Slashdot Mirror
GoHip.com ActiveX Wreaks Havoc
This story popped in several times in the last couple days and it's pretty slow today so I figure it'll be good for a laugh. Apparently GoHip (no relationship to Goku or Gohan) had some sneaky ActiveX that a lot of people installed. Kinda a scary security situation right there. Makes me glad I don't have any of that OL- I mean CO- I mean ActiveX on this box.
The moral of the story is to go to Internet Options --> Security --> Custom Level on your IE browser and turn off ActiveX.
Marjo Wycam, Master of the Programming Arts
1) Read through all of the source of the installer, or
2) Have software that warns you about every change to your system,
there is a chance that the software is editing some part of your computer that it shouldn't. In short, this isn't just a company abusing ActiveX--this is a company abusing basic software practices.
Personally, I call software that changes my outgoing e-mail without my consent a virus...
~=Keelor
...as bad advertising.
Having read abvout what a nasty and insidious thing this company did, I went to their web site to see what they do. Before I hadn't heard of them. I'd be surprised if they didn't get a few more customers from this.
The real morale of the story?
Trust nothing. Trust no one on the 'Net. You don't get something for nothing, so stay away from sites that offer anything "free." It's most likely a scam.
READ those agreements before you click on 'Accept.' You'd read a contract before signing it wouldn't you? Under UCITA those click agreements just might become legally binding.
Most of all, don't use IE and don't use Windoze. You don't need ActiveX or any of that other flashy shit to use the WWW.
Disable anything that allows some site to run code on your machine. Use SSH. Use crypto. Encrypt your hard drive. Lose your keys, and then your data is even safe from your own prying eyes.
Be paranoid, be very paranoid.
Install from source, not RPMS. Read every line of code. Make sure you understand what every line of code does in a package before you type "make." Know the code better than its maintainer before you even dream of running it.
Knowledge is power. Forewarned is fore-armed. An ounce of prevention is worth a pound of cure. Pick a cliche, any cliche, and apply it to evey situation.
The truth is...out there.
Just be sure to wear the gold uniform when you beam down -- you know what happens when you wear the red one.
First, in the article, those "fine print software agreements" were discussed...the legal validity of such have been under question for a while now. Due to various legal details, those "click Next to continue installing" agreements are considered by many to be too automatic and do not require enough action on the agreeing party to be legally binding...
Second, I was amused that GoHip.com considers what they do a Browser Enhancement.
Third, ActiveX ever since it's first incarnation has been horribly gigantic a gaping security hole. Anyone even remotely self-respecting computer security-savvy individual would never dream of having ActiveX enabled on their computer. Unfortunately, the average Joe might not know this...hopefully, they will be educated in time.
Here's one (of many) place I definitely like Java a whole lot better...
Fourth, in the end, this really isn't that big of a deal, as it was relatively benign. Hopefully, however, it will educate people as to the dangers of ActiveX, in general. I think David Kroll said it best: "I think it's pretty tacky what they did". Although he and Finjin did get it wrong when they said: "this is the first time a company has used ActiveX to alter personal information on someone's computer." Just see the ActiveX Exploder link mentioned above! I think they'd be more accurate in saying this is the first time it's been done purposefully and on a large scale by a corporation.
Fifth, this reveals an interesting problem with "signing" such programs with things like Verisign. That signature doesn't really mean as much as most people think that is does, as Verisign said: "Verisign spokesman Gray Chapman confirmed that GoHip is certified by Verisign, but stressed that his company was not in the business of passing judgment on the business practice of its client."
Sixth, GoHip.com sounds horribly sketchy. No phone numbers, bouncing e-mail addresses...is anyone surprised?...But finally, I have to admit to being horribly amused at the final quote by one of the "infected" GoHip.com visitors: "I compliment GoHip for a fine marketing effort as I certainly know who they are. I hate them, but I know who they are". In the end, capitalism seems to be all that matters again...
