LinkSys Wireless Adapter software contains spyware?!?

[BillW]

I use their software and it doesn't try to connect to anyone. Nothing gets
in or out of my computer without me knowing about it. You need to do some
diagnosing the system to find out who is doing it. You could start by
turning off all startup items...


"Spammay Blockay" <SPAMBLOCKER@BLOCKEDTOAVOIDSPAM.com> wrote in message
news:bn70ih$dd$1@bolt.sonic.net...
> In article <0yClb.3325$P%1.2959447@newssvr28.news.prodigy.com >,
> BillW <TheDuck@pond.net> wrote:
> >You need to take your horse blinders off and look at your system. The
> >Linksys software is clean as there are hundreds of thousands of us using
it.
> >Open your eyes and look at your system...
>
> I'm certainly open to the idea that there is a virus out there.
> But... has anybody else *cared* if this software were connecting to
> gemtek or yahoo? Perhaps it's doing this, and nobody's been concerned
> by it? That's possible, too. No need to say I'm blind to the
> various possibilities.
>
> - Tim
>
> --
>

[Spammay Blockay]

In article <9qElb.3337$P%1.2982498@newssvr28.news.prodigy.com >,
BillW <TheDuck@pond.net> wrote:
>I use their software and it doesn't try to connect to anyone. Nothing gets
>in or out of my computer without me knowing about it. You need to do some
>diagnosing the system to find out who is doing it. You could start by
>turning off all startup items...

Do me a favor, would you? Check out what strings are in your
copy of WPC55AG.exe and see if there are any of those websites
I mentioned in it. If you have Cygwin installed, you can use the
'Strings' command. Or just open it with Notepad and search
for 'http'.

- Tim

--

[Mangled&Munged]

Tim,

I have already contacted Linksys about this defect. The problem
that I have seen is that the Linksys Wireless Notebook adaptor utility
software is trying to get the time of day. It is using TCP port 13 (daytime)
and rotating across a vast set of sites, around the world, to try to get the
time of day. If you block (REJECT) this traffic then the software goes nuts
and consumes all of your wireless network bandwidth. I recommend
that you (DROP) this traffic. The silly software will still try to
contact sites via port 13, but will get DROPPED, and timeout. The
timeout/retry is sufficiently long that the aggregate bandwidth impact
is minimal.

Notes:
If you terminate the Wireless Notebook adaptor utility, the
card will still operate, but the attempts to connect to port 13 will
stop.

If you use "Ethereal" you can watch the raw packets and get the
details about what is going on :-) As you monitor the card, you
will see that the moment you start the Wireless Notebook adaptor
utility, the TCP port 13 traffic will start, and the moment you
terminate the utility, the traffic will stop.

Linksys is not the first vendor to do the "daytime" around the world
thing. The difference is that the other vendor that did this fired the
silly engineer that implemented this in their product. In the other
case, the silly engineer sent all daytime requests to the systems
at the University of Michigan. After a few thousand cards were
sold, the admins at the University got very angry and pressed on
the vendor to stop their evil practice. My guess: The engineer that
did this silly goof, got fired, and then got hired by... Linksys :-(

Various versions of Windows also do the daytime around the world
trick. In Windows 2k, you can not disable this junk. In Windows XP
you can disable it.

And as with most problems, none of this happens in Linux :-)

Enjoy,
Don



"Spammay Blockay" <SPAMBLOCKER@BLOCKEDTOAVOIDSPAM.com> wrote in message
news:bn6ehu$9c$1@bolt.sonic.net...
> My firewall is alerting me that my LinkSys WPC55AG wireless
> card is attempting to contact various websites, including
> 'www.gemtek.com.tw' (who may have written this software) and
> 'www.yahoo.com'.
>
> Anybody know why this utility may be doing this? It is not documented,
> and there's no way to configure it. Is it spyware, or merely looking
> for software updates or something? I wouldn't think it would be doing
> that by looking on Yahoo!
>
> - Tim
>
> --
>

[Spammay Blockay]

In article <h5Slb.34310$Ee6.21577@nwrddc01.gnilink.net>,
Mangled&Munged <postmaster@127.0.0.1> wrote:
>Tim,
>
> I have already contacted Linksys about this defect. The problem
>that I have seen is that the Linksys Wireless Notebook adaptor utility
>software is trying to get the time of day. It is using TCP port 13 (daytime)
>and rotating across a vast set of sites, around the world, to try to get the
>time of day. If you block (REJECT) this traffic then the software goes nuts
>and consumes all of your wireless network bandwidth. I recommend
>that you (DROP) this traffic. The silly software will still try to
>contact sites via port 13, but will get DROPPED, and timeout. The
>timeout/retry is sufficiently long that the aggregate bandwidth impact
>is minimal.

[ snippage ]

Thanks for your help! Glad to know I wasn't going mad! :-)

By the way, does your card do the thing, as mine does, of both
LEDs blinking on and off in unison, rather than indicating anything
in particular? The LinkSys tech (1st level, offshored) tells me
they have my card installed in laptops and it behaves as documented.
But someone else here says their card acts like mine.

What does yours do? Is it the same model as mine? (WPC55AG)

- Tim

--

[Jay T. Blocksom]

On Wed, 22 Oct 2003 22:32:49 GMT, in <alt.privacy.spyware>,
SPAMBLOCKER@BLOCKEDTOAVOIDSPAM.com (Spammay Blockay) wrote:
>
[snip]
>
> I'm certainly open to the idea that there is a virus out there.
> But... has anybody else *cared* if this software were connecting to
> gemtek or yahoo? Perhaps it's doing this, and nobody's been concerned
> by it? That's possible, too. No need to say I'm blind to the
> various possibilities.
>
[snip]

This, or something very much like it, was reported previously. See:

<http://groups.google.com/groups?selm=sz9_a.165%24v9.82%40nwrddc01.gnilink.n et>

and follow the thread.

At the time, I was skeptical; but the evidence appears to be mounting.

--

Jay T. Blocksom
--------------------------------
Appropriate Technology, Inc.
usenet01[at]appropriate-tech.net


"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
-- Benjamin Franklin, Historical Review of Pennsylvania, 1759.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
NOTE: E-Mail address in "From:" line is INVALID! Remove +SPAMBLOCK to mail.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Unsolicited advertising sent to this E-Mail address is expressly prohibited
under USC Title 47, Section 227. Violators are subject to charge of up to
$1,500 per incident or treble actual costs, whichever is greater.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -