    You don't like it then don't use it.

  5. Another question... by Decaffeinated+Jedi · · Score: 5, Interesting
    Is it spyware if it's mentioned in the User Agreement that you accepted?

    DecafJedi

    --
    DecafJedi
    my weblog: apropos of something
    1. Re:Another question... by GMFTatsujin · · Score: 3, Funny

      Ha! Having stolen and cracked the software, I never HAD to agree to an EULA. You won't catch me that way, you tricky devil!

  6. Consent by JohnGrahamCumming · · Score: 5, Insightful

    In any application where data is sent from within the company (or home) consent is vital. Perhaps you would argue that stealing the software removes the obligation to ask for consent, but the potential for the software to mistakenly think it is pirated is too high.

    POPFile has an option to check to see if there's a new version available. It's incredibly innocuous: it hits a server and check it's version number, the server junks its logs daily. I keep no record. This was initially on by default but people were upset, it's now off.

    The simplest solution is that a piece of software that thinks it is pirated start warning 30 days before it's going to shut itself off to give the user a chance to do something and finally disable itself. That is effective and friendly.

    And get yourself a copy of ZoneAlarm so that you can see which apps would like to talk to the outside world.

    John.

    1. Re:Consent by Jaycatt · · Score: 3, Insightful
      The simplest solution is that a car that thinks it is pirated start warning 30 days before it's going to shut itself off to give the user a chance to do something and finally disable itself. That is effective and friendly.

      I think that's an excellent idea for a number of reasons:

      * Perhaps the user had the software installed by a friend and didn't know it was pirated. A 30 day warning doesn't assume guilt.

      * A lot of share/trialware does this already, so people are used to these kind of reminders.

      * If it was a mistake (maybe the other person with the same serial number is actually the pirate) it gives the company/user time to fix the error before simply shutting down.

      * If the software was obtained illegally, there's still time to correct it and 'repent'.

      * And as reidbold said, it's effective and friendly (in a world where most things are CYA and nuts to the other guy).

      --
      "Shared pain is lessened; shared joy is increased. Thus we refute entropy" - Spider Robinson
    2. Re:Consent by JohnGrahamCumming · · Score: 5, Insightful

      When did I say that all software should be free? Never, and I don't believe it. Since I make my living selling non-free (either sense) software I would be biting the hand that feeds me.

      Imagine the scenario where I change the NIC card in my PC because of a hardware fault. Software X used the MAC address of the NIC for licensing purposes which has now changed and hence thinks it's been copied. One choice would for it to start secretly informing the company that created it that there's a problem, another would be for it to tell me "I think I'm stolen, I'm going to stop working in X days, here's what to do about this". The latter seems friendler to me and if I did steal it it's going to shut itself off and I wont be able to gain from the
      crime.

      Nor did I claim that stealing the software wasn't stealing. It is. That software was copyrighted by someone, copyright law is clear and if they license it to me for money then I have to pay. Pretty simple. That's why I was opposed to Napster and other "services" and said so publically on my web site. They were/are stealing from people.

      Nor do I believe that privacy must be absolute. I just believe in this case that the method used to assist in the enforcement of a license agreement is unreasonable and there are workable alternatives.

      John.

  7. Re:why not? by WTFmonkey · · Score: 5, Insightful

    But, as someone who is innocent until proven guilty, what right do they have to {spy on, steal from, stalk} me? Seriously, if you're going to back the "stealing is a crime" part of the law, you also have to accept that the alleged thief is innocent until proven otherwise. No one (without subpoena or warrant) has a right to that kind of information without consent.

  8. This isn't spyware by mosch · · Score: 5, Insightful
    It's not sending your credit cards, your clickstream or your data files.

    It's not spyware, it's a fucking anti-theft system. Don't like it? Don't steal it.

    1. Re:This isn't spyware by netruner · · Score: 5, Insightful

      I can understand this viewpoint to an extent. However, this doesn't take int account when the antitheft system "misfires" and causes problems for legit users. In my opinion, spyware that acts so intrusively should be allowed under the condition that there are real consequences for false alarms. In this case, if it's not a legit alarm, I would think the company should be prosecuted like a vendor that exercised a backdoor into one of your systems.

      In other words: you better be damn certain that you're tracking a pirate before you start sucking data off his machine.

      However, if the alarm is legit- you really don't have a leg to stand on. Kind of like stealing a design for a new widget and having your prototype explode halfway through construction.

      When you take a step into the illegal side of things, don't look to the law for help.

      --



      DISCLAIMER: This post was not checked for speling and grammar- if you complain- you're a whiner
    2. Re:This isn't spyware by Iscariot_ · · Score: 4, Insightful

      "It's not spyware, it's a fucking anti-theft system."

      Not so. If you remember a few years ago, a judge ruled against Blizzard using spyware in their software even though all it was doing was helping them to squash bugs and prevent cheating.

      So the transmission of even benign data without permission by the user is against the law.

  9. Oh come on. Do you HAVE to ask? by Seumas · · Score: 3, Insightful

    Okay, this one seems simple enough.

    Let's say I am a small book publisher. I publish books about historical battles. I find out that there is someone out in the world who, instead of buying a copy of my book, has simply photocopied a friend's purchased copy of the book.

    Now, let's say I track this person down. Then let's say I break into their house. Then let's say I rifle through all of their belongings. Let's say I get their credit card number, bank PIN number, passwords, social security number, medical history, personal communications, personal habits and all of this information for each person in their family, too. Then let's say I take all of this data and give it to the police or the government. Or maybe I even go much further and just burn the house down with everyone in it.

    Was I justified? I mean, I must be right? After all the person had a photographed copy of my book and didn't pay me the $39.95 for a legitimate right to read it...!

  10. Active copy protections... by Satan's+Librarian · · Score: 4, Interesting
    It's spyware. I think active copy protections such as that are stupid anyway - what happens if the user is legitimate, but either had a file corrupted or a virus infected it? I'd assume they are just doing an MD5 hash of their software at best for the check for cracks, and a parasitic .exe virus would set it off right away. So would some older methods of file innoculation, random disk/transfer corruption, and a whole lot of other things.

    There's a legend that Microsoft actually encountered this back with Microsoft Word 1.0 - it formatted the hard drive if the CRC of the program changed. Bad karma there, hosing innocent users if they got infected. (BTW - I've seen Vesselin Bontchev reference it here and other places, but it could just be he picked up a convenient rumor. Anyone have verification of this story?

    If it's not documented in the EULA for the product, it might even be a potential civil suit against the company. Doesn't Europe have fairly restrictive privacy laws that could come into effect here? Could be criminal there if so, especially if it misfired on an innocent user. Although of course - IANAL.

    BTW - what product?

  11. Was it VisualRoute? by drdink · · Score: 5, Informative
    I have recently seen this sort of thing from Visualware, the makers of VisualRoute. They send data like this:
    ip address: 192.168.55.3 [dhcp77-1.example.com]
    local ip address: 192.168.55.3
    date/time: Mon May 05 07:22:22 EDT 2003
    ethernet mac: censored
    user name: censored
    computer name: censored
    license key: NONE - CRACKED VERSION
    product: VisualRoute (build 1858)
    zone: en_US-06:00
    And yes, that data is falsified to save the identity of who it was. The amount and type of data it collects and sends home is rather disturbing. Can't the damn thing just uninstall itself?
    --
    Beware, Nugget is watching... See?
    1. Re:Was it VisualRoute? by FirstManOnMoon · · Score: 5, Insightful

      What would happen if a crooked employee at Visualware used or shared this information? He now has a valid username and IP address (even if the IP address was NATed, you could match it with the web server logs to find the outside IP.) He can now fire up his favorite cracking program and have at it. If a vulnerability exists in VisualRoute, he now has a list of computers running it that could be exploited. Food for thought...

  12. The right? No. But does it matter? by sterno · · Score: 4, Insightful

    Ultimately if you get taken to court because of a copyright violation that was discovered because the cracked software phoned home, I doubt the court will grant you much leighway.

    If the software's anti-theft tracking was being put in place by the police, that would be a violation of the fourth amendment. On the other hand, this is being done by a private corporation which has far more rights.

    Think about LoJack, the car anti-theft mechanism, that tracks the car. Isn't that effectively the same thing? That's perfectly legal.

    I don't like the notion of a company installing such spyware because there's little guarantee that they are only reporting pirates. Furthermore, what's to keep them from reporting subtle violations of the license agreement that aren't in fact illegal under copyright law. Once the spyware is there, there's effectively no limit on what it can do.

    --
    This sig has been temporarily disconnected or is no longer in service
  13. windows ? by jacquesm · · Score: 3, Interesting

    How many packets does your machine send out that you have not looked at personally ? Mine does that *all* the time (I don't have the time nor the resources to check them all).

    This means that if say MS is checking the contents of my machine and starts harassing me over possibly illegal software that I would have no way of knowing that the info was retrieved using spyware. it's the stupidity of the 'presentation' that gives this one away, if they were a bit more clever about it you'd never have known that it was spyware related.

    The best way to avoid this kind of trouble is to go completely open source or make sure your licenses are paid up :)

    are you on the grapevine yet ?

  14. Re:why not? by beamdriver · · Score: 5, Insightful
    Copying software isn't stealing it's violation of copyrights and it generally isn't a crime, it's a civil tort.

    Installing spy programs on someone elses computer and misapproriating their resources to send information about that computer back to you, OTOH, may certainly be a crime.

  15. List o' Spyware by chimpo13 · · Score: 3, Funny

    Does anyone know where there's a list of spyware that does this? I'd like to see what programs to avoid stealing.. uhr.. I mean buying.

  16. What if it was a legit version? by ad0gg · · Score: 4, Interesting

    With the game Black and White that I own, the cd copy protection gave my computer so much problems and the only solution the publisher gave me was to install a new cdrom, so I was forced to install the cd crack to actually play the game. I'd hate to be labeled a pirate and taken to court because I actually wanted to play a game I legally purchased(Hell I preorded).

    --

    Have you ever been to a turkish prison?

  17. Re:What is "AUP," please? by LookSharp · · Score: 3, Funny

    Acceptable Use Policy, standard to most Internet Services Providers (AKA ISPs).

    PS - AKA Stands for Also Known As.

    PPS - PS stands for... eh, forget it :)

  18. Why are they sending you this information??? by GreenCrackBaby · · Score: 3, Interesting

    I can't tell, but I'm assuming that you work at an ISP (AUP complaint?). Why on earth would you care about this information?

    "Oh no! One of our users is doing something illegal and it has nothing to do with us! Quick, pull the plug on him!!!"

    Seriously...unless you are law enforcement, what could you possibly do with this information? If I wrote your ISP and told them I saw you smoking pot, should I expect them to pull the plug on your connection??? How is this any less rediculous?!?

    --

    "The market alone cannot provide sufficient constraints on corporation's penchant to cause harm." -- Joel Bakan
  19. Uh? by loconet · · Score: 4, Insightful

    Ok, so if the program is smart enough to discover that it's a cracked copy of itself, why doesnt it just not start up and prevent the user from using the cracked copy.

    --
    [alk]
    1. Re:Uh? by salmacis2 · · Score: 4, Insightful

      Bingo! The software can't know without any degree of certainty whether it is patched or not. So this data is sent back for *all* installations. The software company then checks product ID numbers against those which were registered. So even legitimate copies of this software are sending their customer's details back. *That* has to be a problem.

  20. What this is really telling you is.. by Dr.+Ion · · Score: 4, Insightful

    you need to tighten up your firewall!

    If you don't even know which software or machine is communicating with which outside hosts, don't be surprised when you find out some inside box is relaying spam or leaving out the welcome mat for unwelcomed visitors.

    In any case, what exactly prevents you from naming the offending software? Why speak in generalities and obfuscation?

  21. Use Free Software by no_choice · · Score: 4, Informative

    Given that you undoubtedly agreed to allow the proprietary software to do a full body cavity search on you when you clicked through the EULA, the publisher has the right to do just that. Even if you're using a "legal" copy.

    YOU have the right to refuse to use binary-only, spyware infected, jump-through-hoops licenced programs. Use Free Software instead.

    "But I depend on the proprietary software to do my job." Then support the Free Software movement so someday you won't need to depend on proprietary software anymore.

    1. Re:Use Free Software by FuzzyBad-Mofo · · Score: 3, Funny

      But, but, but.. I didn't click through any agreement! My cat must have walked across the keyboard when I was out of the room, honest!

  22. Re:The right? No. But does it matter? by fuzzybunny · · Score: 3, Interesting


    Erm...while I grant you that in a civil case the rules of evidence will be much more lenient than in a criminal one, there are statutes related to industrial espionage which you could cover yourself with.

    IANAL etc etc, but I am under the impression that, unless you explicitly agree to a function which is not arguably part of the 'core' raison d'etre of the software, things like collecting information without someone's consent on legitimately licensed PCs could be construed as breaking and entering, or the digital equivalent.

    If the software only does this for unlicensed copies, I wonder whether you couldn't use a similar strain of argument (license was not active for arcane technical reasons, whatever.)

    Admittedly, without starting an argument about it, I don't have strong moral qualms about piracy, and I do believe there are certain limits as to what's allowed in terms of evidence collection/snooping even if you are doing something legally "wrong".

    Frankly, I think companies should try to use free/open software anyway if they can, so this never even becomes an issue (ask SCO! :-)

    --
    Cole's Law: Thinly sliced cabbage
  23. Personal Firewall notifies you of this by sublimespot · · Score: 3, Informative

    Personal Firewall is the best approach to keep software from "phoning home".

    You need to use your best judgement - when and why an application connects to the internet. Deny all connections by default.

  24. Re:why not? by vDave420 · · Score: 5, Interesting
    Troll, but I will bite anyway.

    As someone who makes a living writing peer-to-peer software, I completely disagree that "STEALING IS STEALING" as you say.

    I don't want to get into semantics with you, but here goes:
    Stealing involves the deprivation of someone's property, removing thier ability to benefit from it. (paraphrase)

    Information "theft" is not really theft or stealing.

    Thousands of my users probably "steal" my software, but guess what! I DON'T CARE! It is information, which I CANNOT OWN!

    Noone, corporation or individual, has a right to profit.

    Everyone has a NATURAL right to consume and reproduce information. How do I know? Look how we are physically built, for crying out loud!

    Let me close with this somewhat fanatical thought: Every month new ground is broken in the attempt to produce objects by piecing them together molecule by molecule.

    Now, it will probably take longer than my lifetime to occur, but EVENTUALLY you all will be able build a generic THING from its component molecular pieces.

    Consider this "future" world for a moment: No more scarcity, no more hunger, no more epidemics caused by lack of medicines.

    Now consider the same world, with *your* "STEALING IS STEALING end of story" claim: Should the first person/company that creates a new molecular structure have a monopolistic control over said structure? Should you be able to produce (from scratch, not by "physically stealing") a replacement Brake Pad for your car without paying Ford for the privelidge? What about creating your very own "claritin-like" substance for your allergies? Should you have to pay Mosanto?

    I stated before, and firmly believe, that information wants to be worthless, in an economic sense. Information has no "owner" that I recognize, and, as such, I do not consider the "copying" of information to be "theft".

    If someone broke into my office and stole the computer I was writing my source code on, then THAT is theft of information, as it has deprived me of it.

    If someone copies (without my permission) my program and uses it without paying me, oh well! I haven't been deprived of anything! I still have my program! The only thing I *may* have lost is potential profits, but NOONE HAS A NATURAL RIGHT TO PROFIT! NOONE!
    (Thats why "Step 2: ???" is so common! heh)

    In the above "idealistic copying world" example above, noone could profit! There would be no object scarcity, therefore (almost) no intrinsic value to *ANYTHING*, let alone "strictly informational things."

    Time to end this rant, but PLEASE PLEASE consider:
    The end result of personal "posession & ownership" of information, combined with monopolistic control, and the added "Lets consider artificial entities with the stated goal of financial wealth accumulation (corporations) the same as people, with the same 'rights' to own information, etc, is a CORPORATE FEUDAL SYSTEM, not the (what I consider) ideallic, everything-copying society that we COULD have then.

