main

Microsoft takes Windows Update away from the pirates

configure   on 02 July 2004 - 10:01 · 126 comments & 19244 views

Advertisement (Why?)
Much rejoice there were when Microsoft's Barry Goffe announced that everyone (including the so-called "thief's") would be able to install Windows XP Service Pack 2. A few days later, A Microsoft spoke person said otherwise and from then on, it was very clear that Microsoft was not going to let shady users have an easy ride - it was like a screeching noise to the ears of those without a legit copy.

SouL2kEEp has just reported that Windows Update 5 has also been taken down the same path as Service Pack 2 for Windows XP. Neowin has a screen shot of the message that claims an invalid Product ID is being used.

I'm sure that this was a tough decision to make as Microsoft has been vigorously focusing on security issues and worm outbreaks. Preventing users from obtaining patches from Windows Update means that they will be left vulnerable and could contribute to the attack which, in the end, may also affect the legitimate customers.

While I can agree that Microsoft does not hold responsibility for those who are not customers, I still feel that blocking Windows Update may be a bit too extreme and could affect the company's reputation on security matters in the long run.

Screenshot: Windows Update preventing access
News source: In-House


Areas of concentration in the DirectX 9.0 SDK Update (Summer 2004) RC0 release are:
- HLSL support for Pixel Shader & Vertex Shader 3.0
- Effects Framework performance improvements
- Pre computed Radiance Transfer improvements
- New Sample framework
- New & Updated Samples
- PIX tool for better debugging of Direct3D applications
- Introduction of the Preview Pipeline for easier content creation

Post a comment · Send to friend Comments · There are 126 additional comments
#1 mercuryx013 on 02 Jul 2004 - 10:13
The image doesn't work.
#2 chrisxtreme on 02 Jul 2004 - 10:13
broken image link

but i know what it looks like in person, time to install my legit copy and having to activate everything i reinstall, and eventually activation by phone only =(
#3 Lycan on 02 Jul 2004 - 10:13
The screenshot link doesnt work "The page you were looking for does not exist, check spelling?"
(1 reply) #4 ACTIONpack on 02 Jul 2004 - 10:18
The screenshot link does not work. I try different file type from jpg to gif and it didn't work. Someone is not paying attaction.
#4.1 configure on 02 Jul 2004 - 10:23
It's not spelling mistake.
(6 replies) #5 cdcase on 02 Jul 2004 - 10:20
I understand why they are doing this. Technically they are correct - if you didn't pay for your OS then you shouldn't have access to free updates.

BUT....

Microsoft almost has a social responsibility to ensure all instances of its OS are patched. This subject has been beat to death on other forums. The article is correct - if you don't allow pirates to patch, then you guarantee thousands of zombie pcs out there that will be permanent hosts for viruses and trojans. Which is pad PR for MS.
#5.1 markjensen on 02 Jul 2004 - 12:43
The part where you said that Microsoft almost has a social responsibility to ensure all instances of its OS are patched struck me as particularly relevant.

And do consumers not have a 'social responsibility' to properly and legally license/purchase their software?
#5.2 Fally on 02 Jul 2004 - 13:05
Consumers definately have a responsibility to purchase the software they use.

But should MS punnish all the other users of the internet because its software is buggy and creating zombie boxes and DESTROYING the usefulness of the internet.

I think every windows box needs to be patched to ensure the reliability of the internet as a whole. So much for the M$ 'Trustworthy Computing Initiative' I guess it only sounds good when your software is causing hell and you want people to think your doing something about it...
#5.3 markjensen on 02 Jul 2004 - 13:18
I would wager that most of the "zombie boxes" are units that have been purchased at stores (and are therefore fully licensed) by clueless consumers. These consumers can update, but don't.

People who download illegal versions (or keys) from various sources are much more likely to follow security issues and keep their boxes up to date. They will also likely find a way to circumvent this 'feature', too.

Making the claim that this will harm the internet users, as a whole, is quite clearly wrong. Look in this and other Neowin forums to see how many pirates claim to have found ways around this already (or have their energies focused on finding ways).
#5.4 Beaux on 02 Jul 2004 - 18:32
QUOTE
I would wager that most of the "zombie boxes" are units that have been purchased at stores (and are therefore fully licensed) by clueless consumers. These consumers can update, but don't.

That's what SP2 is supposed to change. Automatic updating will be the default, so the clueless people's machines will still get updated.
#5.5 markjensen on 02 Jul 2004 - 19:22
QUOTE (#5.4)
That's what SP2 is supposed to change. Automatic updating will be the default, so the clueless people's machines will still get updated.

