By Joris Evers
Wednesday, June 14 2006 10:30 AM
URL: http://www.zdnetasia.com/news/security/0,39044215,39367349,00.htm

Millions of Windows users may unwittingly be test subjects for an unfinished Microsoft antipiracy tool.

The software maker has been delivering a prerelease version of Windows Genuine Advantage Notifications software to PCs as a "high priority" item in the built-in update feature in Windows. The tool, also known as WGA Notifications, is used to validate the authenticity of Windows software installed on a PC.

The move is a first for the software maker. Microsoft normally asks people to join test programs before it initiates the download of any such trial software.

"I don't think that we have done it before," David Lazar, director of the Windows Genuine program at Microsoft, told CNET News.com on Tuesday. "WGA Notifications is a unique program."

Microsoft has been expanding its effort to distinguish pirated copies of Windows from legitimately acquired ones. The original WGA program, launched in September 2004, calls for people to validate their Windows installation when they download additional Microsoft software from a Microsoft Web site. In November, it introduced the separate WGA Notifications program. It now sends prerelease WGA Notifications software to people in a number of countries, including the United States.

But some security experts are troubled by Microsoft's decision to deliver prerelease software to millions of Windows users without clearly notifying them. People may not realize they are participating in a trial and have in essence become unsuspecting guinea pigs, they said.

"It shouldn't be offered to such a wide audience without more notification of the fact it is beta," said Russ Cooper, a senior scientist at Cybertrust, a security vendor in Herndon, Va. "Even with more notification, I think it should not be offered in the way it is."

Microsoft notes that this is "prerelease software" in the user license, which is displayed when WGA Notifications is about to be installed. People can decline the download at that point, but experts believe that most won't understand the license and that many don't read user license details.

No immediate benefit
Some suggest that pushing the antipiracy tool out as a "high priority" update in the same way as security fixes is a ploy to get people to install it.

"I don't see any way for Microsoft to get the software run by a large fraction of the user base except by calling it 'high priority,'" said David Walker, an IT professional in Las Cruces, N.M.

Running the tool doesn't offer any immediate benefit for users, Walker noted.

"You could argue that this is mislabeling," he said. "I suppose it is a high priority for Microsoft to get rid of counterfeit software...It's not critical for the continued operation of the user's computer."

Michael Cherry, an analyst at Directions on Microsoft, agreed.

"While I have been supportive of Microsoft's Genuine Windows Program, there are no circumstances that I can think of where it makes sense to use Windows Update or Automatic Updates to distribute beta or nonfinal code," he said. Automatic Updates is the update feature in Windows.

Microsoft needs to find a better way to distribute noncritical or test software, Cherry said. The company should consider coming up with better labels for updates so that customers can understand when an update is needed to resolve a security problem or when it is needed to improve reliability, he said.

No warning label
Indeed, most consumers won't know what to do when Automatic Updates offers them the piracy tool and thus will simply accept it, said Michael Silver, a Gartner analyst.

"There's not a lot of benefit for consumers to allow this to be installed, but most won't know what it is and will probably just allow it," he said.

Although the WGA Notifications tool isn't finished yet, the software doesn't come with the same caveats as other Microsoft beta software, such as warnings that it could cause system crashes or otherwise affect PC performance, Microsoft's Lazar acknowledged.

"It is prerelease software. We're still testing it end-to-end, including the delivery mechanism," he said.

But, he added, "I want to assure everyone that WGA Notifications has been rigorously

An exception to policy...

tested, and we're confident that the software can be installed and used safely."

Microsoft does understand the distribution concerns, Lazar said.

"We can see that people are very concerned about this particular feature or this particular aspect of the rollout, and it is something that we will consider in our future plans," Lazar said, indicating that Microsoft is not about to change the way it is testing WGA Notifications.

WGA Notifications is an exception to Microsoft policy, Lazar noted. Microsoft has not changed its approach on trial software, under which it does not send out unfinished code without an enrollment stage, he said.

"It is not a change in policy," he said.

The WGA Notifications program is a precursor to the antipiracy features Microsoft is building into Windows Vista, the new version of the operating system set for release in January 2007. In Vista, certain operating system features will only work as long as it is a properly licensed copy.

Following download and installation of the WGA Notifications tool, people who use a pirated copy of Windows will see alerts at start-up, login and during their use of the operating system. The alert reads: "This copy of Windows is not genuine; you may be a victim of software counterfeiting." Those who use a legitimate copy of the software won't see any messages, Microsoft has said.

Microsoft has said that there is a real benefit to its users in validating a copy of Windows. Only "Genuine Windows" users can download additional Microsoft software, such as Windows Defender, for example. Also, if a Windows copy is deemed pirated, it will only download "critical" updates, not less urgent fixes. Hackers, however, have repeatedly found ways around the checks.

"Our experience is that customers--as long as the process is understandable, unobtrusive, quick and painless--appreciate not only their copy of Windows more, but also appreciate Microsoft more. Now they have something that is more valuable than before," Lazar said. "They appreciate …the confidence that they got what they paid for."

Declining is an option
When Microsoft launched the original WGA program in September 2004, it asked for validation only if people were downloading from Windows Update and the Microsoft Download Center Web site. Validation was optional and 56 percent of people opted in, Lazar said.

People can also decline the more recent WGA Notifications download, but 60 percent have chosen to install it, he said.

Although people can decline the WGA Notifications install, they can't remove the program once it is running. Also, those who decline the installation may receive reminders to run the tool. That's especially true for Windows Live OneCare security subscribers, who will see an alert that their system might be at risk because of the missing Microsoft update.

Microsoft is looking into the OneCare issue, Lazar said, particularly at "whether or not OneCare should be urging you to install WGA Notifications."

The installation concerns are only the latest criticism for the WGA program. Last week, Microsoft provided a public mea culpa for not disclosing that the WGA Notifications tool pings a Microsoft server every time its starts up. One critic had likened the tool to spyware for its undisclosed behavior.

In response to the earlier criticism, Microsoft plans to release an update to WGA Notifications this month that phones home only once every two weeks. A final release with worldwide introduction and no more calls to Microsoft is slated by year's end.

Microsoft has not yet decided whether running the application will remain optional or whether it will become mandatory.

"We're considering opt-in versus making it a requirement," Lazar said.