Home page logo
/

bugtraq logo Bugtraq mailing list archives

RealPlayer and Comet Cursor
From: keela () REAL COM (Keela Robison)
Date: Thu, 9 Mar 2000 19:10:04 -0800


Mr. Harrington,

I wanted to respond directly to your concerns regarding RealPlayer and
privacy.  First to set the record straight, the version of Comet Cursor
distributed with RealPlayer does NOT transmit GUIDs.  RealNetworks is
committed to protecting privacy, and we specifically worked with Comet
Systems to ensure that their software met our standards for informed
consent.  We decided along with Comet Systems to remove any GUID from the
version distributed by RealNetworks.  As a result, the Cursor software
distributed with RealPlayer 7 could not be used in any way to track any
individuals' behavior.  In addition, it is very important to understand
that selecting the RealPlayer version with Comet Cursor is entirely
optional during the download process and that Comet Cursor's existence as
part of some RealPlayer bundles is clearly disclosed when you download,
along with links to Comet's privacy statement.

The privacy policy that you quote in your post is not accurate for the
RealPlayer version; please refer to the privacy policy that Comet Cursor
has posted relating to the version bundled with RealPlayer, and to which we
link from our Web site: http://www.cometsystems.com/help/real_privacy.shtml.

I hope that this addresses your questions.  RealNetworks is very concerned
that our privacy practices are accurately described; if you have any
further questions about our privacy policies or practices, please email us
at privacy () real com 

Regards,
Keela Robison
Product Manager, RealNetworks Consumer Products

---------- Forwarded message ----------
Date: Wed, 8 Mar 2000 14:36:25 -0800
From: pedward () WEBCOM COM
To: BUGTRAQ () SECURITYFOCUS COM
Subject: Realnetworks is trojaning people...again!!!

Okay, I had a nice long message I wrote, but accidentally canned it in ELM
(arggh!)

So, I admit to using windows for 2 reasons:  playing games and viewing
content that
can't be viewed on my Unix box.

That brings me to this subject.  I wanted to watch some classic Southpark and
Windows media player wouldn't play it (virgin '98 install), so I got RP 7.0
from
RealNetworks.

I installed it and so on and soforth.  I noticed tonight (3 days later) a
program
called "Comet Cursor" installed on my machine.  I recalled a privacy issue
with
this and investigated further.  Here's the lowdown from their website for
those
who don't remember:

http://www.cometsystems.com/help/privacy.shtml

What anonymous information is collected about users of the Comet Cursor?
 Our software contacts our servers to record logs of cursor impressions
using a GUID (Globally Unique
 IDentifier). When you download the Comet Cursor software, it is issued a
GUID from our servers. Using
 this GUID, we can keep track of how many people are using our software.
The GUID is also used every
 time the software contacts our servers when we log cursors changing (for
example, our software could
 inform our servers that at 12:31pm on November 16, 1999, 143 different
people saw their arrow cursor
 change into a baseball bat cursor on a baseball team's Website).
Collecting such statistics is an audit
 mechanism we use to bill our clients, since some of them pay us on a
"per-cursor-impression" basis.

 Second, our software checks in to see if a new version of the Comet
Cursor software is available. If
 there is a bug fix or version upgrade available for the Comet Cursor, the
software will retrieve the new
 code and replace the outdated code.

So, the Comet Cursor is really a backdoor to log your viewing habits, etc.

I was fairly confident that I didn't get this 'infection' via unprotected,
ahem, viewing
of websites.

I searched the registry and found the Comet Cursor to be a child of the
"RealNetworks" root.

I then uninstalled the realnetworks package and comet cursor.  I checked
back, the only items
remaining were:

- c:\windows\system\comet.dll -- I deleted this by hand
- A registry entry at HKEY_LOCAL_MACHINE\Software\Clients\Comet -- The
notable thing about this
      entry was the following key->value pair:

              OriginatorId    "Real_Dec99"

So, I uninstalled, reinstalled, uninstalled, and reinstalled to confirm
this hypothesis; RealNetworks
is installing a privacy trojan into your system without your permission or
documentation.

They have been caught once before doing this.

FYI, the press release is here:

      http://www.cometsystems.com/press/pressrels/102099.shtml

Grr, I am plenty pissed (not in the UK sense of the word, unfortunately)
right now...

--Perry

--
Perry Harrington                 Director of                   zelur xuniL
 ()
perry () webcom com             System Architecture               Think Blue.
 /\





  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]