Slashdot Mirror
Microsoft Sued Over WGA
Hope Thelps writes "The Seattle PI is reporting on a lawsuit being brought against Microsoft in response to their WGA spyware. Groklaw is also covering the story. Although there are a lot of similarities to Sony's rootkit, the actual harm done is less concrete. It'll be interesting to see how this turns out."
Sued by the same moneymonger who sued Sony.
whoopie, M$ loses and donates another $1,000,000.00 worth of software to some high school system or third world country as retribution (at a cost of about 35 cents to the evil empire).
win or lose this will deter Microsoft from using wga to shut down any unlicensed (or otherwise) computers...for a while at least.
"I just only wish there was an alternative..." typed the man in his slashdot repsonse on his Linux workstation.
FLR
How can an official component of Windows be spyware? It's their operating system, they allready own you if you use it. Pull down your pants and get it over with allready.
"If you don't have eyes you shouldn't have wings" -- Carl Pilkington
A Microsoft spokesman, Jim Desler, agreed with the allegations. "Spyware is deceptive software that is installed on a user's computer without the user's consent and has some malicious purpose," Desler said.
Well, actually he claims to have disputed the allegations, but then he said what's quoted above, and finally (to the press corp's horror and astonishment), proceeded to shove his entire foot, ankle, and leg (up to his knee), firmly down his own throat.
Let's break this down:
[x] Deceptive software...check!
[x] Installed without user's consent...check! (Well, basically with as much consent as any other spyware package, so I think there's a good case to be made for this point.)
[x] Malicious purpose...check! It beams data back to the mothership every day and can be used to remotely break the computer. I think that qualifies as "malicious."
So apparently by Microsoft's own admission, WGA is spyware.
I'd personally argue for a more expansive definition of spyware (or malware, or scumware, etc...), but even given the relatively constrained definition proposed by Microsoft itself, WGA seems to qualify.
A: On a pile of money.
In the case of Windows Updates, I would argue that it is even more out of the user's control. For alot of malware, you have to click "yes install" at some point. For Windows Updates, the recommended state is to "automatically download and install in the background." In theory a user could examine each and every update to figure out what they all do, but in practise the actual purpose of each update is heavily obfuscated. Worse yet, in the case of WGA, once you allow it to install (it seems innocent enough at first), it is used against you to force further installations.
Frankly the tactic Microsoft is using in their updates is not ethical. Everyone is told to do their Windows Updates (for security reasons), and Microsoft is exploiting this to slip in some other software that the user does not necessarily need. Worse yet, this software sends back information to Microsoft HQ without user permission. If this does not count as spyware, I don't know what does.
I hope this lawsuit makes Microsoft wake up to the illegitimacy of their tactics.
Hey, at least the Sony rootkit comes with music!... this thing comes with worse: Windows!
A computer once beat me at chess, but it was no match for me at kick boxing.
Call BS on this one.
I would have seen that behavior on one of hundreds of PCs. I have not.
You're either posting for FUD, or your machine isnt' configured how you think it is.
Or the problem is between the keyboard and the chair.
-Malakai
A Dragon Lives in my Garage
1. WGA communicates with Microsoft HQ. The information transferred may or may not be 'sensitive' but this could be considered an invasion of privacy.
2. Any program that uses up system ressources without performing a task explicitly requested by the user is harmful in the sense that it slows down the computer. This is one of the main complaints with spyware/adware: they slow down your computer for no purpose (or at least no purpose that you, the user, are interested in).
3. WGA appears to effectively give someone else (specifically Microsoft) control over your machine (for instance the recently announced "remote shutoff" function). To the user, a program that limits their control of the computer (and gives someone else more control) is harmful. Note that the argument "but Microsoft would only shut off illegitimate versions of Windows" doesn't make any difference. Even if that's true, there is still a loss of control for the user. This is harmful to the user.
To the same extent that any other piece of so-called "spyware" is harmful (installed in a tricky way; sends info back to some company; wastes CPU cycles and disk space; etc.), WGA should also be considered "harmful."
The problem with WGA is that is not an update, security-patch, or feature upgrade. It does *nothing* for the user, and only installs in order to give Microsoft more control/leverage over your machine. From the user perspective, it is a net negative, hence harmful.
I'm sure that I'm not the only one who hates all of the BS you get when you buy a new laptop/desktop. First thing I've always done with my Dell laptops/desktops is format, reinstall xp + linux. However, I got frustrated with the activation when I didn't always internet or the activation insisted i make a 30 minute call to MSFT to get a rediculously long key. Long story short, I used the ever-so-famous corporate copy + key (generated with keygen) even though I have XP Pro COAs on the systems. Now, a few years down the road WGA is going to force me to reinstall--now that I have many important business apps installed. How many others are in the situation of "invalid keys" with legit COA licenses?
