Look out! Adobe is watching you!

[Per Ofverbeck]

This one was new to me; cannot find any previous posts here...

It seems, every time you start one of the CS3 apps, it pings an IP address that is deliberately chosen to look like a local network one, but that leads to a "behavioural analytics" company.  Here are the gory details:

http://uneasysilence.com/archive/2007/12/12789/

Adobe has responded, telling us how innocent and beneficial it all is:

http://blogs.adobe.com/jnack/2007/12/adobe_ate_me_ba.html

Maybe it IS innocent, but if so, WHY use an obviously misleading address to do it secretly?  Why not tell us all about it from the start?

I don´t like this at all.  I´m going to install Little Snitch and refuse Adobe apps all outgoing traffic except while activating or upgrading.

I just don´t trust them like I did before

[francois]

John Nack has already replied on his blog (here). My only problem is not phoning home but disguising it into a local network address.

Edit: for those concerned about it, just modify your hosts file.

[sniper]

"Edit: for those concerned about it, just modify your hosts file."
How would I go about that?  Wayne

[Brad Proctor]

"Edit: for those concerned about it, just modify your hosts file."
How would I go about that?  Wayne
[a href=\"index.php?act=findpost&pid=164538\"][{POST_SNAPBACK}][/a]

For Windows XP...

Go to this directory

C:\WINDOWS\System32\drivers\etc\

open the "hosts" file in Notepad, and add the line (2O7 with the letter O not zero):

127.0.0.1       192.168.112.2O7.net

[francois]

If you use a Mac, edit the "/etc/hosts" file. First, make a backup of your hosts file and then use a text editor (or open the Terminal and type   nano /etc/hosts).

My hosts file looks like that:

##
# Host Database
#
# localhost is used to configure the loopback interface
# when the system is booting.  Do not change this entry.
##
127.0.0.1   localhost
255.255.255.255   broadcasthost
::1             localhost
fe80::1%lo0   localhost

127.0.0.1  192.168.112.2O7.net



When it is saved, you need to flush the lookup cache using dscacheutil -flushcache (Leopard) or lookupd -flushcache (Tiger).

I must go out of the office right now and don't have much time. Try to Google for /etc/hosts.

HTH

Edit: you can also read this article.

[Per Ofverbeck]

If you use a Mac, edit the "/etc/hosts" file....

Yep, that´s efficient - when you know which address the "malware" will try to contact.  In this case, the commotion must have rendered the insidious 192.168.... type of address fairly useless for them, so it will probably be abandonned soon (and, hopefully, the nitwit who got the idea of using it will be fired..).

However, it is unlikely that they´ll stop the practice altogether, so we´ll soon have some new "obfuscator" address (how about "Yourpersonaluserfolder.com"?  ) to cope with.  Then the edited hosts file will be stymied, but something like LittleSnitch will tell you what´s going on.

[sniper]

Thanks bproctor.     Wayne