Orbit Downloader

» see orbitdownloader.com as it lived, on the wayback machine

~ the obit ~

Orbit Downloader was a free download manager for Windows, released in 2006 by a developer called Innoshock. It did what the category had done since GetRight: split a file into parts pulled in parallel, and resume after a dropped connection. It hooked into Internet Explorer and Firefox and took over whenever a download started.

What set it apart was video. In 2007 a clip on YouTube was a Flash stream with no save button, and Orbit could pull the file out of the page. Its homepage sold this in the vocabulary of the day, as "new generation web (web2.0) downloading" from sites such as Myspace and Imeem. A later tool named Grab Pro added RTMP, the streaming protocol of Adobe's Flash media servers.

It was also small. The site claimed an installer under 2 MB and less than 3 MB of memory in use, and said its peer-to-peer source selection made downloads up to 500% faster. The program cost nothing and earned its money at install time, through offers to change the browser homepage and OpenCandy bundles of third-party software. Betanews later called it one of the most successful download managers around.

~ the rap sheet ~

~ a tray icon in the ttnet years ~

I remember Orbit from the ttnet broadband window, roughly 2007 to 2010, when a download manager was standard equipment on a Windows desktop in Turkey. Lines were slow and they dropped, so a resume button was worth a tray icon. The names rotated: FlashGet one year, DAP the next. Orbit was the one that also understood video.

~ orbital decay ~

On 21 August 2013 ESET's research blog published a post by Aryeh Goretsky under the title "Orbital Decay". Somewhere between version 4.1.1.14, released on 25 December 2012, and version 4.1.1.15 of 10 January 2013, the main executable orbitdm.exe had gained a new habit. It quietly downloaded a DLL with a function named SendHTTP from orbitdownloader.com, then fetched an encrypted list of targets from the same server.

The machine then attacked whatever was on the list. If WinPcap was installed the module sent SYN floods, and otherwise it fell back to plain TCP and UDP packets. In ESET's lab a test PC pushed out connection requests at about 140,000 packets per second. The target list was base64 text XORed with the hash of a password hardcoded in the DLL, so a user watching the network would have seen nothing worth a second look. ESET began detecting the program as Win32/DDoS.Orbiter.A.

Who put it there was never settled. Betanews wrote that there was no way to tell who was responsible, and noted that some of the configuration files ESET saw were empty, as if the module was still being tested.

~ frozen at 4.1.1.19 ~

Nobody answered for it. Betanews tried to reach Innoshock and found that the last entry on the developer blog dated from 2009 and that the official forum had been left to spammers. On 23 August it pulled Orbit from its DownloadCrew site and pointed the download link at ESET's report. Download.com and Softpedia disabled their copies too, along with most of the other large software libraries.

The website never reacted. Wayback captures show the same homepage from 2013 through 5 August 2018, still offering version 4.1.1.19 with support for Firefox 3, and still listing Imeem, which had closed in 2009. The next capture, from October 2019, is a one-kilobyte placeholder. Since September 2024 the domain has carried an unrelated page of web-based video downloaders that uses the old name and nothing else from it.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »