Thang Dang Minh: Good student turned fraudster

Today, we would finally like to introduce the guy who is behind the Safabyte, ComponentForge, XtraComponents and ComponentSoft.net scam. His name is Đặng Minh Thắng, although he usually simplifies this to Thang Dang Ming or Thang Dang. Sometimes he calls himself Thang Minh, Hoang Minh or Jimmy Dang. He was born on June 9th, 1980, which means he just turned 30 today! Until recently, he might have lived or worked at 107 Phố Đức Giang in Long Biên district of Hanoi, the capital of Vietnam.

After finishing his studies at Hanoi - Amsterdam High School, a prestigious Vietnamese high school, he studied information technology at Hanoi University of Technology. In 2003, his team won the first prize at his university's Students Scientific Conference for an emedded system that controls car engines. After finishing his studies, he went on to work for various software companies located in Vietnam and abroad (such as FPT Software, one of the Vietnamese largest software companies).

At this point, Thang Dang was on his way to become a well-known and respected professional. Instead, he turned to the dark side of copyright infringement. In 2007, he launched his grand project: Safabyte, the fraudulent .NET component vendor - selling software based on code stolen from long-standing .NET component vendors such as Rebex, ComponentSpace, ComponentAce or LanapSoft. After changing his brand name and payment processor many times (once every few months recently), he still continues with this practice until this day under XtraComponents and ComponentSoft.net brands.

(You can find a photo of this Thang Dang here or here.)

We have been informed that he currently lives in the United States, possibly studying for an MBA at WKU and residing at the campus (College Heights Blvd 1806, Suite 201). This opens a wide range of opportunities! Perhaps studying law might have been a better choice for him after all? :-)

ComponentSoft.net - the scammer changed his brand. Again!

It looks like the con-artists behind Safabyte, ComponentForge decided that putting a new API on top of code stolen from Rebex (did than last time with XtraComponents) was not such a great idea after all. Instead, they decided to start over again with a new brand. In February, they launched a new website at CodeUltimate.com, but less than two months later, they finally settled on calling themselves ComponentSoft.net. They even got a brand-new website design this time. But the very stealthiness and secrecy they engage in is what revealed them again.

Let's look closer:

  • Their domain name was registered anonymously. This alone made them suspicious. Why would a reputable company do this? Unsurprisingly, he changed this to a fake name after reading this blogpost. Luckily, you can still check out componentsoft.net domain history in DomainTools - the entries in red were "privacy protected" (anonymous) registrations.
  • API of many of their components look just like Rebex API with renamed classes. Some parts were added, changed or removed, but the core functionality is the same. There are even some identical bugs!
  • They never reveal their real company name and address. When pressed through their transaction provider, they implicitly confirmed that they are not a US-registered company, yet fail to mention this on their website. Instead, they still present themselves as "ComponentSoft, a division of ATP, Inc., located in Walnut, California" while in fact they appear to be a division of "ATP Technology, JSC located in Hanoi, Vietnam".
  • Once again, they claim that "ATP, Inc. is a Microsoft Certified Partner", which is very unlikely because this "ATP, Inc." doesn't even seem to exist.
  • Their install package contains two sets of DLLs. One set infringes on Rebex IP, other set infringes on other people's IP. The installer decides which one to install. This doesn't look like something a reputable company would do, ever. He will undoubtedly get rid of the fake DLLs now, but his customers victims who have downloaded the package prior to publishing this blogpost can still verify this (contact us for details).
  • Many of their forum posts are from 2009. This is very suspicious, because the domain name was only registered in March (and the previous domain in January). In fact, these forum posts were simply recycled from the forums of their previous incarnations - unsurprisingly, they treat their customers' support request and nicknames just like other people's code. Their ComponentSoft News also extend back to 2009. No mention of any name change. But we understand - changing their name is no longer a news for them.
  • The testimonials at their website never mention anyone who could be contacted to verify them. In fact, many of these testimonials look copy&pasted from other companies' websites.
  • They pretend that completely unrelated website (with .eu instead of .net in the domain name)

