Filed under: Security, Windows, Microsoft
Windows Genuine Advantage phones home
by Jordan Running Jun 9th 2006 at 2:25PM
Here's a bit we missed when it went around on Wednesday: Remember Windows Genuine Advantage, the app from Microsoft that will helpfully notify you, over and over again, if it thinks your copy of Windows or Office is pirated? It turns out nagging isn't its only trick. Windows Genuine Advantage also quietly phones home to Microsoft's servers, "checking in" each and every day. Microsoft calls the phone-home functionality a "safety check"--they say the software is still a pilot program, and it needs to check in in case of "an unforeseen emergency that would require the program to terminate quickly." Uh... huh. Microsoft has acknowledged that though the imformation-gathering is disclosed in the shrinkwrap EULA, they should have been more up-front about the check-in and plans better disclosure in the future. Right. Because that will make everybody feel better about it.
With Halloween fast approaching, it's a great time to get in some practice defending your territory against zombies. In Graveyard Shift, you take aim at zombies and other creepy-crawlies, blasting them into splatters of cartoony green guts. It's a casual first-person shooter, and it's very easy to get the hang of - use the mouse to aim, click to fire. Graveyard Shift has at least 15 levels, and it might even have some secret stages I haven't unlocked yet.
They key to getting good at Graveyard Shift is learning to use ...
Reader Comments (Page 1 of 1)
Alex Land said 3:31PM on 6-09-2006
Okay so the program checks back to MS to say, indeed, that your copy of xp is genuine. Who cares? Unless you're not running a valid copy I suppose.
Reply
Guerro said 3:36PM on 6-09-2006
More importantly, how does one remove the offending software ??
Reply
~J~ said 3:46PM on 6-09-2006
Agree #1, who cares. If you're using legit software, then I for one have no issues in a little 'call' to say I'm a respectible and legal user. Hats off to Microsoft for having the balls to do this.
Reply
bzaks said 3:46PM on 6-09-2006
So um.... when's it going to kill my windows?
Reply
Ben said 4:14PM on 6-09-2006
Wow, who can we trust in the software world? Now even microsoft is going about it's business the spyware way? Shame..
Reply
Bryan said 4:24PM on 6-09-2006
After the last Windows automatic update, my system froze. When I turned it back on, I got a warning that my copy of windows was not genuine. The problem is...It is genuine. I logged onto the MS page and re-ran the system checker, and it appeared genuine, and killed the nagging screens. I sure hope they didn't put me on the watch list.
Reply
Alex Land said 10:50PM on 6-09-2006
#5, I googled 'spyware definition'. The first result that comes up is as follows:
Any software that covertly gathers user information through the user's Internet connection without his or her knowledge, usually for advertising purposes. Spyware applications are typically bundled as a hidden component of freeware or shareware programs that can be downloaded from the Internet. Once installed, the spyware monitors user activity on the Internet and transmits that information in the background to someone else. ...
MS isn't using 'spyware'. They're simply ensuring that your copy of windows is legit.
Reply
Jordan Running said 10:54PM on 6-09-2006
I'm not sold on the spyware issue one way or another, but Alex, it seems like the definition you posted fits Microsoft's WGA "feature" to a tee.
Reply
Wayne G Longwood said 3:12AM on 6-10-2006
Does anyone know what address it phones home to? It'd be easy enough to block that with a rule in my firewall...
Reply
Lohan Roberto said 1:22PM on 6-10-2006
Microsoft is 'changing' the wga so it only calls home every 2 weeks, but if you dont' want to waite, here is a permanent work arround:
http://zxo.blogspot.com/2006/06/wga-notification-phones-home-during.html
Reply
Alex Land said 3:08PM on 6-10-2006
I'm not really sure if I agree with that, Jordan. If I were to compare WGA to anything, it would be one of those 'send anonymous statistics' options that almost all new software comes with these days (winamp is the first one I can think of off the top of my head)..
One notable exception is iTunes, so there you go apple fanboys.