Yeah.

Now, if we can only convince the clueless to install this update.
#5.6 duhovnik on 06 Jul 2004 - 09:27
The true answer on this question is here: www.suse.com
(2 replies) #6 Jasco on 02 Jul 2004 - 10:25
Yeah.. thats REALLY smart MS

What about those people who use the Corporate edition? O_o

Last edited by 1422 on 02 Jul 2004 - 10:32
#6.1 shao on 02 Jul 2004 - 10:57
smart comment too.. hehehe
corporate version works fine here. An illegal key isn't determined to be illegal purely by the amount of installs it's been used on.. but surely you knew that already!
#6.2 Beaux on 02 Jul 2004 - 18:36
QUOTE (#6.0)
Yeah.. thats REALLY smart MS

What about those people who use the Corporate edition? O_o

They still can take out corporate editions with illegal keys. They did it with SP1 and will do it again with SP2.
(3 replies) #7 ruskie on 02 Jul 2004 - 10:31
I don't understand how this is going to effect pirates. There are plenty of Windows keygens/product id changers which will make valid keys.
#7.1 Xeron on 02 Jul 2004 - 10:57
I don't think it will effect pirates. Might affect them a bit though.
#7.2 dhitb on 02 Jul 2004 - 11:08
This was discussed before SP1 even made RTW, the decision to block invalid serials with WUv5 was made back then. This is not really news (to me anyway ), but they could still change it.

How it works, from what I've read back then, is they will compare the PID to a list of known serials to which are associated with certain registrants or VLK licensees. If this is the system they are using, it will effectively block most or all keys generated using the well-known generator. However, they might've decided to use a simple system that is similar to the one in SP1/SP2 where it only blocks certain known pirated serials from using WUv5 (i.e. FCKGW). In which case generated keys would still be able to use WUv5. I don't know how to confirm it either way though. What I do know, is if they block all generated keys, they may catch unwanted attention from the DoD or some other government officials due to the security risks posed by this move. It's all up in the air at the moment though.
#7.3 dismuter on 02 Jul 2004 - 22:23
Keygens are not a workaround for this. They check the key to see if it was issued by MS.
(1 reply) #8 cdcase on 02 Jul 2004 - 10:33
forgot to add - a mega-corporation like MS can easily afford the server badwidth to allow a little update "leeching". In addition, their behavior is only going to drive piracy further underground, and it will spur the hacker community to come up with more sofisticated tools.

They really need to address the product activation hastle, which is feeding some of the piracy numbers.

Last edited by 42277 on 02 Jul 2004 - 10:39
#8.1 twyst3d on 04 Jul 2004 - 03:26
i think MS should make it so pirated copys can get to windows updates but while 'searching for the windows update software' it should give a security warning and require it to be installed and if there is a pirated key it should restart windows and disable boot with a message saying this is a pirated version of windows please obtain a legit copy or contact your computer manufacture
(3 replies) #9 dreamthief on 02 Jul 2004 - 10:34
has this pirate prevention for updating already in place? I just for the fun of it generated a key. It worked with windowsupdate version 5.
#9.1 configure on 02 Jul 2004 - 10:36
It appears to be so with Windows Update 5
#9.2 anakinsolois on 02 Jul 2004 - 12:33
I dont think its been activated yet, coz i use Windows Update 5 and it works for me.
#9.3 theyarecomingforyou on 02 Jul 2004 - 13:00
QUOTE
I dont think its been activated yet, coz i use Windows Update 5 and it works for me.


It has been activated... I've had people tell me about it. I think this is a good thing because many people will have copies of XP but will never know if they're copied unless they were told on WindowsUpdate. Most people can have an illegal copy and go about using it without having to worry, or possibly without ever knowing.
(1 reply) #10 clx on 02 Jul 2004 - 10:36
so there stopping everyone who doesnt have a legit copy of an os from getting updates, which supposadly protect again hacking and cracking etc
so they are effectivly increasing the number of potentaly infected machines in the open, which in turn means there will be more machines "passing on" the infection to users who are to slow to update

where as if they let everyone update there will be fewer computers to spread the infection as more people have updated to patch the holes....

anyone following this?

anyway, whats the next step? they trace the ip address of the ppl who fail to update, contact isp's, get home addresses, then send some big men in black sutes to sort the ppl out.....

anyone fancy moving to linux even more now?

anyway, i'm safe, mines legit
#10.1 cdcase on 02 Jul 2004 - 10:42
QUOTE
they trace the ip address of the ppl who fail to update, contact isp's, get home addresses, then send some big men in black sutes to sort the ppl out.....


Don't be surprised if they are already flushing out a plan to do this very thing - maybe send the people a nice "invite" to clarify the "discrepency" in their serial number.
(14 replies) #11 cdcase on 02 Jul 2004 - 10:46
OMG - just thought of something...

WHAT ABOUT AUTOPATCHER!!??? Do you think they will put the muscle on it and shut it down??

I LOVE AUTOPATCHER!!
#11.1 WindowsNT on 02 Jul 2004 - 10:49
Microsoft will see that as a loophole, so if they are reading this then it's R.I.P for AutoPatcher.
#11.2 biscrage on 02 Jul 2004 - 11:00
Relax guys, it doesnt check your serial when you download the patches at download.micrisoft.com, so autopatcher is probably fine. I hope
#11.3 dhitb on 02 Jul 2004 - 11:10
That's good to know, Biscrage, the Windows Update Catalog is still very useful. Hopefully AP won't be shut down for its ease of use.
#11.4 mstx on 02 Jul 2004 - 11:12
Good point there. So pirates can just use autopatcher instead
#11.5 welshkid on 02 Jul 2004 - 11:26
maybe the maker of auto patcher will get in trouble coz loads of pirates will use it now?
#11.6 SouL2kEEp on 02 Jul 2004 - 11:37
...now?

as if they are not already?
#11.7 cdcase on 02 Jul 2004 - 12:00
I am afraid that they will see it as an unauthorized distrubution of their software and will clamp down on it. I have to say that Autopatcher way cool and completely useful. ITs the only way I can reformat and re-install the OS without worrying about getting hammered by a virus before I can get the updates from Windows Update.

It will be a sad thing to lose that tool!
#11.8 DELTA75329 on 02 Jul 2004 - 17:04
AutoPatcher is a side issue here... You still need to get SP2 (which checks the serial) installed first. As far as I know, AP will not be used to assist with SP2. AP will need SP2 installed prior to installing Post-SP2 updates (which do not routinely check the serial).
#11.9 bilemke on 03 Jul 2004 - 04:15
a note.. it looks as if the sp2 updater doesnt always do this as the screenshot shows it is installed.. only windows update blocked you from getting further updates.
#11.10 SkyyPunk on 03 Jul 2004 - 13:57
if i remember correctly, it doesnt send anything to MS about your key/serial. That is all stored and verified on your machine, when you go to Win Update, that downloads something for your machine to reference what is allowed to install and what isn't if your serial is invalid. Autopatcher then does not circumvent this really, because if it is something they dont want people with pirated copies to have, it is built into the update to have it check, so you would get an error installing saying invalid key (like when SP1 came out, you could download it many places, didnt matter though because it is built into the update install
#11.11 StarSabers on 03 Jul 2004 - 15:23
Previous versions (v4) did not check that I am aware of. However, v5 does, as MS states in their Privacy Policy:

QUOTE
What data is collected – and why?
Windows Update collects general system information from your computer with each visit, so that you receive the updates that work best with your computer. The information is also used to generate aggregate statistics about how the Windows Update web site is used and which systems need support, so that we can improve our service. This information includes:



Computer make and model
Version information for the operating system, browser, and any other Microsoft software for which updates might be available
Plug and Play ID numbers of hardware devices
Region and language setting
Globally Unique Identifier (GUID)
Product ID and Product Key
BIOS name, revision number, and revision date
#11.12 bush on 04 Jul 2004 - 08:01
it's normal. all what they need to know for updates
#11.13 markjensen on 04 Jul 2004 - 14:32
QUOTE (#11.12)
it's normal. all what they need to know for updates

Wrong.

They don't need to know that information for updates. They can send and have a local program execute on your PC that analyzes your needs and retreives updates. I know that this is how it used to work.

They just want that information.
#11.14 snippet1 on 05 Jul 2004 - 00:38
QUOTE (#11.13)
They just want that information.

They already have the infromation. Provided it's legit and you activated, that is.
(3 replies) #12 tterb on 02 Jul 2004 - 11:06
no worries for me, i just switched to linux. got tired of pirating all that software
#12.1 nexx on 02 Jul 2004 - 11:59
Same, and I've never been happier.
I actually enjoy using the computer now..it's a strange feeling. Goodbye Microsoft.
#12.2 Avicus on 02 Jul 2004 - 15:00
Hehe, I'm doing this on Saturday... it'll feel nice to not have illegal software... and yes, the computer does feel nicer (with linu and linux has put the fun back in computing! Go Gentoo!
#12.3 chacho on 02 Jul 2004 - 15:06
QUOTE (#12.2)
linux has put the fun back in computing!

you took distrowatch's slogan
(1 reply) #13 NinjaOfLove on 02 Jul 2004 - 11:40
Microsoft's unwillingness to take the needed steps to battle piracy are only going to make the legitimate end user suffer. Like usual.

