Feeds

RealNetworks admits to new spyware bug

And to being too thick to exploit it

  • alert
  • submit to reddit

Beginner's guide to SSL certificates

A flaw in RealNetworks RealDownload, Netscape/AOL Smart Download, and NetZip Download Demon, discovered by Gibson Research founder Steve Gibson, appears, at least in the case of RealNetworks, to be the result of ignorance rather than nefarious intentions, according to a FAQ hastily issued by the company.

"We weren't even aware [the flaw] was there," RealNetworks spokesman David Brotherton said in an interview with MSNBC. "We were not using it to log users behaviour in any way. The [unique identifier Gibson discovered] served no function we needed, and it has been eliminated."

Apparently, due to confusing information in Microsoft Windows developers' documentation (another shocker), an ID string the company had intended to be random actually identified users, and without RealNetworks knowledge.

Gibson discovered the problem by using a packet sniffer, which indicated that not only was a unique user ID being generated, but that download records were being sent back to the company.

"Every time you use one of these utilities to download any file from anywhere on the Internet, the complete URL address of the file, along with your computer's individual Internet IP address, and a unique ID tag that has been assigned to your machine, is immediately (and secretly) transmitted to the program's publisher," Gibson said in a recent report on his Web site.

"This allows a database of your entire, personal download history to be assembled and uniquely associated with your individual computer, for whatever purpose the program's publishers may have today, or tomorrow."

Gibson says that when he first published his findings, RealNetworks denied them and threatened legal action, apparently the impulse of the decade wherever embarrassed Internet companies are concerned.

"RealNetworks will hold you and your company liable for any damages caused by your patently false and reckless statements," Gibson says the company wrote in a memo.

On further consideration of the facts, which Gibson provided in copious detail, the company changed its tune to the satisfyingly conciliatory, PR-salvaging tones we hear today.

This is not the first time that RealNetworks' privacy protections have been weighed in the balance and found wanting. Last year, privacy advocate Richard Smith discovered similar features in RealNetworks' RealJukebox software, much to the company's embarrassment.

Meanwhile, AOL is currently embroiled in a lawsuit over its Netscape SmartDownload software, in which it is claimed that the utility captures and transmits user-identifiable information to the company when the utility is used, quite contrary to AOL's stated, and putatively exemplary, privacy policies. ®

Providing a secure and efficient Helpdesk

More from The Register

next story
Scrapping the Human Rights Act: What about privacy and freedom of expression?
Justice minister's attack to destroy ability to challenge state
WHY did Sunday Mirror stoop to slurping selfies for smut sting?
Tabloid splashes, MP resigns - but there's a BIG copyright issue here
Google hits back at 'Dear Rupert' over search dominance claims
Choc Factory sniffs: 'We're not pirate-lovers - also, you publish The Sun'
EU to accuse Ireland of giving Apple an overly peachy tax deal – report
Probe expected to say single-digit rate was unlawful
Inequality increasing? BOLLOCKS! You heard me: 'Screw the 1%'
There's morality and then there's economics ...
Hey Brit taxpayers. You just spent £4m on Central London ‘innovation playground’
Catapult me a Mojito, I feel an Digital Innovation coming on
While you queued for an iPhone 6, Apple's Cook sold shares worth $35m
Right before the stock took a 3.8% dive amid bent and broken mobe drama
EU probes Google’s Android omerta again: Talk now, or else
Spill those Android secrets, or we’ll fine you
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.