An inside look at Apple's sneaky iTunes 8 upgrade

An inside look at Apple's sneaky iTunes 8 upgrade

Summary: I’m reading lots of complaints about the new iTunes 8 update causing horrific problems on Windows machines, including widespread reports of STOP errors, aka the Blue Screen of Death. So how can a supposedly simple software update cause a fatal crash? Maybe because this isn’t a simple software update. Once again, Apple is using its automatic update process to deliver multiple software packages, including a device driver that has a long and checkered history of causing the Blue Screen Of Death to appear. And it’s delivering this massive payload without even a pretense of proper disclosure and without asking consent from its users. I was able to reproduce a crash and put together a gallery that shows the whole sordid process.

SHARE:

Update, 12-September, 5:45AM PDT: Apple has issued a revised download for iTunes 8 intended to correct this problem. My analysis is in this follow-up post.

I’m reading lots of complaints about the new iTunes 8 update causing horrific problems on Windows machines, including widespread reports of STOP errors, aka the Blue Screen of Death. My colleague Adrian Kingsley-Hughes has asked readers for reports and Gizmodo has a sketchy post as well. How can this be happening? Assuming that the underlying hardware is working correctly, STOP errors can only be caused by kernel-level drivers or system services. A poorly written program can crash itself but not the entire system. So how can a supposedly simple software update cause a fatal crash?

Maybe because this isn’t a simple software update. Once again, Apple is using its automatic update process to deliver massive amounts of new software to users, including a device driver that has a long and checkered history of causing the Blue Screen Of Death to appear. And it’s delivering this massive payload without even a pretense of proper disclosure and without asking consent from its users.

I was able to reproduce a crash using an iPod and iTunes 8 and fixed it by removing the suspicious driver. I’ve dissected the process and put together a gallery that shows how extensive the infiltration is and where you can find the likely culprit.

To see what software is sneaking along with the upgrade, see my image gallery: Apple’s sneaky iTunes 8 install

AppleÂ’s sneaky iTunes 8 installHere’s a blow-by-blow analysis of what happens when you allow Apple Software Update to install iTunes 8:

The first thing you see is a notice from Apple Software Update. It promises an update to iTunes+QuickTime and says nothing about any other software.

itunes_small01.jpgNext, you accept a license agreement, which also makes no mention of anything other than iTunes. According to a code at the end of the license agreement, it has not been updated since October 2007.

After you enter your administrator’s credentials in a dialog box, the download and installation proceed automatically. The downloader dialog box notes that the complete install package is nearly 80MB in size, but the size shown in its progress bar changes several times.

itunes_small02.jpgOpening the folder where Apple Software Update stores its temporary files reveals what’s really going on. The download consists of five installer packages and a master setup program. In addition to iTunes and QuickTime, the package includes the Bonjour service (which has been a part of iTunes for a long time), plus Apple Mobile Device Support and MobileMe. The latter two packages appeared for the first time, according to Ars Technica and other sources, in the July update to iTunes. And a look inside Control Panel shows that this time around, Apple is giving Windows users an opportunity to uninstall MobileMe, which they didn’t do in the previous update.

When I used an antispyware tool (Sunbelt Software’s VIPRE), it detected that a new Apple program was loading at startup. Although it went by the prosaic name AppleSyncNotifier, its icon reveals that it’s actually MobileMe.

But in addition to all that software, Apple is also sneaking a couple of driver updates onto the system. One is a USB controller update, which is apparently used when connecting an iPod or iPhone to the system. On my system, this driver file was copied to the system but was not installed until I connected an iPod Mini via a USB port. Most of the trouble reports on the Apple forum indicate that this driver is identifying itself in the text that appears on the STOP error page. The only clue that this driver is being installed is in the System Restore dialog box.

