Altova XMLSpy "phones home" user data

[Bruno Lustosa]

--sdtB3X0nJg68CQEu
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

I don't know if this is already well known, but it has come to my
attention that whenever someone will launch XMLSpy, the program will try
to connect to Altova's servers, send some user info through a POST to a
web server, and wait for a response.
It will then answer whether the copy is authentic or not, and probably
stop the program should it be a pirated copy.
It also seems to be some kind of Live Update, judging from the script
name it's calling.
What bothers me is that it's sending user information that was _not_
entered into the program. It sends user name used to register the
program, and it also sends an email address that I'm almost sure was not
entered into the program.
If the machine is not connected to the internet, or its path to altova
is firewalled, the program will run with no problems.
Of course, being a security professional, I don't like programs opening
hidden connections to the outside and sending personal data from users
without my (and their) knowledge, so I thought that others here would
like to know that.

This is a sample of the data sent out that I captured with tcpdump. It
is being sent to 207.244.119.109. Already firewalled here.

POST /liveupdate.asp HTTP/1.1
Referer: LicMan=20
Content-Type: application/x-www-form-urlencoded
User-Agent: AltovaLiveUpdate
Host: link.altova.com
Content-Length: 117
Cache-Control: no-cache

u=3DUser%20Name&c=3DCompany&e=3Demail%40address.com&v=3DXMLSpy%205%20rel.%2=
02&k=3D28GkAD-Ee281s-qCAt2s-4Fss37-8P7M2C-AP3EH3&f=3Dl

--=20
Bruno Lustosa, aka Lofofora | Email: bruno@lustosa.net
Network Administrator/Web Programmer | ICQ UIN: 1406477
Rio de Janeiro - Brazil |

--sdtB3X0nJg68CQEu
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQE/zgsNiNfNvfQ8L5IRAuPAAJ95Ur0fYSjI/RRLRxG89oTSzb+JEACgpJPh
yetVhRMF4EDwVcnX1BNtrfo=
=026U
-----END PGP SIGNATURE-----

--sdtB3X0nJg68CQEu--

[Greg Steuck]

>>>>> "Bruno" == Bruno Lustosa <bruno@lustosa.net> writes:

Bruno> ... whenever someone will launch XMLSpy, the
Bruno> program will try to connect to Altova's servers, send some
Bruno> user info through a POST to a web server, and wait for a
Bruno> response.
<skip>
Bruno> What bothers me is that
Bruno> it's sending user information that was _not_ entered into the
Bruno> program. It sends user name used to register the program, and
Bruno> it also sends an email address that I'm almost sure was not
Bruno> entered into the program. If the machine is not connected to
Bruno> the internet, or its path to altova is firewalled, the
Bruno> program will run with no problems. Of course, being a
Bruno> security professional, I don't like programs opening hidden
Bruno> connections to the outside and sending personal data from
Bruno> users without my (and their) knowledge, so I thought that
Bruno> others here would like to know that.

As an alternative to firewalling one can add a local address for
link.altova.com into %SYSTEMROOT%/system32/drivers/etc/hosts, like so:

127.0.0.1 link.altova.com

I tested this on my system. Here is the data that I received from the
program by running "nc -lp 80":

POST /liveupdate.asp HTTP/1.1
Referer: LicMan
Content-Type: application/x-www-form-urlencoded
User-Agent: AltovaLiveUpdate
Host: link.altova.com
Content-Length: 95
Cache-Control: no-cache

u=XXXXX%20Inc&c=XXXXX%20Inc&e=&v=XMLSpy%205%20rel.%203&k=000000-111111-222222-333333-444444&f=l

Bruno> it also sends an email address that I'm almost sure was not
Bruno> entered into the program. If the machine is not connected to

I can confirm the fact of "phoning home", but I could not confirm the
alleged disclosure of private information (e parameter is empty).

Thanks
Greg

[Alexander Falk]

In-Reply-To: <86ekvlkvmn.fsf@home.nest.cx>

>>>>>> "Bruno" == Bruno Lustosa <bruno@lustosa.net> writes:
>
> Bruno> ... whenever someone will launch XMLSpy, the
> Bruno> program will try to connect to Altova's servers, send some
> Bruno> user info through a POST to a web server, and wait for a
> Bruno> response.

That is correct, this is a process described in our EULA in Section 1(k) Software Activation and Section 1(l) LiveUpdate. Please see our EULA for details, which is available on our website under this URL: http://www.altova.com/order_license4.html

> Bruno> What bothers me is that
> Bruno> it's sending user information that was _not_ entered into the
> Bruno> program. It sends user name used to register the program, and
> Bruno> it also sends an email address that I'm almost sure was not
> Bruno> entered into the program.

This is incorrect insofar as the information transmitted is data that has been entered by the user into the Registration dialog (Help menu / Registration). This does include the e-mail address, provided that the user has entered this into the Registration
dialog when requesting an evaluation key-code from our license server.

Regarding the collection of e-mail addresses from users of our software, who are requesting an evaluation key-code, please see our strict privacy policy, which is available at this URL: http://www.altova.com/privacy.html

Altova takes privacy and security very seriously, and we believe we have properly disclosed any legitimate anti-piracy measures in our product in the EULA.

Sincerely,

Alexander Falk
President & CEO
Altova, Inc.