Executable Archaeology: The Case Of The Stupid Thing Eating All My RAM

http://www.veracode.com/blog/2013/05/executable-archaeology-the-case-of-the-stupid-thing-eating-all-my-ram/

by gluxon • 13 years ago

242 40 13 years ago

IvyMike• 13 years ago

I would like to see the bug report. "BUG12345: Shaking my computer results in a loss of available memory".

kens• 13 years ago

That reminds me of the famous Sun Microsystems discovery that shouting at hard drives increases their latency (for real): http://www.youtube.com/watch?v=tDacjrSCeq4

sneak• 13 years ago

I like your username.

0x0• 13 years ago

I find it incredible that Microsoft would allow OEMs to preload software like this. The end user experience and impression of Windows 8 takes a brutal hit.

snprbob86• 13 years ago

What you already know, but need to be reminded, is that there is not one, uniform "Microsoft", who has the power to allow or disallow something. Even in the highest levels of the corporate hierarchy, it takes a great deal of effort to influence the direction of the ship (never mind intentional steering). In the case of OEM shovelware, there were quite a few people who worked very hard to get rid of it. However, Dell alone has substantial influence over this decision through their sheer volume of sales of Windows. When you consider existing contracts, OEM motivations, and internal politics, it's no longer that incredible that this preloaded nonsense persists. What's incredible is that the concerted effort to regain control of the ship doesn't seem to be having much effect.

pvnick• 13 years ago

Time for a new captain.

bediger4000• 13 years ago

Agreed, there's no uniform "Microsoft" that controls anything. They're blameless in this.

Now, on to more interesting topics. Why should I, as a consumer, care about that? I see "Windows 8" in a commercial, it looks like there's a "Microsoft", but then I do my diligence, and I find out about weird rubbish as described in the article. It makes all the different, patchwork quilt of Microsoft's look really bad, even if "Spacer" did it. It looks to me, a consumer, as if there's a (possibly inadvertent) effort to shaft people. Maybe all those rumors about Windows slowing down when a new version is released are true. After all, a shaken tablet uses up memory, apparently without bound, which will cause problems eventually.

Why are you asking for some or all of the Microsofts to be given a break? That's really anti-free market.

NolF• 13 years ago

The anti-trust rulings in the 90s prevents Microsoft from restricting OEMs on the crapware they install on computers.

marshray• 13 years ago

It's hard to imagine another policy without making it excessively difficult for vendors to add new features. For example, a button on a laptop that changes Wifi configuration might need a similar driver program.

Hardware vendors are generally expected supply their own drivers for all but the most common built-in devices. This can include user-mode applications. The driver certification process has greatly improved the quality of 3rd party kernel drivers. In my experience BSODs are really rare these days.

But obviously there can still be quality-of-implementation issues. This sounds like a question of "is this really a good use of RAM from the users' cost/benefit perspective?"

Disclosure: I'm new at Microsoft but my role has basically nothing to do with this stuff. Just my personal opinion as a long time developer and industry-watcher.

Fizzer• 13 years ago

Microsoft does work at eliminating this kind of thing. They clearly just missed this one.

Microsoft's main source of control over OEMs is the logo program. All laptops that want to get the "Designed for Windows" sticker (logo) have to pass a minimum bar set by Microsoft, which includes things like "must boot within X seconds" or "must sleep within Y seconds", "must output the correct audio frequencies", etc. My guess is none of the logo tests invoke the accelerometer which is why this got missed.

The logo program is great in theory, but in practice it doesn't work too well since consumers don't care about the sticker. Therefore, if Microsoft makes the requirements too high, OEMs will simply stop trying and just sell their laptops without a sticker.

Cthulhu_2• 13 years ago

I can imagine the logo problem / Microsoft's Seal of Approval also comes with a discount for OEM licenses.

