How to check for software “improvement” reporting agents?

Question

It's an old problem. My computer is slowing down. One thing I'm wondering is how many programs are automatically reporting use statistics back to the manufacturer. I always say no when asked, but don't really trust everyone to be polite and civilized these days. There might also be reporting for other purposes. Is there any way that I can check the system for software that's automatically reporting to somewhere?

Answer 1

To check if programs are “phoning home” you’ll need to monitor and control your Internet activity, but there are a few ways you can do that. In order of least to most informative (and complexity):

• The simplest way to do this is to get a bandwidth monitor and simply watch your bandwidth. If you see spikes when you launch a program, then it may be accessing the Internet (of course you can only tell if you have no other programs using the Internet, so this won’t work if you are downloading things in the background).

  Figure 1: Hmm, something just used the Internet connection

  

• Monitor your Internet connections with a program like CurrPorts or TCPView. They will let you see the programs that have network connections open as well as the actual location they are connecting to.

  Figure 2: Hold on; did I install a web-server?

  

  Figure 3: Wait, yes, I did. Whew!

  

• Use a packet-sniffer to not only view the network connections, but also the data sent and received. There are plenty to choose from with differing levels of complexity and power (like Wireshark or Network Monitor), but I prefer SmartSniff because it is very easy to use and yet provides most of the power that most people need most of the time.

  Figure 4: Hey, I told AllDup to not check for updates! (Actually I didn’t, I manually performed an update for the purposes of the screenshot.)

  

• Use a firewall to control and log Internet access.

  • You can use a software (“personal”) firewall like the Windows firewall, ZoneAlarm, etc. These have the advantage of giving you fine-grained control over what happens. You can configure incoming and outgoing network access per-program, per-protocol, per-address, etc. as well as get detailed logs.

    Figure 5: Apparently nobody trusts a company whose main product is a cracking tool. Go figure. (Of course you will want to use a more up-to-date firewall than the one in this screenshot.)

    

  • You can use a hardware firewall like the kind that is built into most routers. They are usually more limited (though you may be able to use a third-party firmware like DD-WRT, OpenWRT, Tomato, etc. for more options and configurability). They also don’t usually give you good, permanent logs. However, hardware firewalls have three distinct advantages:

    • They are in a dedicated piece of hardware, so there is no performance impact on the system (security software often impacts a system’s performance).

    • They block data early, so incoming bad-nections will not even make it to the system to have to be dealt with, and outgoing connections should get a hard smack-down even if they leak from the system.

    • Because they come in a wide variety of configurations (countless models of routers with countless firmware and hardware revisions), it is generally unfeasible for anyone to bother crafting an exploit to use a vulnerability to bypass them (that’s not to say that someone couldn’t target you specifically if they know exactly what router you have, but that’s not usually a problem). With software firewalls on the other hand, they tend to come in a much smaller range of configurations which is why they are exploited often. (To be fair, software firewalls are easier to update and are done so much more frequently than router firmware which may be discontinued altogether, but again, that only matters if someone is specifically targeting you, in which case, get another router).

    Figure 6: Why does my fancy collector’s, tin-box edition of Prey need to connect to the Internet just to play single-player? Well not anymore! (Actually the last update removed the disc- and server-checks.)

    

Answer 2

Netstat, wireshark, snort IDS, router logs, etc.. Your computer's slowing down may actually be related to your hard disk usage, operating system bloat, gremlins, and ID-10-T errors.

Answer 3

If you're using Windows, the Task Manager and the Resource Monitor can be helpful in telling you what is clogging your CPU, memory, hard disk and network, other useful tools to look at are the Sysinternals tools.