I don't think I need to explain the dangers of having even a few systems out there that aren't patched.

Lower prices and release older versions of products for free or severely discounted prices and piracy will decrease. Coming up with new schemes like this will not work.
#13.1 cdcase on 02 Jul 2004 - 11:55
yes this is a good point, but there are major support issues when older OS versions are sold. But Windows and Office are the only cash cows that Microsoft has, and despite the industry pressure to commoditize they will resist the pricing pressure until the last possible second. You can't blame them, and as a Microsoft shareholder I understand that. However, I also understand that I am not willing to pay $200 for the OS and twice that for Office when the PC cost me $600.

Microsoft is in a big pickle here with hardware prices falling like rocks and Open Source software growing like wildfire, and going after the piracy segment is their way to try to maintain their profit levels. It will work for the casual copier, but hardcore pirates will continue to thrive because they have the technical savy and tools to easily circumvent any measures that MS throws out there.
(1 reply) #14 Randall_Lind on 02 Jul 2004 - 11:48
I reported this 2 weeks ago in the fourms. People also posted the work around
#14.1 chacho on 02 Jul 2004 - 15:06
ok.
#15 aoeu on 02 Jul 2004 - 11:49
Hey, look on the bright side, at least MS forced me to find valid keys for all my home computers. ^_^

Thanks for the advance warning MS! Now I know my windows will at least be able to run SP2!
#16 zephiK on 02 Jul 2004 - 12:02
aww
(2 replies) #17 harper x on 02 Jul 2004 - 12:27
Why Why Why, If people ent to the effot to get a copy in the first place especially if they downloaded it what make microsoft think that within a few days of release there won't be a keygen or work arround up in the same place.
it seems like a pointless waste of time on microsoft's behalf.

Disservice : It takes months to find a customer, but only seconds to lose one.... The good news is we should run out of them in no time!

Pehaps a quote microsoft shoul consider with the new revolution in open sourse, lets face it ie is loseing out to firefox already, tha is because

1. its free
2. its fast
3. its not microsoft

#17.1 markjensen on 02 Jul 2004 - 12:55
I am an Open Source user and supporter... However, I find the claim that "IE is losing out to Firefox already" a bit premature.

IE still has roughtly 95% marketshare, I believe.
#17.2 Fantmx on 02 Jul 2004 - 20:32
That's assuming the people that downloaded the copy are using the computer its installed on. I know a lot of people that have downloaded a copy and used it to upgrade their parent's, aunts, uncles etc. computers. Those people may not understand that they have illegal software. They will also not know how to get around this.
#18 ThunderRiver on 02 Jul 2004 - 12:40
Hey hey .. why are you people still here debating about this? Didn't we go through tis already with SP1? You guys only keep short term memory or something?

Same goes to Windows 2003 Server RTM pirated keys..
(2 replies) #19 Gary_Player on 02 Jul 2004 - 12:51
Ehg

So even joe-pirater with a fresh install of winxp wont be able to go to windows update? Thats kinda wierd...Wouldnt the product ID be "Information about your computer" that MS supposidly doesnt check when you go to windowsupdate?
#19.1 longwilli on 02 Jul 2004 - 12:58
lol you live in a fantasy world
#19.2 Joel on 02 Jul 2004 - 18:18
QUOTE (#19.0)
So even joe-pirater with a fresh install of winxp wont be able to go to windows update? Thats kinda wierd...Wouldnt the product ID be "Information about your computer" that MS supposidly doesnt check when you go to windowsupdate?

MS says no Personal info is communicated to them, not no info at all. How else would they know what patches you need?
(2 replies) #20 Outcast Jedi on 02 Jul 2004 - 12:58
This is only a move that will cause some problems with pirates... People can easily find new way to go pass...
#20.1 tlogank on 02 Jul 2004 - 12:59
Doh...it got me. I think this is only affecting users with SP2 installed...now, where to find a workaround.
#20.2 betasp on 02 Jul 2004 - 13:20
WOW, got me too. I guess I will have to chenge back to my valid key (wherever I put it), or secure myself a more valid key.
(6 replies) #21 moeburn on 02 Jul 2004 - 13:22
so am I to understand that any webpage with IE can download and store your WindowsXP cd-key?
#21.1 superterran on 02 Jul 2004 - 13:57
Yep, I was thinking that too - they must have upped the security before they allowed IE to do that... use firefox.
#21.2 Fowen on 02 Jul 2004 - 15:03
QUOTE (#21.1)
Yep, I was thinking that too - they must have upped the security before they allowed IE to do that... use firefox.

