Month: November 2005

We speculated on this last week.  It’s true.

From the FTC:

Outfit Used Unsuspecting Bloggers to Spread its Malicious Code

An operation that uses the lure of free lyric files, browser upgrades, and ring tones to download spyware and adware on consumers’ computers has been ordered to halt its illegal downloads by a U.S. District Court at the request of the Federal Trade Commission. The court also halted the deceptive downloads of an affiliate who helped spread the malicious software by offering blogs free background music. The music code downloaded by the blogs was bundled with a program that flashed warnings to consumers who visited the blog sites about the security of their computer systems. Consumers who opted to upgrade by clicking, downloaded the spyware onto their computers. The court has frozen the organization’s assets pending a further hearing. The FTC will seek to bar the deceptive and unfair practices permanently and require the operators to give up their ill-gotten gains.

The FTC complaint alleges that the Web sites of the defendants and their affiliates cause “installation boxes” to pop up on consumers’ computer screens. In one variation of the scheme, the installation boxes offer a variety of “freeware,” including music files, cell phone ring tones, photographs, wallpaper, and song lyrics. In another, the boxes warn that consumers’ Internet browsers are defective, and claim to offer free browser upgrades or security patches. Consumers who download the supposed freeware or security upgrades do not receive what they are promised; instead, their computers are infected with spyware.

Link here.

Alex Eckelberry
(Thanks Eric)

This is really interesting. Wired has a list of the worst bugs in history.

July 28, 1962 — Mariner I space probe. A bug in the flight software for the Mariner 1 causes the rocket to divert from its intended path on launch. Mission control destroys the rocket over the Atlantic Ocean. The investigation into the accident discovers that a formula written on paper in pencil was improperly transcribed into computer code, causing the computer to miscalculate the rocket’s trajectory.

1982 — Soviet gas pipeline. Operatives working for the Central Intelligence Agency allegedly (.pdf) plant a bug in a Canadian computer system purchased to control the trans-Siberian gas pipeline. The Soviets had obtained the system as part of a wide-ranging effort to covertly purchase or steal sensitive U.S. technology. The CIA reportedly found out about the program and decided to make it backfire with equipment that would pass Soviet inspection and then fail once in operation. The resulting event is reportedly the largest non-nuclear explosion in the planet’s history.

More here.

Alex Eckelberry

Will Sony BMG music go the same way?

Here’s what’s hard for me:  I’m a huge fan of Sony electronic products.  I buy everything Sony.  I have great respect for the consistent quality, reasonable prices and their incredible commitment to responsible environmental policies. Unlike some others, I will not boycott Sony electronics products over this stink. 

Maybe it’s because Sony BMG isn’t actually the Sony you and I know.  It is a joint venture between the massive Bertelsman Group and Sony. The chairman, Rolf Schmidt-Holtz, is a Bertelsman guy.  Michael Smellie, their COO, is a former Bertelsman exec.  Luddite of the Year Thomas Hesse, BMG’s President of Global Digital Business, is also a friggin Bertelsman guy right out of Bertelsman’s Worldwide Headquarters in Gutersloh, Germany (more on him later).  And Andrew Lack, the CEO, is a former NBC News guy.  

In other words, we’re not talking about people like Sony Chairman Nobuyuki Idei, a very cool and very smart guy. 

Here’s what he said a couple of years ago:

The music industry has been spoiled. They have controlled the distribution of music by producing CDs, and thereby have also protected their profits. So they have resisted Internet distribution. Six years ago I asked Sony Music to start working with IBM to figure out how to offer secured distribution of their content over the Net. But nobody in Sony Music would listen. Then about six months ago, they started to panic. They have to change their mindset away from selling albums, and think about selling singles over the Internet for as cheap as possible—even 20 cents or 10 cents—and encourage file-sharing so they can also get micro-payments for these files. The music industry has to re-invent itself, we can no longer control distribution they way we used to. Most entertainment executives understand this, but how to exactly execute on this model is more difficult.

