Government spyware

EPIC, the Electronic Privacy Information Center, has discovered a number of documents through a Freedom of Information Act request that indicate possible intelligence violations against US residents.

From the EPIC website:

Documents (pdf, 3.1 mb) obtained by EPIC under the Freedom of Information Act describe thirteen cases of possible FBI misconduct in intelligence investigations. The documents were released by the Bureau in response to an EPIC open government request (pdf) for information about the FBI’s use of provisions of the PATRIOT Act. EPIC has written a letter (pdf) to the Senate Judiciary Committee highlighting the need for the Attorney General to report to Congress on potentially unlawful intelligence investigations. For more information, see EPIC’s PATRIOT FOIA Litigation page. (Oct. 24 

Washington Post article (which also tells the government’s side of the story) link here via beSpacific.

Alex Eckelberry

Timing is everything

Our VP of Product Management, Greg Kras, took off with his wife and two other Sunbelt employees for a long-planned vacation: A cruise to Cozumel.

They left Thursday. 

Cozumel?  Yup. Where the eye of Wilma was hanging out a few days ago.

They ended up on an “extended cruise to nowhere”.

We got this email from him this morning:

Well, if you hadn’t noticed, I’m not in the office today.   I’m currently somewhere in the Gulf of Mexico floating around in a brightly colored tin can.    Yesterday we hauled ass to make it to the Port of Tampa but when we were about an hour away the Coast Guard shut down the port due to tornado watches that had just gone into effect.

So, it looks like we will get in tomorrow but who knows at this point.  I tried to read my email earlier but it’s frustrating to say the least over this connectivity.   It looks like nothing is on fire so that’s a good thing.  I’ll check in later, make the subject line interesting or I’ll miss it.

Captain Kras 
 

Alex Eckelberry

 

Power to the p2ps

Content Delivery Networks (CDNs) like Akamai are the current way to deliver large amounts of content over the internet.  If you have a lot of bandwidth that’s going to be consumed, you’ll probably look to a CDN to help you.   For example, when BMW launched those cool online films a few years back, they used Akamai to stream the movies.  You’re talking massive bandwidth here — in BMW’s case, they had something like 200 terabytes of data viewed through Akamai.

But it’s the classic client/server model. 

The p2ps can change all that, which is one reason I’m so concerned about things like the Grokster ruling. We need innovation here, not fear, especially where you are looking at an internet with increasingly massive propagation of rich media.

Media analyst Phil Leigh just did an interview with the CEO of Kontiki, is a legitimate p2p delivery network. From Phil:

As Digital Media becomes increasingly central to the Internet, the economics of content delivery will become ever-more important. Conventional content delivery networks, like those provided by Akamai, have done a good job to date. In point of fact, Akamai is supposed to be mathematically the optimal solution available within the framework of a client/server architecture. However, Peer-to-Peer distribution may actually be a fundamentally superior architecture relative to client/server, especially in terms of the economics of content delivery.

Although Shawn Fanning’s Napster made “P2P” become a controversial term owing to the alleged abuses of copyright infringement, it is often overlooked that one of the reasons that it was successful was because of superior economics. In point of fact, it was so economical that a college student (Fanning) was able to launch a paradigm shifting phenomenon from his college dorm room.

Essentially a P2P network utilizes the existing storage and bandwidth of the community members themselves to both store and transfer the files. Therefore, there is no centralized storage cost and no need for extremely (meaning costly) broadband pipes to a group of central servers.      

You can listen to the interview here.  

Alex Eckelberry 

  

New threat simulator

M�rg�d logo ®

Note — this is only for highly experienced users.  Don’t play with this thing unless you really know what you are doing.

Although the security community has relied on the “Eicar Antivirus Test File” for years, the complex advances in malware requires a more modern and thorough threat simulation.  To this end the “DFK Threat Simulator” was created.  Bundling a declawed collection of dropper, rootkit, virus, trojan, spyware, keylogger, leaktest, and alternate data stream technology, the DFK Threat Simulator is a serious representation of the modern dangers facing computer users today.  A full description of this simulator, including screenshots and file download, can be found here.

Alex Eckelberry

 

Wilma

Sunbelt is very lightly staffed today if you’re trying to get a hold of us.  

