Feeds

RealNetworks admits to new spyware bug

And to being too thick to exploit it

  • alert
  • submit to reddit

Remote control for virtualized desktops

A flaw in RealNetworks RealDownload, Netscape/AOL Smart Download, and NetZip Download Demon, discovered by Gibson Research founder Steve Gibson, appears, at least in the case of RealNetworks, to be the result of ignorance rather than nefarious intentions, according to a FAQ hastily issued by the company.

"We weren't even aware [the flaw] was there," RealNetworks spokesman David Brotherton said in an interview with MSNBC. "We were not using it to log users behaviour in any way. The [unique identifier Gibson discovered] served no function we needed, and it has been eliminated."

Apparently, due to confusing information in Microsoft Windows developers' documentation (another shocker), an ID string the company had intended to be random actually identified users, and without RealNetworks knowledge.

Gibson discovered the problem by using a packet sniffer, which indicated that not only was a unique user ID being generated, but that download records were being sent back to the company.

"Every time you use one of these utilities to download any file from anywhere on the Internet, the complete URL address of the file, along with your computer's individual Internet IP address, and a unique ID tag that has been assigned to your machine, is immediately (and secretly) transmitted to the program's publisher," Gibson said in a recent report on his Web site.

"This allows a database of your entire, personal download history to be assembled and uniquely associated with your individual computer, for whatever purpose the program's publishers may have today, or tomorrow."

Gibson says that when he first published his findings, RealNetworks denied them and threatened legal action, apparently the impulse of the decade wherever embarrassed Internet companies are concerned.

"RealNetworks will hold you and your company liable for any damages caused by your patently false and reckless statements," Gibson says the company wrote in a memo.

On further consideration of the facts, which Gibson provided in copious detail, the company changed its tune to the satisfyingly conciliatory, PR-salvaging tones we hear today.

This is not the first time that RealNetworks' privacy protections have been weighed in the balance and found wanting. Last year, privacy advocate Richard Smith discovered similar features in RealNetworks' RealJukebox software, much to the company's embarrassment.

Meanwhile, AOL is currently embroiled in a lawsuit over its Netscape SmartDownload software, in which it is claimed that the utility captures and transmits user-identifiable information to the company when the utility is used, quite contrary to AOL's stated, and putatively exemplary, privacy policies. ®

Security for virtualized datacentres

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Big Content outs piracy hotbeds: São Paulo, Beijing ... TORONTO?
MPAA calls Canadians a bunch of bootlegging movie thieves
Google Glassholes are UNDATEABLE – HP exec
You need an emotional connection, says touchy-feely MD... We can do that
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
US court SHUTS DOWN 'scammers posing as Microsoft, Facebook support staff'
Netizens allegedly duped into paying for bogus tech advice
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Verizon bankrolls tech news site, bans tech's biggest stories
No agenda here. Just don't ever mention Net neutrality or spying, ok?
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.