Feeds

RealNetworks admits to new spyware bug

And to being too thick to exploit it

  • alert
  • submit to reddit

Intelligent flash storage arrays

A flaw in RealNetworks RealDownload, Netscape/AOL Smart Download, and NetZip Download Demon, discovered by Gibson Research founder Steve Gibson, appears, at least in the case of RealNetworks, to be the result of ignorance rather than nefarious intentions, according to a FAQ hastily issued by the company.

"We weren't even aware [the flaw] was there," RealNetworks spokesman David Brotherton said in an interview with MSNBC. "We were not using it to log users behaviour in any way. The [unique identifier Gibson discovered] served no function we needed, and it has been eliminated."

Apparently, due to confusing information in Microsoft Windows developers' documentation (another shocker), an ID string the company had intended to be random actually identified users, and without RealNetworks knowledge.

Gibson discovered the problem by using a packet sniffer, which indicated that not only was a unique user ID being generated, but that download records were being sent back to the company.

"Every time you use one of these utilities to download any file from anywhere on the Internet, the complete URL address of the file, along with your computer's individual Internet IP address, and a unique ID tag that has been assigned to your machine, is immediately (and secretly) transmitted to the program's publisher," Gibson said in a recent report on his Web site.

"This allows a database of your entire, personal download history to be assembled and uniquely associated with your individual computer, for whatever purpose the program's publishers may have today, or tomorrow."

Gibson says that when he first published his findings, RealNetworks denied them and threatened legal action, apparently the impulse of the decade wherever embarrassed Internet companies are concerned.

"RealNetworks will hold you and your company liable for any damages caused by your patently false and reckless statements," Gibson says the company wrote in a memo.

On further consideration of the facts, which Gibson provided in copious detail, the company changed its tune to the satisfyingly conciliatory, PR-salvaging tones we hear today.

This is not the first time that RealNetworks' privacy protections have been weighed in the balance and found wanting. Last year, privacy advocate Richard Smith discovered similar features in RealNetworks' RealJukebox software, much to the company's embarrassment.

Meanwhile, AOL is currently embroiled in a lawsuit over its Netscape SmartDownload software, in which it is claimed that the utility captures and transmits user-identifiable information to the company when the utility is used, quite contrary to AOL's stated, and putatively exemplary, privacy policies. ®

Secure remote control for conventional and virtual desktops

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
How to simplify SSL certificate management
Simple steps to take control of SSL certificates across the enterprise, and recommendations centralizing certificate management throughout their lifecycle.
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.