Feeds

RealNetworks admits to new spyware bug

And to being too thick to exploit it

  • alert
  • submit to reddit

Top three mobile application threats

A flaw in RealNetworks RealDownload, Netscape/AOL Smart Download, and NetZip Download Demon, discovered by Gibson Research founder Steve Gibson, appears, at least in the case of RealNetworks, to be the result of ignorance rather than nefarious intentions, according to a FAQ hastily issued by the company.

"We weren't even aware [the flaw] was there," RealNetworks spokesman David Brotherton said in an interview with MSNBC. "We were not using it to log users behaviour in any way. The [unique identifier Gibson discovered] served no function we needed, and it has been eliminated."

Apparently, due to confusing information in Microsoft Windows developers' documentation (another shocker), an ID string the company had intended to be random actually identified users, and without RealNetworks knowledge.

Gibson discovered the problem by using a packet sniffer, which indicated that not only was a unique user ID being generated, but that download records were being sent back to the company.

"Every time you use one of these utilities to download any file from anywhere on the Internet, the complete URL address of the file, along with your computer's individual Internet IP address, and a unique ID tag that has been assigned to your machine, is immediately (and secretly) transmitted to the program's publisher," Gibson said in a recent report on his Web site.

"This allows a database of your entire, personal download history to be assembled and uniquely associated with your individual computer, for whatever purpose the program's publishers may have today, or tomorrow."

Gibson says that when he first published his findings, RealNetworks denied them and threatened legal action, apparently the impulse of the decade wherever embarrassed Internet companies are concerned.

"RealNetworks will hold you and your company liable for any damages caused by your patently false and reckless statements," Gibson says the company wrote in a memo.

On further consideration of the facts, which Gibson provided in copious detail, the company changed its tune to the satisfyingly conciliatory, PR-salvaging tones we hear today.

This is not the first time that RealNetworks' privacy protections have been weighed in the balance and found wanting. Last year, privacy advocate Richard Smith discovered similar features in RealNetworks' RealJukebox software, much to the company's embarrassment.

Meanwhile, AOL is currently embroiled in a lawsuit over its Netscape SmartDownload software, in which it is claimed that the utility captures and transmits user-identifiable information to the company when the utility is used, quite contrary to AOL's stated, and putatively exemplary, privacy policies. ®

Build a business case: developing custom apps

More from The Register

next story
BBC goes offline in MASSIVE COCKUP: Stephen Fry partly muzzled
Auntie tight-lipped as major outage rolls on
iPad? More like iFAD: We reveal why Apple fell into IBM's arms
But never fear fanbois, you're still lapping up iPhones, Macs
Amazon Reveals One Weird Trick: A Loss On Almost $20bn In Sales
Investors really hate it: Share price plunge as growth SLOWS in key AWS division
Bose says today is F*** With Dre Day: Beats sued in patent battle
Music gear giant seeks some of that sweet, sweet Apple pie
There's NOTHING on TV in Europe – American video DOMINATES
Even France's mega subsidies don't stop US content onslaught
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
Too many IT conferences to cover? MICROSOFT to the RESCUE!
Yet more word of cuts emerges from Redmond
Chips are down at Broadcom: Thousands of workers laid off
Cellphone baseband device biz shuttered
Twitch rich as Google flicks $1bn hitch switch, claims snitch
Gameplay streaming biz and search king refuse to deny fresh gobble rumors
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.