Slashdot Mirror
GoHip.com ActiveX Wreaks Havoc
This story popped in several times in the last couple days and it's pretty slow today so I figure it'll be good for a laugh. Apparently GoHip (no relationship to Goku or Gohan) had some sneaky ActiveX that a lot of people installed. Kinda a scary security situation right there. Makes me glad I don't have any of that OL- I mean CO- I mean ActiveX on this box.
... bending over and grabbing your ankles in the prison shower.
and under UCITA, this business practice would be perfectly legal (and no doubt Amazon will shortly patent it...)! After all there was some form of contractual "consent" through a click through license agreement, from what I understand from the wire article, and of course (changed) terms were actually posted SOMEWHERE on the site. What more could we ask of a potentially UCITA compliant slimeball company??
The moral of the story is to go to Internet Options --> Security --> Custom Level on your IE browser and turn off ActiveX.
Marjo Wycam, Master of the Programming Arts
1) Read through all of the source of the installer, or
2) Have software that warns you about every change to your system,
there is a chance that the software is editing some part of your computer that it shouldn't. In short, this isn't just a company abusing ActiveX--this is a company abusing basic software practices.
Personally, I call software that changes my outgoing e-mail without my consent a virus...
~=Keelor
...as bad advertising.
Having read abvout what a nasty and insidious thing this company did, I went to their web site to see what they do. Before I hadn't heard of them. I'd be surprised if they didn't get a few more customers from this.
I love the "ActiveX gets put in your system folder and started every time you start your system." That's some good fact checking. I presume they meant to indicate that an ActiveX download could install a back door which would set itself to load everytime you start your PC...
ActiveX is a superb technology for intranets, but it has absolutely no place on the open internet apart from extremely high quality/high credibility sites. Then again despite all the anti-MS rantings that will undoubtably come of this, ActiveX is in a nutshell simply an EXE that can be embedded. There's nothing more insidious about ActiveX than that link of blooblemeisters.com "Download the new management console for your Linux machine here!".
As a sidenote: There's an ad running at the top of my machine for penguin computers showing a giant penguin stepping on the Redmond campas. Are all these companies so bloody insecure and defensive? Really these ads are pathetic. Is there an IS manager out there anywhere who is such a loser he'd buy a machine because the ad shows it stepping on Microsoft? That's uber lame gentlemen, and anyone who is motivated by such things should seek medical help.
Cheers!
Horray for Pokey!
Spoon not. Fork, or fork not. There is no spoon.
The real morale of the story?
Trust nothing. Trust no one on the 'Net. You don't get something for nothing, so stay away from sites that offer anything "free." It's most likely a scam.
READ those agreements before you click on 'Accept.' You'd read a contract before signing it wouldn't you? Under UCITA those click agreements just might become legally binding.
Most of all, don't use IE and don't use Windoze. You don't need ActiveX or any of that other flashy shit to use the WWW.
Disable anything that allows some site to run code on your machine. Use SSH. Use crypto. Encrypt your hard drive. Lose your keys, and then your data is even safe from your own prying eyes.
Be paranoid, be very paranoid.
Install from source, not RPMS. Read every line of code. Make sure you understand what every line of code does in a package before you type "make." Know the code better than its maintainer before you even dream of running it.
Knowledge is power. Forewarned is fore-armed. An ounce of prevention is worth a pound of cure. Pick a cliche, any cliche, and apply it to evey situation.
The truth is...out there.
Just be sure to wear the gold uniform when you beam down -- you know what happens when you wear the red one.
First, in the article, those "fine print software agreements" were discussed...the legal validity of such have been under question for a while now. Due to various legal details, those "click Next to continue installing" agreements are considered by many to be too automatic and do not require enough action on the agreeing party to be legally binding...
Second, I was amused that GoHip.com considers what they do a Browser Enhancement.
Third, ActiveX ever since it's first incarnation has been horribly gigantic a gaping security hole. Anyone even remotely self-respecting computer security-savvy individual would never dream of having ActiveX enabled on their computer. Unfortunately, the average Joe might not know this...hopefully, they will be educated in time.
Here's one (of many) place I definitely like Java a whole lot better...
Fourth, in the end, this really isn't that big of a deal, as it was relatively benign. Hopefully, however, it will educate people as to the dangers of ActiveX, in general. I think David Kroll said it best: "I think it's pretty tacky what they did". Although he and Finjin did get it wrong when they said: "this is the first time a company has used ActiveX to alter personal information on someone's computer." Just see the ActiveX Exploder link mentioned above! I think they'd be more accurate in saying this is the first time it's been done purposefully and on a large scale by a corporation.
Fifth, this reveals an interesting problem with "signing" such programs with things like Verisign. That signature doesn't really mean as much as most people think that is does, as Verisign said: "Verisign spokesman Gray Chapman confirmed that GoHip is certified by Verisign, but stressed that his company was not in the business of passing judgment on the business practice of its client."
Sixth, GoHip.com sounds horribly sketchy. No phone numbers, bouncing e-mail addresses...is anyone surprised?...But finally, I have to admit to being horribly amused at the final quote by one of the "infected" GoHip.com visitors: "I compliment GoHip for a fine marketing effort as I certainly know who they are. I hate them, but I know who they are". In the end, capitalism seems to be all that matters again...
I think the main problem here is the award of a digital signature to something that obviously is set out to cause anoyment. Personaly I like to power that the ActiveX controls allow, such as the windows update control which checks what updates you need automatically, however unless there is a reliable organisation looking at the controls then it is no longer going to be possible to trust anyone.
What are the requirements for getting a digital signature? Has someone actually tested the control on their system and decided that the changes it makes are suitable or is the process more a foregone conclussion. Companies simply going through the motions to get the signature?
-- "Outside of a dog, a book is a man's best friend. Inside of a dog, it's too dark to read."
Personally I think Dragonball references are Kahamahilerious :)
Finkployd
On a practical note, here's what I keep telling the people;
1. Turn off these everywhere...
HTML (except the browser)
Java
Java Script
Active-X
VBA or macro features
Anything similar to the above
2. Cookies - Delete it and recreate a new unreadable cookies file.
3. Never open any message unless you...
Know the person sending it
Expect the message
4. Move all mail to a Spam/Suspect/Trash folder automatically if the mail doesn't pass these two rules at a minimum...
It's from a known and trusted person or mailing list
It's addressed to one of your valid mail addresses; it's not from a mailing list
5. Remove all personally identifying comments from programs that have net access (Netcape's Mail Identity page, ...)
6. Don't give out your email address unless it's REALLY NECESSARY.
7. Use different email addresses for different types of mail; business, personal, ....
8. If you have to give out an email address for one-time use, tag it; /. asks, use something like slashdot_yanky@hotmail.com or some such (or better yet, get your own domain and mail server...quite handy!)
The best way to handle this is a firewall with filters. Remember, Procmail For Security and good ipchain rules are your friends!
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
The long term solution is to set your bios to boot from A floppy first, put in the RedHat install floppy and the install CD, and your troubles are gone for good. With the Gnome interface that comes with RH 6.1, Windows users will have no trouble coming up to speed.
The only "downside" is that you will be able to tell who is using broken MS software: their apostrophes will be displayed as question marks.
And no, I'm not trying to exclude distros other than RH. It's just the one I am familiar with, and have found very easy to install. So I think it's a good choice for the new user.
Moohahaha! There's nothing more satisfying than waking up to Anime references on /. on a Sunday morning. :-) After my Neon Genesis comments to an article about implanting consciousness in a computer received a pathetic +1 Funny, this is some sort of vindication. ;-)
Way to go, CmdrTaco!
There I was thinking that ActiveX was a bad idea simply because of the dozen or so exploits I have seen announced ZDNet over the past few months (visit the Windows Update site sometime and count all the IE 5.0 patches).
.exe mind you) have the ability to modify system files on my machine? At least Java browser apps work in a security sandbox and cannot affect system files.
Actually I'm lying, the real reason ActiveX is a bad idea is that it gives waaaay too much power to in-browser apps. Why would I want a plug in I download from a website (not an application or
I run a dual boot system here ( Linux / Win95 ) since I have some occasional guests that are a little afraid of Linux yet. I was absolutely incensed when I found out they had run across GoHip, and it had mucked with my system. I fired off a complaint to every one of their upstream providers, and the computer crime section of the FBI. As far as I was concerned, GoHip had run an exploit on my system, cracked it, and performed unathorized and hostile modifications to my files.
There is no longer a web browser available under Win 95 on my system. My guest will just have to overcome their "fear of flying" and surf under an OS that I can lock down.
Told ya -- Evangelion (Neon Genesis Evangelion) just mentioned one comment below.
Contrary to the popular belief, there indeed is no God.
There are just too many sites out there that use this stuff. Sure Javascript, Java, Active-X, etc. all have security issues. But every time I go disabling any of them guess what happens? My wife goes to use the computer and tries to bring up Playsite, or Uproar, Sony Play Station (etc etc), and what happens? Nothing works! Then she gets mad and I have to re-enable all that stuff.
;-)
The only real solution I see for myself personally is to simply have a separate computer for browsing the net. Computer are cheap these days, and how much resources does a computer need to browse the net? Since nothing important is kept on the net browsing computer these security issues don't really matter much to me. And having to reboot periodically isn't a problem either, since all the real work is being done on a more powerful machine else.
It makes for a lot less stress too. Heck if I did all the things some people advocate whenever a story like this comes up I'd be a paranoid cave-dwelling hermit!
I'm not a journalist, but I play one on slashdot
Cookies - Delete it and recreate a new unreadable cookies file.
Well, since you're posting on slashdot as a logged in user, you're obviously hypocritical on this one. Why not instead tell them to run something like junkbusters that'll actually let them control what cookies they want instead of just blindly and across-the-board killing them all?
"If one is really a superior person, the fact is likely to leak out without too much assistance" -- John Andrew Holmes
that GoHip tells you exactly EXACTLY what they are going to do with your computer in its download agreement, but these people are 'too busy' to read it and 'feel they shoudln't have to'!
I don't see GoHip forcing people to their website and forcing them to download this stuff. Yet another example of personal responsibility taking a vacation within the walls of slashdot.
Here is their info from the WhoIS registry. Also the USPTO registration.
Registrant:
Alchemy Communications (GOHIP-DOM)
9610 DeSoto Ave.
Chatsworth, CA 91311
US
Domain Name: GOHIP.COM
Administrative Contact, Technical Contact, Zone Contact:
Administrator, DNS (JH334) dnsadmin@ALCHEMY.NET
Alchemy Communications
9610 Desoto Ave
Chatsworth, CA 91311
(818) 718-0366 ext. 402 (FAX) (818) 700-2835
Record last updated on 14-May-1998.
