Slashdot Mirror
Microsoft Misrepresenting WGA's Functionality?
Legal Ethics writes "According to an article on Groklaw, Microsoft is misrepresenting what the Windows Genuine Advantage (WGA) tool is to pressure people into installing it. It comes with no uninstall, it fails to disclose many pieces of information it provides to Microsoft, and it misrepresents itself as a 'critical update' when it does not address any security vulnerability, although it remains to be seen if it can create one. ZDNet has a series of screenshots so that you can see exactly how badly it misrepresents itself. Oh, and it also checks for updates, so Microsoft can presumably execute arbitrary code on any machine with it installed, merely by making that code part of a WGA update."
.
We also know that Linux is a European consipracy to attack our computers.
This story was probably planted by GOOGLE, the America-hating empire.
Bill Gates is a true patriot who has spread the American Way of Freedom and Capitalism around the world, and he is clearly far cleverer than this mysterious "P" "J". Friends, don't let the democ-rat lies stop you from getting the facts
And what can us consumers do about it? If we refuse it, we don't get updates. This is punishing us the legit users, while pirates will still be laughing at M$'s latest attempt at stamping them out!
I gave it some thought before I installed it earlier. I knew all it did was report to MS that I had a legal copy of Windows, but the bad part about it was that it seemed I had to install it before I could download any other critical updates.
It's a damned-if-you-do and damned-if-you-don't situation...
I had never thought of that. I just assumed that it's within a company's power to give people updates to ensure they've paid for the software, but come to think of it, the ones who have paid for it shouldn't have to put up with anything they don't want to, and the ones that haven't, well, they're probably not going to.
Send email from the afterlife! Write your e-will at Dead Man's Switch.
well?... last time some software package was reported doing this it was labelled spyware and the company was prosecuted..
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
do we really need a play-by-play commentary of some jackass installing an update? 17 pages of ads and shit.
the question is when are the anti-malware community going to step up to the plate and provide protection from this software
the fact its made by Microsoft should be irellavent, just analyse the behaviour of the application and judge it on that
communicates unique information at any time to an American based advertising company (msn anybody?) with you the user having no idea of what data and what the implications are of giving this company that data
can your business really risk an application like this on your systems ? are you prepared for the consequences of letting this program run unchallenged inside your companies infrastructure ?
but they are not allowed to misrepresent its nature or what it does to consumers, that is called fraud.
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
It's not the fact it's there, it's the fact Microsoft is not properly disclosing everything it does. This has nothing to do w/ the anti piracy isuse.
...and that's all there is to it.
If you want to be able to disable the Genuine Windows Advantage Add-on for IE (accessible via Tools|Manage Add-ons... in IE), you might be surprised (or not) to see that Microsoft will not let you do so. It gives you some sort of stupid "disabled by Administrator" message, even when you're logged on as Administrator (I guess MS thinks it's the administrator for your computer).
To enable the radio button that allows you to disable this worthless add-on, follow these instructions I found:
Modern copyright is theft of culture from everyone and it retards the progress of the useful arts and sciences.
...why they have to install a piece of software to determine whether your copy of Windows is legit or not. Why not just run a check online when you're doing updates? There's GOTTA be more to this...
Earn a % of cash back from Newegg, Tiger Direct, Walmart.com, and more: http://www.mrrebates.com?refid=458505
Since Windows is sending information home, and the user has no control over that messaging with regard to timing or content, it seems to me HIPAA-compliant systems (and other systems requiring security) cannot be built on Windows.
What an opportunity for the open source world!
How to bypass and disable the Genuine Windows Validation Check (from http://www.mydigitallife.info/2006/03/07/bypass-an d-disable-genuine-windows-validation-check/):
Note: The data.dat that are replacing the original data.dat can be blank text file or empty, or you may type whatever you want there.
With this hack (or crack if you want), Windows WGA piracy check will be bypassed and you can now download software from Download Center or apply updates from Microsoft/Windows Updates.
Modern copyright is theft of culture from everyone and it retards the progress of the useful arts and sciences.
Non-admins may get the euphemistic warning of possessing pilferred software,? PostID=370244&SiteID=25/
http://forums.microsoft.com/Genuine/ShowPost.aspx
Notice the MS solution, delete this, open up all permissions on that (good idea?), read, write, execute, delete for everyone! Or pay-up to get your copy of MS Winders to shut up.