    The road we are starting down today is leading us towards the scarier of the two, I believe.

    -vDave-

    {dave -at- bearshare -dotcom-}

    Help me out, and use BearShare for all of your p2p (INFORMATION COPYING) needs!

    --
    The pig browse. With Google. Sigh is to the chicken. Chicken is fool. Giggle. The DailyWTF giggle.
  25. A great way to discourage such... by Satan's+Librarian · · Score: 3, Insightful

    Call the company. Say you found the user and pirated software, and appreciate their notice. Tell them the software has been deleted and the user has been reprimanded. Tell them you have banned said software company wide because your company does not use pirated software - or spyware.

  26. Re:why not? by RealAlaskan · · Score: 4, Informative
    ... stealing is stealing, ...

    Yes, it is. Funny you should say that and then follow it with:

    ... and if you're stealing a piece of software ...

    Stealing is stealing. Infringing upon someone's copyright is NOT stealing, it's infringing upon their copyright. Stealing is stealing, and using cracked software is something else entirely. That's why each is prohibited by a different law. You can't ``steal'' software unless you grab a boxed set and run out of the store.

    That may sound like a trivial distinction, but it's not: it is the heart of the matter. It's this sort of sloppy thinking that makes it so easy for Disney to get copyrights extended another 40 years every time Mickey has a birthday.

    It's important to remember that property rights are natural rights, which pre-exist our constitution (that's what our constitution says). Copyrights, patents, and the like are privileges which the constitution allows but does not require Congress to grant. When we equate copyright violation to theft, we blur that distinction, and play into the hands of those who would like to enclose the commons of our cultural heritage.

  27. Re:why not? by pla · · Score: 5, Interesting

    Seriously folks I think lately we've forgotten that stealing is stealing, and if you're stealing a piece of software you should be punnished for stealing a piece of software.

    And for those situations where stealing doesn't mean stealing?

    Two trivial examples that I suspect most us us could get "caught" for:

    First, a friend purchased (completely legal, nothing unkosher whatsoever, not even grey-market) a copy of Age of Empires - AoK. It has a rather annoying copy protection scheme, however, which annoys legitimate users (whereas pirates just run a cracked version with no hassles at all). So the solution? He uses a cracked copy of the game. A stupid software test for known program cracks would flag him as "stealing", yet he did no such thing.

    Second, and even more difficult to deal with - I have all of my CD collection on my HDD, since I only ever listen to them while at the computer. Legal format-shifting as allowed even by the DMCA. Yet, can I "prove" to some stupid spyware bot that yes, in fact, I really do own the CD? Nope. And even if I could, I shouldn't NEED to; my computer serves me, I do not serve my computer.


    More important than false positives, though, we should consider the issue of why we buy software in general. If I buy a game, I buy it to play that game. If nowhere in the documentation (or preferably, on the outside of the packaging) does it describe its "RIAA-friendly anti-piracy technology", it damn well better not have any. I don't buy software to spy on me, I buy it to do the task it describes itself as performing. Nothing more, and nothing less.

  28. Some possible problems... by SmackCrackandPot · · Score: 3, Insightful

    There's always the danger that a disgruntled employee could plant a cracked version of the software on a company computer.

    And what about shared laptops. Somebody loads on some software while attending a conference and then hands the machine back.

    Some floating software licensing schemes work on using IP addresses, MAC addresses, monitoring the real-time clock to make sure dates don't change. What if one of these circuits fails (stray cosmic rays, power surge), does that automatically make the user a criminal?

    Sure, software companies have the right to protect their software, but I don't think they have the right to allow their applications to automatically generate crime reports. W It would be more for the application to request new short-term licenses and deny access than do anything destructive. If an application can detect that it has been cracked then it should just refuse to work.

  29. Re:why not? by Lumpy · · Score: 4, Insightful

    Seriously folks I think lately we've forgotten that stealing is stealing,

    fine then you dont mind us installing a new tracking device on your cars to tell the manufacturer and your loan company and officer where your vehicle is at all times.

    if you aren't doing anything wrong then why are you against it?

    get the idea yet?