Record created on 14-May-1998.
Database last updated on 26-Feb-2000 12:35:37 EST.
Domain servers in listed order:
NS1.ALCHEMYFX.COM 209.132.221.21
NS2.ALCHEMYFX.COM 209.132.221.22
About Alchemy, GoHip's host/ Parent Company
:Alchemy Communications
1200 West 7th Street, Suite L1-100
The Garland Building
Los Angeles, CA 90017
TEL: 213-596-3000
FAX: 213-596-3004
Email: goldensales@alchemy.net
PTO Trademark Registration for GOHip
Word Mark GOHIP!
Owner Name (APPLICANT) GoHip, Inc.
Owner Address 8306 Wilshire Boulevard, #54 Beverly Hills CALIFORNIA 90211 CORPORATION CALIFORNIA
I think Microsoft's motto should be:
Where did our software take you that you didn't want to go today?
kwsNI
Obviously we can't trust users, crackers, or corporations to keep things safe. If a service is available in the browser or the OS, it will be abused and the user -- who is responsible -- will only get confused when things go wrong. They are to blame for not doing something, but we all know they won't do anything till it's too late.
What's left? Patch the browser using a binary editor or other tools. Here are some things to do to get started. But, what to patch? (I had a list of 6 places to patch, but can't find it on this machine...maybe the one at home.)
To give you an idea, a quick check of main netscape binary (Linux) shows 200+ points where Java Script functions might be patched, let alone Java;
strings netscape | grep "JS_" | wc -l
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
(puts on glasses)
(removes all traces of expresstion from the face)
"I am your father".
Contrary to the popular belief, there indeed is no God.
Did you see the terms and conditions?
I especially like the part under "E-Mail."
Your acceptance of the "Free Video Update" browser enhancement constitutes your agreement to receive periodic communications from GoHip! and THIRD PARTIES, via e-mail.
So, you have no choice but to let them sell your email address to spammers. In fact, you agree to this when you click "Accept" on the license agreement that nobody reads. This has nothing to do with ActiveX security of course, but it's just more evidence that GoHip is run by criminals.
-CausticPuppy "Of all the people I know, you're certainly one of them." -Somebody I don't know
Hey. did I say almost as bad as Pokemon? Actually, the animation is worse. ;-)
I am the Lord.
I am the Lord.
God Hates Moderators.
Pablo Nevares, "the freshmaker".
Pablo Nevares, "the freshmaker".
It seems like it has become necessary for the operating system to protect the user from malicious net code - just about everything downloaded from the net should be automatically locked into an operating system-supported "virtual machine" where all resources are released when the user shuts down that connection.
Applications which want to be persistent on a user's machine will have to ask for permission, and if they further want access to certain system resources, they will have to ask the user for permission to hook into those resources (and which resources they are hooking into) - all protected by the operating system.
Of course, this will not protect naive users from social engineering, but the _default_ behavior will be of protection rather than being wide open - and in the case of multi-user systems, then the administrator will be able to control how much access each user will allow the outside net to access system resources.
The problem, the issue and the greatest need in the internet community is user education. Period. Odds are, that if you're reading slashdot, you know at least enough that you're aware of the security issues involved with something like Active X, but does your mom? Does your sister? Do your customers? What we need to do is lay out a set of safe surfing practices. Practical ones get the average, or even the less than average web user educated enough to follow those practices. Then we'll see these sort of practices decrease, if not actually wither and die. Practical safety procedures, they have to be practical in the sense that we must make sure and offer our grandmothers an alternative to sending you those .exe greeting cards, show them how to point to a URL so you can download elfbowling for yourself, teach them that there are animated greeting cards online that are safe. It is NOT enough to tell them that "that's lame, you don't need to do it" we have to tell them *WHY* and show them a safe alternative.
Nice. ;-) (I was the Gendou at Otakon 99.)
(...well, there were a couple others. But they were only there on Saturday morning. So I win.)
I'll be there again this summer. Unfortunately, the number of Reis is diminishing, so I'll have to start molesting Lains. Lain is the theme this year, so I'm sure to have better luck.
I am the Lord.
I am the Lord.
God Hates Moderators.
While GoHip isn't too great, there is already a company out there called Aureate, who bribe shareware and trial program vendors to install a few files on your system, along with the main program. These files (look for advert.dll) sit around as IE and Netscape plugins, and spy on everything you do, from personal registry information to every url you click on.
I could post a list of exactly which vendors install this thing, but it's too long. (GetRight and Globlascape Cute** probably being the most ocmmon source). If I were you, and using any windows based o/s, I'd look for advert.dll. Deleting it only partially solves the problem, but it's betetr than nothing.
YAHHH!
Yes another Evangelion fan. Have the two movies been released in the U.S. ? Some excellent computer graphics and risk taking in the film versions.. had a special meaning for lots of psychologically scarred Japanese youths. Female characters are interesting too.
Is there a way to view this page without crashing your computer?
Your acceptance of the "Free Video Update" browser enhancement constitutes your agreement to receive periodic communications from GoHip! and THIRD PARTIES, via e-mail.
....and you authorize us to invade your mail client to root out all your e-mail accounts stored therein??
