Adobe Demo products mess with System files (?)
|
|
Thread rating:  |
Matthew Hills - 07 Feb 2005 20:43 GMT It seems that the Adobe Tryout products modify some system files? Has anyone else noticed this? Is it part of the demo/expiration thing, and does it cause any problem?
I just ran a routine permissions check and got a notice about incorrect permissions for /System/Library/Sounds/Submarine.aiff (it had been set to global +rwx), and the timestamp on the file was pretty recent.
Checking my system logs to see what was going on at that time, I noticed that was when I had tried a demo of Adobe's Illustrator CS.
To double-check, I restored the Submarine.aiff file, re-downloaded the installer and ran it.... again, the permissions had been changed and the file modified...
Any thoughts?
Thanks, Matt
Tom Harrington - 07 Feb 2005 22:32 GMT > It seems that the Adobe Tryout products modify some system files? Has > anyone else noticed this? Is it part of the demo/expiration thing, and does [quoted text clipped - 12 lines] > > Any thoughts? That's a curious little detail, isn't it.
What's the size of this file on your Mac? On mine it shows up as 172046 bytes. I'm wondering if more was changed than just the permissions on the file.
 Signature Tom "Tom" Harrington Macaroni, Automated System Maintenance for Mac OS X. Version 2.0: Delocalize, Repair Permissions, lots more. See http://www.atomicbird.com/
Dave Balderstone - 07 Feb 2005 22:57 GMT > What's the size of this file on your Mac? On mine it shows up as 172046 > bytes. I'm wondering if more was changed than just the permissions on > the file. Here, the size is the same and modified date is Sept 22, 2003.
-rw-r--r-- 1 root wheel 172046 22 Sep 2003 Submarine.aiff
I have the full Adobe CS suite installed, but have never run a tryout version of any of their apps.
djb
 Signature "The thing about saying the wrong words is that A, I don't notice it, and B, sometimes orange water gibbon bucket and plastic." -- Mr. Burrows
Matthew Hills - 07 Feb 2005 23:11 GMT >That's a curious little detail, isn't it. > >What's the size of this file on your Mac? On mine it shows up as 172046 >bytes. I'm wondering if more was changed than just the permissions on >the file. Since my earlier post, I updated from 10.3.4 to 10.3.7, and it looks like this file was restored...
So I tried to duplicate the process (re-downloaded the illustrator demo):
Before install of Illustrator CS Demo: -rw-r--r-- 1 root wheel 172046 21 Jan 11:03 Submarine.aiff after install (but haven't launced Illustrator CS): -rwxrwxrwx 1 root wheel 172046 21 Jan 11:03 Submarine.aiff after running the trial version of Illustrator CS: -rwxrwxrwx 1 root wheel 172046 7 Feb 14:56 Submarine.aiff
An inspection with Hexedit shows changes to a few hundred bytes near the end of the file after the trial version was run. (Note: my 30 days to demo the software has expired, so it just starts up and tells me that my trial has expired)
I don't notice any big change to the sound itself... I just got a bit queasy about this, as I recall having one sound get pretty corrupted last fall, and I seem to remember hearing of some problems with apple's Mail caused by corrupted sound files...
Matt
Dave Balderstone - 07 Feb 2005 23:54 GMT > An inspection with Hexedit shows changes to a few hundred bytes near the end > of the file after the trial version was run. (Note: my 30 days to demo the > software has expired, so it just starts up and tells me that my trial has > expired) That's very odd... If Adobe is screwing with OS installed files they are behaving VERY badly.
djb
 Signature "The thing about saying the wrong words is that A, I don't notice it, and B, sometimes orange water gibbon bucket and plastic." -- Mr. Burrows
Matthew Hills - 08 Feb 2005 00:02 GMT >> An inspection with Hexedit shows changes to a few hundred bytes near the end >> of the file after the trial version was run. (Note: my 30 days to demo the [quoted text clipped - 3 lines] >That's very odd... If Adobe is screwing with OS installed files they >are behaving VERY badly. I found it a bit odd -- in general I think very highly of Adobe's trial program.
I'd be interested in seeing if anyone else has tried installing the trial and whether they get similar results... (ie, is it something weird about my system? -- I do find it odd that I haven't seen lots of posts about "repair permissions" tripping on this sound file before)
Matt
Dave Balderstone - 08 Feb 2005 00:31 GMT > I'd be interested in seeing if anyone else has tried installing the trial and > whether they get similar results... (ie, is it something weird about my > system? -- I do find it odd that I haven't seen lots of posts about > "repair permissions" tripping on this sound file before) I don't think I have a production Mac that hasn't had the CS suite installed on it but I'll check at the shop tomorrow and see if I can duplicate this.