    --
    Do not look at laser with remaining good eye.
  30. Re:why not? by tomhudson · · Score: 4, Interesting
    Simple solutions:
    1. Unplug the phone jack/ethernet card
    2. Find out where its' sending packets to, and edit your hosts file on your proxy/firewall accordingly
    3. Remove the software (duh!)
    Or, to take the parent posters' idea of a virus (actually, a worm) to the next step, have it scout the net looking for legit copies, and installing the crack on their machines. So even legit customers would end up "phoning home".

    Seriously, just remove the software. If it does something you want/need, you have three choices:

    1. buy a legit copy
    2. develop a competing product
    3. put up with the knowledge that it is phoning home
    Mind you, if I wrote it, I wouldn't have it phone home, - I'd have it phone a (very) expensive 900 number (say, $50.00 a call) that I'd own, and you'd end up paying for your license when you got your next phone bill :-)
  31. Where is the crime in spyware? by mec · · Score: 4, Interesting

    So the (alleged) spyware sends copies of certain information about your computer back to the company that produced the software.

    The user still has all the information they started with. No one has been deprived of any information. All that has happened is that an additional copy of this information has been created and distributed.

    In order to object to this, you have to admit that some information does have owners, and also that it is wrong to copy information without the consent of the owner.

    Then, this being slashdot, you have to do a little song and dance, like this: "when other people create music and software and movies, and I make a copy of their stuff, it's fine. But when someone else makes a copy of information from me without my consent, that's wrong!"

    Your information wants to be free; my information wants to be private. See?

    My own beliefs are the same as Linus Torvalds: "He who writes the code chooses the license". If you don't like spyware, don't friggin run it. I don't.

    1. Re:Where is the crime in spyware? by boojum.cat · · Score: 5, Insightful
      Your information wants to be free; my information wants to be private. See?

      Oh, come on. That's ridiculous. There's a distinction between public information and private information. Published programs, even if they're copyrighted, are published. They're not private, like the user's MAC address and personal grooming habits.

      I'm not trying to justify running pirated programs, I just think you need to make a better argument.

      If you don't like spyware, don't friggin run it.
      Now, that's a better argument.

      --
      Lost: one sig, witty, 120 chars, sentimental value. Reward offered.
  32. Re:why not? by SoTuA · · Score: 5, Insightful
    STEALING IS A CRIME...

    True.

    And gathering personal information about a user, without his/her consent without a legal warrant is...

    Seriously, this information is NOT what anybody can get from public records. If I gathered this information about someone, and that someone found me out, I'd be charged with cyberstalking or whatnot.

  33. Re:why not? by armyofone · · Score: 3, Insightful
    Subpoenas and warrants are for the government, not a private company.

    In the words of Frank Zappa, "There's the crux of the biscuit" :-)

    This is why we have a huge problem with corporations running amok. They have somehow gotten the idea that they are not accountable for their actions. In reality, corporations have no more right to your personal information than the justice system. Even less so since the justice system does indeed need to get a warrant to search your personal space - unless you willingly give them permission, that is. A private company also needs your permission to collect your personal information. They may try to get around this with one of those over-restrictive EULA's, but I would venture to say that most EULA's may not be legally binding. We'll see how they hold up in court in future.

    In the meantime, if I decide to install any 'cracked' software, (not that I would), I'll be sure to make sure that machine has no chance of talking to the internet.
    --
    "A revolution without dancing is... a revolution not worth having"
  34. Too easy for a false 'pirate' by YrWrstNtmr · · Score: 4, Interesting

    Say you're a small shop. You have need of 3 copies of s/w package X.
    You go down to BigBox store, and buy 3 copies of X.
    Back at the office, you use one CD to load all the machines. Leave the other 2 in the shrinkwrapped boxes, on the shelf. Perfectly normal...happens all the time.

    The running s/w sees 2 other copies of the same s/n on the LAN, and phones home. PIRATE! PIRATE!

    You're 'legal'. You have paid your fees for the 3 copies. But Company X, due to their incorrect reporting and intrusive networking, thinks you are in violation. They send the BSA after you, with all the attendant fees.

    At this point, you're guilty until you can prove your innocence.

    Absolute BS, I say.

  35. "Oh come on," indeed... by X_Bones · · Score: 3, Insightful

    um, what? you might have a point if the software in question searched the user's hard disk for these pieces of information, but it's not. According to the post, the information sent from the program to a remote server is:

    "the users IP, a timestamp, the product in question, the users PC name, username, and MAC address."

    Every single piece of information transferred is accessible through the use of other, perfectly legitimate pieces of software, unlike medical records (which require a plausible reason to access); it should be clear that this program is not 'rifling through anyone's belongings.' And the mentioning of burning down the house is completely absurd; nobody is considering giving this data to law enforcement agencies or blowing up the user's computer if it's running pirated software (to relate your analogy to the situation being discussed). Please take your slippery slope arguments elsewhere.

  36. Re:why not? by shepd · · Score: 5, Insightful

    >Some people, especially young children, seem to have a difficult time grasping that although nothing physical is taken, theft has still occurred.

    No, it hasn't. Most parents (including yourself, I'm sure) tell their children, once they're old enough to read, that they should check the dictionary. I hope you don't mind if I do it for you.

    theft

    \Theft\, n. [OE. thefte, AS. [thorn]i['e]f[eth]e, [thorn][=y]f[eth]e, [thorn]e['o]f[eth]e. See Thief.] 1. (Law) The act of stealing; specifically, the felonious taking and removing of personal property, with an intent to deprive the rightful owner of the same; larceny.

    Note: To constitute theft there must be a taking without the owner's consent, and it must be unlawful or felonious; every part of the property stolen must be removed, however slightly, from its former position; and it must be, at least momentarily, in the complete possession of the thief. See Larceny, and the Note under Robbery.


    I don't know how much clear it can be than that, sorry.

    >it's not the physical manifestation that's holds the majority of the value of the item, it's the intellectual property.

    The only real IP I know of is Internet Protocol. "intellectual property" is a buzzword used by various anti-piracy groups to scare users. IMHO, it rates right up there with "speed kills" and "this baby is crying because it's dad was killed by a drunk driver".

    >So, your thinking that even though you took it, the fact that they still have it (wow, magic), let's you off the hook is just plain wrong.

    I'm not saying that. What I am saying is that piracy is not only a lesser crime (IMHO) than stealing, as it only deprives the owner of an imagined profit, and, in fact, does not cause a direct loss like shoplifting, it really bears no relation to stealing. The similarity ends at the word loss. Speaking of which, murder would be a loss of life, and therefore has the same amount in common with stealing as does piracy.

    Again, just my humble opinion.

    That being said, I feel that piracy ISN'T a good thing, that it is illegal, but that it is overzealously punished in today's times where steamboat mickey is still copyrighted property. The only way what people will wake up and stop the insanity (put copyright terms back into the hands of the people) is if people stop making it out to be something it isn't.

    >By the way, you're not even close in interpreting how copyright laws apply to these situations.

    Uhh, seriously, read a law dictionary. Without something being missing from the victim, and without it being in the hands of the perpetrator (preferrably at the same time) there can be no theft.

    While the crime of copyright infringement is generally punished in a federal court, and the crime of speeding violations in a municipal or provincial (or, in the US, a state) court, the style of offense is identical. They're both victimless crimes. Sure, you could say I *would* have bought a piece of pirated software rather than pirating it, but at the same time, if I get a stolen (for real) camcorder for $50 that sells for $5,000 do you think there's even a chance in hell I would have bought it if it weren't stolen? The fact is there is normally no specifically identifiable victim from piracy that can prove a loss, which is just like when you receive a speeding ticket -- nobody can prove a loss. It's just illegal, that's all.

    It's always a lot more complicated to convince someone a crime is bad when there is no victim, and *THAT'S* why the BSA (et al.) want you to (wrongly) think copyright is theft. Because then they have their victim -- english teachers.