And how in the world do they get your e-mail address? Should they add a line in there saying
Pablo Nevares, "the freshmaker".
Pablo Nevares, "the freshmaker".
I got the entire series and the movies on VCD on eBay. I also got the infamous fan dubbed English version. If you want to watch the movies, but don't speak english - you may be out of luck. Ayanami Rei is... hehehe, I want to spoil the movies, but I won't. ;)
I would probably support a moderation of the above as redundant (story says company uses ActiveX to &$%#!& over computer users, poster says having ActiveX on your computer will &$%#!& you over), but I'd really like for the person who considered it off-topic to log off and post as AC (to avoid undoing their moderation) and tell us why they think it so.
I see even classic Slashdot is now pretty much unusable on dial up anymore.
Always Read The Fine Print--before you sign anything, whether it's with the flourish of a fountain pen or the click of a mouse. And keep in mind that when someone offers something for free, they mean according to their definition of the word, not yours.
I see even classic Slashdot is now pretty much unusable on dial up anymore.
For those few who might not know, the moral (noun) of a story is the point it's supposed to get across. In olden days stories were told to get across the point that one should be a person of "goodness or correctness of character and behavior", that is, that one should be moral (adj.)
Hope this improves everyone's morale.
I see even classic Slashdot is now pretty much unusable on dial up anymore.
Where can we get more information on this practice? Is there a link to a more detailed story somewhere? I didn't find advert.dll on my machine, but this still pisses me off (though as long as I don't catch this from Paint Shop Pro I won't be _hopping_ mad...)
Freedom: "I won't!"
Suggest either "damn it" (formal,two separate words,) or "dammit" (one made-up word, informal, colloquial, vernacular, slightly less vehement type thing).
I see even classic Slashdot is now pretty much unusable on dial up anymore.
from the story
'..."I compliment GoHip for a fine marketing effort as I certainly know who they are. I hate them, but I know who they are," he said.'
I see even classic Slashdot is now pretty much unusable on dial up anymore.
Sorry.
I am the Lord.
I am the Lord.
God Hates Moderators.
I decided to try this out. Mainly to see if the patch MS posted a few months ago to stop this sort of thing (i.e. ActiveX inserting arbitrary code into your StartUp directory) actually did.
It doesn't. Apparently all it does is stop *unsigned* ActiveX from inserting arbitrary code. Now, while that's certainly an absurdly necessary thing to have done--and it does stop the most major abuses of that ActiveX hole (eg. the Bubbleboy Outlook/OE virus)--I think it's pretty damn ridiculous to assume that any program should be able to stick arbitrary code in my StartUp directory just because it's signed. Or that it should be able to make changes to my registry without asking, as gohip's code does as well. (But don't worry--when you download their program to fix your registry (which does work, BTW), it pops up a cryptic looking dialog box asking if you really truly want to make changes to your registry.)
The sad thing is (flamesuit on) I actually *like* a lot of the ideas behind ActiveX--namely that it might be a good idea to store applets on the client side instead of having to download them every time you visit a web page--and I've seen some pretty nice uses of it. (eg. the dynamic hierarchical news menu on MSNBC. Of course, being ActiveX, don't bother trying to check it out unless you're running IE 4 or 5 on a Windows box--last time I checked, it doesn't even work in IE 4.5 for Mac.)
Unfortunately, its outrageous lack of cross-platform compatability and its moronic-to-criminal lack of safe security privilages have nearly killed off some actually sorta neat technology. Oh well.
Anyways, I hope this incident will point out to some people who've pretended otherwise what a farce "signed" code is. On the web, you don't know who to trust. As anyone who thought about it could have predicted, the danger isn't some 1eet hax0r somehow piggy-backing his trojan onto your connection with some Nice Commercial Website...it's the Verisigned trojan that Nice Commercial Website is asking your permission to install.
the moderator is an ass. He couldn't recognize sarcasm if it bit him in the ass.
While that's probably true, I wasn't being sarcastic. ;-)
No, it's true! I have no idea what sarcasm even is! Really!
Oh, I also don't know what what irony means.
I am the Lord.
I am the Lord.
God Hates Moderators.
Did you mean rogue domains or do domains come in different colors these days (or were you referring to "abrasive" domains, or "domains with a jewel-like polish"?)
I see even classic Slashdot is now pretty much unusable on dial up anymore.
The new laws governing shrink-wrap licences not only make this legal, they also make articles like this, pointing out what is happening, -illegal-.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
That's why when I leave my house I leave all my doors and windows wide open with a security camera on each entrance - after all, I can always always figure out who took all my stuff later, right?
Similarily, when I step away from my car I leave the doors unlocked, keys in the ignition, nad the engine running - then I hand a camera and a notepad to some bystander (VeriSign) and ask them to please take a photo and ask for information from anyone that should enter my car.
How much do YOU trust VeriSign to really determine if the people getting certificates are who they say they are? Do you really support a protection racket that demands every company on the planet give them money to present the illusion of security?
I'm not advocating anything apart from a dislike of VeriSign.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I had not heard of these people before your post, but would like to get more details/PROOF if this is true. Its not that I don't believe you, EoRaptor, and frankly it would not suprise me either...
See this link on Aureate's website, saying this is just "rumors": http://www.aureate.com/privacy/addi tionalq.html.
I can say that from looking around their site, this definately doesn't look like something I'd want if I were running windoze. But does it really do everything you said?
