Warning! Don't sync your ilok account

[Righty27]

Originally Posted by Raoul23

This is scary I'm not syncing at all. I haven't had an email though

No e-mail here either ... and likewise shall avoid syncing, but this will preclude adding new licences too. Has anyone had anything removed without receiving an e-mail?

Good to have JC on board - thanks!

[Meads]

Synced yesterday for adding the Console 1, and I'm not sure if anything has been deducted. But I won't sync to check...

[29CountsNY]

I just logged into my account through the web to change my password and I noticed that my Waves 8 Gold and Platinum auth is gone but I still have the Kramer Tape v8 asset......???
I am WUP'd to version 9 and on Waves auth so it's not that big of a loss but this is crazy!!

As a software developer during the day, I know if we had a crack in our website the responsibility would fall on the site/software owner, not the end user.

Not a good way to do business at all.
I'll be buying a second iLok and adding new licenses to that one and refuse to sync my bread butter iLok with their software if this is the way they are going to do business moving forward.

Actually crazy is not the right word, disgusting is the proper word for the way iLok is conducting themselves in the last couple of months.

[Bill Denton]

Before everybody gets all crazy over this, I think there are some things that need to be kept track of:

1. Were any licenses removed for products purchased new, from authorized dealers?

2. Were any licenses removed for used Pro Tools HD/HDX licenses purchased without hardware?

3. In the case of Waves, were any V8 licenses removed when you had not already obtained V9 licenses for?

I don't think we'll be seeing many, if any, "Yes" answers on this.

I think it's common knowledge that there are quite a few paranoid folks on this board, as evidenced by those who want to make this either some big conspiracy, which I don't think is the case, or that it's related to Heartbleed, which I'm pretty sure it isn't.

Heartbleed opened an exploitable hole. I sometimes create an exploitable situation when I leave my lawn mower sitting in the front yard while I go buy more gas; my lawnmower could be easily stolen.

But why would somebody go to all the trouble of stealing my $25.00 lawnmower when there are other far more attractive theft targets? Just because somebody could exploit the Heartbleed holes or steal my lawnmower doesn't mean somebody will do it.

And while our licenses are pretty valuable to us, to the average crook they aren't even worth as much as my lawnmower is. So why would somebody go to all of the trouble trying to steal something that is pretty well worthless outside a specific market...us.

After all, both banks and 7-11's were wide open due to Heartbleed, and crooks could get far more useful information from them than they could get from iLok.

So, let's try to stay cool until we get a handle on what's happening...

[JCBigler]

Originally Posted by Bill Denton

And while our licenses are pretty valuable to us, to the average crook they aren't even worth as much as my lawnmower is. So why would somebody go to all of the trouble trying to steal something that is pretty well worthless outside a specific market...us.

There are many people all over the world that use the Protools and iLok system. If whomever is behind this is using it to collect the authorizations to sell on the black market in third world countries, even at pennies on the dollar, this could amount to a lot of money still.

[Raoul23]

I just checked my account on line and all seems OK at the mo!!! I do not want to lose my version 8 licenses as V9 waves doesn't work with dual monitors. I really hope Pace sort this out!!!!

[Carl Kolchak]

Originally Posted by Bill Denton

Before everybody gets all crazy over this, I think there are some things that need to be kept track of:

1. Were any licenses removed for products purchased new, from authorized dealers?

2. Were any licenses removed for used Pro Tools HD/HDX licenses purchased without hardware?

3. In the case of Waves, were any V8 licenses removed when you had not already obtained V9 licenses for?

I don't think we'll be seeing many, if any, "Yes" answers on this.

I think it's common knowledge that there are quite a few paranoid folks on this board, as evidenced by those who want to make this either some big conspiracy, which I don't think is the case, or that it's related to Heartbleed, which I'm pretty sure it isn't.

Heartbleed opened an exploitable hole. I sometimes create an exploitable situation when I leave my lawn mower sitting in the front yard while I go buy more gas; my lawnmower could be easily stolen.