    In fact, you'll find my previous dictionary definition a little lax. Merriam Webster says:

    theft: 1 a : the act of stealing; specifically: the felonious taking and removing of personal property with intent to deprive the rightful owner of it b : an unlawful taking (as by embezzlement or burglary) of property

    When dictionaries start saying specifically, and highlight it; I think they're trying to curb an improper usage of the term.

    --
    If you could be told what you can see or read, then it follows that you could be told what to say or think - BoC
  37. Re:why not? by Anonvmous+Coward · · Score: 4, Interesting

    "Seriously folks I think lately we've forgotten that stealing is stealing, and if you're stealing a piece of software you should be punnished for stealing a piece of software."

    That's fine provided due process is followed. Calling home and saying "I'm cracked" is not evidence of guilt. I have a piece of cracked software on my laptop. Am I guilty of piracy? Have I stolen anything? Absolutely not! I paid for the software. However, I cannot have a dongle sticking out of the back of my laptop. It's not worth risking breaking of the dongle, or worse, the laptop.

    End of story? Me thinks not. If somebody installs cracked software they haven't paid for simply to evaluate it, have they stolen it? Ethically speaking, no. The fact of the matter is that you cannot return software. The only people who are truely guilty of commiting theft are the people who acquire the software without paying for it, and make use of it.

    I would advise not trying to oversimplify this down to black and white. It is nowhere near as 'end of story' as you're making it out to be.

  38. Re:why not? by deke_2503 · · Score: 3, Insightful
    Information "theft" is not really theft or stealing. Thousands of my users probably "steal" my software, but guess what! I DON'T CARE! It is information, which I CANNOT OWN!

    This is ridiculous. Allow me to make random analogies to support myself, because this is Slashdot, after all.

    Consider a carpenter. If he builds a chair, it is a physical entity which one person (himself) owns. It cannot be reproduced effortlessly. Therefore, he can sell it and make money to compensate himself for his labor.

    Consider, again if you will, a programmer. If he writes a program, it is a theoretically non-physical (yeah, it exists on disk/memory somewhere, but that's irrelevent) creation which he owns. However, it can be copied, meaning someone can reproduce it freely and infinitely with no cost to said person and no compensation for the programmer.

    Where do you get the idea that a program is information from? That's like saying the chair you're sitting on to read slashdot from is information. And obviously there's the kneejerk reaction to this claim of "that's absurd! I didn't say that," but look again. You did.

    People do not create information. Information exists. Therefore, if one creates anything, be it a chair, a program, or a cowboyneal voodoo doll, it cannot be information.

    You make the false assumption that because it is not a physical thing, your programs are information. This only barely makes a semblence of sense because in essence, they are information for how the computer should run. But that's because they don't physically exist. Just because they cannot be canned and shoved on a store shelf doesn't mean they are information.

    Finally, to reiterate and conclude the beating of the dead horse, allow me to give examples of information:

    • George W. Bush is President of the United States.
    • The sky is generally blue
    • Moscow is the capital of Russia
    • The current year is 2003
    • Wine is made from grapes

    The difference between those and a computer program is obvious.

    -dave

  39. How about, not publish software? by Thing+1 · · Score: 3, Insightful
    Do you feel software publishers should have the right to peer into users data, if their software suspects foul play on the machine, or should it do the easy and intelligent thing and just stop working?

    If a software publisher prices their software "out of the market" then a potential user has two recourses: 1. don't use it; 2. pirate it.

    If the software publisher's decision is inappropriate (i.e., the value is $50 but they charge $2,000), then the user can't be blamed for pirating it. I mean, they can be, but let's face it you can't return software you don't like (because "you might pirate it"), so the default behavior is, pirate it to make sure you like it. Then, if you so choose, pay for it.

    I think it's super cool though, that publishers are going to more and more draconian levels in order to "protect their profits" because it just makes open source/free software that much more attractive.

    See the Ernie Ball story for more details. (I love that I saw the Ernie Ball and the optic-fiber sponge stories on Excite last night, and then saw those two posted here today.)

    --
    I feel fantastic, and I'm still alive.
  40. Entrapment by Zerbey · · Score: 3, Interesting

    Doesn't this fall under Entrapment laws, or does that just apply to law enforcement agencies?