Java Spyware

I was minding my own business when I noticed that the Java console had appeared in my Windows taskbar. I found that odd, since I hadn’t run any Java software recently. Opening the console, I find repeated references to RedSheriff.com followed by some HTML and the words "record sent."

That got my attention. I’m sending data to some company I’ve never heard of?

Apparently RedSheriff makes tracking software for companies. They knew that people and companies were able to easily defeat traditional tracking networks by disabling cookies, using proxies, and hiding behind NAT routers. So they decided to solve this problem by creating a small Java applet that runs in your browser on their client sites and sends data to RedSheriff’s servers.

The server logs are unable to pick up information relating to both PC and RAM cache and proxy servers. Server logs will also count all users behind a firewall as one user. All of the above mean that server log files fundamentally undercount site traffic.

RedSheriff Measurement avoids these difficulties by using a patented quantitative activity measurement technology, known as instrumentation, which allows activity to be measured from the browser.

Web servers aren’t able to accurately count traffic so RedSheriff is solving this problem by installing tracking software on consumer’s PCs without their knowledge or permission, effectively transfering the traffic counting burden from the server to the client.

So what are they tracking?

Exit and Entry Pages, Page Impressions, Path Analysis, Unique Visitors, Host Summary, Unique User Sessions, Browser and Operating System, Page Durations, Java/CGI Breakdown, Session Durations, Referring URL, Country of Access, Referring Domain, Reach, Period Page Impressions, Visitor Frequency, Internal and External Referring URL, Loyalty

Of course RedSheriff’s privacy policy assures you that they believe "providing the company with your personal information is an act of trust." They’re running tracking software on my machine to send personal information without my knowledge. That sounds trustworthy.

I’ve replaced their Java class file (measure.class) with a blank file and set it to read-only. I also changed my hosts file to redirect requests to their servers to a black hole and added a filter to the Proxomitron that neuters the applet.