He said this in 2003.  When he says “6 years ago”, he’s talking about somewhere around 1998/1999 when he first started pushing his own people to get with the picture. And $.10–$.20 per download?  He gets it.

But the BMG guys obviously didn’t. Thomas Hesse said the most stupid thing he could have on NPR, when he said “Most people, I think, don’t even know what a Rootkit is, so why should they care about it?”  (if you haven’t heard him say this, just spend a few minutes listening to this NPR story).

In this age, things snowball FAST.  Here’s what Sony BMG is at risk of seeing happen: 

1. People don’t buy the product because of all the bad PR.  I mean, Rootkit — that’s a scary word!

2. Artists, appalled by these kinds of reviews, don’t sign with the label.  Screw it, they can’t handle the pain themselves.  They are, after all, human. 

3. Idiotic statements like the one made by the president of Sony BMG just piss off people who would have been willing to give Sony a break

By the way, we’ve tested this Rootkit and it’s actually easy to override.  Just hold the shift-key when putting in your CD to disable auto-run (see other pointers here).  Then rip your CDs with pleasure.  And Sony’s remover actually worked fine in our tests.  (I know, I know, you’re still pissed, but I wanted to make the point to be fair.)

Well, Sony BMG dudes: This has the rage of the Internet and I think a few of you need to check into Spago for some R&R and some deep thinking… 

You either need to immediately cancel all DRM on all CDs or your business is at serious risk of disappearing. 

 

And that means you go back to Gutersloh!

Alex Eckelberry

EFF has a list here.

EFF has confirmed the presence of XCP on the following titles (each has a data session, easily read on a Macintosh, that includes a file called “VERSION.DAT” that announces what version of XCP it is using). If you have one of these CDs, and you have a Windows PC (Macs are totally immune, as usual), you may have caught the XCP bug.

Trey Anastasio, Shine (Columbia)
Celine Dion, On ne Change Pas (Epic)
Neil Diamond, 12 Songs (Columbia)
Our Lady Peace, Healthy in Paranoid Times (Columbia)
Chris Botti, To Love Again (Columbia)
Van Zant, Get Right with the Man (Columbia)
Switchfoot, Nothing is Sound (Columbia)
The Coral, The Invisible Invasion (Columbia)
Acceptance, Phantoms (Columbia)
Susie Suh, Susie Suh (Epic)
Amerie, Touch (Columbia)
Life of Agony, Broken Valley (Epic)
Horace Silver Quintet, Silver’s Blue (Epic Legacy)
Gerry Mulligan, Jeru (Columbia Legacy)
Dexter Gordon, Manhattan Symphonie (Columbia Legacy)
The Bad Plus, Suspicious Activity (Columbia)
The Dead 60s, The Dead 60s (Epic)
Dion, The Essential Dion (Columbia Legacy)
Natasha Bedingfield, Unwritten (Epic)
Ricky Martin, Life (Columbia) (labeled as XCP, but, oddly, our disc had no protection)

There are two other lists, here and here.

Alex Eckelberry
(Thanks Jarrett)

We love crack sites. They are some of the best places to get spyware. Of course, the cracks are junk but who cares — people like us get lots of fun stuff to test!!!

Anyway, today’s Seen in the Wild is 180 Solutions downloading from a crack site. Thanks Sunbelt spyware researcher Adam Thomas.

From the 180 blog (“Trusting the Affiliate Model”):

Trust is indeed key to it all, and 180solutions is committed to being a role model in our industry by policing distribution and breeding the trust necessary to create and monetize what we call the content economy.

Cool!

I did ask 180 about this download on the crack site, and here’s what they said:

“…it turns out that this was disabled a few weeks ago. What is happening in the screenshot is that there is leftover code which will deliver the notification, however, if the user were to click “Yes”, our program would not be installed, given the fact that it has been disabled. Obviously we’ll take our lumps as long as leftover code presents itself on sites that are against our code of conduct. Our guys are working on making sure that the code is ultimately not leftover, but what matters here is that the install cannot occur.”

