Adobe modifies hosts file to detect whether Creative Cloud is installed

https://www.osnews.com/story/144737/adobe-secretly-modifies-your-hosts-file-for-the-stupidest-reason/

by rglullis • 4 months ago

344 171 4 months ago

cromka• 4 months ago

for a very stupid reason.

I cannot stomach Thom's articles. So borderline judgmental, holier than thou, feels like he only writes whenever there's something to criticize.

No, it's not a stupid reason. Reason is OK, the execution is controversial.

gjsman-10007• 4 months ago

Reason is OK, the execution is controversial.

And even then, only controversial to nerds with opinions. Nothing else about it is controversial.

If anything, knowing whether the app is installed or not is kinda important? If you open a file shared with you in the browser, the option to "Open in Desktop" versus "Install Desktop App" actually works correctly?

rglullis• 4 months ago

In which case, how else would you propose doing it?

- Registering an url handler?

- Asking the user?

jacobgkau8• 4 months ago

If anything, knowing whether the app is installed or not is kinda important? If you open a file shared with you in the browser, the option to "Open in Desktop" versus "Install Desktop App" actually works correctly?

This is not an approach any other app on any platform has historically used, and it doesn't seem sustainable if every app you install has to modify your hosts file to use a hack like this to detect whether it should handle files or not.

If you want the browser to be able to give the OS a file handler and have the OS present an option to install the app if it's not installed, that should be handled at the platform level, not on the website using a hack like this.

Why can a file not simply be downloaded with a page displayed showing a link to install the app and also instructions to open the file, trusting the user will know if they already have it installed? At best, you're talking about a very small UX optimization. Emphasis on the "kinda" in "kinda important."

Steeeve• 4 months ago

It's literally a 2 sentence article. Might as well have just tweeted "Adobe makes me mad"

tombert2• 4 months ago

I don't know anything about Thom, but I've kind of grown to prefer the pissy opinionated tones of blog posts. I think impartiality is difficult or impossible for a lot of tasks, and I'd rather people lay out their opinions plainly than trying to pretend that what they're saying is "objective".

Also, I think writing only when you have things to criticize is a valid enough thing to do; what's the point of writing a glorified "I agree!" article?

I only ever blog when I have something that I think is unique to say, and as such a lot of the time my posts end up being kind of negative. I don't think I'm that negative of a person, I just don't see the point of flooding the internet with more echo-chambers.

trollbridge• 4 months ago

I like his tone too. It also is easier to identify that it isn’t LLM generated text.

(I have nothing against LLMs but have little interest in reading text generated from them.)

pessimizer• 4 months ago

No, it's not a stupid reason. Reason is OK, the execution is controversial.

This is a muddled statement. It is a stupid reason to "execute" the act of silently modifying your host file.

If I murder somebody to keep them from stepping on my foot, and the judge says that it's a stupid reason to murder somebody, it's silly to say that the reason is "OK" because it hurts to have one's foot stepped on.

lousken• 4 months ago

How is defender not flagging this? Changing hosts file should raise alarms

gjsman-10007• 4 months ago

The hosts file is not sacred on Windows. Anyone who is administrator can just edit it. I've done it to add domain names to localhost.

For anyone hand-wringing over this, this used to be normal. The hosts file was invented a decade before DNS. The end user, or app, would edit their hosts file purposefully after downloading a master copy from the Stanford Research Institute which was occasionally updated.

jacobgkau8• 4 months ago

For anyone hand-wringing over this, this used to be normal.

People editing hosts files for other reasons was normal (a long time ago-- and it stopped being normal for valid reasons, as tech evolved and the shortcomings of that system were solved). A program automatically editing the hosts file and its website using that to detect information about the website visitor is not the same thing; that usage is novel and was never "normal."

raverbashing• 4 months ago

I wonder how this works on Windows, if any service overrides/resets it

xattt• 4 months ago

Can this not be blocked with file permissions? Or a symlink to a file in a ro folder?

SoftTalker• 4 months ago

Most software installers demand to be run as root/Administrator.

The fact that this is largely seen as acceptable or even sensible is rather silly in this day and age.

Asmod4n• 4 months ago

Defender warns you this happened.

anxman• 4 months ago

I didn't get this warning on MacOS

hypeatei2• 4 months ago

Most users won't care, especially if the Adobe installer warns them that a security warning might popup after installation. Besides, in practice, any malware editing the hosts file isn't going to get much because of HTTPS; one cannot simply redirect "google.com" traffic to their own IP without issue.

vondur• 4 months ago

If you don't like Adobe modifying your hosts file then I'd not use them. The checking for the software this way is kinda interesting though.

dlev_pika• 4 months ago

I wonder how many Adobe users are aware of this sketchy behavior tho

tonyedgecombe2• 4 months ago

My guess is most Adobe users have no idea there is a hosts file nor what it does.

