Strange 3DxPieMenus.exe Internet connection behavior

Questions and answers about 3Dconnexion devices on Windows.

Moderator: Moderators

ngomes
Moderator
Moderator
Posts: 3321
Joined: Mon Nov 27, 2006 7:22 am
Contact:

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by ngomes »

Hi luping,
And SHA-1 hash result is "a5406727dd66dab49034a1dea5e1c30899d2ff4c".
That's correct. The SHA-1 hashes of the v. 10.5.14 installers are as follows:

Code: Select all

25c6541f9e4c8c55f91602dcaef2bb720f2c2c74 3DxWare32_v10-5-14_r2941.exe
a5406727dd66dab49034a1dea5e1c30899d2ff4c 3DxWare64_v10-5-14_r2941.exe
Nuno Gomes
luping
Posts: 941
Joined: Wed Mar 20, 2019 5:54 pm

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by luping »

ngomes wrote: Fri Apr 05, 2019 9:15 am Hi luping,
And SHA-1 hash result is "a5406727dd66dab49034a1dea5e1c30899d2ff4c".
That's correct. The SHA-1 hashes of the v. 10.5.14 installers are as follows:

Code: Select all

25c6541f9e4c8c55f91602dcaef2bb720f2c2c74 3DxWare32_v10-5-14_r2941.exe
a5406727dd66dab49034a1dea5e1c30899d2ff4c 3DxWare64_v10-5-14_r2941.exe
I use the 64 bit one. Now I have a new SpaceMouse Pro at the cost of 430 USD or 382 Euros in China, too expensive for an end user to own a 3Dconnexion device. Maybe 3Dconnexion should consider lowering the price to a more attainable level, and your sales volume will get a huge boost, and it may lead to more profit...
Attachments
2019-04-06_00h31_55.png
2019-04-06_00h31_55.png (80.57 KiB) Viewed 13513 times
2019-04-04_09h57_00.png
2019-04-04_09h57_00.png (48.51 KiB) Viewed 13513 times
ngomes
Moderator
Moderator
Posts: 3321
Joined: Mon Nov 27, 2006 7:22 am
Contact:

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by ngomes »

luping wrote: Fri Apr 05, 2019 9:43 am Now I have a new SpaceMouse Pro at the cost of 430 USD or 382 Euros in China, too expensive for an end user to own a 3Dconnexion device.
I can't really comment on the price but the SpaceMouse Pro is one of our top-of-the-range devices. 3Dconnexion also manufacturers entry-level models like the SpaceMouse Compact.
luping
Posts: 941
Joined: Wed Mar 20, 2019 5:54 pm

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by luping »

ngomes wrote: Fri Apr 05, 2019 9:55 am
luping wrote: Fri Apr 05, 2019 9:43 am Now I have a new SpaceMouse Pro at the cost of 430 USD or 382 Euros in China, too expensive for an end user to own a 3Dconnexion device.
I can't really comment on the price but the SpaceMouse Pro is one of our top-of-the-range devices. 3Dconnexion also manufacturers entry-level models like the SpaceMouse Compact.
I already have SpaceNavigator, and it gives me very great experience over the past 2 years. Last month I decided to buy a new 3Dconnexion device with more function keys, not two as the SpaceNavigator has. I paid at the cost of a SpaceMouse Enterprise Kit(3DX-700058, price USD 429.00) offered to USA consumers and got a SpaceMouse Pro(3DX-700040, USD $ 299.00). The consumer of 3Dconnexion device in China has to pay higher price than the consumer in USA, very frustrating price policy. Generally notion is that national income per capita of USA is 6 times higher than China.
ngomes
Moderator
Moderator
Posts: 3321
Joined: Mon Nov 27, 2006 7:22 am
Contact:

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by ngomes »

For reference, 3Dconnexion will also use an "extended validation" (EV) certificate to sign executable files. The EV certificate (SHA-1 thumbprint "854f487f0e0f83cf5845071a9c52dc72d136dee4") has an expiration date of Nov 21, 2021.

We're using the EV certificate to establish immediate "Smart Screen" reputation on recent versions of Windows. If an executable is downloaded from the Internet, the "Smart Screen" will display the panel "Windows has protected your PC" panel until the software has built the necessary reputation. For details on the "Smart Screen"feature and the use of EV certificates, please refer to this Microsoft Blog post.

The EV certificate does not replace the normal code-sign certificate (SHA-1 thumbprint "ec31f11b08e8da3a6be68d2bb7dd8723eef3373d"). Both certificate will be used by 3Dconnexion.
luping
Posts: 941
Joined: Wed Mar 20, 2019 5:54 pm

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by luping »

ngomes wrote: Thu May 30, 2019 6:06 am For reference, 3Dconnexion will also use an "extended validation" (EV) certificate to sign executable files. The EV certificate (SHA-1 thumbprint "854f487f0e0f83cf5845071a9c52dc72d136dee4") has an expiration date of Nov 21, 2021.