~J
Well, I read some of the stuff and then found advert.dll. Took me a while to get rid of it.... Tried to delete it, can't in use. Tried to use regsrvr32 to unreg it. Couldn't. Rebooted and it was still in use, even though no 'net apps had been launched! Finally booted to a c: prompt and deleted it from there. Geez.
---
DO NOT DISTURB THE SE
Thanks for the suitable reproof. As the author of the error I am suitably embarassed, but for good purpose.
One wonders whether I used 'reproof' correctly. Methinks it perchance ought to have been 'reprove.' But I know not of what I speak, me being a mere apprentice to newbies in the vineyards of computerdom.
Marjo Wycam, Master of the Programming Arts
Guess what alert I get when I click on the story link? 'An ActiveX control on this page is not safe. Your current security settings prohibit running unsafe controls on this page. As a result, this page may not display as intended.'
Anyway, Aureal says that the rumors are false, and I for one am inclined to believe them. From what I can see, the programs that install the .dll are ones that display a banner ad in the software itself (I know CuteFTP and GetRight do this). So it seems legit that what they're doing is just targetting those banner ads.
On the other hand, I couldn't delete advert.dll (access denied) until I closed IE, so I wouldn't be surprised if it was tracking some kind of surfing info. Also, I was none too pleased about finding the .dll on my HD and Aureate keys all over my registry even after uninstalling the offending programs.
Jerry Pornelle has a letter from Aureate Media about this.
Down in the second letter, the company responsible Aureate Mediab writes back.
Linux is only free if your time has no value. Windows is only free if you threaten to use Linux.
window.external.ImportExportFavorites(0
</script>
When verio unblocks my IP address from their routers, have a look at my fanmail page for the comments of some people whose browser was buggy enough to actually execute this command.
--
I noticed
--
I noticed
It's getting about time to leave everywhere
Thanks for the suitable reproof. As the author of the error I am suitably embarassed, but for good purpose.
One wonders whether I used 'reproof' correctly. Methinks it perchance ought to have been 'reprove.' But I know not of what I speak, me being a mere apprentice to newbies in the vineyards of computerdom.
Go to Preferences|AutoCorrect|Grammar and turn off Anal.
======
"Rex unto my cleeb, and thou shalt have everlasting blort." - Zorp 3:16
Sacred cows make the best burgers.
Sysadmis see that most of their visitors use Microboft and have fewer reasons to object to Microboft only enhancements. It's all some PHB needs to see in conjunction with some BS advert that promises seemles ecomerce with Win2k, blah blah blah.
Why fight it? Surfing is not really that important, I don't have anything to hide, I don't really need those crapy comercial sites that won't work with open standards, who cares if Microboft screws my trash 486, right?
Wrong! Sysadmins need to have direct evidence that Microboft only "enhancements" will keep people off their sites, if the web is to remain open and accesible. Language barriers are a bad enough fragementation, but one that can be overcome. Giving up the web to an insecure opperating system is even worse than fragmentation. Where I've been and how I get there are no one's business but my own. It is really agrivating to think that the sites I visit might be recorded with less effort than recording the books I take out from a public library or the physical places I visit. Sooner or later, someone will write an application that can mount my other hard drives and blow them up too. Even a 386 can be used to break my real machines.
But how to fight this? Your compiler itself can be a Trojan Horse. I don't have the time to chip into Mozilla yet, do you? Sure, I don't visit sites that break my browser, but my wife does.
What entitles them to take such actions at all?
It might be vaguely arguable that anybody can come into your computer on the slightest pretext of having your consent, and change your homepage to theirs. That is intrusive, it is an imposition, but it is simply what _you_ see when you launch your browser. The most serious damage would be if you had a special homepage, kept no record of it and couldn't find it again: then you'd have suffered a loss due to this company's defacement of your property.
However- changing an _email_ sig? On the one hand this is just a line of text. On the other, it's a piece of text that is how you present yourself to the world, and the safe assumption is that this is a bit of text you intentionally chose to tell the reader something about yourself or what you consider important. In that light, the action this company takes is beyond inexcusable. It is like identity rape: to this company, not only is your computer's data not your property (so it can be freely tampered with for their benefit), but YOUR IDENTITY is not your property. The way you present yourself to others via electronic media is not your property! It is so inconsequential to them that they figure a mere 'sorry!' is all they owe you for hijacking parts of your IDENTITY for their own pleasure.
Again, it's one thing to examine the security implications, and the ways in which ActiveX can be used to build this behavior deeply into the system, making it hard to remove. But when did personal property become so meaningless that a stray click on a web page _allows_ a company to totally butcher your personal data for their own benefit?
Do you have a right to have your data for your homepage untampered with unless you explicitly and knowingly give permission for it to be altered?
If not, do you have a right for all of your writing to be untampered with, for instance if you downloaded some sort of grammar checker only to find that it runs and edits every ASCII file on your system that it can open? Is this a case of 'you should have kept backups' (let's hypothesize that it goes and edits all the backups too) or does this begin to look more like destruction of personal property?
Along the lines of this article, do you have a right for your email signature to be _your_ choice? Is it allowable for any joker who can get you to click on a clickwrap license to sneak in their own agenda, sigged to your mail as if it was your own agenda, so your friends can assume that you choose to 'push' this product or service? If so, is it then allowable for the clickwrap license to authorise the software to _send_ MLM-like mail to addresses on your mailing list, intentionally assuming your identity for the purposes of marketing, all in the background so the first you know of it is that you lose your ISP account for spamming, or lose friends over what they think you started doing?
