Feeds

RealNetworks admits to new spyware bug

And to being too thick to exploit it

  • alert
  • submit to reddit

Security for virtualized datacentres

A flaw in RealNetworks RealDownload, Netscape/AOL Smart Download, and NetZip Download Demon, discovered by Gibson Research founder Steve Gibson, appears, at least in the case of RealNetworks, to be the result of ignorance rather than nefarious intentions, according to a FAQ hastily issued by the company.

"We weren't even aware [the flaw] was there," RealNetworks spokesman David Brotherton said in an interview with MSNBC. "We were not using it to log users behaviour in any way. The [unique identifier Gibson discovered] served no function we needed, and it has been eliminated."

Apparently, due to confusing information in Microsoft Windows developers' documentation (another shocker), an ID string the company had intended to be random actually identified users, and without RealNetworks knowledge.

Gibson discovered the problem by using a packet sniffer, which indicated that not only was a unique user ID being generated, but that download records were being sent back to the company.

"Every time you use one of these utilities to download any file from anywhere on the Internet, the complete URL address of the file, along with your computer's individual Internet IP address, and a unique ID tag that has been assigned to your machine, is immediately (and secretly) transmitted to the program's publisher," Gibson said in a recent report on his Web site.

"This allows a database of your entire, personal download history to be assembled and uniquely associated with your individual computer, for whatever purpose the program's publishers may have today, or tomorrow."

Gibson says that when he first published his findings, RealNetworks denied them and threatened legal action, apparently the impulse of the decade wherever embarrassed Internet companies are concerned.

"RealNetworks will hold you and your company liable for any damages caused by your patently false and reckless statements," Gibson says the company wrote in a memo.

On further consideration of the facts, which Gibson provided in copious detail, the company changed its tune to the satisfyingly conciliatory, PR-salvaging tones we hear today.

This is not the first time that RealNetworks' privacy protections have been weighed in the balance and found wanting. Last year, privacy advocate Richard Smith discovered similar features in RealNetworks' RealJukebox software, much to the company's embarrassment.

Meanwhile, AOL is currently embroiled in a lawsuit over its Netscape SmartDownload software, in which it is claimed that the utility captures and transmits user-identifiable information to the company when the utility is used, quite contrary to AOL's stated, and putatively exemplary, privacy policies. ®

Beginner's guide to SSL certificates

More from The Register

next story
Bono apologises for iTunes album dump
Megalomania, generosity and FEAR of irrelevance drove group to Apple deal
HBO shocks US pay TV world: We're down with OTT. Netflix says, 'Gee'
This affects every broadcaster, every cable guy
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
French 'terror law' declares WAR on the INTERNET itself, say digi-rights folks
Liberté, Égalité, Fraternité: Two out of three ain't bad
SCREW YOU, EU: BBC rolls out Right To Remember as Google deletes links
Not even Google can withstand the power of Auntie
Arab States make play for greater government control of the internet
Nerds told to get lost in last-minute power grab bid at UN meeting
Zippy one-liners, broken promises: Doctor Who on the Orient Express
Series finally hits stride, but Clara's U-turn is baffling
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
America's super-secret X-37B plane returns to Earth after nearly TWO YEARS aloft
674 days in space for US Air Force's mystery orbital vehicle
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.