Off topic: Adding newsfeeds to Google Maps

Oh this is cool.   A company called Daden Conuslting has added RSS newsfeeds to Google Maps.

NewsGlobe is a free dynamic layer Network Link from Daden Consulting for Google Earth.

It takes the stories from an RSS news feed, then checks the words in each story title against a list of countries and cities on the Earth. Any matches will result in placemark being placed on GoogleEarth, along with the news item title. You can then click on the placemark to read the summary, then then click through to the original story.

Link here via LooseWire.

Alex Eckelberry

Make financial institutions responsible for stopping phishing?

Bruce Schneier at Wired writes:

“Financial companies have until now avoided taking on phishers in a serious way, because it’s cheaper and simpler to pay the costs of fraud. That’s unacceptable, however, because consumers who fall prey to these scams pay a price that goes beyond financial losses, in inconvenience, stress and, in some cases, blots on their credit reports that are hard to eradicate. As a result, lawmakers need to do more than create new punishments for wrongdoers — they need to create tough new incentives that will effectively force financial companies to change the status quo and improve the way they protect their customers’ assets. Unfortunately, the California law does nothing to address this.

The problem of phishing cannot be solved solely by focusing on the first trend: the availability of personal information. Criminals are clever people, and if you defend against a particular tactic such as phishing, they’ll find another. In the space of just a few years, we’ve seen phishing attacks get more sophisticated. The newest variant, called “spear phishing,” involves individually targeted and personalized e-mail messages that are even harder to detect. And there are other sorts of electronic fraud that aren’t technically phishing.

The actual problem to be solved is that of fraudulent transactions. Financial institutions make it too easy for a criminal to commit fraudulent transactions, and too difficult for the victims to clear their names. The institutions make a lot of money because it’s easy to make a transaction, open an account, get a credit card and so on. For years I’ve written about how economic considerations affect security problems. They can put security countermeasures in place to prevent fraud, detect it quickly and allow victims to clear themselves. But all of that’s expensive. And it’s not worth it to them.”

Article here via Ted Richardon’s blog

Alex Eckelberry

Round 1: Luddites 0, Mothers 1

Candy Chan refuses to give in to a file sharing lawsuit by some record companies… and they countersue trying to get her out of the way and appoint a legal guardian in her stead for this lawsuit.

I’m so sick of the jack-boot tactics of the record industry.  It’s just appalling.  

I really hate piracy and intellectual property theft.  I have several talented artists in my family and they suffer when it happens.  And I make my living selling intellectual property.

So please don’t take my message as being “steal from the buggers”.  Because that just hurts the artists.

But it is just mind-numbingly stupid how the record industry is going about this attempt to fix the problem.  All they’ve done is piss people off to no end.  

Hey, to the showbiz people out there suing kids:

1. Boost your revenues by making a product something that someone actually wants.  I’m sorry, but much of the music and movie fare these days is largely crap. 

2. Make it affordable. $15 a CD for a kid in college and you wonder why they pirate? 

3. Embrace technology, don’t fight it.  

4. Stop blaming piracy for your revenue problems.  See #1 above.

5. Stop attacking 12 year olds.  I’m a parent and I can assure you, a cease and desist letter warning a parent is very potent.  But going after kids with real  lawsuits and demanding financial settlements is just sick.  I really feel for these parents who are getting attacked.

6. Look at your business model. MBAs the world over know that there are four “Ps” in marketing:  Product, Price, Place and Promotion.  So your Product isn’t there (see #1 above).  Your Price is too high (see #2 above).  Your Place (distribution) has changed (see #3).  So now all you have left is Promotion.  Well guess what: The Internet can find the next talented musician faster than giving payola to DJs (see #3 above).

And finally, pick on someone your own size. 

See my earlier blog for more of my viewpoints on p2p.

(Side note:  I have a great solution for music in my household.  I set up an account on iTunes and my kids download the few songs a week that they really want.  It comes out to just a few dollars a week and everyone’s happy.)  

 

Alex Eckelberry
(Thanks John Murrell)

Update on Mindset Interactive

Earlier I blogged that reports of Mindset Interactive’s demise were premature.

Some follow up research by Sunbelt researcher Patrick Jordan has pulled up some more:

From Idealproductgroup.com

Privacy policy for IdealGamebar says that it’s a division of Broadspring.  Bingo.