It is informative and disturbing that this company already goes _almost_ to that extreme, and not as a joke. Surely the next step is intentional impersonation of a computer user, and marketing emails sent as if they were from that person- all sanctioned by the clickwrap license. It's almost here- just one tiny step from what GoHip is doing. It's so close...
And when that happens, I hope more people understand that this is not a security issue. It's not _about_ whether or not you are willing to psychologically barrier yourself in a concrete bunker, defying anyone's attempts to harm you.
Instead, it's about property rights, or a citizen's rights. It's about whether a regular person should even have to be concerned about these abuses. At the moment, in the computer industry, when you read about abuses like this, the first thought is "Security, so that you can stop people doing this to you, as they will no doubt try to do!". And that tells you something- because you never see anything to the effect of, "Screw security- this action is a crime against the person's property and an abuse of his identity. Click or no click, this is criminal! You're not allowed to hijack a person's identity and use their reputation as a marketing tool while trying hard to not alert them to it, and fighting their efforts to stop it happening!"
Am I off base here? Is it really so much to ask, to suggest that a person's arrangement of computer data is property, or at LEAST that the person's reputation and interactions with others is their property, and there is no intrinsic right to hijack that for profit? Not everything that is _possible_ and _profitable_ is legal. In this case, I can't think of a single thing more clearly property than a person's interaction with others, and their ability to determine how they express themselves. Suppose these same bright sparks at GoHip chose to globally replace the word 'video' with 'video (speaking of which, you have to check out GoHip.com! They're great with video)'? That is absolutely trivial, not so far from what they're doing now, and is absolutely, unarguably identity rape.
Is anybody ready to argue that this is defensible, or is strictly a 'security' issue where you only deserve the freedom you're ready to actively fight for? Does anybody seriously think this is 'opt-out' territory, that it's legitimate or right for any person's self-expression to be hijacked for commercial purposes?
If this goes on, forget watching TV and seeing 'the wrong' huge billboard on ESPN or in Times Square- it will be a world where you cannot even trust your own friends. Any of them could be speaking through a software filter that drastically changes what they say, and they would have no right to argue with this and no recourse except total paranoia. Even then, can you control _all_ the points your message passes through? What good will your security do you when your recipient has inadvertently installed a filter that changes your message _coming_ _in_, so that to their eyes, _you_ are the one saying "video (by the way, GoHip kicks ass!)."
Security is _such_ the wrong perspective to take on this stuff. This is civil liberties territory- and already shockingly close to paranoid fantasy. Yet it's not fantasy- people are _already_ having their identities and personal reputations hijacked by GoHip for marketing purposes, and this is seen as legitimate behavior, nasty but legal to do. How much farther do they have to go before the real issues are obvious?
In the past couple of weeks I have noticed that there seems to be an increase in the presence of irrationally pro-Microsoft posters on Slashdot-- at least there seems to be more of them than there have been in the past.
Some of them have actually logged in-- that is, they have not posted as Anonymous Cowards-- probably so they will have the chance of becoming moderators. There are several of those that have logged in who have posted many (more than twenty) times in the past couple of weeks. If you look at their User Info, it is not hard to discern which of them have hard and set bindings to Microsoft, from clues they reveal on their personal websites. I shouldn't wonder that they gain moderator status occasionally.
Can't you just picture Master Gates, or one of his wranglers, ordering the masses of Microsoft minions to "infiltrate" Slashdot and make posts to "defend Microsoft's honor" if they want to keep collecting their paychecks?
All of the evidence seems to indicate that Microsoft is approaching a state of panic these days.
Erchie
I wouldn't have a problem with Microsoft Active X components installing automatically no matter what the browser preferences. Unlike every other company in question, I am already running Microsoft software, probably at least 150 megs of it, if I have IE with ActiveX. Does anyone know how to modify IE so that it identifies itself as the Mac version?
I never read these "click-wrap" licences - but I do so at my own risk. Mayby everyone shuld take a little more responsibility for themselves.
Get the Hell off my planet, you slimy mobster Bush!
Paranoia is a bad thing... Have a beer.
ActiveX controls are not any more of a security hole than any other executable.
The problem is that many Microsoft programs (such as Windows, MSIE, Office, etc.) blindly trust certain kinds of ActiveX controls, allowing them to install and run, without prompting, even if you have ActiveX "disabled" in MSIE.
Regular programs don't do that.
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
I still fail to see the qualitative difference between an ActiveX control and a Netscape plugin...
How about the fact that a Netscape Plugin cannot download and install itself without your permission?
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
its gokou, like you care...
Seems to me that installing the GoHip ActiveX is the same as clicking on HAPPY99.EXE. You're running a program that you got in email. Don't do that!
--
Someone at slashdot.org, please fix up Extrans posting - having to use HTML for everything (or not using formatting at all) is annoying.
:-)
Apparently (this is guesswork), someone at Slashdot had them switched around by mistake for the longest time, but noticed recently and "fixed" it.
Plain Old Text pre-processes your comment, adding <BR> tags at the end of every line, but otherwise leaving things unchanged. Thus, you can mix text-style fixed formatting with HTML tags, as the tags are still interpreted by the client's browser.