Alex Eckelberry
(Thanks Suzi)

Boy I’m slow today.

Anyway, the Other Foot Has Dropped.

From Brian Krebs at the Washington Post:

A class-action lawsuit has been filed on behalf of California consumers who may have been harmed by anti-piracy software installed by some Sony music CDs. A second, nationwide class-action lawsuit is expected to be filed against Sony in a New York court on Wednesday seeking relief for all U.S. consumers who have purchased any of the 20 music CDs in question.

Link here.

Alex
(Thanks David)

Sorry, I don’t read Italian!

Turns out my earlier blog post about Sony being sued was a little off. What happened is ALCEI-EFI, an Italian group, filed a complaint with the police about Sony’s practices. That’s different than suing Sony.

From ComputerWorld:

On Friday, the Milan-based ALCEI-EFI (Association for Freedom in Electronic Interactive Communications – Electronic Frontiers Italy) filed a complaint about Sony’s software with the head of Italy’s cybercrime investigation unit, Col. Umberto Rapetto of the Guardia di Finanza.

The ALCEI-EF Italian press release here, the complaint here. ComputerWorld article here. The original sources for my blog: the Inquirer story here as and techdirt here still report this as a lawsuit.

Note that techdirt does link to a News.com story that mentions that:

Now the lawyers are taking aim, too. Robert Green, a partner at the San Francisco firm of Green Welling, says he’s readying a class action lawsuit against Sony.

“We’re still investigating the case and talking to different people about what happened to them,” Green said on Friday. He plans to argue that under California law, if you buy a copy-protected CD from a music store, you should be informed that a spyware-like utility will be implanted on your hard drive.

Alex Eckelberry

This is cool. Microsoft is giving out Visual Studio Express for one year.

During the launch event for Visual Studio 2005 and SQL Server 2005 yesterday in San Francisco, Microsoft unveiled an unexpected surprise for individual developers: For the next year, its line of Visual Studio Express products will be offered to the public for free. After that, the price reverts to the previously-announced $49 price per product.

“We are announcing a pricing promotion for Visual Studio Express,” a notice on the Microsoft Web site reads. “For the first year after the products launch on November 7th, 2005, customers will be able to visit MSDN to download their copy of Visual Studio Express for free! Our customers are very excited about the release of these products, so this limited-time download is our gift to the hobbyist, student, and novice community.”

Details here.

Alex Eckelberry

I’m a little slow today.  But this is a serious vulnerability.  Get patched ASAP.  The patch is here.  

eEye originally reported this vulnerability.  Here is the security bulletin from Full Disclosure

Windows Metafile SetPalette Entries Heap OVerflow Vulnerability (Graphics Rendering Engine Vulnerability)

Release Date:
November 8, 2005

Date Reported:
September 1, 2005

Severity:
High (Code Execution)

Vendor:
Microsoft

Systems Affected:
Windows 2000
Windows XP SP0, SP1
Windows Server 2003 SP0

Overview:
eEye Digital Security has discovered a vulnerability in the way the Windows Graphical Device Interface (GDI) processes Windows Metafile (WMF) format image files that would allow arbitrary code execution as a user who attempts to view a malicious image.  An attacker could send such a metafile to a victim of his choice over any of a variety of attack vectors, including an HTML e-mail, a link to a web page, a metafile-bearing Microsoft Office document, or a chat message.

The eEye link  is here.

Catherine has more here too.  Brian Krebs is also on it.

 

Alex Eckelberry
(Thanks Eric S.)

 

We’ve been seeing this for a while now — a file starts to play, then is interrupted with a message that the user needs to install VideoC.  

Of course, there is no such player called VideoC.  Instead, what you get is a big, fat nasty payload of spyware.