Someone• 13 years ago

I care about that sticker; I don't like it. Especially with laptops, those stickers (you may get a 'Intel inside' one, too) look ugly. Removal also typically is hard, as the stickers are designed to look good for years.

B the way, I remember reading somewhere that Dell at a time compared the benefits of being in such a program with the cost of applying such a sticker, and found it wasn't worthwhile to take part in that sticker program. Anybody know whether that is true?

lifeisstillgood• 13 years ago

Oh trust me, the end user of experience of Windows 8 is not something that can be significantly more damaged by OEMs

joseph_cooney2• 13 years ago

Interesting article. There are better ways of looking at memory allocations in .NET code, however, including CLR allocation profiler, WinDBG, VMMap, and tools from Telerik, Jetbrains, ANTS etc that take away a lot of the guess work. Still, kudos to the author for not doing an immediate re-pave.

abadidea2• 13 years ago

Author here! I work in/study static analysis, so "running the program" would be entirely defeating the fun ;)

joseph_cooney2• 13 years ago

Right! Your comment re: special tools in the article now makes more sense.

ErikRogneby• 13 years ago

Thank you. This was a fun read.

csallen• 13 years ago

Why protect the guilty "Spacer"?

abadidea2• 13 years ago

[author here] I'm not supposed to directly call out corporations for mistakes in public because then their feelings will be hurt and they won't be a customer in the future ;)

I was kind of expecting someone to tell me "Spacer" was too obvious and to obfuscate it some more, but they let it slide - probably because this is not a security flaw like I'd usually be dropping, just a general oopsie.

DanBC• 13 years ago

Do userland utilities like this have the potential for big scary security holes? Or is Windows 7 / 8 better than that now?

emiliobumachar• 13 years ago

I second that question. Naming and shaming seems a perfectly appropriate way to discourage every vendor from similar future actions.

EDIT: I posted before I saw the author's reply to the same parent. The answer seems quite reasonable.

randallu• 13 years ago

Spacer, spacer, rhymes with... dell?

Stratoscope• 13 years ago

Perhaps it rhymes with another company if you take off the first couple of letters.

(Please forgive me if you knew that and you were just being humorous. In that case, consider me thoroughly whooshed!)

georgemcbay• 13 years ago

The "protection" is token, at best.

Google "MEMS enhancement utility", read headline on first hit... Ah, yes, of course.

ramayac• 13 years ago

Third link, using DuckDuckGo here :)

smaili• 13 years ago

If I were you I would be thankful that there were memory issues, otherwise you wouldn't even have discovered this malware! :)

ars• 13 years ago

It's not malware - it's nothing ware. It does nothing at all except use memory. If there were no memory issue then it really wouldn't do anything.

Like this machine: http://mentalfloss.com/article/24670/machine-turns-itself

caf• 13 years ago

Kind of like an electronic benign tumour.

tempestn• 13 years ago

Thanks, now I'm sorely tempted to drop $60 on a machine that does nothing.

fletchowns• 13 years ago

Very neat discovery and great write-up about it! Were you able to get in touch with somebody at "Spacer" to let them know about the mistake? If so, are they going to correct it?

gluxon• 13 years ago

To the author: Saw this on comex's Twitter and got a good kick out of it. My first surprise was that HN didn't already have this submitted. My second was it reaching first page in 3 hours.

dools• 13 years ago

A perfect example of why you should never use foul language in your code - even if it's not meant for production ;)

Cthulhu_2• 13 years ago

Not even a humorous remark to possible reverse engineers, such as // fucking memory leak, cba to fix?

mark-r• 13 years ago

I work with a guy who left some scathing comments in the code about the incompetence of the vendor he was forced to work with. Interesting times ensued when our company was bought by theirs and they started looking through the source.

primitur• 13 years ago

Am I the only one who thinks this is obviously a ploy to sell more RAM to the angry users!?!@?

Executable Archaeology: The Case Of The Stupid Thing Eating All My RAM

Related Stories