But why would somebody go to all the trouble of stealing my $25.00 lawnmower when there are other far more attractive theft targets? Just because somebody could exploit the Heartbleed holes or steal my lawnmower doesn't mean somebody will do it.

And while our licenses are pretty valuable to us, to the average crook they aren't even worth as much as my lawnmower is. So why would somebody go to all of the trouble trying to steal something that is pretty well worthless outside a specific market...us.

After all, both banks and 7-11's were wide open due to Heartbleed, and crooks could get far more useful information from them than they could get from iLok.

So, let's try to stay cool until we get a handle on what's happening...

Bill, check this thread, you'll find the answers to your questions are indeed mostly "yes", although there is no example for #2.


As for Heartbleed, not only would it be possible for someone to steal your lawnmower, it would be possible for them to leave a clone lawnmower in it's place, that you then kindly fill up with all the fuel you've just bought - automatically syphoning off to the one they've already stolen .

I'm not saying it is Heartbleed - but as soon as Heartbleed was discovered, I checked the security of ilok.com, and found it was unsecure. It's only just been secured, and there's been no news from PACe on the subject whatsoever.

I'm simply pointing out that it's is now worth changing your password, just in case.

There's plenty of money to be made out of this situation, if that were the case, but it could be just as simple for an individual to have bolstered their own hoard of plug-ins, by transferring them from other users accounts, just for their own use, rather than to make a profit.

I don't think that's actually the case, but the bottom line is, if you don't sync your iLok, you wont loose functionality, even if the assets are removed from your account.

Furthermore, it's only prudent to change your password, now that ilok.com is secured.

As for banks, that was entirely different. Even though my own bank's website is still not secure, having my online banking ID, and my password would not benefit anyone, as they don't have my random number generator that is required to log in - the nuke launch codes are safe.

[29CountsNY]

So I have been going in and out of my iLok.com account and a few hours ago my Waves Platinum v8 was missing but I just checked again and it has been returned to my account.....what the hell is going on????

[musicman691]

I just checked my account and most everything looks okay but:
I show two Pro Tools 11 Bundles - one is Type Trial/Demo with an expiration of July 21 2013 and the other is Type License with no expiration. I don't remember having a demo of PT10 or 11 though.

[iLoksupport]

It looks like there is some speculation and misinformation being posted here so we'd like to clear up what is going on.

First, the entire iLok ecosystem was unaffected by the Heartbleed vulnerability. This includes the iLok.com website, the iLok License Manager application, and our license activation services. Our site and services are running smoothly without any problems.

Second, we did send emails to a small number of iLok users regarding license deposits that were made to their accounts by mistake. These users were not randomly chosen, we actually audited every single license to carefully identify only those that were mistakenly deposited.

If you didn't receive an email from us, there were no mistaken deposits identified in your account. But since there seems to be so much speculation and concern by those who were not affected, we're happy to share more information here.

The license deposits that we sent emails about were deposits created by our server, NOT deposits made to an iLok account by a software publisher. These deposits were made when our server saw an iLok but failed to recognize the licenses on that iLok as the very same licenses that already were listed in the iLok account. This created a duplicate of the license, and in some cases, created a full license when what was actually seen on the iLok was an expired license.

This means that the licenses that are being removed are duplicate licenses that should never have been deposited.

So what does this mean for you?

If you didn't get an email from us, that means nothing was changed in your iLok account.

If you did get an email from us, your email lists the licenses that were mistakenly deposited. If the license is currently activated on an iLok, we told you which iLok the license is on, and how to return it. Only the licenses listed are set to be returned.

Several of the posters here had purchased this type of license from another iLok user. Unfortunately we can only direct them back to the party that they purchased the duplicate license from.

We’d like to take this opportunity to publicly apologize to the iLok users who received the mistaken deposits for any inconvenience this may have caused.

Again, if you didn't receive an email from us, your account was not changed in any way.

We hope this helps clear up the questions and worries being posted here. Our support team has been answering the questions of the affected users that have written in to us, and will continue to do so.