Strange 3DxPieMenus.exe Internet connection behavior

Questions and answers about 3Dconnexion devices on Windows.

Moderator: Moderators

luping
Posts: 45
Joined: Wed Mar 20, 2019 5:54 pm

Strange 3DxPieMenus.exe Internet connection behavior

Post by luping » Wed Mar 20, 2019 6:22 pm

Hi, I'm a SpaceNavigator user in East China. I recently installed the latest 3DxWare 10 for Windows (64-bit) version 10.5.13. I noticed that every time I start my computer I always get the alert from my huorong firewall software as you can see from the attached screenshots that the 3DxPieMenus.exe process is trying to connect to two IP addresses:
23.59.139.27
117.18.237.29

I already unchecked the Automatically check for updates option the first time I installed the 3DxWare version 10.5.13.

Any reasonable explanation?
Attachments
2019-03-21_08h57_40.png
2019-03-21_08h57_40.png (33.68 KiB) Viewed 12631 times
2019-03-21_08h57_10.png
2019-03-21_08h57_10.png (33.07 KiB) Viewed 12631 times
2019-03-21_08h51_21.png
2019-03-21_08h51_21.png (171.28 KiB) Viewed 12631 times

luping
Posts: 45
Joined: Wed Mar 20, 2019 5:54 pm

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by luping » Mon Mar 25, 2019 5:03 am

Seemed like it's for telemetry purpose. I just blocked all the outgoing traffic by 3DxWare for privacy protection.

ngomes
Moderator
Moderator
Posts: 1934
Joined: Mon Nov 27, 2006 7:22 am
Contact:

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by ngomes » Mon Mar 25, 2019 7:56 am

HI luping,

Thank for you for reaching us about this matter.

Firstly, 3Dconnexion takes costumer privacy very seriously and what you have reported above is quite worrying. The suggestion is that your machine has been compromised somehow.

Secondly, we expect only the process 3DxService.exe to access a web page (over TCP) to retrieve the version information for the most recent software. If during the installation, the user has disabled the version check, then we expect no software from 3Dconnexion to attempt a remote connection.

You will notice the driver executable files (including "3DxService.exe" and 3DxPieMenus.exe") have a digital signature and timestamp applied with a certificate generated by a reputable certification authority. Version 10.5.13 used the certificate with thumbprint 20cb308df22167e461944f940f5965e855184185.

Also for version 10.5.13, the SHA-1 hashes of 3DxService.exe and 3DxPieMenus.exe are as follows:
b21380c99e2e5e50c294192c0c10825448f9dec2 3dxservice.exe
1feb00a42a0f5109e9acc919f20bec28b2ec67f1 3dxpiemenus.exe

If your system has been compromised, then I do not know how you can revert to a safe state. Any checks that you run may themselves be targeted by the compromised system but if the files in your machine do not match the above, then it's definitely not the software as distributed by 3Dconnexion.

Finally, the above information is verifiable by any costumer with an installation of version 10.5.13 of 3DxWare 10 for Windows (the latest as we write this).

luping
Posts: 45
Joined: Wed Mar 20, 2019 5:54 pm

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by luping » Mon Mar 25, 2019 5:26 pm

ngomes wrote:
Mon Mar 25, 2019 7:56 am
HI luping,

Thank for you for reaching us about this matter.

Firstly, 3Dconnexion takes costumer privacy very seriously and what you have reported above is quite worrying. The suggestion is that your machine has been compromised somehow.

Secondly, we expect only the process 3DxService.exe to access a web page (over TCP) to retrieve the version information for the most recent software. If during the installation, the user has disabled the version check, then we expect no software from 3Dconnexion to attempt a remote connection.

You will notice the driver executable files (including "3DxService.exe" and 3DxPieMenus.exe") have a digital signature and timestamp applied with a certificate generated by a reputable certification authority. Version 10.5.13 used the certificate with thumbprint 20cb308df22167e461944f940f5965e855184185.

Also for version 10.5.13, the SHA-1 hashes of 3DxService.exe and 3DxPieMenus.exe are as follows:
b21380c99e2e5e50c294192c0c10825448f9dec2 3dxservice.exe
1feb00a42a0f5109e9acc919f20bec28b2ec67f1 3dxpiemenus.exe

If your system has been compromised, then I do not know how you can revert to a safe state. Any checks that you run may themselves be targeted by the compromised system but if the files in your machine do not match the above, then it's definitely not the software as distributed by 3Dconnexion.