We're using the EV certificate to establish immediate "Smart Screen" reputation on recent versions of Windows. If an executable is downloaded from the Internet, the "Smart Screen" will display the panel "Windows has protected your PC" panel until the software has built the necessary reputation. For details on the "Smart Screen"feature and the use of EV certificates, please refer to this Microsoft Blog post.

The EV certificate does not replace the normal code-sign certificate (SHA-1 thumbprint "ec31f11b08e8da3a6be68d2bb7dd8723eef3373d"). Both certificate will be used by 3Dconnexion.
After many weeks of monitoring, I finally conclude that 3DxPieMenus.exe is doing validity check for digital certificate via OCSP (Online Certificate Status Protocol) by connecting to ocsp.digicert.com. Safe application behavior.
ngomes
Moderator
Moderator
Posts: 3321
Joined: Mon Nov 27, 2006 7:22 am
Contact:

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by ngomes »

Hi luping,
luping wrote: Fri Jul 05, 2019 7:50 pmAfter many weeks of monitoring, I finally conclude that 3DxPieMenus.exe is doing validity check for digital certificate via OCSP (Online Certificate Status Protocol) by connecting to ocsp.digicert.com. Safe application behavior.
For clarity: 3DxPieMenus.exe is not programmed to connect to the network, let alone to the Internet. We can only speculate to what you are seeing. One guess is that a security program is checking the validity of the Authenticode signature (the executable of 3DxPieMenus.exe is currently signed with a certificate issued by DigiCert). Again, this is only an educated guess.
luping
Posts: 941
Joined: Wed Mar 20, 2019 5:54 pm

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by luping »

ngomes wrote: Mon Jul 08, 2019 4:05 am Hi luping,
luping wrote: Fri Jul 05, 2019 7:50 pmAfter many weeks of monitoring, I finally conclude that 3DxPieMenus.exe is doing validity check for digital certificate via OCSP (Online Certificate Status Protocol) by connecting to ocsp.digicert.com. Safe application behavior.
For clarity: 3DxPieMenus.exe is not programmed to connect to the network, let alone to the Internet. We can only speculate to what you are seeing. One guess is that a security program is checking the validity of the Authenticode signature (the executable of 3DxPieMenus.exe is currently signed with a certificate issued by DigiCert). Again, this is only an educated guess.
Thank you for you reply. Recently I switched to SME and cadmouse, I noticed that when I click 'Stop 3DxWare' to turn off SpaceMouse Enterprise, the LCD screen light is turned off, and when I click to run Microsoft Office Excel, the SpaceMouse Enterprise LCD screen is turned on and the 3DxWare tray icon appears, and several 3DxWare service related processes are running. MS Excel Loads the 3Dconnexion add-in for it, probably this is the reason why some 3Dconnexion application executable is trying to connect to Internet, it's the Windows OS mechanism working to verify the digital certificate. Just my guess.
2019-07-28_08h26_12.png
2019-07-28_08h26_12.png (15.45 KiB) Viewed 8061 times
2019-07-28_08h23_17.png
2019-07-28_08h23_17.png (62.84 KiB) Viewed 8061 times
SME.png
SME.png (64.22 KiB) Viewed 8061 times
luping
Posts: 941
Joined: Wed Mar 20, 2019 5:54 pm

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by luping »

Thank you for your reply.

I can't modify my posted reply in this thread to correct my typo error, sorry for that.
ngomes
Moderator
Moderator
Posts: 3321
Joined: Mon Nov 27, 2006 7:22 am
Contact:

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by ngomes »

The behaviour reported in the original post is a consequence of the common-language runtime (CLR) loader connecting to the Internet to verify the executable Authenticode signature. As 3dxpiemenus.exe and other managed assemblies distributed by 3Dconnexion have an Authenticode signature (currently signed using a certificate issued by DigiCert), the loader may have to contact DigiCert's web site to retrieve the certificate revocation lists (CRLs).

A few details on the above are documented by Microsoft here and here.
luping
Posts: 941
Joined: Wed Mar 20, 2019 5:54 pm

Re: Strange 3DxPieMenus.exe Internet connection behavior

Post by luping »

ngomes wrote: Fri Jan 17, 2020 10:19 am The behaviour reported in the original post is a consequence of the common-language runtime (CLR) loader connecting to the Internet to verify the executable Authenticode signature. As 3dxpiemenus.exe and other managed assemblies distributed by 3Dconnexion have an Authenticode signature (currently signed using a certificate issued by DigiCert), the loader may have to contact DigiCert's web site to retrieve the certificate revocation lists (CRLs).

A few details on the above are documented by Microsoft here and here.
Oh, nice, thanks for the latest clarification regarding my question. After reading these two links you provided, I also noticed that there's the mentioning of such words:
You should avoid the unnecessary startup cost associated with verifying the publisher signature unless your application executes on a computer with custom CAS policy, or is intending to satisfy demands for PublisherIdentityPermission in a partial-trust environment.


After all, I have a deeper understanding of the application behavior.
Post Reply