On a practical note, here's what I keep telling the people;
1. Turn off these everywhere...
HTML (except the browser)
Java
Java Script
Active-X
VBA or macro features
Anything similar to the above
2. Cookies - Delete it and recreate a new unreadable cookies file.
3. Never open any message unless you...
Know the person sending it
Expect the message
4. Move all mail to a Spam/Suspect/Trash folder automatically if the mail doesn't pass these two rules at a minimum...
It's from a known and trusted person or mailing list
It's addressed to one of your valid mail addresses; it's not from a mailing list
5. Remove all personally identifying comments from programs that have net access (Netcape's Mail Identity page, ...)
6. Don't give out your email address unless it's REALLY NECESSARY.
7. Use different email addresses for different types of mail; business, personal, ....
8. If you have to give out an email address for one-time use, tag it; /. asks, use something like slashdot_yanky@hotmail.com or some such (or better yet, get your own domain and mail server...quite handy!)
The best way to handle this is a firewall with filters. Remember, Procmail For Security and good ipchain rules are your friends!
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.
Moohahaha! There's nothing more satisfying than waking up to Anime references on /. on a Sunday morning. :-) After my Neon Genesis comments to an article about implanting consciousness in a computer received a pathetic +1 Funny, this is some sort of vindication. ;-)
Way to go, CmdrTaco!
There I was thinking that ActiveX was a bad idea simply because of the dozen or so exploits I have seen announced ZDNet over the past few months (visit the Windows Update site sometime and count all the IE 5.0 patches).
.exe mind you) have the ability to modify system files on my machine? At least Java browser apps work in a security sandbox and cannot affect system files.
Actually I'm lying, the real reason ActiveX is a bad idea is that it gives waaaay too much power to in-browser apps. Why would I want a plug in I download from a website (not an application or
I run a dual boot system here ( Linux / Win95 ) since I have some occasional guests that are a little afraid of Linux yet. I was absolutely incensed when I found out they had run across GoHip, and it had mucked with my system. I fired off a complaint to every one of their upstream providers, and the computer crime section of the FBI. As far as I was concerned, GoHip had run an exploit on my system, cracked it, and performed unathorized and hostile modifications to my files.
There is no longer a web browser available under Win 95 on my system. My guest will just have to overcome their "fear of flying" and surf under an OS that I can lock down.
There are just too many sites out there that use this stuff. Sure Javascript, Java, Active-X, etc. all have security issues. But every time I go disabling any of them guess what happens? My wife goes to use the computer and tries to bring up Playsite, or Uproar, Sony Play Station (etc etc), and what happens? Nothing works! Then she gets mad and I have to re-enable all that stuff.
;-)
The only real solution I see for myself personally is to simply have a separate computer for browsing the net. Computer are cheap these days, and how much resources does a computer need to browse the net? Since nothing important is kept on the net browsing computer these security issues don't really matter much to me. And having to reboot periodically isn't a problem either, since all the real work is being done on a more powerful machine else.
It makes for a lot less stress too. Heck if I did all the things some people advocate whenever a story like this comes up I'd be a paranoid cave-dwelling hermit!
I'm not a journalist, but I play one on slashdot
Cookies - Delete it and recreate a new unreadable cookies file.
Well, since you're posting on slashdot as a logged in user, you're obviously hypocritical on this one. Why not instead tell them to run something like junkbusters that'll actually let them control what cookies they want instead of just blindly and across-the-board killing them all?
"If one is really a superior person, the fact is likely to leak out without too much assistance" -- John Andrew Holmes
that GoHip tells you exactly EXACTLY what they are going to do with your computer in its download agreement, but these people are 'too busy' to read it and 'feel they shoudln't have to'!
I don't see GoHip forcing people to their website and forcing them to download this stuff. Yet another example of personal responsibility taking a vacation within the walls of slashdot.
Here is their info from the WhoIS registry. Also the USPTO registration.
Registrant:
Alchemy Communications (GOHIP-DOM)
9610 DeSoto Ave.
Chatsworth, CA 91311
US
Domain Name: GOHIP.COM
Administrative Contact, Technical Contact, Zone Contact:
Administrator, DNS (JH334) dnsadmin@ALCHEMY.NET
Alchemy Communications
9610 Desoto Ave
Chatsworth, CA 91311
(818) 718-0366 ext. 402 (FAX) (818) 700-2835
Record last updated on 14-May-1998.
Record created on 14-May-1998.
Database last updated on 26-Feb-2000 12:35:37 EST.