In addition to this driver, the system also updates the GEARAspiWDM.sys driver (in Windows\System32\Drivers). I had to dig deep to discover this change, which is not documented anywhere. This driver is typically used with third-party programs that write to CD and DVD drives. The old iTunes versions of this driver is dated January 29, 2008. The new one is from April 17, 2008. This driver has a long and colorful history of causing Windows crashes. [Update 17-Sep: After looking deeper, I can confirm that Apple's driver is the culprit and that Gear's driver is unrelated to these crashes. In fact, Gear's signed driver might even be an innocent bystander in a separate iTunes support issue. See my follow-up post "Apple, not Gear, deserves the blame for iTunes crashes" for details.] I remember dealing with it back in Windows 2000 days. And sure enough, a search for GEARAspiWDM.sys BSOD turns up thousands of hits. I’ve also found anecdotal reports of this driver causing iTunes to crash, including this one from the Gear Software forum last May. The image below shows the Previous Versions dialog box, which I used to determine that the file had been updated.

itunes_small03.jpgWhen I plugged an iPod Nano into my Windows Vista system for the first time, it offered to install a driver and then asked me to reboot. When I restarted, I plugged in the iPod again and the machine locked up solid. No blue screen, just a black screen that didn’t respond to any input. After a restart, I tried again and got the same result when I attempted to open iTunes.

For the third try, I decided to replace the GEARAspiWDM.sys driver file with its earlier version. I used the Previous Versions feature of Windows Vista Ultimate to find the older version, copied it to my desktop, deleted the newer driver, and then copied the January version to the Drivers folder. This time iTunes opened just fine, displaying the contents of the iPod. (When I simply deleted the driver file, I got an error upon starting iTunes warning me that my installation was incomplete and that I might not be able to burn CDs or DVDs until I completed it.)

I can’t say my tests are conclusive, but my long history with this file suggests that it might well be at the root of the problem for others as well.

An even bigger problem is Apple’s attitude toward its Windows customers. These additional software packages and drivers are being installed with no disclosure and no consent. A pile of software, including the troubled MobileMe service, is also being installed and enabled at startup on Windows machines, even where the user has no MobileMe account and, for that matter, no mobile device.

Apple’s Get a Mac ads love to tweak Microsoft for its frequent crashes. Someone from Apple needs to look in the mirror and realize that they’re the problem in this case.

Topics: Windows, Apple, Hardware, Mobility, Operating Systems, Software

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

262 comments
Log in or register to join the discussion
  • But Ed did you Manage to get the Subliminal messages out of your mind.

    Ed,

    While, I agree that there is no reason for apple to install a long list of programs in your computer when you just want iTunes; it is common practice. Hell, everyone seems to be in bed with Google and their silly browser bar. No I do not want the google desktop installed when I am installing Java or any other program for that matter. And for that matter tell Microsoft that I don't want Silverlight or their download center either.

    However, I disagree on the point of drivers. In many chases they are neccesary. Has Apple been doing a poor QC job the last year or so, yes. Should they tell you every file that they are sending your way, only if they are not going to QC it first. Like I would want to say yes or no to the hundreds of files that the average program comes with these days. No one has that kind of time.

    In all I would tend to think that every software company is sneaky. But are they breaking your PC that is the question. I give you an A for finding the suspect driver and reporting it so we can avoid it, but a D for paranoia.
    tomam
    • The driver is not neccessary

      [b]However, I disagree on the point of drivers. In many chases they are neccesary.[/b]

      Not in this case they are not. Plenty of people use both Quicktime and iTunes that do not own an iPod or iPhone. There is no excuse for Apple, or anyone for that matter to install drivers on your system without your knowledge.

      Apple is proving it is as bad if not worse than companies like Gator in installing malware and other junk. I for one will [b]NEVER[/b] install Apple's crappy software again on my PC's.
      soonerproud
      • Did you miss the part

        about the driver only installing when you plug in your iPod/iPhone
        for the first time?
        frgough
        • The fact is

          I have installed iTunes many times and the Apple mobile device support is installed and present in the add remove programs under the control panel. I don't own an iPod or have never connected one to my PC's, yet Apple's crap for an iPod is installed on my PC. Before making your snide remarks, please do some more research first before criticizing someone's post.