Still not convinced? Then just use .NET Reflector to compare the assemblies. The code in the first picture was written by Rebex. It is a part of SshSession.SendPacket method. An identical code can be found in ComponentSoft's UltimateSftp.dll assembly (the second picture):

The scammer will undoubtedly modify the stolen version of SshSession.SendPacket as soon as he becomes aware of this post, but it doesn't really matter. Most of the code in a majority of his components comes from Rebex, so we can simply find another example. Just let us know if you need additional information to do your own analysis.

Kill switch found in ComponentForge/Safabyte components

Summary

We just learned that some versions of ComponentForge and Safabyte products include a "kill-switch" or "call-home"-code that occasionally calls a webservice at the vendor's website. This can be both security and reliability threat. Full version of NetXtremeFtp Suite was reported to contain this functionality. We are not sure yet whether their other components or XtraComponents products also suffer from this issue. Needless to say, there is no mention of this anywhere at the vendor's website or in their "privacy policy". But what else to expect from a fraudulent business entity that doesn't even tell you their address or owner name...

Symptoms

 

When using the purchased "full version" of NetXtremeFtp Suite sold under ComponentForge and Safabyte brands, you may experience the following SfbLicenseException error when ComponentForge or Safabyte websites are not operational:

{"The license key is invalid or has been deactivated. Please contact ComponentForge Sales Team at sales@componentforge.net."}

This exception is raised from a background thread that is started when the FtpClient object's constructor is called.

Complete stack trace:

at Cforge.Licensing.Ftp.SfbLicenseManager.ValidateLicenseThreadStart()
at System.Threading.ThreadHelper.ThreadStart_Context(Object state)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state)
at System.Threading.ThreadHelper.ThreadStart()


Analysis

 

NetXtreme component is trying to validate a license key at runtime by calling a webservice located at ComponentForge or SafaByte websites. The address of this webservice is http://www.componentforge.net/license.aspx?val=key or http://www.safabyte.com/license.aspx?val=key, where "key" is the "license key" you get when you purchase a "license" to these stolen components. The webservice returns a single byte: 1 if the key is valid and 0 if it isn't. This test is not done every time and it only occurs on 3rd, 6th, 9th, 12th, ... day of every month.

Validating license keys by calling a webservice at the vendor's website is a very bad practice because it makes the component completely unusable:
  • when disconnected from the Internet
  • when it runs behind a paranoid firewall
  • when the vendor's website is being rebooted, in maintenance or just inaccessible
  • when Safabyte/ComponentForge goes out of business (which can happen overnight)

On December 3rd, 2009, some versions of NetXtreme FTP Suite stopped working when both ComponentForge and SafaByte websites were down temporarily. This behavior was only observed in the purchased copies of the components.

It is quite amusing that a Vietnamese software pirate is so concerned about other people pirating his software that he has chosen to offer this crippled version as the "full version" of his product.

Kill switch

This "feature" makes it possible for the vendor to:

  • render any "full version" of the software useless by disabling its license key in their database
  • cause a forced upgrade without the customers agreement (by switching off old license keys)
Even well-known companies have been criticized for including kill switches in their products. Because ComponentForge/Safabyte/XtraComponents “company” is actually a scam, this is yet another reason to stop using their products immediately. Essentially, all their clients are at the mercy of a software pirate.

Possible security threat?

It is always worrying when a component connects to a webservice at the vendor’s website, and even more so if it was made by a fraudulent entity. For example, it would be extremely easy to "enhance" this to steal their client's passwords as well. Although this doesn't seem to be the case at the moment, the infrastructure is there.

Also, calling a webservice at the vendor's website means that he knows IP addresses of all his clients, which in itself can be a security thread.

Solution

Considering that all Safabyte/ComponentForge/XtraComponents products mentioned in this article are illegally based on source code owned by Rebex and other vendors, all customers are advised to cease using them and to replace them with legitimate products by reputable companies, preferrably those that don't call any questinable webservices behind their back.

