PDA

View Full Version : Why eXeem shouldn't be replacing our bittorrent clients


NitnayLion
01-22-2005, 12:52 PM
Source: Methlabs.org (http://methlabs.org/forums/showthread.php?p=55662#post55662)

written by Joseph Farthing and Taliban/Eremini

From the early days of peer-to-peer (p2p) networking, most of the interest in the p2p scene was centred around Napster. However, this network had a fatal flaw.
In one of the most famous technology lawsuits of recent times, various recording companies managed to shut Napster down in the courts. Their argument was that the Napster network was centralised – totally dependant upon the central Napster servers to transfer files. Thus, Napster themselves were party to the copyright infringement that occurred on the networks, since if these servers were turned off no copyright infringement could happen.

The next step in peer-to-peer networking, at least the type of network that tried to evade censorship, either politically or through civil means, was to decentralise the network. If the system could exist without a central server, at least in part, then it would be harder for the operators of the network to be sued. This worked, and soon networks like the FastTrack (used by KaZaA) and Gnutella2 were capable of operating without anything more centralised than a list of currently connected users.

This tactic worked, at least from the point of view of network developers. The lawsuits against decentralised networks dried up, and it was ruled that users, not operators were responsible for activity on decentralised networks.

However, Bittorrent is now the most popular peer-to-peer system, purportedly accounting for 35% of Internet traffic. Certainly not all Bittorrent traffic is illegal – a large portion of Bittorrent use is used to transfer large legitimate files such as Linux distributions. However, for those who wished to use Bittorrent to download more “questionable� material the network was just too centralised – the network depends upon a central tracker, as well as a source for downloads.

This means that, just like Napster, Bittorrent sites could be taken down by attacking the source – a series of lawsuits and raids by organisations such as the Motion Picture Association of America (MPAA), who's former chairman described people who infringe copyright as “Terrorists�, has targeted a number of Bittorrent sites, such as Lokitorrent and, ostensibly, Suprnova, one of the most popular torrent “link� sites.

However, Suprnova closed only after a number of other Bittorrent sites had closed, and it is in this article that we will examine exactly what the reason for the closure of Suprnova was, and will look into the history and existence of eXeem, the new “Suprnova� application.

The majority of torrent sites that were closed were Bittorrent trackers, hosts of the servers that work like the Napster servers used to and are required for downloads to work. Suprnova, on the other hand, was merely a link site, it didn't host a tracker itself, and so any legal argument against it would be difficult to use in court. As such, it is unlikely that Suprnova was legally attacked by the MPAA.

So, why was Suprnova closed? The website now advertises eXeem, and eXeem was hyped prior to the closure of Suprnova. Is it not possible that the closure of Suprnova was as much to do with eXeem as the MPAA? Didn't the developers perhaps wait until a large number of other torrent websites were closed down in order to remove suspicion?

Suprnova was a website populated by many adverts, which were in theory used to pay for the bandwidth costs of the Suprnova website. A website that was as large and popular as Suprnova would have had very high hosting costs, and as such any profit made via the adverts would have been quite small.

However, as a distributed, decentralised application eXeem does not cost the developers much to run at all. Any adverts displayed in this program wouldn't cost anything to produce, but would generate a constant revenue.

The truth is that, for all its hype, eXeem is a closed source, windows only application that is integrated with Cydoor, the spyware application that is rated as high risk by Microsoft and numerous other anti-spyware products, and described, in the case of one client, by the antivirus firm Kaspersky as a “Trojan Downloader�.

On our test machine (Windows XP Professional) we tried installing the new open beta of eXeem. The installation process asked us if we wanted to install an IE toolbar, which we were able to decline. However, it's licence agreement asks the user to agree too install third party applications, and includes a clause that the licence agreement can be changed without notice.