          [b]Edit: I meant Apple Mobile Device Support, not Apple USB storage driver.[/b]
          soonerproud
          • Then why don't you just uninstall it through control panel

            At least you have that option.

            I agree with you Apple's iTunes is crap, but you're making the USB storage driver a mountain out of a molehill if you never use an iPod.

            Chill, dude...
            hasta la Vista, bah-bie
          • No such option

            The USB driver is not an individual option in the Programs Control Panel.
            Ed Bott
          • soonerproud just said there was

            [i]"the Apple USB storage driver is installed and present in the add remove programs under the control panel."[/i]
            hasta la Vista, bah-bie
          • Look at the picture

            I actually showed a picture of the Control Panel, so you tell me.
            Ed Bott
          • So you're saying he's wrong then (nt)

            ?
            hasta la Vista, bah-bie
          • @ b8375629@...

            I meant Apple Mobile Device Support. This is still a iPod/iPhone service that is unnecessary and is installed without consent on both iTunes and Quicktime. I deselected for Apple to install automatic updates, yet it is still there in the control panel along with Bonjour which I also never consented to be installed.
            soonerproud
      • Ditto....

        I turned off the Apple update for QuickTime. And now I am glad I did because I don't use Ipod or I whatever, just QuickTime. Don't need the I-whatever-flavor-of-the-month-crap upgrade bundle. I'll update it when I need it or want it.
        FranC.
        • If you only use Quicktime

          I'd get Quicktime alternative instead:
          http://www.free-codecs.com/download/quicktime_alternative.htm

          no need having a holy (as in Swiss cheese) piece of software like that on your PC if you can help it
          tikigawd
      • Well...

        Most people have zero idea what a device driver is. You can't go the route of asking permission to install a device driver without freaking out 85% of users. This would be a step back towards Linux in this regard - needing to know OS technical details of that sort.
        Techboy_z
        • Right

          So just let it break stuff instead. That's definitely the better route eh?
          Joeman57
        • "A step back towards Linux"?

          That's hilarious...

          :D
          hasta la Vista, bah-bie
      • You can install a service but not driver without the hardware being present

        the Windows API call installing a driver requires the hardware to be present for the driver to be installed.

        If Ed doesn't have an iPod connected, then there is no driver being installed. And in any case

        (1) how does this get into kernel mode. Vista isn't supposed to allow kernel mode drivers is it? Otherwise what on earth was the point of it all.

        (2) These drivers are WHQL certified. I guess this means they don't bother testing anything, and just get their $$$ and party it up as many have expected over the years.
        stevey_d
        • Once again, Stevey, you don't know what you're talking about

          The GEARAspiWDM.sys driver is a file-system filter driver. It is a kernel-level driver that works with the CD/DVD drive and the file system. Go look it up. I explained it here: http://content.zdnet.com/2346-12354_22-220803-12.html.)

          And then go read the part where I talked about plugging in an iPod and locking up my system as a driver installed.

          And again, who told you these drivers are WHQL-certified? And who told you Vista banned kernel mode drivers? You do realize you are now just making stuff up?
          Ed Bott
          • OK Ed, give me a link to the $240 driver signing site

            You told me before you'd "given me the link already" not that I could see. Point me to the place in microsoft.com where I get my driver WHQL certified for $240 (or signed or whatever).

            So you're effectively saying that vista isn't as secure as Windows NT 3.51 since kernel level drivers CAN be installed. (even on vista x64).
            stevey_d
          • Already did that

            I did that the last time we had this stupid discussion, Stevey. Pay attention.

            You posted exactly the same challenge on July 17 as part of the same discussion. I posted two links for you that explain the WHQL program and its costs in detail. If you had actually read these links, you would know that nothing you have posted today is true.

            I know you follow these things up, almost obsessively, it seems. But you never seem to remember the answers to the questions you ask. That sure is curious.

            Oh, and I was wrong. It's $250. Sorry.
            Ed Bott
          • OK please please post it again now.

            Seriously, I'd like you to post the link, and I'll never mention it again.
            I've tried going around and around hundreds of pages at microsoft.com.
            stevey_d