While we are not in the direct path (we’re in the Tampa area), we did get some tropical storm conditions.  Last night, we advised all employees not to venture out if there’s any doubts as to road safety.  Also, since schools are closed, many parents have to stay home today to take care of their children.

The people who really got hit are down south from us, in Ft. Myers and Naples.  Now we’re seeing the eye venture over areas like West Palm Beach and it’s still a very strong storm (cat 2). 

It’s a pretty incredible storm, much like Charley in its speed but much larger. 

Btw—our weather right now is beautiful.  High winds with temperatures in the 60s.  We’re looking at a relatively “cold” Florida this week as we get down to the 50s.  

 

Alex Eckelberry

Watching Blizzard

I’m a little late on this one, but as a follow-up from my previous post on Blizzard and the Warden Client (which allegedly has spyware-like attributes):

Greg Hoglund (co-author of “Exploiting Software, How to Break Code”) has released a program called “The Governor”, which shows exactly what Warden is doing.

The fact is that the warden client reads information from other processes on the computer. Regardless of the reasons, this technically counts as ‘spying’ on a user. So, reasons aside, the term ‘spyware’ is fitting.

Rather than debate the morality of this behavior, I would like to give the consumers the power to make this decision for themselves. I am releasing a program called ‘The Governor’. The Governor is very simple – it watches the activities of World of Warcraft, and clearly reports which data is being read from other processes. The Governor makes no attempt to subvert or alter the behavior of the warden client, or World of Warcraft. The Governor will not assist you in cheating. The Governor exists for one reason, to tell you the truth.

Link here via EFF Deep Links (also worth reading).

Sfd2q34a

Alex Eckelberry

Free Vmware Player — Great news

VMware: an EMC Company

I saw something earlier about Vmware coming out with a new free player.  I didn’t pay it much attention — didn’t quite know what it was and didn’t have time to check it out.

Then I read ToaSecurity’s mention of it and realized…this is a Vmware that anyone can use.

If you do ANY spyware research, beta testing, playing with software, you need this.

We run Vmware ourselves but it’s usually too pricey for the average user.  

So now is your chance — get the free Vmware Player.  Link here.

And hats off to Vmware for doing this wonderful service.

Alex Eckelberry

Seen in the wild: 180 Active/X install

I’m starting a new series of blog posts, called “Seen in the Wild”.  These are various odds-and-ends we see during our research.

This was picked up today by Sunbelt spyware researcher Adam Thomas.  It shows a certified ActiveX install of 180 Search Assistant, offering “Free Porn Access By 180 Search Tools”.

What’s interesting is not that 180 was installed through a porn site (I suppose it’s something they have every right to do). Rather, it’s that the ActiveX control is so explicit in saying what the purpose of the install is (“Free Porn Access By 180 Search Tools”).  This is classic CDT stuff (CDT is the distributor 180 bought).

Incidentally, the install came off a crack site, which also sometimes passes you off to a Super Search page which installs various malware through an IFRAME exploit.

180adsfa_09

180df_90234 

Alex Eckelberry

LA Times article on 419 scams

Well worth reading.  Link here.

As patient as fishermen, the young men toil day and night, trawling for replies to the e-mails they shoot to strangers half a world away.

Most recipients hit delete, delete, delete, delete without ever opening the messages that urge them to claim the untold riches of a long-lost deceased second cousin, and the messages that offer millions of dollars to help smuggle loot stolen by a corrupt Nigerian official into a U.S. account.

But the few who actually reply make this a tempting and lucrative business for the boys of Festac, a neighborhood of Lagos at the center of the cyber-scam universe. The targets are called maghas — scammer slang from a Yoruba word meaning fool, and refers to gullible white people.

But what’s disgusting to read is stuff like this:

The e-mail scammers here prefer hitting Americans, whom they see as rich and easy to fool. They rationalize the crime by telling themselves there are no real victims: Maghas are avaricious and complicit.

To them, the scams, called 419 after the Nigerian statute against fraud, are a game.

…”Nobody feels sorry for the victims,” Samuel said.

Scammers, he said, “have the belief that white men are stupid and greedy. They say the American guy has a good life. There’s this belief that for every dollar they lose, the American government will pay them back in some way.”

They have no clue.  No clue about the many lives absolutely destroyed by these scams.  No clue about the hurt and harm they create.

