Skip navigation.

Prepare!

Lee Harvey's Zombie Hit Parade

August 2007

( Monthly archive )

Time Warner customer? Dell owner? They might be spying on you...

, , , ...

Note: If you're not a Time Warner cable (RoadRunner rr.com service) customer, then you can ignore this post.

If you ever went through Time Warner's Road Runner Medic download+install for Windows, then you most likely have this Windows NT service process running:

   sprtsvc.exe

(To check: goto Start> Run... taskmgr, Processes tab)

So what is sprtsvc.exe? Well, luckily, it registers itself under your Services (Start> Run... services.msc) as "SupportSoft Sprocket Service". Searching the web doesn't reveal much information on it, so I decided to poke around...to which I found this folder:

C:\Documents and Settings\All Users\Application Data\SupportSoft\medicsp2\

...which contains log files, xml config files, ini files, zip files, etc. I highly recommend that you examine the contents (and modified date/time frequency) of these files (esp. the log files) and judge for yourself.

Personally, it seems Time Warner logs all running processes, network info, hardware info, operating system info and patches, and installed programs, during every system startup, then submits it to http:\\medic.rr.com\global\ over an unencrypted, raw HTTP connection. In addition, the service seems to use Microsoft's BITS to download additional data in the background, unbeknownst to users.

Therefore, I have stopped "SupportSoft Sprocket Service" in services.msc, and set its Startup type to "Manual", instead of "Automatic".

I'll keep monitoring this, and if I discover anything else, I'll update this post. Stay tuned...

Nice new security tool: Mandiant Red Curtain

, , , ...

Mandiant Red Curtain
http://www.mandiant.com/mrc

A tool to manually scan folders or files for suspicious criteria, such as entropy/randomness, binary packing, compiler signatures, digital signatures, and other characteristics that generate an overall threat score. While not fool-proof, it does find some interesting files -- especially on computers used by kids.

Note: Mandiant Red Curtain requires Microsoft .NET Framework 2.0

BTW, to obtain a sanity check of Mandiant's file scoring, submit individual file samples (those marked red in Mandiant with high scores) to...

VirusTotal
http://www.virustotal.com/

...which further scans them using 32 separate virus scanning engines with their latest signature DATs.

Note: Opera binaries are packed using ASPack, and are not digitally signed with a code-signing certificate, which apparently qualifies them as yellow in Mandiant. Obviously, you can ignore Mandiant's ranking of Opera binaries.

Enjoy.