5 ms·
Had the same thought, but upon investigation I don't see the incentive for the vendor to do something shady with it. They have a clear business model: Develop
by MauranKilom 5y ago
Had the same thought, but upon investigation I don't see the incentive for the vendor to do something shady with it.
They have a clear business model: Develop software for Windows that companies need. See their About page: https://www.oo-software.com/en/company https://www.oo-software.com/en/company
Hence, it is clear what benefit they draw from releasing this software for free: Marketing. They are not in the business of brokering user data or mining bitcoin covertly. This tool isn't even installed, it's "run once". To me, that's about as trustworthy as it could be.
- marcodiego 5y ago> I don't see the incentive for the vendor to do something shady with it. Now. It is not a matter of having incentives. It is a matter that they can abuse and you simply have no way to check or control it.
- loldk 5y agoIncentives are literally just reasons for doing things. So naturally I don't follow your logic at all.
- breakfastduck 5y agoYou have no way to check if this app is sending network requests back 'home'? That doesn't seem correct at all.
- marcodiego 5y agoFor such an intrusive application there are many ways to hide it. Not saying they do it, but I see no way to check it unless looking at the source code.
- MauranKilom 5y agoWell, two possibilities that come to my mind: - Run it in a Windows VM. The program could detect this and not phone home in this case, of course. - Monitoring on network level (wireshark on same network, Pi-hole, router itself...). This is virtually impossible for the program to circumvent. You could also audit the changes it made to the system (resorting to stuff like diffing disk images before/after if you really want zero trust) to verify that nothing sneaky was left after running the program once.
- stinos 5y agoIs it possible to circumvent Wireshark, Procmon and the likes? Otherwise those 2 combined give pretty good insight in what an application is doing wrt I/O.
- jabits 5y agoLooking at the source code is pretty useless unless you compile it yourself...
- judge2020 5y agoWindows will most likely consider this malware, since it is effectively piracy (removes activation checks) and it does mess with Windows Defender by disabling a bunch of phone-home stuff like malware sample submission. If you're already getting people to disable Windows Defender and/or make an exception for the exe, it's suddenly super easy to also embed some custom C&C into it, either for mass use (eg. using a Windows service to have machines participate in a ddos botnet) or for targeted use - when a specific network block downloads it, the C&C sends a different payload that quietly looks for git credentials or trade secrets and ships them off. They technically don't have an incentive now, but if they ever get one, it'll be super easy to abuse this position to embed malware. Don't think of the threat as the current company, but someone buying them for $millions and quietly doing this years later.
- schleck8 5y agoIt is not considered malware by Smart Screen from what I can tell. Kaspersky doesn't have any issues with it either, and I've run both the original and the ++ Version of ShutUp. This is portable by the way, so I don't really see the point in worrying about rogue company takeovers.
- OrvalWintermute 5y agoWindows won't treat this like malware, because, all the other similar products out there are not treated as malware either. because it does not run as a service/persist, it will be undone by the next big windows update anyways.