ChrisArchitect• 4 months ago

[dupe] https://news.ycombinator.com/item?id=47617463

https://news.ycombinator.com/item?id=47624990

jameskraus• 4 months ago

Honestly a pretty nifty way to detect if it's installed. I'm sure this can power a lot of nice features, like linking directly into adobe products if they're installed.

turtlebits• 4 months ago

It can power even more security issues too. This is absolutely horrendous.

tonyedgecombe2• 4 months ago

I’m wondering how this can be exploited.

Terr_2• 4 months ago

Recycling a comment from prior discussion (4 days, 68 points, 13 comments): https://news.ycombinator.com/item?id=47617463

_______

Oh helllll no. Let's imagine an analogy for Adobe leadership:

1. You hired a night janitor to clean and vacuum your executive offices.

2. That janitor secretly stops at every desk-phone to alter the settings of voicemail accounts.

3. After the change, any external caller can dial a certain sequence to get a message of "Yes, this office was serviced by Adobe Janitorial!"

What's your reaction when you discover it? Do you chuckle and say something like "boys will be boys"? No! You have a panic-call, Facilities revokes access, IT starts checking for other unauthorized surprises, HR looks into terminating contracts, and Legal advises whether you need to pursue data-breach notifications or lawsuits or criminal charges.

* Is it acceptable because they had some permission to touch objects in the rooms? No.

* Is it acceptable because the final effect is innocuous? No.

* Is it acceptable because the employment contract had some vague sentence about "enhancing office communication experiences"? No.

* Is it acceptable if they were just dumb instead of malicious? No.

No person that would blithely cross those lines can be trusted near your stuff, full-stop.

jacobgkau8• 4 months ago

To be fair, your analogy has one flaw:

3. After the change, any external caller can dial a certain sequence to get a message of "Yes, this office was serviced by Adobe Janitorial!"

Theoretically, it's not "any external caller." Only the janitor's department calling in can dial that sequence and get "Yes, you serviced this office!" If anyone else tries to dial the extension, the desk-phone pretends it doesn't know what it means. (Because it seems Adobe's server serving the analytics image checks the request origin and only serves the image if the origin is Adobe's own website.)

The origin "security" doesn't excuse the complexity and the potential for both exploits and human-error breakage in the future.

gray_-_wolf• 4 months ago

Only the janitor's department calling in can dial that sequence

Is this the case though? Cannot any website use the same trick Adobe does to check whether you have Creative Cloud installed? Like, the entries in /etc/hosts are not magically scoped to work just on Adobe's web, no?

Terr_2• 4 months ago

Perhaps, but Adobe Janitorial saying "don't worry, we use a secret code" won't really excuse the situation or mollify the customer whose trust-boundaries were violated.

charcircuit• 4 months ago

It's more like when you join a company the laptop is given the ability to connect to an internal network for employees.

This is an extremely common practice.

ramon156• 4 months ago

To be fair, to crack all adobe products requires a few reg keys. It's wild that they have just given up on pirates.

snapcaster• 4 months ago

They don't want to be too hard on piracy, its their new/young user on ramp method

kenhwang• 4 months ago

Also a lot of recent features are AI related and rely on talking to Adobe servers, which would require a valid subscription. They're probably betting the AI features are valuable enough that local only pirated copies aren't a threat long term.

OptionOfT• 4 months ago

Can't even reproduce it when setting location to Belgium, or CA or AZ.

I must be missing something.

hypeatei2• 4 months ago

Looks like they got a wildcard certificate for *.creativecloud.adobe.com[0] so that the HTTPS connection works and so they don't have to publish DNS records for the "detect-ccd" subdomain to obtain a cert. Pretty neat setup, but also kinda hacky.

0: https://crt.sh/?q=creativecloud.adobe.com

j45• 4 months ago

Make affinity sound like a smarter and smarter choice.

matsemann• 4 months ago

Oh well, as a teenager, blocking adobe servers in hosts file was how you got to "phone activation" and could generate a code. So I guess we're even, heh.

butlike• 4 months ago

That CS2 torrent was a GOAT.

9dev• 4 months ago

FCKGW-RHQQ2-…

userbinator• 4 months ago

The title of this article recalled that exact memory for me too. Not only Adobe but cracks for a few other expensive softwares needed the same.

...and then Adobe (unintentionally) gave away free downloads of CS2, with valid serial numbers, once they shut down the activation servers. You can still find them on the Internet Archive.