Here is an example on a porn site that spyware researcher Patrick Jordan saw today:

Alex Eckelberry

 

More and more, the machines that we use and depend on are collecting information about us. In some cases, they just store it for later access. In other cases, they actually report back to their makers (the product manufacturer). This information can and does find its way into the hands of the government and who know who else? Is this a problem, or just a way to make the world safer for law abiding citizens? Let’s take a look at some of the ways our technology is telling on us.

It’s been common knowledge for a while that several major printer vendors engineer their color laser printers to embed tiny yellow dots into the printed documents to make it possible to track the origins of the document. This was done in cooperation with the U.S. Secret Service for the ostensible purpose of tracking down counterfeiters who use the printers to make their own currency. Last month, the Electronic Frontier Foundation (EFF) was able to crack the code for Xerox DocuColor printers. Their researchers discovered that printers made by Xerox imprint the serial number of the printer and the date and time the document was printed.

Xerox isn’t the only vendor using the technology; it’s just the only one for which the code has been cracked. Other printer brands that embed identifying information include Canon, Dell, Epson, HP, Lexmark and others. Wondering if your color laser is telling the world (or at least, the U.S.S.S.) where and when your documents were printed? Here’s a list of some of the brands and models that do here.

Last spring, the Real ID Act was passed by the U.S. Congress and signed into law by President Bush. It requires state issued driver’s licenses and ID cards to have “machine readable technology” in order for them to be accepted for air travel, banking and entering federal buildings. Just last month, the U.S. State Department laid out rules for embedding radio frequency identification (RFID) chips in U.S. passports issued after October 2006.

At the same time, our cell phones have built-in Global Positioning Satellite (GPS) transceivers that can pinpoint our locations (although most of them currently allow you to turn the feature off). Our new cars contain “black boxes” (or more formally, Sensing and Diagnostic Modules or SDMs) that record data about travel velocity, heading, location and even the number of occupants and whether they’re using seatbelts. Cameras are watching and recording our actions in stores and office buildings, at red lights and toll booths, and even on public streets. The U.K. has had cameras everywhere for quite some time. In the wake of the London bombings, New York City is now planning to add cameras to their own subways.

Any one of these, by itself, seems fairly innocuous. Taken together, it paints a picture of a society in which privacy has become a thing of the past and we’re under constant surveillance. Now the European Commission is proposing to keep detailed records of phone calls made, emails sent and Web sites surfed by all 450 million EU citizens, link here

Does this trend make you nervous, or is it just the price we pay to live in high tech times? Do the advantages of modern technology outweigh the disadvantages (including the privacy issues)? How far will it go? What do you think the future holds for individual privacy – or the lack thereof? Let us know what you think.

Deb Shinder
Editor, Sunbelt WXPNews

Funkytoad.  Link here.

Need a way to Manage Internet Explorer’s Zone’s?
If so, then ZonedOut is for you. Add, Delete, Import, Export, Build a WhiteList and More: Now includes Restricted, Trusted and Intranet Zones.

 

 

Alex Eckelberry
(Thanks Bob J.)

Looks like more people are switching than at least one analyst predicted.

What the heck.  The Mac is a more secure system.  I guess I don’t blame them. 

In a research note released to clients on Monday, Needham & Co. analyst Charles Wolf said the number of Windows users purchasing a Mac appears to be far higher than the firm had previously anticipated.

“If we assume that all of the growth in Mac shipments during the past three quarters resulted from Windows users purchasing a Mac, then purchases by Windows users exceeded one million,” the analyst said. “Indeed, the number of Windows users purchasing Macs in 2005 could easily exceed our forecast of 1.3 million switchers in 2006.”

Needham had previously estimated that 500,000 Windows users would purchase a Mac in 2005, but says its model underestimated the number of Windows users the Mac could capture because it was limited to Windows users who had purchased an iPod.