Credits 

Big thanks goes to Max, former ComponentForge/Safabyte client, for bringing this issue to our attention!

 

More evidence - Rebex and ComponentForge blog similarities part II

Another example of copy&pasted blogpost:

·         Compare HOWTO: Using FTP or SFTP in PowerShell (Rebex) and Using your NetXtremeFtp or NetXtremeSshFtp in Windows PowerShell (ComponentForge/SafaByte)

·         Post structure: Rebex

o   Step 1 - Loading FTP or SFTP assembly

o   Step 2 - Connecting, logging in, uploading, downloading and deleting files

·         Post structure: ComponetForge

o   Step 1 - Loading an assembly (NetXtremeFtp.dll or NetXtremeSshFtp.dll)

o   Step 2 - Connecting, logging in to an FTP or SFTP server, making directory, uploading, downloading, deleting file and removing directory

·         Almost identical sample code.

·         Check screenshots for details (blog.componentforge.net will most likely disappear soon).

 

More evidence - Rebex and ComponentForge blog similarities

Have you already seen the evidence of the Safabyte scam? That was just the beginning. We have much more to show you!

 

ComponentForge’s (aka Safabyte) company blog has some very interesting posts. It looks very familiar to me. Especially the posts which were written by a Rebex employee and published on blog.rebex.net.  Safabyte just shortened, reworded and republished them on their website.

 

Would you like to see some examples? Here is the first one:

·         Compare the folowing posts:  HOWTO: Registering SFTP and FTP/SSL for use in SSIS package (Rebex) and Registering NetXtreme components for use in SSIS Script Task in SQL Server DTS (ComponentForge/Safabyte)

·         Rebex:

  •  
    • Add new Script Task
    • Modify the script via the "Desing script" in "Properties dialog". The Visual Studio for Applications IDE pops up.
    • Add reference to the dlls in the Project Explorer window. The SFTP and FTP/SSL components should be listed in the Add Reference dialog now.
    • Add the code to connect, transfer files or do whatever you want as described in SFTP and FTP/SSL tutorials.
    • Adding the references for the SSIS Script Component (used in data flow task) is similar.

·         Safabyte:

o   Add new Script Task

o   Modify the script via the "Design Script" in "Properties dialog". The Visual Studio for Applications IDE pops up.

o   Add reference to the dlls in the Project Explorer window. The SFTP and FTP/SSL components should be listed in the Add Reference dialog now.

o   Add the code to connect, transfer files or do whatever you want as described in SFTP and FTP/SSL tutorials.

o   Adding the references for the SSIS Script Component (used in data flow task) is similar.

·         Identical wording.

·         Amusingly, they forgot to change the component name. FTP/SSL is the name of a Rebex product, ComponentForge actually calls their forged versions NetXtreme FTP and NetXtreme SSH FTP (instead of SFTP).

·         Screenshots are attached – blog.componentforge.net will most likely disappear soon.

 

How to get rich fast (code monkey version)

How to get rich fast? If you are living in a country where copyright law is just for fun and you know how to write software, it's rather easy:

  1. Purchase a source code of some commercial software components.
  2. Rename all namespaces, methods, properties, etc.
  3. Throw away the samples and write new ones.
  4. Compile, repackage and sell as your own work.
  5. Profit!

This is exactly what a company (?) called ComponentForge or Safabyte did! Check out our website about ComponentForge/Safebyte scam if you are interested in details.

You'll soon find more posts about this case on this blog. More evidence, more traces, more about the people involved. Remember the book Cuckoo Egg book by Clifford Stoll about tracing a spy in a computer system which started at Berkeley campus back in eighties? Well, we probably won't find a Soviet agent here, but it can be interesting anyway. We already have some various traces to follow...

Would you like to know more?

Update (2009-10-16): They did it again, this time under XtraComponents brand!