The First Pings of Paranoia

The much-disliked Windows Genuine Advantage is like all anti-piracy software: it makes life miserable for legal customers while failing to halt the genuine advantage of mass piracy operations.

CNET now reports that Microsoft has released a method for halting alerts generated by WGA. But it's never enough for monopolistic-minded corporations. Like most governments, Microsoft and corporations with overswollen egos want more, more, and more intrusion into the lives of their customers.

Here's a prediction you won't hear from Bill Gates: Microsoft will rename WGA and will write even more intrusive software to probe your computer(s). Like virus writers, Microsoft programmers will learn from their mistakes and the mistakes of others (like Sony getting caught with the root kit software they licensed for CDs) and eventually figure out how to be undetectable.

One reason to not upgrade software is because of new bugs that we have to suffer through. Another reason is to avoid increased surveillance by software companies. One CAD package, for example, sends a ping back to corporate headquarters each time you start the software. It's just a ping, but here's how the information can be (ab)used:

- How often their software is being used (from the number of incoming pings).
- And where (from the IP address sent with the ping).
- And at what times (from the date and time of the ping).
- And if pings are coming from locations with no licenses (IP addresses of pings matched to IP addresses collected by the online registration system).

Match the data collected from pings with the software's end user license that gives the corporation the right to send agents to search your home for illegal software, and it's easy feel the pings of paranoia.

(You can prevent software from providing information about your use by getting ZoneAlarm to block outgoing requests. Except that some programs won't run unless they can call home, such as the first release of Alibre's Xpress software.)

Comments

[Matt Stachoni]

While I agree that the "Windows Genuine Advantage" tool is ridiculous (for no other reason than that it was effectively cracked months ago), the damning evidence that can be had from a simple ping is next to nil for a software company looking to go after individual instances of software piracy.

The facts you can glean from such a trackback to the user are almost all isolated to geography. If the "CAD Package" you refer to is sending lots of pings home from Uruguay, for example, and the CAD vendors doesn't sell to Uruguay, there might be something to investigate.

But companies routinely purchase volume licenses, where one serial number goes on many many machines, in many different offices, each with a different IP. IPs also change on a daily basis, depending on your ISP (many companies do just fine with broadband services with a dynamic IP, because it's cheaper than a static IP).

Furthermore, many apps - including AutoCAD - allow users to run the software on more than one machine, which dilutes any aggressive tactics one can get by examining IP addresses alone.

Heck, I must be flooding Autodesk with pings on a constant basis, just because ADT crashes out all the time.

In other words, such pings can net a developer a big picture view of installations, but specific instances of illicit use require a LOT more information to be gathered before potential evidence can be produced in a court of law.

The nefariousness in such "phone home" spyware techniques come when the software demands some sort of activation on installation (many do not), and sends back extensive system and personal information, such as machine name, user name, software serial and registration numbers, and so on. With THAT information, a developer can determine if the installation is proper and/or uncracked, and that can get you into trouble.

Furthermore, companies are getting very smart about what packets can legitimately come in and go out of their routers. Lots of packets sent to a single target would definitely raise some flags, or at least prompt some bright soul to put a packet sniffer on the line to see what's getting sent back. I've not heard of any such investigation being done for a CAD app.

So, unless a lot of data is being sent back to the Mother Ship at runtime, I wouldn't worry too much about any black helicopters landing in your back yard because you fired up that warez copy of Phososhop.

But, that said, it might be wise to keep a couple extra tinfoil hats at the ready. Just in case.