According to checks with Apple Store Specialists, Wolf also said a larger than expected percentage of Windows to Mac converts appear to be purchasing Apple’s higher-end systems and that their transition is fueled by the epidemic of viruses and malware on the Windows platform.

Link here via /.

Alex Eckelberry

RetroCoder makes a commercial keylogger called SpyMon, something that someone would normally buy on purpose.  But just in case, it’s in our threat database and we treat it like we treat all commercial keyloggers — we tell the user it’s on the system, make the default action “Ignore” and let the user decide whether or not to remove it. 

But they don’t like the fact that we list it.  And so they sent us this little gem through our standard submission form:

If you read the copyright agreement when you downloaded or ran our program you will see that Anti-spyware publishers/software houses are NOT allowed to download, run or examine the software in any way. By doing so you are breaking EU copyright law, this is a criminal offence. Please remove our program from your detection list or we will be forced to take action against you.

Thank you,

Anthony Ball

A check on their website confirms this policy:

This software package is a copyrighted product. As such the owner of the copyright expressly forbids any use, disassembly, examinination [sic] and/or modification by anyone who works for or has any relationship or link to an AntiSpy or AntiVirus software house or related company. If you do produce a program that will affect this softwares [sic] ability to perform its function then you may have to prove in criminal court that you have not infringed this warning.

Infingement [sic] of a copyright licence is a criminal offence .

Well well well. This brings up an interesting issue.  Can you use copyright law to protect your product from being evaluated by a spyware researcher?  

The answer is, absolutely not.

Already knowing the answer, I checked with our high-priced lawyers and the answer agreed with mine.  Regardless of EU law, US law or the Supreme Law of the Lower Hebrides, simply listing an application as potential spyware is not copyright infringement.  Unless you reverse engineer the application, there is no liability for infringement. 

Of course, there is US case law to support a position about using EULAs in general to inhibit First Ammendment free speech, such as when New York AG Elliot Spitzer stopped Network Associates from imposing onerous license conditions (“a New York state judge has ruled that Network Associates can’t prevent people from talking about its products.”). Or, this link, reporting the NYAG’s view that “Whether the subject is political debate, debate in the arts and sciences, or debate over what software to buy, we must protect free and open speech from intimidation. The public has a right to information about products.”  (Thanks Ben)

Eric Howes and Suzi Turner pointed out that this is redolent of the Ash1ey Affair that occurred back in August and September of last year.  Here’s how it went: A fellow by the name of “Ash1ey” was behind a product called Privacy Tools 2004. His program was on SpyareWarrior’s Rogue/Suspect list, and when he released a new version with a new database, he expected to get it de-listed from the site. It didn’t work out that way, and Ash1ey was quite upset.  In short, he added a clause to his EULA forbidding anyone associated with SpywareWarrior from testing his program, and he threatened to write malware himself. Ash1ey is now the poster boy for rogue antispyware applications. 

The idea of using “copyright law” or EULAs as an attempt to suppress antispyware research is both disturbing and laughable.  While the reasoning is sophomoric (along the lines of “I watch Boston Legal, therefore I am a lawyer”), it could put smaller publishers that don’t have legal resources to pull listings of products.  We’ve seen this happen with a couple of antispyware vendors — they get a legal threat and they just fold, because they don’t have the legal resources to fight it.

Well, to Mr. Ball, I wish you luck in your efforts to suppress free speech and common sense.  Your application will continue to be listed, as well as a large number of others. 

 

Alex Eckelberry
(Thanks to Ben Edelman, Wayne Porter, Chris Boyd, Eric Howes and Suzi Turner for their helpful input on this issue.)

Phil Leigh, a friend of mine and a good digital media analyst, had this to say this morning, introducing an interview with former Sony lawyer Steve Gordon.

(These are Phil’s words, not the lawyer’s):

According to the RIAA, the gross domestic revenue for the recorded music business was $14.6 billion in 1999, but it had dropped to $12.2 billion last year. That’s five years of pain. Perhaps it’s only human nature for the industry participants to seek a culprit; and given the pain, a culprit that can be demonized as well. Anyone who has not been living in a cave for the past five years knows that they identified P2P file trading as precisely that devil.