Yes, if you are stupid enough to click on the little "Yes" button when the active x dialog box comes up, I am sure they can look at many things.
#21.3 superterran on 02 Jul 2004 - 17:38
can you run windows update without clicking the 'Yes'? I never tried, but then again - I don't really have anything to hide from microsoft. it is kind of screwed up that they can access infomation like product id's from activex; thats just not right.
#21.4 mat on 02 Jul 2004 - 18:00
an ActiveX Program can do everything to your PC!
its just a normal Programm. once installed it has the same rights as your account has.

And yes: thats a seriously flawed "Security" Modell
#21.5 superterran on 02 Jul 2004 - 19:35
Yes, that's pretty screwed up. I'm glad i gave up on IE a long time ago.
#21.6 twyst3d on 04 Jul 2004 - 03:34
other sites cannot get the product ID/Serial for windows, it all goes by what it shows as registred to under system propertys example, XXXXX-XXX-XXXXXXX-XXXXX if u ever called microsoft product support they ask for that and thats how they can tell if your using a pirated copy and if your using a OEM copy of windows or a copy from the store/microsoft
#22 DrunkenMaster on 02 Jul 2004 - 13:56
Wow, talk about in-depth reporting!!! Someone must have pirated and installed Windows in order to get that screenshot
#23 superterran on 02 Jul 2004 - 13:56
I wonder how long it will take to beat this system...

I can imagine it now, downloading all the hotfixes from a BT site or iRC. I can see two completely diffrent sides of this issue.

I work for a computer repair chain, and i look over six stores. Now, although we follow Microsoft's EULA to a tee (they audit us) it would have been easy, up in till now to sell copies of XP Pro that wouldn't cost us a cent; It would no longer be pratical, since it's now pretty obvious that it's not legitimate.

However, they are opening up a huge hole in there defenses with DDOS attacks. It's really a tough call - i dunno what I would do in that situation.

I think for people like me - I could get the latest hotfixes on my system, it might be a little harder than it used to be, but i could get it to work; lucky i use a legit copy of XP Pro - but for those kids who had problems burning the ISO file to install it, they're out of luck; at least until somebody makes an installer for it, or reverse engineer it.
#24 Grappa on 02 Jul 2004 - 14:14
It's thieves, not "thiefs".
#25 chacho on 02 Jul 2004 - 15:09
QUOTE
The image doesn't work.

QUOTE
broken image link

QUOTE
The screenshot link doesnt work "The page you were looking for does not exist, check spelling?"

QUOTE
The screenshot link does not work. I try different file type from jpg to gif and it didn't work. Someone is not paying attaction.


we get it.
(1 reply) #26 Tartan on 02 Jul 2004 - 15:17
This will backfire on Microsoft on a HUGE SCALE, as more and more vulnerable compluters, probably 100s of thousands get viruses and trojens and attack other pcs on a MASSIVE SCALE.

If Microsoft think they have security problems now, just wait till 6 - 12 months from now.
#26.1 em_te on 02 Jul 2004 - 19:26
If it backfires, it would have already backfired with SP1.
#27 y_notm on 02 Jul 2004 - 16:02
wow, you guys are acting like Microsoft didn't do the same thing when Service Pack 1 was released. The keys that were blocked in SP1 were blocked at Windows Update as well.

The leaked corp key for Windows Server 2003 was blocked at WU as well.

Why is this a shocker? its not a new policy.

Blocking out a minority of Windows XP users isn't going to make the situation worse. While there's still a risk to users running Windows 2000 and the illegitimate users stuck on XP SP1 will be infected by these unupdatable computers, SP2 users (when SP2 is properly configured, aka not f*cked with after its been installed) will be OK.

Besides, those people who were able to download and install a pirated copy of windows more than likely already know the procedure to get around the blocking for SP2 and WU5, and will most likely use that knowledge to their advantage
#28 Mister Lamar on 02 Jul 2004 - 16:08
get a legal copy and stop whining
#29 Azadre on 02 Jul 2004 - 16:41
I have OEM
#30 Xenomorph on 02 Jul 2004 - 16:42
ok guys, here's a secret:

if your CD key doesnt work, USE A DIFFERENT and VALID ONE!

problem solved!

i got the "invalid product key" message before. i changed my key, rebooted, and then it worked fine.

PS: i have two legit copies of XP Pro, so i never wory about using VL Keys