Alex Eckelberry
(Thanks Sam)

Flock is here (sort of)

If you’ve followed the hype lately about Flock, chances are your interest is piqued. BusinessWeek recently wrote about it (link here) and there has been some buzz out there.

But no Flock yet.

Curious, I went to their website and signed up for notifications on the product. Yesterday, I got an email offering a “Developer Preview”, which I promptly downloaded. It’s available now — if you want to download it, go to their page.

Well, it is buggy but all in all, a nice browser. It’s mozilla based, but with a bunch of extras oriented around things like del.icio.us, blogging and flickr. In other words, it’s very much in the current zeitgeist of the internet.

I’ve only given it a quick whirl but it’s nice. 

Main124af

Flock has that Nordic icy look so popular in modern browsers.

Flockshelfflock

The Shelf feature is nifty — you just grab pics into it and then can drag them into a blog post.

Flockbrows

You can write blogs right in Flock, and grab text and graphics from web pages, which are inserted automatically.

Feel free to give it a whirl.

 

Alex Eckelberry

 

Sunbelt/Microsoft seminar on spyware

If you’re in the Miami Dade/Ft. Lauderdale area, feel free to drop by.  Registration info at the bottom of this post.  

 

01[1asdfasdf]
02asdfasdf23

 

Date and Time:
November 11, 2005
9:00 AM – 12:00 PM

Location:
Microsoft Corporation
6750 North Andrews Ave.
Suite 400
Fort Lauderdale, FL 33309
(954) 489-4800

Driving Directions

 

Click here to register.

Adware community cackles with glee

Law professor Eric Goldman has come out with an attack on the recent work of anti-spyware superstar Ben Edelman, comparing his work to the McCarythism and the puritan witchhunts.  

So here’s what happened:

In a recent writeup, Ben questioned Claria’s practice of buying advertising on networks that ultimately end up as pop-ups in spyware installs.  He gave two primary examples:

1. Claria purchased advertising through Zedo.com, which through a lengthy chain of other third party networks, ultimately ended up as a Claria advertisement popped-up after an install of ContextPlus adware (which, incidentally, was installed without Ben’s consent).

2. An advertisement by Amazon.com placed through Claria’s new BehaviorLink advertising network was shown through a pop-up from adware KVM Media.  (It got to the user through a Savings-Card.Com popup, which got the ad from BehaviourLink.) 

Implicit and explicit questions raised by Ben’s article:

a) Should Claria be advertising its products through adware that was installed with no consent, even through a chain of intermediaries?

b) Should Claria’s BehaviorLink network provide advertising that ultimately gets shown to the user through adware that has a history of being installed with poor notice and consent?

Before you answer that question, consider this:  You run a reputable company selling teddy bears.  You get approached by an advertising network that offers to get you lots of advertising on the internet.  They tell you they run ads through adware installs.  Would you still run the ads with them?  Or would you say “thanks, I’d rather just advertise on normal vehicles like CNN.com and yahoo.com”.

So have you answered that question? Most people would say “no”. 

So Ben’s question is valid: If Claria is trumpeting a cleaned-up image, why is it advertising its own (and its clients products) on adware that may not have been installed in the most acceptable fashion? 

Eric Goldman has a different take:

….That threat isn’t spyware; it is witchhunts where mere association, even if attenuated, equals guilt. We saw similar manias in the Seventeenth century witchhunts of Puritan New England, with the 1940s and 50s Red Scare of McCarthyism, and now with the latest round of zealotry, the anti-spyware crusade. I think each of us has the personal responsibility to vigilantly guard against the temptation of a taint-by-association mania and the resulting significant negative consequences it can produce for the falsely accused

…To be clear, I recognize that Claria, in theory, derives an economic benefit from the ad placed by Venus123.com and delivered via ContextPlus. But once again, SO WHAT? Everyone upstream from Claria derives the same economic benefit–its investors, its landlord, its Internet access providers, etc. Using this rationale, shouldn’t they be on the hook too?

…I would like to know: (a) the full universe of people who could be X (and does it include their vendors? customers? investors? employees?), and (b) is X’s responsibility based on the law (if so, which legal doctrines?), morality (if so, what moral doctrines?), blinding emotional outrage, or some other basis?