What OS version are you running?
 Signature "The thing about saying the wrong words is that A, I don't notice it, and B, sometimes orange water gibbon bucket and plastic." -- Mr. Burrows
Matthew Hills - 08 Feb 2005 00:48 GMT >I don't think I have a production Mac that hasn't had the CS suite >installed on it but I'll check at the shop tomorrow and see if I can >duplicate this. > >What OS version are you running? I first noticed this with 10.3.5, while running "check disk permissions" in anticipation of my update to 10.3.7 -- that precipitated my first post.
My recent posts have been since updating to 10.3.7
Matt
Dave Balderstone - 08 Feb 2005 01:22 GMT > I first noticed this with 10.3.5, while running "check disk permissions" > in anticipation of my update to 10.3.7 -- that precipitated my first post. > > My recent posts have been since updating to 10.3.7 I'll try and reproduce this in the next couple of days and let you know what I find.
djb
 Signature "The thing about saying the wrong words is that A, I don't notice it, and B, sometimes orange water gibbon bucket and plastic." -- Mr. Burrows
Kevin - 18 Feb 2005 06:20 GMT > >> An inspection with Hexedit shows changes to a few hundred bytes near the end > >> of the file after the trial version was run. (Note: my 30 days to demo the [quoted text clipped - 3 lines] > >That's very odd... If Adobe is screwing with OS installed files they > >are behaving VERY badly.
> I found it a bit odd -- in general I think very highly of Adobe's trial > program.
> I'd be interested in seeing if anyone else has tried installing the trial and > whether they get similar results... (ie, is it something weird about my > system? -- I do find it odd that I haven't seen lots of posts about > "repair permissions" tripping on this sound file before) *delurk*
Hi folks,
I know I'm a latecomer to this thread, but it caught my attention as I very recently had similar problems with Submarine.aiff. I use it as my "new mail!" sound in Mail, and at one point noticed that the sound was playing oddly -- when I got new mail, the sound would play ("Bling!") always followed by a burst of static. It didn't always manifest itself; some apps played it fine without static. I eventually solved the problem as I recall, by opening Submarine.aiff in a sound editing program and chopping off the last few milliseconds of the file, which indeed seemed to be staticy (blips on the waveform).
I had no idea how this happened, and has not been a problem ever since, but having read this thread I remember now that I installed the Adobe Indesign CS tryout right around the same time...
Brian Hughes - 08 Feb 2005 08:55 GMT > It seems that the Adobe Tryout products modify some system files? Has > anyone else noticed this? Is it part of the demo/expiration thing, and does [quoted text clipped - 10 lines] > installer and ran it.... again, the permissions had been changed and > the file modified... I can confirm this same thing with the Adobe After Effects tryout. I ran a "repair permissions" first, then I opened the terminal and did an "ls -l" for "/System/Library/Sounds/Submarine.aiff"
Then I installed the Adobe AE tryout, then reran the permissions check:
Permissions differ on ./Applications, should be drwxrwxr-x , they are drwxrwxrwx Permissions differ on ./Library/Application Support, should be drwxrwxr-x , they are drwxrwxrwx Permissions differ on ./System/Library/Sounds/Glass.aiff, should be -rw-r--r-- , they are -rw-rw-rw- Permissions differ on ./System/Library/Sounds/Purr.aiff, should be -rw-r--r-- , they are -rw-rw-rw- Permissions differ on ./System/Library/Sounds/Submarine.aiff, should be -rw-r--r-- , they are -rw-rw-rw-
Now I should mention that I verified here, I didn't repair.
So in my case, 3 sound files and 2 directories had their permissions changed. The before and after ls for the 3 files only shows "Submarine.aiff" was modified. I can also hear a very loud glitch at the end of the sound file. I silenced the glitch in Peak and replaced the Adobe modified file. Then I reran the AE tryout application.
Guess what! The sound file was modified again!
So I again replaced the file but this time used XRay to set the file permissions to 0400 (read-only, for owner root). When I tried to launch AE, the License Manager hung for about 20 seconds (and quit and relaunched) then AE opened. The sound file wasn't modified this time.
I quit AE and replaced Submarine.aiff with a backup copy and repaired permissions. Running AE again I found that it didn't modify the file this time and it took some time to launch.
So, what is going on here? I'd venture a guess that After Effects is hiding a code or date data in the sound file. Perhaps it's not supposed to be audible, I don't know why it is on my system. It also looks like the License Manager is verifying this data but it doesn't appear to be able to modify it if the permissions are reset. It's not the only thing it uses so I don't see why it has to modify system files.
Personally, I'm pretty ticked off that Adobe (or the installer maker) would modify system files it does not own or have any right to. Sure I authorized the install but this borders on malware. It's even worse that it's files in the /System/Library path as those shouldn't be changed by most applications.
Looking further I found what modifies the sound file, a small application inside the AE bundle called VSetupT:
Adobe After Effects 6.5.app/Contents/MacOS/VSetupT
Just running it by itself, it will modify the sound file, assuming you haven't fixed the preferences. It's made by Aladdin Knowledge Systems, <http://www.aladdin.com/>, not to be confused with the StuffIt makers.
I already own the Standard Version of AE and it doesn't contain this application, only the trial version. So be on the lookout for malware made by Aladdin Knowledge Systems, modifying your system files without your permission. Adobe probably isn't aware that these files are being modified, they are just including the Aladdin HASP technology into the trial software.
 Signature If you *really* need to e-mail me, send it to: usenet at hughesvideo dot com
Matthew Hills - 08 Feb 2005 18:45 GMT >I can confirm this same thing with the Adobe After Effects tryout. Good to know that it isn't just me (or my system) going crazy...
>"Submarine.aiff" was modified. I can also hear a very loud glitch at the >end of the sound file. It is really strange that they leave such an obtrusive footprint.
I must confess some ambivalence about this--it isn't easy to release a fully functional demo and ensure security... If it was as easy as deleting the odd ~/Library/Preferences/.Some_preference.pref, it wouldn't be much of an obstacle for anyone wishing to "extend" their trial license. And, as I posted earlier, the opportunity to demo the software is wonderful.
I guess we should just be thankful that they aren't monkeying with anything in the font folder!
Matt
Bruno Gaufier - 08 Feb 2005 20:30 GMT >> I can confirm this same thing with the Adobe After Effects tryout. > [quoted text clipped - 4 lines] > > It is really strange that they leave such an obtrusive footprint. Adobe is using this trick to check the demo period.. Some time ago, I tracked the files modified by an Indesign demo setup ; They were : - /System/Library/Sounds/Submarine.aiff - /iNode72203691 - /Library/Preferences/AppleTalk 43A46D - /.DRM_Home Of course, there was a few more things in the classic system folder (The "System" case if I remember) and all the things they are putting everywhere.
And after reading Brian's post, it appears that they are also badly trashing the OS security (I did not check security, but changing rights on "/Application" and "/Library/Application Support" to "writable by everyone" is absolutely stupid).
Someone, at Adobe, is probably thinking that Mac users are dumb ;-)
 Signature Bruno Remove the "remove.me" part to answer
Brian Hughes - 09 Feb 2005 01:37 GMT > >> I can confirm this same thing with the Adobe After Effects tryout. > > [quoted text clipped - 15 lines] > (The "System" case if I remember) and all the things they are putting > everywhere. I found everything you did but not the AppleTalk file, I also found /DRM_etc but there are probably others. Thats the weak thing about this "security" by Aladdin, it's basically "security through obscurity". If you can find everything it modifies you can continue to use the trial software as long as you want. The software isn't crippled so it's a good deal if you don't have any scruples.
> And after reading Brian's post, it appears that they are also badly > trashing the OS security (I did not check security, but changing rights > on "/Application" and "/Library/Application Support" to "writable by > everyone" is absolutely stupid). > > Someone, at Adobe, is probably thinking that Mac users are dumb ;-) Yes, and I think I'll be sending a message to Adobe about this. I own After Effects Std, I downloaded the trial to see if I wanted to upgrade to the Pro version. I'm rather ticked off that the installer corrupted my sound file, let alone changed my permissions. What other files did it modify and are they corrupted as well?