 

(http://www.igamebar.com/privacy.htm)

2q384729347
(Click to enlarge)

This is what the game bar looks like:

 Garm234234

(Click to enlarge)

We are testing the toolbar watching for transmissions of data, but so far they only re-direct the user to Infospace when mistyping a URL.  Also, the installation doesn’t show in Hijackthis as any register changes for the 404 page. 

New sites:

Idealproductgroup.com
Idealgamebar.com
Idonatesearch.com
Idonatesearch.org
Idonatetoolbar.com
Idonatetoolbar.org
Igamebar.com

We are continuing to research this…

Alex Eckelberry 

Internet blues

Grant Marylander is a friend of a friend, and I got this email forwarded to me.  It’s a classic experience dealing with a broadband company (personally, I have Brighthouse down here and the support is pretty good, and their service is excellent). 

I’ve reprinted the letter with permission of the author.

Our Internet went down this weekend. Your palms are sweating at the thought, aren’t they? Don’t even try to imagine what it’s like in real life; you’ll drive yourself into near catatonic hysteria.

We took it well for the first five minutes. Five minutes of powering off the modem and router. Five minutes of restarting all the computers. Five minutes of searching for non-existent manuals and coming up with a postage size note which referred us to a website for troubleshooting Internet connection problems.

When self-help failed us, we started to feel the panic. If we couldn’t fix the problem ourselves, our fate rested solely in our Internet provider: Comcast. Relying upon this communications monolith for help is roughly akin to asking United if there are any Mileage Plus seats available for your trip to Hawaii. In either case, the response is never worth the effort.

Nonetheless, our limited options compelled me to call their toll free number, negotiate a series of computer generated questions (“If you’re calling from a touch tone phone, prefer boxers to briefs, like the smell of freshly mowed grass, know the words to MacArthur Park, and can speak in tongues, press pound”), and wait for my call to be transferred to the far reaches of space so a person whose command of English was second only to his complete lack of knowledge of anything computer related.

Comcast’s highly trained technician ran me through a series of security questions to ensure I wasn’t some nut who randomly reported Internet outrages just for the thrill of hearing terms like “ping” and “IP” spouted in a foreign accent. After verifying my identity, I was promptly placed on hold while the technician checked to see if, in fact, my Internet connection was down. This permitted me to listen to the London Symphony’s version of “King of the Road” while I watched my kids repeatedly open and closer their browsers in the faint hope that repetition might spawn a cure.

Just as I was preparing to beat myself into unconsciousness with a paperweight rather than listening to a flute version of “Jumping Jack Flash,” my technician reappeared to announce that, in fact, my Internet connection was down. He then proceeded to run me through the obligatory power down, power up sequence I had performed before the call. Once I completed this task and assured him that I was still Internet deprived, the technician announced that my modem had became unregistered, an affliction which had randomly hit a number of subscribers in my area. “Register me,” I pleaded.

“Well, I don’t know how to do that. Let me check with my coach.” Honestly, he said “coach.” Not boss. Not supervisor. Coach. At that point, I was fairly sure that Comcast’s call center was located in an Indian middle school for the dyslexic and verbally challenged.

Fifteen minutes and five Henry Mancini songs later, the tech was back with bad news. “My coach has gone to out to eat and won’t be back for an hour. Then he’s got a meeting. But after that, he should be able to re-register your modem. Give us till 4:00 and you should be up and running.”

Four o’clock? That was in three hours. How were we supposed to survive for three hours without the Internet? I mean, I had lots of important things to do – check the weather, my e-mail, the calorie count for a McDonald’s hamburger, where to take Brazilian fencing lessons, the exchange rate for the dinar, stuff like that.

When I broke the news to the family, there was general bedlam, followed by clothes renting, profanity and plans to home invade the neighbors so we could use their Internet. We were momentarily mollified when we tried to pick up an unprotected wireless connection using the laptop but, once that failed, we resorted to self-medication and a heavy dose of TiVo. Every fifteen minutes or so, someone would traipse off to a computer to see if were back online.

At 4:00 sharp, I was on the horn with Comcast to find out why the hell we weren’t speeding along the Internet highway in search of junior Sudoku puzzles. Needless to say, I was subjected to another identity scan (“name five anagrams you can form using your mother’s maiden name) and the obligatory power down/power up cycle before the technician would confirm that I was still without the Internet. My crack technician, who sounded strangely like my first crack technician, told me that my modem had always been registered and the problem was with the connection to my house. “Are you sure that this isn’t an area wide problem?” I asked, hoping that my misery was shared by others.

