It looks like the con-artists behind Safabyte, ComponentForge decided that putting a new API on top of code stolen from Rebex (did than last time with XtraComponents) was not such a great idea after all. Instead, they decided to start over again with a new brand. In February, they launched a new website at CodeUltimate.com, but less than two months later, they finally settled on calling themselves ComponentSoft.net. They even got a brand-new website design this time. But the very stealthiness and secrecy they engage in is what revealed them again.
Let's look closer:
- Their domain name was registered anonymously. This alone made them suspicious. Why would a reputable company do this? Unsurprisingly, he changed this to a fake name after reading this blogpost. Luckily, you can still check out componentsoft.net domain history in DomainTools - the entries in red were "privacy protected" (anonymous) registrations.
- API of many of their components look just like Rebex API with renamed classes. Some parts were added, changed or removed, but the core functionality is the same. There are even some identical bugs!
- They never reveal their real company name and address. When pressed through their transaction provider, they implicitly confirmed that they are not a US-registered company, yet fail to mention this on their website. Instead, they still present themselves as "ComponentSoft, a division of ATP, Inc., located in Walnut, California" while in fact they appear to be a division of "ATP Technology, JSC located in Hanoi, Vietnam".
- Once again, they claim that "ATP, Inc. is a Microsoft Certified Partner", which is very unlikely because this "ATP, Inc." doesn't even seem to exist.
- Their install package contains two sets of DLLs. One set infringes on Rebex IP, other set infringes on other people's IP. The installer decides which one to install. This doesn't look like something a reputable company would do, ever. He will undoubtedly get rid of the fake DLLs now, but his customers victims who have downloaded the package prior to publishing this blogpost can still verify this (contact us for details).
- Many of their forum posts are from 2009. This is very suspicious, because the domain name was only registered in March (and the previous domain in January). In fact, these forum posts were simply recycled from the forums of their previous incarnations - unsurprisingly, they treat their customers' support request and nicknames just like other people's code. Their ComponentSoft News also extend back to 2009. No mention of any name change. But we understand - changing their name is no longer a news for them.
- The testimonials at their website never mention anyone who could be contacted to verify them. In fact, many of these testimonials look copy&pasted from other companies' websites.
- They pretend that completely unrelated website (with .eu instead of .net in the domain name)
Still not convinced? Then just use .NET Reflector to compare the assemblies. The code in the first picture was written by Rebex. It is a part of SshSession.SendPacket method. An identical code can be found in ComponentSoft's UltimateSftp.dll assembly (the second picture):
The scammer will undoubtedly modify the stolen version of SshSession.SendPacket as soon as he becomes aware of this post, but it doesn't really matter. Most of the code in a majority of his components comes from Rebex, so we can simply find another example. Just let us know if you need additional information to do your own analysis.