Just thought that you guys might wanna know that Microsoft has came up with an article on removing WGA.
w00t
What peeves people so much about WGA is that MS pushed it out as a Critical Update, meaning that all machines with Auto Update install it without prompting. It is undeniably not a critical security update and to make matters worse it phones home. After taking some heat, MS then conceded that the installation of WGA will be optional (if by optional you mean selectively blocking some non-critical updates). It's still being pushed, but you don't have to install it. For those of you with your less than legit copies worried about not receiving updates, you can always download third-party update packs if you don't mind a bit of a delay. Not necessarily a bad thing considering that MS has been known for having to patch their patches. I'm not an MS fan, but not a huge hater. Just a strategically stupid time to ramp up WGA after the whole rootkit fiasco. I'm not an MS fan, but not a huge hater. Just a strategicly stupid time to ramp up WGA after the whole rootkit fiasco.
Look everybody wga is NOT SPYWARE. I ran Microsoft Windows AntiSpyware Beta on WGA and it came up CLEAN. So drop it okay?
http://www.firewallleaktester.com/removewga.htm
I CANNOT vouch for the legitimacy of that utility (so scan it first, try it on a staging machine, etc., YMMV, Batteries not included, and all that jazz). I just did a quick search for utilities for removing WGA, but being a Linux user I don't have much use for it myself. There are reviews of it on legitimate sites (for example, PC World) but then they've also unknowingly recommended scumware in the past as well.
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
In other news, Jack Kevorkian sued the developers of the POSIX-compliant 'NUX commandline program "killall", citing that the application didn't really kill "all" the programs on the computer but instead should be renamed to "killnothingbut". This intellectual Advantage(TM) of Kevorkian stemmed from his introduction of the oft'quoted uber-leet commandline tool "kevork" which injects null pointers into the code and data segments of all programs that are non-responsive to the "TERM" and "KILL" flags. Kevorkian was unable for comment on whether this is a closed or open-source application, though it was rumoured by his assistant that it is a simple library replacement with a namely-fassioned symlink to killall that the library determines based at runtime with argv.
Sincerily,
John "kill'em'all" Dahmer
In other words, false positives. Also, doesn't it phone home every day or something? You'd think you'd only need to check once.
Want a high quality FOSS RTS game? Try Warzone 2100!
The thing is my hijacked copy of Windows XP won't even download updates because it has an 'invalid key', so how are they going to deliver the WGA?
Let's see... I just ran Microsoft Update, then I clicked "Custom". It tells me:
No mention of WGA. So I click "Details" and lo and behold, it's the WGA Validation Tool that I must install. My only option is "Download and Install Now". There is no skip, ignore, anything. So as far as I can tell, in order to continue receiving updates, I must install this spyware. I don't feel that that qualifies as an "optional" install.
Good end evil don't come into it.
Unacceptable behaviour isn't justified by saying that the perpetrator was acting in his own best interests rather than out of a desire to hurt people.
If the electricity company thinks I'm fiddling the meter to get out of paying them what I should then there are some acts that are acceptable for them to resolve that and some that aren't. I'd say that entering my premises on the pretext of fixing a dangerous defect in the system and while they're here hiding a camera that relays images to them would be unacceptable.
You may well not like the analogy or you may draw the line of acceptable versus unacceptable at a different point to me, but either way the issue isn't resolved by saying that they're not evil and they're just out to protect their own interests. We have to make judgments on what is and isn't acceptable in pursuit of those interests.
To me, Microsoft have gone way over the line. You may disagree. But don't try to reduce it to a comic book battle of good versus evil and then accuse me of calling them evil.
To summarise the summary of the summary: people are a problem. ~ h2g2
True story:
I sometimes use my university's wireless network (whenever I bring my laptop). Since the university's IT lab has no way of knowing who is using what laptop[1], they redirect all initial traffic to a portal where you must log in (using the username + password you use on all other university computer systems). Point being, you get a network connection, but must log in to actually get where you want.
Since I installed WGA[2] (at the point I was rather indifferent to it), every time I use the university's network I get 50 entries in the Application Log (error source: crypt32; description: "Failed auto update retrieval of third-party root list sequence number from: with error: [timeout/server cannot perform operation/error code]"). This happens before I have a chance to log in on the university network, which of course means that my laptop can't yet access said site. More annoying, though, is that svchost -k netsvcs starts eating memory like crazy; peaking at over 90 MBs and then falling down to 70-80 (used to stay at 20-30). This only happens when I use the laptop at the university; at home (where obviously no login is required) the process stays at 20-30 MB.
I personally think that some "advantage" component that, when unable to access some site, causes a process to eat up 3-4 times the memory it usually does, taking up an extra 10% of the computer's physical memory in the process, is rather a DISADVANTAGE. I don't know how much memory spyware typically consumes, so I can't reflect on the comparison between WGA and spyware. 50 MB seems a rather hefty price for failing to communicate with some server, though.
Maybe they should rename it WGD?
[1] I guess a) setting up individual users' connections, including keys, is too much work, b1) collecting MAC addresses is too much work, b2) Joe Average won't be able to figure out his computer's wireless' MAC anyway, and c) there are potential security leaks if wireless cards, or laptops, are stolen/sold to non-university users (both a and b1).
[2] Troubles started at that point. Could be something else, I SUPPOSE, but I think it is unlikely.