“Absolutely. Our computer cross-checks every outage notice and you are the only person in this area suffering a connectivity problem.”

The tech then told me that the earliest they could have someone out was Monday afternoon. I’m not sure what happened next because my hyperventilation caused me to pass out. When I finally came around, I found my family preparing to sacrifice a goat on an altar of keyboards and discarded video cards. I forestalled the sacrifice long enough to give everyone the bad news. During the resulting hysteria, the goat managed to escape his bonds and flee in an old Red Flyer wagon.

Without a sacrifice or repairman to cure our loss, we fell into a deep despair that was periodically interrupted with condemnations of all things Internet and the occasional rush to the computer to see if Divine Favor had restored our connection. By early evening, we were spent and retired to our bedrooms for a restless night filled with dreams of dropped connections and pages unavailable imagery.

The next morning brought a renewed desire to fix this problem ourselves. My youngest and I braved a freezing rain to trace our cable line to a box on the side of the house. Of course, the box had been painted over, thereby making entry nearly impossible. As I was taking a chainsaw to the unyielding hinges, a neighbor hailed me from her porch. “Is your Comcast down too?”

Five minutes later, I was screaming into my phone about the nationwide loss of our Internet connection. My newest technician, a sycophantic clone of the other techs, assured me that Comcast was well aware of the problem and was sending a repairman as soon as possible. “When?” I demanded. “We don’t have an ETA but someone should be out sometime today.”

I paced the hallway for hours (or at least 30 minutes) before I saw a repair truck stop outside the house. I ran out to urge the repairman to new heights of speed and competence. Unfortunately, in the span of a minute, the repairman had disappeared. Within minutes, the truck was gone. The Internet, however, remained only a memory.
I searched the neighborhood for the repair truck, anxious for any word on when we might be restored to civilization. While I drove through every street and cul de sac, the repairman mysteriously returned to our house where he resumed his mystical incantations over the cable box.

“The Internet’s back up.” My heart still flutters when I think of those words. “The Internet’s back up.” I may tattoo that phrase on my back, right next to the Chinese character for “No MSG” (it was supposed to say “Justice” but the tattoo guy’s Cantonese was a bit rusty).

Within fifteen minutes, all of the pain was forgotten. Well, almost all of the pain. I still shake a little when I think about it. But I found this great website to help with Internet withdrawal. I should be okay. As long as the Internet doesn’t go down again.

Alex Eckelberry

Doing the right thing, right

There is an article in ComputerWorld that talks about how Finjan found a security flaw in the search engine.

Google promptly fixed it. 

Wow.  What an amazing concept.  Flaw found.  Flaw fixed.

Our experiences with Google have been equally satisfying. This company gets it.  Responsive and highly professional. 

Contrast that with Cisco frantically attempting to bludgeon Michael Lynn into silence and their keystone cops attempts to kill the information.  In that case, they were responsive in the beginning with Michael, but then things just got really weird. Of course, all they got was the Streisand Effect (a term TechDirt coined a while back).

(At some point, however, I will write about the ethics of releasing security information to the public, but that’s another discussion).

Article link here via Donna.

Alex Eckelberry

Rumors of Mindset Interactive’s demise? Hmmm…not so fast

F-Secure reports:

“Spyware vendor Mindset Interactive shuts down their business

Favoriteman and NetPal nuisances have after several years stopped. The company behind it has closed and we can report they have moved out of their company offices. All related web servers are unreachable and the already distributed Spyware no longer functions.

mindsetinteractive

Like many Spyware vendors, Mindset Interactive has used multiple names to distribute their Spyware. That is why termination of the company behind it is such a positive turn.

Mindset Interactive was behind Favioriteman also known as F1Organizer, ATPartners, SpyAssult and Window Help 4 Smart Browsing. They also constructed NetPal, which had a massive numbers of games as distribution channels.

F-Secure will keep Favoriteman and NetPal in detection to clean out the final filth.”

Actually, our research indicates that the death knell may not have clanged loudly, at least not yet.