ProllyInfamous• 4 months ago

I also did this as a teenager.

Doing this again, now (well into adulthood): recently gifted a "broken" 2013 MacPro[0], and have set it up as my retro CS4 workhorse (decades old software on a decade old machine). Hosts/PiHole ready, blocking "*adobe*" entirely.

Only problem now is I cannot find four's `FCKGW-RHQQ2-`... my oldmanfish surfs onwards, Santiago remaining uncertain. For now I just don't quit and never shut down (fresh install allows limited launches).

[0] RAM slot was jamming, not allowing proper seating

nashashmi• 4 months ago

So can I fool the website that I have CC installed?

Dwedit• 4 months ago

Browsers could still do something about mixed Internet and LAN/Localhost requests by IP address regardless of the domain name.

SahAssar• 4 months ago

This does not request a local/LAN file, it's a remote server but without any DNS entry unless the hosts file entry is present.

Dylan1680710• 4 months ago

Did you misread the post?

They're doing this because the localhost shenanigans got blocked. This is pure internet requests, but the IP changes (or fails to resolve) based on what's in your hosts file.

1bpp• 4 months ago

I owe thousands of dollars to amtlib.dll.

psyclobe• 4 months ago

The most difficult of tasks is trying to un-unstall this pos app on windows.

hatradiowigwam• 4 months ago

Whether it's run as root/administrator or not - you can disable this behavior by setting the immutable flag on /etc/hosts. No user, including root, can write to a file with the immutable flag set(although root could _remove_ the attribute and then write).

throw_await• 4 months ago

what happens if you happen to use a DNS server that resolves this domain to the correct IP?

djfobbz• 4 months ago

"Correct IP" wins ;)

ryandrake2• 4 months ago

As a general principle, application developers should not have free rein to modify my system's configuration, and OS's should do their part to make it very difficult for developers. Installing your binaries into C:\Program Files\AppName or /usr/local/bin? Fine. Dumping crap all over C:\Windows or /usr or /boot or something? No way--the OS should make the developer obtain my consent (not just a blanket sudo-like escalation) to do these things. Sneakily modifying /etc/hosts to act against me? Get the hell outta here!

mikkupikku2• 4 months ago

I thought the days if needing to "sudo" to install applications on windows were long gone; doesn't basically everything happily do user installations now? I would view a demand to escalate as basically proof that the application is about to do something janky, if not outright malicious. On linux, if I can't build and run software with just my user account, that software has some explaining to do. Virtually every desktop application should be able to run without escalated privileges.

Ajedi32• 4 months ago

"C:/Program Files" is still the recommended place to install programs, and it requires admin privileges to write to. Some programs (ab)use C:\ProgramData for that purpose instead and therefore don't need admin privliges. But even with that hack, ultimately Windows still uses the https://xkcd.com/1200/ permission model. (Everything runs with full access to all your data.)

vpShane• 4 months ago

on windows and mac they just get a prompt and a lot of people don't read it, care, nor wonder what it's actually doing they just want it to work.

I know you all know this but companies will do this knowing that exploiting all of us.

I use Linux and agreed on all those points. when I used adobe before it wanted to charge me a fee to cancel my subscription and wouldn't let me just 'cancel' in their system so I just blocked the payments on my card and dipped out.

good software, garbage company

TacticalCoder• 4 months ago

On linux, if I can't build and run software with just my user account, that software has some explaining to do.

Yup same. The software I install as root are those shipping stock with the distro. Others I compile and run from user accounts (like Emacs, which I always compile from source).

Dylan1680710• 4 months ago

Your impression is pretty far off, I think. Just naming a program setup.exe makes it escalate by default. Many installers can be used without escalation but going the traditional path isn't suspicious.

armadyl• 4 months ago

As a general principle, application developers should not have free rein to modify my system's configuration, and OS's should do their part to make it very difficult for developers.

Funny enough macOS, iOS, iPadOS and Android do this and they are constantly attacked for it.

I do think there needs to be more strict adherence by developers to standards like XDG but I don’t know how it could be enforced.

nulld3v2• 4 months ago

They are constantly attacked because they prevent users from modifying the system configuration, not just app developers.

gjsman-10007• 4 months ago

I do think there needs to be more strict adherence by developers to standards like XDG but I don’t know how it could be enforced.

It can't be enforced. Developers can and will always do whatever they want with the tools available. For good ends (Adobe) or for ill (malware).

If you try to fix it with sandboxing and closed app stores (Apple forcing sandboxing and using SIP), you get attacked. If you don't try to fix it and let devs do as they please (Microsoft allowing host file editing), you get attacked. The conclusion of these incompatible goals? HN and nerds have zero relevance in policy discussions, because they don't have a consistent policy to offer [1].

[1] Unless, of course, you define "devs shouldn't be able to do anything bad even if they choose" and "users should be able to anything bad if they choose" and "users should be able to write their own software capable of bad things while simultaneously not being held to the standard of devs" as a compatible principled position.

inetknght3• 4 months ago

Installing your binaries into C:\Program Files\AppName or /usr/local/bin? Fine.

I used to have this opinion too.

Then I decided that I actually don't want random things to install to `/usr/local/bin`. They should install to `${HOME}/.local/bin`. I should be perfectly capable of installing any application without modifying the system for every user.

lmm2• 4 months ago

You should have that option, but you should also be able to install things for all users. That's a pretty common case - most of the time if you install something on your computer, you are the administrator of that computer and want the thing you installed to be available for all users of that computer.

dev_l1x_be4• 4 months ago

developers should not have free rein to modify my system's configuration

s/free rein/the ability/

I am a big believer in read only operating systems. /etc should not be writable.

zymhan• 4 months ago

We get it, you like Nix

Dylan1680710• 4 months ago

How do you configure things without something basically equivalent to writing to /etc?

And whatever you do use to configure things, what if photoshop accessed it directly? I'm sure you'd be upset with that even if it didn't touch /etc.

qq66• 4 months ago

This is why I love iOS in many ways: it's very difficult for an app to have "action at a distance" inside your OS. If you force-quit the app it's pretty much like it never existed.

mhh__• 4 months ago

I won't name names just in case I'm misremembering but I'm pretty sure a remote desktop program you've heard at one point was adding a global LD_PRELOAD and pointing it at a shared library that anyone could write to.

But I might be making this up so not being specific lest I do a cheeky libel

massysett• 4 months ago

Meet macOS System Integrity Protection. Even root can’t do some things. Some hate it, I love it and would never turn it off. I know some parts of my system haven’t been gunked up by random vendors.

https://en.wikipedia.org/wiki/System_Integrity_Protection

anal_reactor• 4 months ago

The problem is that you have 100 apps that want to overwrite system files for malware reasons and then you have 1 app that wants to do it for legit reasons and there's no blanket method to tell these two situations apart.

jbverschoor• 3 months ago

They can have all the root they want In a sandbox or vm

dpedu• 4 months ago

I installed Creative Cloud just last week. No such entry was created in the hosts file on my macOs system.

cyanydeez• 4 months ago

Are we sure this is to detect Creative Cloud instead of, trying to detect whether you have/had a pirated version of Adobe installed? Some reference material I've seen often involved blackholing adobe hosts to prevent installation software from verifying or otherwise talking to adobe.

dblohm7• 4 months ago

I don't know whether is still does this, but 8-9 years ago I discovered that Acrobat overwrites the COM registry entries for Microsoft Active Accessibility (oleacc.dll) such that any application attempting to instantiate MSAA gets the Adobe DLL instead of the system DLL. This actually broke the stuff I was working on and had to override it in my app manifest to forcibly use the system version.

I inquired about it and got some BS about how they absolutely _had_ to do this to intercept MSAA instantiations across the system, when in reality they were using a global solution to solve a local problem.

reactordev• 4 months ago

Adobe has been user hostile since Create Suite launched. Where were you? They have been hiding backdoors in windows machines and Mac machines since at least 2010.

crest• 4 months ago

There are no suspicious entries in my /etc/hosts just what I put there.

stego-tech• 4 months ago

Honestly, I've been dealing with crap like this for so many decades that I'm a fervent supporter of every "installer" just showing and logging a Git PR-styled diff to the user of every file and system change, everywhere in the system, complete with the ability to rollback from it.

I am tired of inconsistent logging, opaque system changes, and vendors generally being malicious with endpoint security in the name of protecting profit.

Screw the "show me the log" option that scrolls by in a flash and you can't get back to, show me the damn diff first.

ethanrutherford• 3 months ago

Maybe you will read it carefully every single time (and to be clear, I doubt even that) but for the majority of users this will only lead to increasing the already excessive amount of decision-fatigue they deal with when interacting with software day to day. People already blindly click through sequences of confirmation boxes when they think they already know what they're doing. Odds are a million to one you've done that very thing before yourself. Adding even more friction is only going to make the average user spam the "next" button even more fervently.

hrvstr• 3 months ago

For *.pkg installers there is Suspicious Package at least.

https://www.mothersruin.com/software/SuspiciousPackage/

lemoncookiechip• 4 months ago

Adobe really relishes being a villain. I don't understand how one company can be so anti-consumer.

Ylpertnodi2• 4 months ago

Consumers keep buying adobe.

basilikum• 4 months ago

I'd like to answer the closing question

At what point does a commercial software suite become malware?

The vast majority of commercial software is malware.

drowntoge• 4 months ago

As much as I dislike what AI slop is doing to visual design, I wouldn’t mind seeing Adobe get hurt for being the comically terrible company it is.

Duanemclemore6• 4 months ago

I have been an Adobe user since 1996. Starting with Photoshop 3. Then, using the rest of their programs since 1999.

Between this and the fact that they've just 1. Changed all the old accounts to "Adobe Creative Cloud Pro" 2. DOUBLED the monthly fee, now charging you for the AI features whether you want them or not, and 3. Removed any tiers that have full program access but no AI, I am walking away forever when my current month expires.

Not to mention, students now only get the old $19.99 membership for the first year.

I teach visualization and representation tools to architecture students. I had always taught them Adobe products before. Now I can't in good faith sign them up to have their expertise tied to using this program stack forever. So tomorrow I am giving them a lecture on free to use and FOSS versions of the same tools. And I'm going to teach the class from them in perpetuity. Congratulations, Adobe that's 50+ students a year who won't be using your products when they graduate.

mishkatronic• 4 months ago

Is that not potentially detrimental to your students if the use of Adobe products is a more common industry practice?

eqvinox• 4 months ago

Probably different at huge companies, but small employers I know don't care how you get your work done. If anything they're happy if they don't have to buy/rent licenses for you.

…now that I think about it, don't architects predominantly work in smaller companies?

Duanemclemore6• 4 months ago

No, the concepts are the same. The button you push is incidental.

For example, the GNU Image Manipulation Program now has non-destructive workflows and adjustment layers - and can easily easily be configured with photoshop-like keybinds anyway.

That's not to mention free-to-use tools like Affinity.

The things an architecture student needs it for are:

Photo adjustment:

Lightroom -> Darktable

Photo retouching:

Photoshop -> Affinity Pixel or Gnu Image Manipulation Program

Vector drawing (which for us is mostly processing from 3d modeling programs):

Illustrator -> Affinity Vector or Inkscape

Board and Book Layout

InDesign -> Affinity Layout or Scribus or VivaDesigner

Plus, for motion graphics and video processing, my partner and I have had great luck replacing AfterEffects and Premiere with Blender and DaVinci Resolve, respectively.

And ... believe it or not, I've had excellent luck with LibreOffice Draw as a PDF editor, so anything they would have needed Acrobat Pro for is covered by that (and / or PDF SAM).

The real "sticky wicket" is Revit. Autodesk has been a FAR more abusive company for FAR longer, but it's what we're stuck with - although the emergence of the BIM Workbench (Building Information Modeling) with the release of FreeCAD 1.0 [0] and the continued development of BlenderBIM (oh, now called BonsaiBIM) [1] at least gives some hope.

Anyway, for the Adobe replacements, here's more [2] based on [3]

[0] https://wiki.freecad.org/BIM_Workbench

[1] https://bonsaibim.org/

[2] https://github.com/KenneyNL/Adobe-Alternatives?tab=readme-ov...

[3] https://x.com/XdanielArt/status/1799474607055102257/photo/1

raxxorraxor• 4 months ago

I think it is the opposite of detrimental and should have been best practice 10 years ago already. Same goes for software development, which I regard as a creative exercise as well. Today the software landscape is different and learning the common industry workflows is probably the least difficult part of any design curriculum.

Detrimental would be to subject students to the whims of Adobe, which doesn't really have that much moat any more.

Ylpertnodi2• 4 months ago

What alternatives do you suggest?

Duanemclemore6• 4 months ago

See my comment below, or here [0] and the same on github here [1].

[0] https://x.com/XdanielArt/status/1799474607055102257/photo/1

[1] https://github.com/KenneyNL/Adobe-Alternatives

knlam• 4 months ago

Yearly reminder that Adobe CC is malware. Open your Activity Monitor on your Mac and see how much craps CC run on your computer

taspeotis• 4 months ago

https://devblogs.microsoft.com/oldnewthing/20061101-03/?p=29...

throwawayqqq11• 4 months ago

Would it be possible (practical) to uniquely identify large numbers of users and even bypass anonymization efforts like tor and VPNs with this?

rkagerer• 4 months ago

I vote we all add that HOSTS entry to poison their despicably dark-pattern detection algorithm.

Adobe modifies hosts file to detect whether Creative Cloud is installed

Related Stories