Can we really trust the eXeem developers? Who are they anyway? What is clear is that they are not directly connected to Suprnova. The Suprnova founder is more of a PR guy than a developer of the application. Isn't what this is all about – money? Compared to Suprnova, eXeem has the potential to make a far higher profit margin than a tracker website, and combined with the connection to Suprnova it is possible that many people will try this application, if only to see what all the fuss is about over this Suprnova “replacement�.

We used several major anti-spyware applications, including Microsoft's new anti-spyware system, on our test system, ensuring it was registered clean prior to the eXeem installation. After the install a number of spyware elements were found (15 in the case of Microsoft's scanner, although we are not sure how it classifies these elements). The key factor was the Cydoor dlls and adcache, which are rated as a “high threat� by Microsoft, and as critical by other companies.

Full Story HERE (http://methlabs.org/forums/showthread.php?p=55662#post55662)

GUNrLa5eR
01-22-2005, 03:09 PM
Good find Nitnay this article is sure to create quite a stir amongst P2P users in general. And I will vouche for you on this one because it did install cydoor on my system. When I found that out I then promptly removed exeem from my system.

Just to show you how the developers took it when I went into their IRC channel.

[15:18] <Loki> AHAHAHAHHAHA
[15:18] <Loki> that article is so full of shoot its not even funny
[15:18] * dynabite (getlost@Nova-8F94CA8B.speed.planet.nl) Quit (Quit: )
[15:18] <[GUNr]La5eR[UTC]> Wait until people download and install it then theyll see whos telling the truth
[15:19] <Loki> ha
[15:19] <[GUNr]La5eR[UTC]> i ran adware before i installed it
[15:19] <[GUNr]La5eR[UTC]> then after
[15:19] <[GUNr]La5eR[UTC]> look what shows up
[15:19] <[GUNr]La5eR[UTC]> CYDOOR!
[15:19] <ellspurs84> -_-
[15:19] <Loki> well of course
[15:19] <Loki> we've never once said that it didn't have cydoor
[15:20] <Loki> cydoor is NOT spyware though, unlike what many believe
[15:20] <Loki> all cydoor does is show the ad
[15:20] <[GUNr]La5eR[UTC]> Well would you like to educate us on this ground breaking development.
[15:21] <Loki> what groundbreaking development?
[15:21] <[GUNr]La5eR[UTC]> ok if cydoor delivers the ad
[15:21] <[GUNr]La5eR[UTC]> then you can send any type of ad to us
[15:21] <Loki> could
[15:21] <Loki> but we won't
[15:21] -novastream.suprnova.org- *** You are banned from suprnova.org ([Anrkist] j00 just been edjumacated)
[15:21] * Disconnected
Session Close: Sat Jan 22 15:21:48 2005

Is what I was going to say afterwards was that a DLL contains code that can access your registry, load other pieces of software, and can pose a serious security risk to your system.

Now if they didnt have anything to hide they wouldnt have k/g-lined me from their network. So something smells very fishy about their behavior. I could have took it to a PM to one of the devs but thought it just to let the community know that this program is installing a piece of software that can pose major security risks.

Carrie
01-22-2005, 10:15 PM
there were many rumors that they were going to include spyware. My question is...where were they educated in spyware? its not bad? Cydoor is not bad? what a bunch of BULL SHIT!

Nothing like Monkeys with Malware! gotta love that.

I bet those morons voted for Bush.

NitnayLion
01-22-2005, 10:24 PM
UMMMMM








I voted for Bush. LoL

Carrie
01-22-2005, 10:26 PM
To further prove my point...


Alias:TrojanDownloader.Win32.BHO [Kaspersky]

Adware: Software that brings ads to your computer. Such ads may or may not be targeted, but are "injected" and/or popup, and are not displayed within the form of an ad-sponsored application. Some Adware may hijack the ads of other companies, replacing them with its own. See also Spyware, Browser Helper Object.

Downloader: A program designed to retrieve and install additional files, when run. Most will be configured to retrieve from a designated web or FTP site.