Pinging addictivetechnologies.com (207.182.237.210) and mindsetinteractive.com (207.182.237.210) shows that the site is unavailable and whois for that IP number is under the hosting company, Velocity Networks.

But let’s look at some more:

IP:207.182.237.210
vistainteractivemedia.com
10 Corporate Park, Suite 315
Irvine, CA 92612

IP: 207.182.237.210
Mindset Interactive
5 Corporate Park Suite 160
Irvine, CA 92606

Here are the websites we can find associated with Mindset or Mindset executive Scott Walker

Dead sites:

Addictivetechnologies.net
F1organizer.com 
F1organizer.net 
Favorites1.com 
Favorites1.net 
Addictivetechnologies.com 
Mindseti.com 
Mindsetinteractive.com 
Freebiesrus.com  

But…

Live sites!

Idealbrowser.com
Broadnetsoftware.com 
Broadspring.com
Idealproductgroup.com
Vistainteractivemedia.com 
Vistainteractivemedia.net 
Flashgamejunkie.com 
Flashgamesjunkie.com 
Idealringtones.com 
searchenginebar.com
Reflexivesearch.com 

From what we can tell, they still own the sites and they still are assigned IP addresses.  Last year MindSetInteractive put up a sign that they were changing to Vistinteractivemedia.  They also have Broadspring.com along with Vistainteractivemedia that is running the RX toolbar bundled in Kazaa alongside Best Offers.

Finally,according to this site,  Aadcom was listed as part of the MindSet Interactive Group during their days with Direct-Revenue. Today a whois shows an email address for vistainteractivemedia and they share the same DNS servers and IP range. 

In short, not so fast…

Spyware researchers — contact me offline for more detailed information if you need it.

 

Alex Eckelberry
(Thanks to our Patrick Jordan for his extensive work on this project!)

Global State of Information Security

CIO and PwC have released the Global State of Information Security 2005.


“It’s clear from the data that respondents spend most of their time in reactive mode: responding to incidents, deploying firewalls, and dealing with everyday nuisances like spam and spyware. Ironically, the most common proactive step respondents take is to develop business continuity and disaster recovery plans. So even their proactive steps are investments in reactive measures.

Having said that, a few numbers did pop out that suggest that the foundation is being laid for a time when information security may become more strategic. This year more companies employed security executives and focused on integration between physical and information than in the two previous years…”


“…There’s a sudden and dramatic rise in companies monitoring their employees. The upsurge, part of a trend toward more surveillance both in public and in private, can be attributed to several factors.”


“Information security is getting more money, but exactly how much and from where isn’t always clear. It’s more evidence of a lack of strategic direction.”

Alex Eckelberry
(Thanks to beSpacific)

The Microsoft protection racket

Follow-up from my previous post on Microsoft getting into security software, the outspoken John Dvorak weighs in with this thoughts.

“Does Microsoft think it is going to get away with charging real money for any sort of add-on, service, or new product that protects clients against flaws in its own operating system? Does the existence of this not constitute an incredible conflict of interest? Why improve the base code when you can sell “protection”? Is Frank Nitti the new CEO?

…Microsoft has stayed away from the antivirus, antispyware game for a long time because it knew that there was this inherent conflict of interest unless it gave away such software for free. After all, the exploits utilized by malware are possible because of flaws within the Microsoft code base. There is no incentive to fix the code base if it can make additional money selling “protection.”

It was also obvious that Microsoft was so far behind the curve with antivirus software that it would embarrass itself if it entered that game, although it did quietly come up to speed over the years. But that still begs the question: Why protect the users when you can fix the code?”

I don’t entirely agree with John, but it’s an entertaining article nonetheless.

Alex Eckelberry

 

Another baffling statistic

On the heels of a well intention but flawed study that showed that the annual risk of ID theft was $24 billion, we now have a new terrifying statistic:  26.7 million Americans will become victims of identify theft.

“In a recent study … of the top 2,000 known spyware threats, they found that 15 percent of spyware is actually stealing all the information typed on an infected computer, by logging the information the user types and then transmitting it to the spyware’s creator. This method is called “key logging,” and was the cause for five percent of the identity theft cases last year.”

OMG.  This is really hyper-inflated data.  There are no definite statistics on the prevalence of keyloggers, but I can assure the ostensibly quaking public that it is far, far less than 15% of all users.   It is a very small number.