 Signature If you *really* need to e-mail me, send it to: usenet at hughesvideo dot com
bruno - 09 Feb 2005 19:24 GMT [snip]
>> And after reading Brian's post, it appears that they are also badly >> trashing the OS security (I did not check security, but changing rights [quoted text clipped - 8 lines] > my sound file, let alone changed my permissions. What other files did it > modify and are they corrupted as well? For the Indesign demo, the only corrupted file was the ".aiff". All other files were new ones. The following files and folders were also created during setup (or first launch - Some of them are also used by other Adobe apps) :
~/Library/Preferences/com.adobe.InDesign.plist : of course ! /Library/Application Support/Adobe/ : Misc support files /Applications/PAO/Adobe InDesign 2.0 Trial/ : The app. /Library/Application Support/Privilege/ : Licenses ? serial numbers ?
For indesign (I don't remember the exact version, but I think it was a 2.0), I'm pretty sure the list is exhaustive.
An easy (Something easier may be possible) way to find all modified files is to use the fs_usage command and search the result for every suspect file access (The fs_usage must be run as root while installing and on first launch).
 Signature Bruno Remove the "remove.me" part to answer
Brian Hughes - 10 Feb 2005 01:16 GMT > > Yes, and I think I'll be sending a message to Adobe about this. I own > > After Effects Std, I downloaded the trial to see if I wanted to upgrade [quoted text clipped - 14 lines] > For indesign (I don't remember the exact version, but I think it was a > 2.0), I'm pretty sure the list is exhaustive. I looked in my Console log and noticed that it was looking for other sound files during the install, in my case Temple.aiff, which doesn't exist, and a few others I can't remember.
I downloaded and installed the InDesign demo (although I already own InDesign) and here are the files it installed that are part of the demo control:
Modified Files: /Library/Application Support/Adobe/Adobe Registration Database /System/Library/Sounds/Submarine.aiff
New Files or Folders: /Library/Application Support/Privilege/
(These are all invisible) /Library/Preferences/QuickTime D9087F /iNode48856617 /.DRM_Home /.DRM_etc
Regardless of what files, folder or permissions the demo modifies or creates, the demo control software that Aladdin creates is so easy to circumvent it's not even funny. Adobe would be better off creating trial-only serial numbers that expire. The download date could be encoded into the serial number which is provided at download time. That would be better than modifying sound files, creating hidden files with deceptive names or messing up permissions.
I know I've seen quite a few posts about the iNodeXXX files, it makes many people worry about disk corruption:
<http://groups-beta.google.com/groups?q=inode+group%3Acomp.sys.mac.*>
The naming of these files are the same as actual orphaned inode files. All I know is I'm never downloading a demo that uses Aladdin's software, their programmers are idiots.
> An easy (Something easier may be possible) way to find all modified files > is to use the fs_usage command and search the result for every suspect > file access (The fs_usage must be run as root while installing and on > first launch). I use the File Buddy snapshot feature to take before and after install snapshots. Then you can use the "compare snapshot" and it will output lists of deleted, modified, and new files. If you take a snapshot of your entire drive you can find everything the installer touches. You can also create a snapshot after you run the demo.
Looking at fs_usage I think File Buddy does a better job. Not only do you get the list of files but you can modify or delete them right from the list window.
Brian Hughes
 Signature If you *really* need to e-mail me, send it to: usenet at hughesvideo dot com
Brian Hughes - 09 Feb 2005 08:27 GMT > >I can confirm this same thing with the Adobe After Effects tryout. > [quoted text clipped - 10 lines] > of an obstacle for anyone wishing to "extend" their trial license. And, as > I posted earlier, the opportunity to demo the software is wonderful. Actually, it is easy to defeat the trial license, once you know how, in such a way that the license never expires. You just have to figure out what files the DRM software creates and/or modifies. Then you can make a few changes and the trial never needs to end. (The only drawback is it takes about 60 seconds to launch AE) I know how to defeat it for the AE installer but I won't detail it here nor do I condone it.
So, not only does the software solution that Adobe is using, created by Aladdin, modify system files it isn't authorized to modify, the scheme is so lame it borders on that amateur. I hate to think that Adobe paid Aladdin for this demo control software.
I noticed that when I run the installer, I have to authorize twice; once for the installer, the other for the demo control application. At that point you are giving it authority to add and modify system files. If you delete or fix those files later, the software will still modify them again. All without authorization, even if you fix the permissions!
Like I said in another post, this is malware and shouldn't even be allowed on any computer where you are concerned with security. This isn't about Adobe or its software, this is about the software created by Aladdin <http://www.aladdin.com> that Adobe uses to control the demo period.
Brian Hughes
 Signature If you *really* need to e-mail me, send it to: usenet at hughesvideo dot com
|
|
|