Nothing like family (non-admins) and employees (non-admins) thinking they have purloined software. Isn't an unfounded accusation called, "Libel" http://dictionary.reference.com/search?q=Libel/?
(My SuSE never accuses me with false accusations.)
One ring to bind them - should probably have more fiber and less rings in their diet.
Hello, Sir. I represent the manufacturer of the car you are driving. I have just replaced the motor in the vehicle with a treadwheel powered by four asthmatic hamsters. I hope you enjoy the improvement to our car.
Have nice day.
Bwwwwwwwwwwwahahahahah!
KFG
When I read this, I thought, this has GOT to be a joke:
Oh, and it also checks for updates, so Microsoft can presumably execute arbitrary code on any machine with it installed, merely by making that code part of a WGA update.
Where did WGA come from? Auto Updates. What does Auto Updates do? Downloads executable code and makes it a part of your Windows OS.
"Shocking facts" like those really put Slashdot editors low in my eyes.
This "genuine advantage" notifier is remarkably easy to disable. Here's a link that documents numerous ways to defeat it. http://labnol.blogspot.com/2006/04/workarounds-to- disable-non-genuine.html
I poked around trying to figure out what was wrong.. Didn't see anything. I clicked the "get legal" or whatever it says button at login but nothing ever happened. I eventually remembered that this particular computer had locked up on reboot the week before on a Tuesday and thought perhaps it had something to do with the latest updates from MS. I uninstalled the last few updates I could find. Rebooted, reinstalled them and eventually everything came back to normal and no more complaints about an illegal copy.
I hope this never happens to aunt Tilly. I wonder when XP will really be ready for the desktop.
--- Liberty in our Lifetime
I wish people would quit acting as if anything was unqualifiably better. Life consists of trade-offs but to hear some people talk, life would just be a bowl of cherries if one were to just do this or that... Sheesh... Yes, Linux is better in some ways, but there's that trade-off thing at work there.
A Critical Security Vulnerability has been reported for all x86-platform PCs.
Short description: By retailing a piece of software called an "Operating System" to a computer user, and then using social engineering to promote the installation of this software, a so-called "Operating System Vendor" may be able to execute ARBITRARY CODE on a user's computer.
Severity: Severe. The exploit allows an entity to execute arbitrary code on a machine so compromised. Challenge Vector: Remote or local installation of components, either onto a pre-existing Operating System or onto an otherwise bare x86 PC. Mechanism: A package of executable software, called an "Operating System" is distributed by "Operating System Vendors." These Operating Systems have declared purposes which they fufill with wildly-varied results. These operating systems posess code which may not be fully understood by the user, often these Operating Systems enforce systems of privilege and resource maganement which place the Operating System in a position of "arbitrating" between the PC hardware platform and the user. When the Operating System has been so installed, it is capable of executing arbitrary code on the host system.Don't blame me, I voted for Baltar.
Collects info about user? Collecting info about my hardware and my installation without my consent is close enough. Check.
Change settings on my computer? You cannot remove it without some hack. Check.
Doing all this without "appropriately obtaining your consent"? Hell yes check.
WGA is spyware by Microsoft's own definition.
One thing I will credit Microsoft for, is I do not know ANYONE legitimate or not, where windows stopped running because of verification failure.
In 2 personal cases, other products I paid a lot of good money for stopped. First Norton anti virus, after a hard drive failure would not validate and refused to run on the new hard drive.
And second the most evil spy ware in the universe - steam - tells me I have a banned CD key - I'm sitting here looking at a CD, a box, a manual, and a receipt for $50 and I have never given a copy of anything to anybody - and they call me a crook and ban me - I swear if I ever get the opportunity I will do physical harm to someone who is responsible for steam. Then their joke of tech support says they cant offer any help since i have a banned key. Don't cross my path in a dark alley, i'll ban your head from your shoulders, thiefs.
slashdot troll = you make a compelling argument I do not like the implications of.
Yeah, it does. One known-pirated computer that I know of (I used to work at a computer store) used to have WGA report as valid. A few months later, it reported as pirated (which was true.) So yeah, it does a better job of checking now. How good? I dunno.
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
I just bypass it. How to bypass WGA
Corporation, n. An ingenious device for obtaining individual profit without individual responsibility. - Ambrose Bierce
I reinstalled XP recently and my Key decided to "run out of activations" so i had to call up MS. I was furious...
I contemplated installing the various coporate versions and hacked Pro versions that i have on back up just out of spite.