The industry sought legal remedies and pursued their devil with the single minded determination of a Tomcat during rutting season.  But it has proven to be an obsession as damaging as Captain Ahab’s quest for the White Whale. It has distracted them from the potentialities of other opportunities in the Digital Domain where they have still made only half-hearted efforts that are generally overpriced. This was most recently demonstrated when Sprint launched a wireless digital download service to selected cell phones and priced it at $2.50 per track.

More importantly, the demonization of P2P has led them imagine conspiracies where none exist. For example, they apparently feel since digitized recorded music has stimulated demand for computers and devices like the iPod, that the hardware manufacturers are smugly satisfied with a habituated consumer practice of piracy. Thus, they have demonized the hardware makers as well.

Where will this bunker psychology lead them? More lawsuits? Copy protected CDs? Lobbying efforts for new legislation in Washington? Evolutionary adaptation to new technologies? Our guest on Wednesday was with Sony records for ten years and provides the record label perspective on the future of the music business.

You can hear the interview here.

 

Alex Eckelberry

You’ve probably seen those webpages which have the secrets to finding a human being on various monolithic IVR (Integrated Voice Response) phone systems.

I hate these systems. In our tech support, we use call screeners.  You call in our toll-free number, get a screener who gets the gist of your problem, assigns you a trouble ticket and then forwards your call to the appropriate technician. It adds perhaps a minute to the call but it makes the whole experience much more satisfactory.  

The link to this new “Find a Human” site is here.  

 

Alex Eckelberry

Comment spam is increasing.  For now, I’m staying on top of it with usually only a few hours delay.  I don’t want to go to a moderated format but if it continues, I may have to.

GRRRR.

 

Alex Eckelberry

EMI proclaims:

“EMI is not using First 4 Internet technology. We recently completed a trial of three content-protection technologies (Macrovision’s CDS300, SunnComm’s MediaMax and SonyDADC’s key2audioXS), and First 4 Internet’s technology was not one of those tested.”

Cnet story here.

 

Alex Eckelberry

 

 

Based on a settlement with the Luddites, Grokster has moved offline, shutting down its service.

It’s website says:

The United States Supreme Court unanimously confirmed that using this service to trade copyrighted material is illegal. Copying copyrighted motion picture and music files using unauthorized peer-to-peer services is illegal and is prosecuted by copyright owners.

There are legal services for downloading music and movies. This service is not one of them. 

Grokster hopes to have a safe and legal service available soon.

The new Grokster, called Grokster 3G, is at a new website.  It promises:

A safe, secure & legal P2P experience…

NO Adware
NO Spyware
NO Bundles!
NO Viruses
NO Hassle
Just the best of what P2P has to offer.

You can signup for the beta of the new Grokster by sending an email to them.

The Luddites crow:

Mitch Bainwol, RIAA chief executive, said in a statement on Monday: “This settlement brings to a close an incredibly significant chapter in the story of digital music. At the end of the day, this is about our ability to invest in new music. An online marketplace populated by legitimate services allows us to do just that.”

MSNBC story here.  Luddite propoganda here.

 

Alex Eckelberry

 

 

Update here.

Sony Rootkit fiasco has started one lawsuit. techdirt speculates more may be coming.

SONY IS FINALLY GOING to HAVE to answer the tough questions, it is being sued. According to the press release here, and the complaint here, the Italian group ALCEI is suing Sony over the rootkitting DRM infection. Since I don’t speak Italian(1), I will have to take the word of readers that they are doing things right.

It seems that ALCEI hired a noted Italian security researched names Stefano Zanero to dot all the I’s and cross all the T’s. This one will be great fun to watch, and hopefully will set the right precedents.

Link here via techdirt.

Alex Eckelberry