Finally, the above information is verifiable by any costumer with an installation of version 10.5.13 of 3DxWare 10 for Windows (the latest as we write this).
Hello, ngomes, thank you for your reply! At least someone as the forum moderator replied me.
To your response, I checked the SHA-1 hash results, and here are the screenshots taken from my computer, they are the same SHA-1 hashes. And the Thumbprint is the same too. My computer is protected with standalone firewall software and antivirus software with all the latest updates.
Attachments
2019-03-26_08h20_04.png
2019-03-26_08h20_04.png (159.75 KiB) Viewed 12559 times
2019-03-26_08h17_40.png
2019-03-26_08h17_40.png (95.52 KiB) Viewed 12559 times
2019-03-26_08h16_22.png
2019-03-26_08h16_22.png (94.92 KiB) Viewed 12559 times

luping
Posts: 45
Joined: Wed Mar 20, 2019 5:54 pm

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by luping » Mon Mar 25, 2019 6:04 pm

Last night, 3DxPieMenus.exe tried to connect to these IP addresses again:
23.59.139.27
117.18.237.29

It all seems that 3Dconnexion uses 3DxPieMenus.exe and these IP addresses to track and monitor end users' 3DxWare usage and deployment activities, these activities are not covered so far in any provision of the 3DCONNEXION SOFTWARE LICENSE AGREEMENT explicitly stated.

If 3Dconnexion S.A.M. wants to track 3Dconnexion hardware and software end users' activities globally in the hope of software improvement and enhancement, please add extra privacy provision to your 3DCONNEXION SOFTWARE LICENSE AGREEMENT(Revision: 12331A), and give end users(as customers of the hardware) a clear choice not to participate into such scheme. I love to use 3Dconnexion hardware and plan to buy new one(s) if such customer concern get addressed properly.
Attachments
2019-03-26_08h39_16.png
2019-03-26_08h39_16.png (30.25 KiB) Viewed 12556 times
2019-03-26_08h36_36.png
2019-03-26_08h36_36.png (83.47 KiB) Viewed 12556 times
2019-03-26_08h36_06.png
2019-03-26_08h36_06.png (59.31 KiB) Viewed 12556 times

ngomes
Moderator
Moderator
Posts: 1934
Joined: Mon Nov 27, 2006 7:22 am
Contact:

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by ngomes » Tue Mar 26, 2019 12:54 am

Lupin,

Regrettably, you are insisting that 3Dconnexion is using the driver software to track our costumers and somehow violate their privacy. This could not be further from the truth.

As I mentioned above, we are very serious about our costumer's privacy.

My only explanation for what you are observing is that you have a compromised system, be it by a rogue software or simply by using inadequate monitoring tools.

Your report is isolated. We have costumers deploying our software in very information sensitive machines and we have not had a single instance of a problem such as reported by you.

luping
Posts: 45
Joined: Wed Mar 20, 2019 5:54 pm

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by luping » Tue Mar 26, 2019 4:07 am

Maybe that's a bit far from what I expected from your response. To be honest, I love to use my 3Dconnexion device on my computer.
As for privacy, I think there's nothing wrong about usage information telemetry and/or collection, as long as the data is being collected to improve the overall experience of 3DxWare. Take Microsoft for example, Windows 10 Pro comes with build-in telemetry. And look at Mozilla, Firefox comes with data collection and displays options for end users to decide. All are very transparent for end users to control and configure.
Attachments
2019-03-26_19h01_01.png
2019-03-26_19h01_01.png (97.71 KiB) Viewed 12544 times
2019-03-26_18h55_42.png
2019-03-26_18h55_42.png (74.05 KiB) Viewed 12544 times
2019-03-26_18h54_44.png
2019-03-26_18h54_44.png (30.38 KiB) Viewed 12544 times

ngomes
Moderator
Moderator
Posts: 1934
Joined: Mon Nov 27, 2006 7:22 am
Contact:

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by ngomes » Tue Mar 26, 2019 6:43 am

Hi Luping,
luping wrote:
Tue Mar 26, 2019 4:07 am
Maybe that's a bit far from what I expected from your response. To be honest, I love to use my 3Dconnexion device on my computer.
As for privacy, I think there's nothing wrong about usage information telemetry and/or collection, as long as the data is being collected to improve the overall experience of 3DxWare.
What I'm trying to get across is that we do not have telemetry in our software. The only remote access we have is the "version check" which the user can enable or disable during installation. As of version 10.5.13 and early, this check is done by the user-mode driver (3DxService.exe), not by 3DxPieMenus.exe (which is a component to render the "radial menus" feature).

Our software does not send telemetry. We don't do this.

luping
Posts: 45
Joined: Wed Mar 20, 2019 5:54 pm

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by luping » Tue Mar 26, 2019 7:04 am

ngomes wrote:
Tue Mar 26, 2019 6:43 am
Hi Luping,
luping wrote:
Tue Mar 26, 2019 4:07 am
Maybe that's a bit far from what I expected from your response. To be honest, I love to use my 3Dconnexion device on my computer.
As for privacy, I think there's nothing wrong about usage information telemetry and/or collection, as long as the data is being collected to improve the overall experience of 3DxWare.
What I'm trying to get across is that we do not have telemetry in our software. The only remote access we have is the "version check" which the user can enable or disable during installation. As of version 10.5.13 and early, this check is done by the user-mode driver (3DxService.exe), not by 3DxPieMenus.exe (which is a component to render the "radial menus" feature).