Extrans pre-processes your comment, converting all HTML symbols to their escaped equivalents (e.g., < is converted to <). Thus, you comment will be displayed exactly as you entered it, character for character.
HTML Formatted doesn't do any pre-processing at all, other then to remove some HTML tags Considered Harmful.
Get it?
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
I have a friend who uses CVS to maintain his Windows partition. (CVS is a program which is normally used to manage large trees of source code and keep track of changes made to them). That way, he can see all the changes an installer makes, and he can just roll the changes back if he doesn't like them.
perl -e 'fork||print for split//,"hahahaha"'
Use the delete option.
You know.. Verisign did nothing wrong here.. but here's my beef with the way certification is handled these days. The public accepts what it shouldn't. Here's why.
When browser came of age, and security was of great concern, if you recall, the main hubub was about credit card information, and how SSL protected it. In other words, ask joe average internet user what certificates are for, and he'll say 'for encryption, so my credit card doens't get stolen by hackers listening in on the line'. That's what the press implied, and that's how people thought.
Now.. the REAL reason the certificate system works as it does is a bit different. It's not for the encryption, but for the authentication. A properly signed Verisign certificate, presented by CDNow.com is supposed to let you know that CDNow.com *IS* CDNow.com, and not an imposter. It's supposed to let you konw that they are a real business, and that they have proven this, with legal documents, to Verisign. This is why Verisign 'signs' the certificate.
You see, it was never supposed to be about granting encryption priveleges; only about authenticating the merchant.
So. Technically, we think it's kind of necessary to have a Verisign for commercial transactions.. but they rose to power based on the fact that people thought it was necessary JUST FOR ENCRYPTION (and hey.. if you didnt' have a verisign signed cert, browsers would bitch... so in the publics eye, you were not trustworthy if you didn't have their signature).
Fine. For financial transactions, fine. My security and piece of mind comes from knowing that Verisign says this company is real, and I have someone to chase down when they overcharge my card.
Now.. software... Verisign signing software? Why? To prove it came safely from the download site to my HD? WHy do I need a verisign to do that?
IN E-commerce, verisign fills a need.
With downloadable software... like Active-X, where the security model kind of SUCKS, it would make much more sense if that signature implied omsething, like the software provider has guaranteed that this software follows certain guidelines... etc.....
Regular programs require more work to install. Remember that while the Joe Sixpacks of the world might remember running an install program, they probably won't remember allowing an ActiveX control to run and they'll have no way of knowing that, because they checked the "Always trust $CORP" box six months ago, they just ran arbitrary code a few minutes ago. The problems come when you consider how many people have checked the "Always trust content from Microsoft". As pointed out on BUGTRAQ, this will allow controls from Microsoft to be installed transparently. Bad, but it's not the end of the world, right? Consider that someone could use this to install an older version of a Microsoft control with a known vulnerability. Ooops. Maybe IE6 will fix it.
Nice costume. I'm thinking of going as Ohminae Yuu (Spriggan) to the next Anime Expo.
---
Oper on the Nightstar
Hey, Shouldn't slashdot have a anime category? Or at least a cartoon category that maybe throws in news about the simpsons and south park. . . Just a thought.
18 USC 2701. Unlawful access to stored communications
(a) Offense. - Except as provided in subsection (c) of this section whoever - (1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or (2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided in subsection (b) of this section.
(b) Punishment. - The punishment for an offense under subsection (a) of this section is -
- (1) if the offense is committed for purposes of commercial advantage, malicious destruction or damage, or private commercial gain - (A) a fine under this title or imprisonment for not more than one year, or both, in the case of a first offense under this subparagraph; and (B) a fine under this title or imprisonment for not more than two years, or both, for any subsequent offense under this subparagraph; and
- (2) a fine under this title or imprisonment for not more than six months, or both, in any other case.
This was probably drafted to protect E-mail services, but now that there's a lot more electronic communication, it has broader applicability. A computer running a web browser is certainly "a facility through which an electronic communication service is provided". And altering the user's selection of a home page fits within the phrase "alters, or prevents authorized access to, a wire or electronic communication". And notice there's an extra penalty when commercial gain is involved, indicating that Congress foresaw the possibility of businesses committing this crime.The main Federal computer crime act only covers some computers, basically government and bank systems. (Most computer crime prosecutions take place under state laws.) But this one is broader.
Well if you don't know what CaptiveX does then don't use it. Just cause it's CaptiveX.OCX rather than CaptiveX.EXE does't make much difference. Both contain binary code.
Think of it this way.
:P).
ActiveX was around LONG before the web got popular and long before Microsoft even created IE. What was it for? Cross-language (and theoretically cross platform) in process reuse of software components - ones usually with 'windows' or graphical components.
Now most of Microsoft software as itself either been an ActiveX control an ActiveX container, or more usually, both (Word/Excel/IE). You can like embedded Word inside IE, and Excel inside that for example. Or even IE within IE.
When Microsoft created IE, they thought hey, wouldn't it be neat if someone could create a user interface with HTML, and still be able to use the controls/widgets provided by ActiveX. So essentially lots of LANs could have apps that are served using HTML from a webserver. So that's part of the reason why the idea of "zones" came along.