Ok, in the interest of fairness, it’s actually quite difficult to always control where your advertising ends up when you do a deal with a third party media network.  You buy advertising “inventory” and they deliver you impressions/clicks/whatever. But even a large online advertiser like AskJeeves actually has a policy not to advertise through adware products. Does Claria?  We don’t know the answer to that question (and anyone from Claria is welcome to post a comment clarifying that question).

So what is wrong with Ben questioning the fact that Claria is mixing it up with sleaze?  Since Eric uses comparisions drawn from McCarthyism and burning witches at the stake, let’s draw another parallel:  If you were trumpeting that you were cleaned-up, would you then advertise your products in a brothel?   I would call that a moral judgment, not a legal issue.  And Ben wasn’t questioning the legality.  He was implicitly questioning Claria’s judgement.  

The comment wars on Eric’s site have begun.  

Alex Eckelberry

Update:  I have removed the statement that Eric compared Ben’s work to the Holocaust.  Eric’s original blog quoted Martin Niemoller’s famous (and powerful) words about the Holocaust as a metaphor of how each of us has a personal responsibility to stand up for the falsely accused, because ultimately in such situations there’s a risk that we’ll be the next ones falsely accused.  Eric has since removed that reference from his blog.  

Click here for related SunbeltBlog posts on Eric Goldman

Note: Since I realize that not all the people reading this blog actually follow how online advertising works, read this for a quick primer only if you need it:  In the ad business, “inventory” means available advertising space.  When you place advertisements online, you often buy them through what are called “third party media networks”. These third party networks maintain an inventory of popups and ads on the web.  Examples of third-party advertising networks are Almondnet, 247RealMedia, Tribal Fusion, BurstMedia, Advertising.com, Zedo.com and ValueClick.  If you were a website owner and wanted to make money, you sign up with a third party advertising network which then displays advertising on your site and they pay you for that privilige (you usually have little or no control over what ads are displayed). Claria recently started its own third party network, called BehaviorLink.    

 

F-Secure on a new nasty

Something to watch out for:  From F-Secure:

Somebody has lately been seeding emails like the one pictured below.

www.thefive.us

Obviously, they are not from Symantec. And when you click the link, you end up getting redirected to a web page which will initiate an autodownload of a file called “rxBot.exe”, which is – you guessed it – a variant of the RXBot family.

A mail like this will pass most corporate email filters. There’s no attachment. There’s no masked link either, so phishing filters probably won’t detect it.

Read more here.

(Side note:  Stefan at F-Secure emailed me with a minor inadvertent error on their part — this is actually a variant of Rbot – not Rxbot, and they have a description of this naughty little thing here.)

Alex Eckelberry

Seen on the web

One of our techs, Jon Petita, had this come up on a customer’s computer that was infected with adware.  Internet Explorer was not open.

I presume (hope) that the Navy marketing department is unfamiliar with the fact that ads placed through certain media companies may just land on a user’s desktop through adware.

The url for the ad is

http://banners(dot)pennyweb(dot)com/E1/C18443/ifrcr_E1_C18443-3/creative(dot)html?pw_click=http://ads(dot)addynamix(dot)com/click/2-2129370-1-18443-30018-1129732382?

 

Nacc2342

Alex Eckelberry

Beta launch of the Sunbelt Underground

Header_03[1]adf

The Sunbelt Underground Network is now in beta.  This is a site that tries to give people a feel for what Sunbelt is like on the inside. At the Underground, you’ll find videos such as these:

Silly Putty Physics Experiment
Ever wonder what would happen if you dropped 50 lbs of Silly Putty from the 7th floor of an office building? Wonder no more as our crack team of Sunbelt Scientists take the challenge.

View Video | 2:03 | AVI – Low Res
View Video | 2:03 | AVI – High Res

See The Photos
View Photos Of The Experiment

All-Access Pass
Take a tour behind the doors of Sunbelt Software.

View Video | 16:37 | WMV

Our corporate motto is do it fast, do it right and have fun while you do it. On the fun side, Sunbelt is also famous (or infamous, depending on your take) for its Halloween get-ups.  Halloween is a BIG day at Sunbelt, and you can see some of our past Halloween pics at the site as well.

 

 

 

Take a look and check back on a regular basis.

Alex Eckelberry