If WGA was spyware, MS would be selling the information it collects or they would target ads based on your browsing prefs. This, of course, isn't the case.
Reply
Ben said 4:16PM on 6-10-2006
Alex Land, if what you said is correct, then it is spyware. They are collecting info about your OS then sending it back to the mothership..
Reply
hazard said 9:43PM on 6-10-2006
the wga is not the only windows process that calls back home on a regular basis. for instance everytime you select search in windows explorer it tries to contact 207.46.248.249 and there are plenty of others..
for Wayne: the address wga tries to contact is 207.46.250.101 and below is a whois dump - have to laugh at street address.
----------------------------
whois 207.46.250.101
----------------------------
OrgName: Microsoft Corp
OrgID: MSFT
Address: One Microsoft Way
City: Redmond
StateProv: WA
PostalCode: 98052
Country: US
NetRange: 207.46.0.0 - 207.46.255.255
CIDR: 207.46.0.0/16
NetName: MICROSOFT-GLOBAL-NET
NetHandle: NET-207-46-0-0-1
Parent: NET-207-0-0-0-0
NetType: Direct Assignment
NameServer: NS1.MSFT.NET
NameServer: NS5.MSFT.NET
NameServer: NS2.MSFT.NET
NameServer: NS3.MSFT.NET
NameServer: NS4.MSFT.NET
Comment:
RegDate: 1997-03-31
Updated: 2004-12-09
RTechHandle: ZM39-ARIN
RTechName: Microsoft
RTechPhone: +1-425-882-8080
RTechEmail: noc@microsoft.com
OrgAbuseHandle: ABUSE231-ARIN
OrgAbuseName: Abuse
OrgAbusePhone: +1-425-882-8080
OrgAbuseEmail: abuse@microsoft.com
OrgAbuseHandle: HOTMA-ARIN
OrgAbuseName: Hotmail Abuse
OrgAbusePhone: +1-425-882-8080
OrgAbuseEmail: abuse@hotmail.com
OrgAbuseHandle: MSNAB-ARIN
OrgAbuseName: MSN ABUSE
OrgAbusePhone: +1-425-882-8080
OrgAbuseEmail: abuse@msn.com
OrgNOCHandle: ZM23-ARIN
OrgNOCName: Microsoft Corporation
OrgNOCPhone: +1-425-882-8080
OrgNOCEmail: noc@microsoft.com
OrgTechHandle: MSFTP-ARIN
OrgTechName: MSFT-POC
OrgTechPhone: +1-425-882-8080
OrgTechEmail: iprrms@microsoft.com
# ARIN WHOIS database, last updated 2006-06-08 19:10
# Enter ? for additional hints on searching ARIN's WHOIS databas
Reply
Neal Saferstein said 10:50PM on 6-10-2006
Microsoft is just protecting there business model.
Neal Saferstein
Reply
Pramit said 2:42AM on 6-12-2006
Here's a way to kill it without having it start up in the first place:
http://pramit.nairi.net/redux/2006/06/11/stopping-windows-genuine-advantage-dead-in-its-tracks-and-still-getting-the-updates/
Reply
Jordan Running said 12:55PM on 6-12-2006
There's a couple flaws with that line of reasoning, Alex. Unlike Winamp, et al, this is not an option. There's no checkbox (editing the registry, deleting files manually, or using a third-party fix does not count as a checkbox) to turn it off and unless you read the fine print you'll never know it's happening. And Unlike Winamp, et al, we have no indication that the information Microsoft collects is in any way anonymous.
Reply
Neal Saferstein said 11:51PM on 6-12-2006
Try using this work around
http://zxo.blogspot.com/2006/06/wga-notification-phones-home-during.html
Neal Saferstein
Reply
J Westerman said 10:04AM on 8-02-2006
I would like some kind expert to provide a program that sends an email to Microsoft Customer Services every time they take information out of my computer without my permission. Nothing abusive. Simply a reminder that I object to intrusive surveillance.
Reply
The Dude Dean!! said 2:50PM on 8-02-2006
MS Is big brother!!!
Reply