But instead i called up MS went through their automated crap which is a nightmare in stupidity. After it finished it told me "I can not activate my key and to hold on to for an operator"
YAY.
So i get to the operator... I give her the code, she gives me a new key... all is solved...
Not so fast...
I go to install updates... and WGA must be installed first...
OK lets do it...
ERROR.. UNKNOWN ERROR.
What?! What the fuck?
I call MS tech support...
The guy is completely useless and puts me through to a smarter tech...
As i'm waiting for brainiac to pick up, i discover that by default windows XP installs IE with "Custom" security settings which does not allow WGA to install.
So lets recap. WGA wont install automatically on a default XP install because IE is set to custom security rather than "Medium"
Oh the stupid headache...
So i figure it out while waiting and then the guy picks up cause i'm a nice guy i waited to tell him what the problem was...
I tell him and i hang up.
WGA is not only a pain in the ass for legal users... the activation itself in windows is down right stupid. I have to call MS everytime i want to reinstall now.
Which is what? every month?
I made an image of the boot drive install instead. No thanks MS.
Its just too much. I dont care about MS's bottom line, i care about the dollars i spent and its a headache. Too much is too much and that too much was WGA itself.
I have the coporate and hacked WGA versions, I know how to reg hack the WGA dll out and kill access to it and bypass the windows update...
BUT I also OWN my windows... I tried to do the right thing and in the end, yeah it works but it was a big fuckign headache that i'm not willing to deal with any more. Things are only going to get worse as DRM and every other attempt made at taking control of your computer is made by these companies.
I like for it to be known that its just as easy to run the hacked versions with less of a headache... I was on the verge of doing it out of spite...
I only wanted to know why my Key wasnt working and why WGA was not allowing me to update cause i was angry... Thats the only reason i am running my legit copy of XP now.
I'd gladly explore other options next time if it means saving my time and my sanity.
After installing Office 2007 beta, I couldn't get it to activate. I did some tracing with Ethereal and found that an https connection was made to Microsoft servers and a blob of data sent. Microsoft servers don't respond and 60 seconds later the connection is closed. After installing WGA, the Office 2007 activation worked fine.
In case anyone is curious, these are the benefits Microsoft claims if you use WGA: http://go.microsoft.com/fwlink/?linkid=39157
What is really funny is that if you click Validate Now on that page and you are using Firefox, it wants to install a plugin for Firefox. Yes, Microsoft has written a plugin for Firefox!
You are thinking the same way Sony did about the rootkit. In the words from a deputy director of Homeland Security about Sony, "it may be your IP, but it's NOT your computer"! The same applies here, Gates didn't pay for the computer or the electricity to run it, so what's on it is none of his business.
A M$ piece of spyware reporting home in realtime is just setting the stage for remote control over your software choices. Think about the RIAA/MPAA asking M$ to dis-able Limewire on all computers for a big enough bribe. Or M$ deciding that they don't want Open Office to run on their OS. It will happen!
There has never been a reason to trust M$ and I don't see that changing.
Professional Politicians are not the solution, they ARE the problem.
I noticed that everytime wgatray.exe is run, it's making a quick call out to MS to check for updates. It's not alot of bandwidth, but I imagine it's a special server at MS that is doing the checking.
Now, if, for example, someone were to write a simple program that called wgatray.exe in an infinite loop and had a few hundred thousand people running it, then Microsoft would wind up on the end of a DoS attack. What would happen if the wga server was down? Would Windows stop working?
(When I say simple, I mean simple, as in a 2 line batch file, didn't Microsoft think this through?)
tray.bat
-----------
wgatray.exe
tray.bat
I find your remarks a little odd considering:
If those are actually representative of your needs as a Windows user than you wouldn't have a problem moving over to Linux. If they aren't representative of your needs then get better examples and ask yourself why you chose those examples in the first place.
Time makes more converts than reason
Just because some piece of software wants to do something doesn't mean you have let it.
Why not just block it with a firewall? According ZonaAlarm the IP that WGA connects to is (or maybe *was*) 64.4.52.189
From WikiPedia:
Windows Genuine Advantage Notifications and Firewalls
Some personal firewalls, though not the basic one in Windows, may alert on the method by which wgatray.exe is started, in the case of Outpost firewall, it is identified as a "hidden process". The wgatray.exe process itself can be firewall blocked, without apparent problems. Removing the reference to WGALOGON.DLL using HijackThis appears to effectively de-install this update, to the point where it will be offered again if it has not been marked "do not show".
And I'm sure there are a dozen other ways to avoid the WGA.
Next, once you're comfortable with configuring a live-CD, back up your data and do a dual-boot install. Use linux as much as you can stand it, then switch back to Winderz for the few must-have apps. If you hate it, dump linux and you'll have a fresh Windows install that may run well for a few months. ;-)
Once you convert to OSS versions of most of your apps, and are comfortable with linux being your primary environment, back up your data then install a 100% linux install. Then, for those few clingy win32 apps, try using Wine (a mostly bitter pill, but it does some stuff well) to run the apps. Failing that, try Qemu. If *that* fails, try VMWare or Win4Lin.
Eventually, a few months down the road (or a couple of years, even), you may decide that the stability and reliability of Linux outweighs the win32 baggage and you either find linux equivalents you really like or you "settle" for something not 100% what you'd prefer.
I began the above transition about 7 years ago (except live-CDs weren't around). Took about 2 years. Games kept me dual-booting for about a year... until a wife and kids took more of my time and I decided that silly free games (nethack and xmame) were enough for the occasional video game fix. Then Quicken and Turbo Tax kept me using VMWare for about a year. I replaced Quicken with GnuCash for a year or so, then I ditched it for a simple spreadsheet checkbook balance sheet. By that time, I was beyond the simple tax returns, and I decided that $200 yearly H&R Block trip was less painfull than the $50 TurboTax and several hours of punching in stuff. (Also, the whole anti-piracy FUBAR for Turbo Tax in the late 90s turned me off Intuit.)
So I've been 100% Winderz free for 5 years, and I'll never go back. I don't put up with DRM or anti-piracy shit any more. If I doesn't run on Linux (now, FreeBSD/amd64), I find something else to use.
Freedom... indeed!
Method of processing duck feet
Yes. You trade off some functionality and eye candy for freedom. Any takers?
evil is as evil does
Better yet, it runs on straight Wine with a few patches.
The same is true the other way though. I'm currently for practical reasons running Windows on my laptop (because current employer runs that, and it just ends up being easier overall getting the job done.)
Privately, it drives me nuts, I regret not having made the thing dualboot.
There's no Kphotoalbum, picasa is available from Google, and tries to solve sorta the same problem, but frankly it doesn't measure up. It has lots more eyecandy but much less funcionality. I'm not aware of any other sub-$1000 program even playing in the same ballpark.
Mail clients is a hassle. Thunderbird is barely acceptable, yet fails to manage a lot of stuff I've been taking for granted for years. Simple stuff that mutt, pine and kmail all manage. Yes, it's possible it can be convinced to do something similar, but atleast it's not equally trivial.
Development-tools all have to be installed manually. And they tend to be more opaque than I'm used to. When they fail, they do so with much less information that migth help. Frequently the best advice amounts to "reinstall".
One can install CygWin, but the tools under cygwin are a lot less polished than under a real *nix.
I have several, legal licenses to XP. Yet, I *always* use a borrowed, corporate serial number. Why? No activation. Why do I care? Aside from the principals involved, my XPs always run in virtual environments -- VirtualPC, VMWare Workstation, and of late Parallels Workstation. I've not tried Bochs, etc.
I'm not trying to debate the licensing (I know I'm supposed to use my own numbers; I don't care, though) or the multiple machine issues (I've got all the licenses I need legally; convenience is the issue). Instead I bring questions:
How does activation work in a virtual environment on multiple, physical machines? Sure, the virtual machine "footprint" is going to change between using VMWare, VPC, and Parallels. But what bearing does the host machine have on it? If I take my legally activated product (the non-corporate version) disk image from physical machine to physical machine, is there a tie to the real, physiscal hardware? As far as I know, processor ID, MAC address, and so on are all virtualized, but is there something else in the activation checksum that these commercial VM solutions tie to the physical hardware?
I don't know enough about the license (who really does?); to me the "machine" is the disk image, so I have no moral qualms about moving it from physical machine to physical machine as long as they're not used at the same time (etc. etc.).
Oh, so why don't I try it? I just don't want to "burn up" any of my serial numbers. Meaning, invalidate them because now I look like I've pirated the number because I'm installing onto too many machine. VMWare for Windows and Linux, VPC for Mac and Windows, Parellels for Mac/Linux/Windows... I'm a big time pirate trying to install a single serial on *seven* computers, ya know?
--Jim (me)