Our software does not send telemetry. We don't do this.
Thank you for your timely clarification. I trust what you told me. : )

ngomes
Moderator
Moderator
Posts: 1934
Joined: Mon Nov 27, 2006 7:22 am
Contact:

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by ngomes » Tue Mar 26, 2019 7:44 am

luping wrote:
Tue Mar 26, 2019 7:04 am
Thank you for your timely clarification. I trust what you told me. : )
It's us, 3Dconnexion, that owe you a thank you, Luping. We very much appreciate you taking the time to bring what may be a very serious issue to our attention.

Unfortunately, we cannot explain why the firewall tool is reporting 3DxPieMenus.exe attempts to send data to a remote location. We did not coded our software that way and neither do we have some other driver software that will send telemetry.

luping
Posts: 45
Joined: Wed Mar 20, 2019 5:54 pm

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by luping » Tue Mar 26, 2019 8:03 am

ngomes wrote:
Tue Mar 26, 2019 7:44 am
luping wrote:
Tue Mar 26, 2019 7:04 am
Thank you for your timely clarification. I trust what you told me. : )
It's us, 3Dconnexion, that owe you a thank you, Luping. We very much appreciate you taking the time to bring what may be a very serious issue to our attention.

Unfortunately, we cannot explain why the firewall tool is reporting 3DxPieMenus.exe is attempting to send data to a remote location. We did not coded our software that way and neither do we have some other driver software that will send telemetry.

Buy and register a new SpaceMouse® Pro Wireless before June 11th 2019 and get a CadMouse Wireless with Pad for free*.

This offer is valid from March 11, 2019 to June 11, 2019 in the following countries: Austria, Belgium, Bulgaria, Croatia, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Monaco, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, United Kingdom and the United States of America.

https://www.3dconnexion.eu/spacemouse_p ... motion/eu/


Could this promotion be extended to mainland China too?

ngomes
Moderator
Moderator
Posts: 1934
Joined: Mon Nov 27, 2006 7:22 am
Contact:

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by ngomes » Tue Mar 26, 2019 8:13 am

luping wrote:
Tue Mar 26, 2019 8:03 am
Could this promotion be extended to mainland China too?
I'm sorry, Luping. I'm in Engineering and I do not have information on sales promotion. It seems to be for Europe only, though.

You may want to reach out to my colleagues in your region. Please see here.

luping
Posts: 45
Joined: Wed Mar 20, 2019 5:54 pm

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by luping » Tue Mar 26, 2019 8:01 pm

ngomes wrote:
Tue Mar 26, 2019 8:13 am
luping wrote:
Tue Mar 26, 2019 8:03 am
Could this promotion be extended to mainland China too?
I'm sorry, Luping. I'm in Engineering and I do not have information on sales promotion. It seems to be for Europe only, though.

You may want to reach out to my colleagues in your region. Please see here.
I did before, but issac han stoped short of giving any detail, and just replied via Tencent QQ chat group that it's a new product. I see only packaging changes when compared to old model number, with a carry case. It's unfair for customers in mainland China to bear extra cost buying 3Dconnexion devices.

ngomes
Moderator
Moderator
Posts: 1934
Joined: Mon Nov 27, 2006 7:22 am
Contact:

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by ngomes » Fri Apr 05, 2019 6:46 am

With today's release of v. 10.5.14 of 3DxWare 10 for Windows, we are now using a new digital certificate (thumbprint "ec31f11b08e8da3a6be68d2bb7dd8723eef3373d"). Unchanged software (build before April 2019) will still be shown signed by the older certificate which expired on March 13, 2019.

luping
Posts: 45
Joined: Wed Mar 20, 2019 5:54 pm

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by luping » Fri Apr 05, 2019 8:53 am

ngomes wrote:
Fri Apr 05, 2019 6:46 am
With today's release of v. 10.5.14 of 3DxWare 10 for Windows, we are now using a new digital certificate (thumbprint "ec31f11b08e8da3a6be68d2bb7dd8723eef3373d"). Unchanged software (build before April 2019) will still be shown signed by the older certificate which expired on March 13, 2019.
And SHA-1 hash result is "a5406727dd66dab49034a1dea5e1c30899d2ff4c".
Attachments
2019-04-05_23h51_28.png
2019-04-05_23h51_28.png (48.29 KiB) Viewed 10485 times

Post Reply