If you've got an application like say winamp that reuses IE as an ActiveX control in it's own mini-webbrowser, and say the folks at
Nullsoft decided they wanted to put some cool ActiveX control they themselves wrote into their mini webbrowsers to make it "do something". Now why should IE warn you of these things? First ofall, if you downloaded and installed Winamp, then the control is already registered and installed on your system, hell it wouldn't be any differnt from winamp using the control directly themselves (making winamp the container) or using IE as an intermediary container so they could add some fancy DHTML decoration around the control.
Microsoft's mistake was trying to push ActiveX as an INTERNET component reuse method. They didn't anticipate the level at which crackers would abuse trust systems. However that said, most people who are willing to just let any ActiveX control from anywhere run, would be the same type of people to run any binary someone emails or gives them.
I think for custom apps and internal applications, ActiveX on IE provides you with quite a powerful platform, with just as much security as any standard app (next to none
This page has a reverse engineering of Binary Boy, part of the Aureate network, that shows what the function of advert.dll is. Of course, it might have other malicious functionality as well, but I dunno...
You know a large portion of people couldn't author a driver if their life depended on it. Just a thought.
"God is Dead"
--Nietzsche
"Nietzsche is Dead"
--God
> But the power that ActiveX has is really no
> different than the power that any other plugin
> for any other browser has. Anyone that's ever
> downloaded a plugin for Netscape has put
> themselves in exactly the same danger that
> someone downloading an ActiveX control has put
> themselves in.
Well there are exception, though it has to be said, rare exception. Some plugins are implemented in JAVA (such as the netscape media) these are protected in the same way as normal JAVA applets.
But there is a small flip side. JAVA, and JavaScript can be "signed" and therefore be allowed to access various parts of the system that is not usually accessible to "unsigned" ones. This could result in a similar situation to the problem about malicious ActiveX controls.
However, the signed applet does tell you exactly HOW they are going to access the browser properties (well under Netscape anyway). For example if an applet is about to access the user preferences, a security box would pop up saying " the applet is about to read the user preferences", allowing you to "back out" easily if you get cold feet.
Like everything, a bit of vigilence does pay. Try and read the alerts, and dont nessasarily click "Remember this descision from site x" unless you are absolutly sure about what you are doing.
Conveniently enough, even us Windows users can help ourselves with three minutes of regedit time. Aureate creates it's own key directory (two locations), and it's helpfully named "Aureate."
Deleting the entire key and doing a "Find File" to clean up any other niggling and dangling files seems to do a very good (albeit inelegant) job of rooting this shite out.
Rafe
V^^^^V
Rafe
Opinions expressed by the author may not actually exist in the wild.
One of the best features of IE are the zone settings for security. I would love to see Mozilla adopt a similar approach (without the security holes). I set IE to not run any unsigned scripts or apps, and to prompt me on the signed ones. I also don't accept permanent cookies. That's how I do the Internet zone. The restricted zone is reserved for the various ad servers, and I don't allow anything at all there. The trusted zone is what I use to basically allow cookies. I still like to be prompted for all ActiveX controls.
"Logic . . . merely enables one to be wrong with authority"
Logic ... merely enables one to be wrong with authority. -- Doctor Who
Well I'm pretty sure you enter it somewhere along the way. Many normal users will just enter their email in the online registration without thinking twice about it (assuming there's an online reg., I didn't really want to find out).
However, it wouldn't be beyond them to root around your system to find it though!
-CausticPuppy "Of all the people I know, you're certainly one of them." -Somebody I don't know
There seems to be a bit of confusion here about what "ActiveX" means. This isn't very surprising, since "ActiveX" has been used as a marketing term, in the same way that "OLE" used to be.
"ActiveX" now appears to be a blanket term for COM (Component Object Model) technologies. Any COM components can now be described as "ActiveX objects", while "ActiveX controls" are COM components containing classes that can implement part of a GUI. These are quite difficult to write, but are very useful for building larger GUIs. From IE3 onwards, they are the main interface for plug-ins. So if you get Acrobat Reader, that will include an ActiveX control to display PDFs. As we all know, IE also supports automatic download of ActiveX controls - encouraging the wider use of plug-ins, and that's a problem. Disabling ActiveX controls altogether, however, will disable the plug-ins you want. I have downloading and running of ActiveX controls set to "prompt".
The other problem with ActiveX controls in IE is in scripting. Only controls declared as "safe to script" can be controlled by scripts on web pages, but many controls have been mistakenly marked as such when they are not. So scripting should generally be disabled. Unfortunately, a few pages do need it for navigation, so I currently set scripting to "prompt" as well. This gives me a lot of prompts, though. Perhaps there should be a toggle for scripting, or a white-list for sites whose scripts the user trusts.
exactly what i was thinking =)
Pablo Nevares, "the freshmaker".
Pablo Nevares, "the freshmaker".
Tom Swiss | the infamous tms | my blog
You cannot wash away blood with blood
Conveniently enough, advert.dll caused my machine to GPF each time I closed IE 5.01. Do you think Micro$oft listed this in their knowledge base? Nope. Picked it up off usenet by searching deja.com. Sure enough, it was a bear to delete but once it was gone, everything went back to normal (crashing on when its supposed to ;-)
r/
Dave
Um, my point was just to say that there's really no difference between OCX and EXE except the methods of which they are distributed.
:P
OCX ofcourse more commonly comes with apps, but their distribution from websites is a bit of a worry if people don't understand the security model of explorer.
OLE OLE OLE OLE OLE OLE OLE OLE OLE OLE
mm