I’m talking keyloggers here, people.  Stuff that actually steals your bank data, ebay accounts, passwords, etc.   Not stuff that grabs search terms and displays contextual advertising.  That may not be not nice, but it’s not stealing your credit cards.

Yes, we’ve discovered a LOT of keyloggers, over 25 in just the past few months.  But all of them were on unpatched Windows XP systems, and the actual volume of users infected, while not insignificant, was in the range of perhaps thousands on a cumulative basis. 

Now, there are risks out there, and I suppose I should have a sense of gleeful avarice to see others do free marketing for the industry; but on the other hand, the industry can’t go overboard.  Our duty as technologists is to not scare the public off the Internet—rather, provide the education and the tools to help people be safe—and lobby for the infrastructural changes that will effect a safer online experience.

Alex Eckelberry

Is Warcraft spyware?

World of Warcraft

Well, not Warcraft/World of Warcraft per se, but an an application called the “Warden Client”, downloaded on the fly from Blizzard servers.

From Rootkit.com:

“I watched the warden sniff down the email addresses of people I was communicating with on MSN, the URL of several websites that I had open at the time, and the names of all my running programs, including those that were minimized or in the toolbar. These strings can easily contain social security numbers or credit card numbers, for example, if I have Microsoft Excel or Quickbooks open w/ my personal finances at the time…

Next, warden opens every process running on your computer. When each program is opened, warden then calls ReadProcessMemory and reads a series of addresses – usually in the 0x0040xxxx or 0x0041xxxx range – this is the range that most executable programs on windows will place their code. Warden reads about 10-20 bytes for each test, and again hashes this and compares against a list of banning hashes. These tests are clearly designed to detect known 3rd party programs, such as wowglider and friends. Every process is read from in this way. I watched warden open my email program, and even my PGP key manager. Again, I feel this is a fairly severe violation of privacy, but what can you do? It would be very easy to devise a test where the warden clearly reads confidential or personal information without regard.

This behavior places the warden client squarely in the category of spyware. What is interesting about this is that it might be the first use of spyware to verify compliance with a EULA. I cannot imagine that such practices will be legal in the future, but right now in terms of law, this is the wild wild west. You can’t blame Blizz for trying, as well as any other company, but this practice will have to stop if we have any hope of privacy. Agree w/ botting or game cheaters or not, this is a much larger issue called ‘privacy’ and Blizz has no right to be opening my excel or PGP programs, for whatever reason.”

Alex Eckelberry
(Thanks Dan)

 

Update:  Well, this certainly was a roasty hot subject.  I should clarify that Blizzard uses this technology to find “cheaters”, which this fellow defends here.

New Rootkit Detection Tool

I originally found this on Lazy Genius.

This is cool. Joanna Rutkowska has developed a new rootkit detection tool — System Virginity Verifier. Download link.

You can read about it at Rootkit.com. She also has a powerpoint presentation here.

The idea behind SVV is to check important Windows System components, which are usually altered by various stealth malware, in order to ensure system integrity and to discovery potential system compromise.”

She has other tools on her download page.

Note: This is a technical tool intended for an advanced user. If you’re just getting in to rootkits, I would start with the Sysinternals Rootkit Revealer.

Alex Eckelberry

Declan McCullagh on spyware legislation

Article here.

“A better solution might sound like a radical one: for Congress to do nothing.”

He’s right that Can Spam was basically garbage (never having it legislated in the first place might have actually reduced spam, not increased it, because Can Spam made it legal to “spam” so long as you met certain requirements).  

The fundamental problem is the patchwork quilt of state legislation that a Federal bill would resolve. The difficulty is that a Federal bill might very well create a “safe harbor” for adware companies that consumers might not actually approve of.

Alex Eckelberry
(Thanks, Ben)

 

Fears that DHS Cybersecurity might do a FEMA-like bungling

CNET writes this article questioning if the Department of Homeland Security’s Cybersecurity functions are in danger of becoming another FEMA disaster — e.g. reacting sluggishly to a cyber threat.

Well, the answer to me is “of course”.  We expect this vast bureaucracy run by a former lawyer to protect us from a national cybersecurity threat?  We’re on our own here folks.  We’re going to have to take responsibility for our national cybersecurity…and guess what… I think we’ll do a fine job of it judging from what I’ve seen in the security community.  

Alex Eckelberry