Search Hijacker: Any software that resets your browser's settings to point to other sites when you perform a search. Hijacks may reroute your info and address requests through an unseen site, capturing that info. In such hijacks, your browser may behave normally, but be slower. Search results when such a hijacker is running will sometimes differ from non-hijacked results.

Displays popup/popunder ads that are displayed when main product is not running or do not appear to be connected with the product (such as popunder ads). Can't be uninstalled by Windows Add/Remove Programs and no uninstaller is provided with application. Changes browser settings other than homepage, without user permission

Distibution: The Cydoor site claims that Cydoor ships with KaZaA, NetAnts, LimeWire, Babylon, IMesh, and other applications. May also ship with Rosoft CD Extractor, and Rosoft Audio Recorder.

Cydoor: 45
The "Clot Factor" is a measure of how much a pest "gums up" a machine by adding registry entries, files, and directories. As more objects are placed in a machine, manual removal becomes more difficult and more error-prone.

Always embedded with some host application. Cydoor's Ads OnSoftwareâ„¢ embeds advertising in host software, converting it to "free" adware. User tracking is tied to the GUID (Global Unique Identifier): "Upon installation of a software application integrated with our advertising technology, Cydoor Technologies sets a numerical identifier on your computer."

Two Cydoor applications are potentially involved: CD_CLINT and CD_LOAD.

CD_CLINT: If the application with which Cydoor is bundled is an online application, such as a browser or P2P program, then CD_CLINT.EXE/CD_CLINT.DLL is installed.
CD_LOAD: For offline applications, such as MP3 players, CD_LOAD.EXE/CD_LOAD.DLL is installed. CD_LOAD.EXE runs in the background always, and whenever a connection is available, downloads ads for offline use. CD_Load.exe has no user interface. Upon invocation, it immediately tries to make an internet connection to 209.67.3.166:53 or some other address, depending on version. Even if denied the connection, it remains resident. "Your software does not have to be Internet related. The only requirement is that users occasionally go on the Internet so that ads can be downloaded transparently while they are online." - Cydoor.
With each boot, Cydoor attempts to make contact with its host via the internet. Some versions may use HTTP port 80 to connect to any of the servers listed here. After data exchange, ads are retrieved from the server and downloaded to c:\Windows\System\adcache\ for subsequent display.

Users do not have to be online while using software embedded with Cydoor: "Ads are pulled from the protected ad cache within each user's computer whether they are online or offline. Your program will continuously display ads from the cache until it is updated-which occurs the next time the user goes online. Ad loads and reports are transmitted the moment that happens."

Likely to slow performance of Internet Explorer.

Transmits email address and user-supplied demographic information (if supplied) to Cydoor. Demographic info is shared with third parties. Transmits advertising metrics such as ad displays and clicks.
from the privacy policy: 'Please be aware that Cydoor advertisers or Web sites that have links in software on our network may utilize demographic information about you. This privacy statement does not cover the information practices of those Web sites linked from software on the Cydoor Network. From time to time, Cydoor works with third-party ad servers such as Valueclick, Commission Junction, Adventures, Advertising.com, RealMedia and BeFree and others to serve advertising to the Cydoor Network. Please visit these providers individually to learn more about how they handle privacy.

'Some software installations will direct you to a partner site, where you may be prompted to complete a registration. The information our business partners collect pertains strictly to their privacy practices, and we do not have access to any of the information collected at these sites. In addition to demographic data, Cydoor requires that you provide your email address during the installation of Cydoor-enabled software programs. If you prefer not to provide us with your email address, then you may opt-out of the software installation. Providing Cydoor with your email address will enable us to send Cydoor-specific technology updates, as well as special offers and promotions from our business partners.' -- http://www.cydoor.com/Cydoor/index2.html

Information from: (http://www.pestpatrol.com/PestInfo/c/cydoor.asp)

Ken
01-23-2005, 12:10 AM
UMMMMM








I voted for Bush. LoL

And it shows.

MilesApart
01-23-2005, 07:13 PM
Wow, enough said Feenies. LOL.