Domain servers in listed order:
NS1.ALCHEMYFX.COM 209.132.221.21
NS2.ALCHEMYFX.COM 209.132.221.22
About Alchemy, GoHip's host/ Parent Company
:Alchemy Communications
1200 West 7th Street, Suite L1-100
The Garland Building
Los Angeles, CA 90017
TEL: 213-596-3000
FAX: 213-596-3004
Email: goldensales@alchemy.net
PTO Trademark Registration for GOHip
Word Mark GOHIP!
Owner Name (APPLICANT) GoHip, Inc.
Owner Address 8306 Wilshire Boulevard, #54 Beverly Hills CALIFORNIA 90211 CORPORATION CALIFORNIA
Did you see the terms and conditions?
I especially like the part under "E-Mail."
Your acceptance of the "Free Video Update" browser enhancement constitutes your agreement to receive periodic communications from GoHip! and THIRD PARTIES, via e-mail.
So, you have no choice but to let them sell your email address to spammers. In fact, you agree to this when you click "Accept" on the license agreement that nobody reads. This has nothing to do with ActiveX security of course, but it's just more evidence that GoHip is run by criminals.
-CausticPuppy "Of all the people I know, you're certainly one of them." -Somebody I don't know
Pablo Nevares, "the freshmaker".
Pablo Nevares, "the freshmaker".
It seems like it has become necessary for the operating system to protect the user from malicious net code - just about everything downloaded from the net should be automatically locked into an operating system-supported "virtual machine" where all resources are released when the user shuts down that connection.
Applications which want to be persistent on a user's machine will have to ask for permission, and if they further want access to certain system resources, they will have to ask the user for permission to hook into those resources (and which resources they are hooking into) - all protected by the operating system.
Of course, this will not protect naive users from social engineering, but the _default_ behavior will be of protection rather than being wide open - and in the case of multi-user systems, then the administrator will be able to control how much access each user will allow the outside net to access system resources.
I disagree. A superb technology would be cross-platform so at least everyone can use it.
Is there an IS manager out there anywhere who is such a loser he'd by a machine because the ad shows it stepping on Microsoft?
I don't think so, and I don't think that's what the ad is supposed to do. Banner ads are there to make you click on them to find out more, and I'd think this ad achieves just that.
The stuff that's supposed to make you buy is on the page you're led to.
P.S.: Someone at slashdot.org, please fix up Extrans posting - having to use HTML for everything (or not using formatting at all) is annoying.
This message is provided under the terms outlined at http://www.bero.org/terms.html
The problem, the issue and the greatest need in the internet community is user education. Period. Odds are, that if you're reading slashdot, you know at least enough that you're aware of the security issues involved with something like Active X, but does your mom? Does your sister? Do your customers? What we need to do is lay out a set of safe surfing practices. Practical ones get the average, or even the less than average web user educated enough to follow those practices. Then we'll see these sort of practices decrease, if not actually wither and die. Practical safety procedures, they have to be practical in the sense that we must make sure and offer our grandmothers an alternative to sending you those .exe greeting cards, show them how to point to a URL so you can download elfbowling for yourself, teach them that there are animated greeting cards online that are safe. It is NOT enough to tell them that "that's lame, you don't need to do it" we have to tell them *WHY* and show them a safe alternative.
While GoHip isn't too great, there is already a company out there called Aureate, who bribe shareware and trial program vendors to install a few files on your system, along with the main program. These files (look for advert.dll) sit around as IE and Netscape plugins, and spy on everything you do, from personal registry information to every url you click on.
I could post a list of exactly which vendors install this thing, but it's too long. (GetRight and Globlascape Cute** probably being the most ocmmon source). If I were you, and using any windows based o/s, I'd look for advert.dll. Deleting it only partially solves the problem, but it's betetr than nothing.
Your acceptance of the "Free Video Update" browser enhancement constitutes your agreement to receive periodic communications from GoHip! and THIRD PARTIES, via e-mail.
....and you authorize us to invade your mail client to root out all your e-mail accounts stored therein??
And how in the world do they get your e-mail address? Should they add a line in there saying
Pablo Nevares, "the freshmaker".
Pablo Nevares, "the freshmaker".
> A superb technology would be cross-platform so at least everyone can use it.
A little unclear on the concept of intranet are we?
I still fail to see the qualitative difference between an ActiveX control and a Netscape plugin other than that the latter is more hassle, less efficient, and therefore less peopl are inclined to develop or use them.
I've finally had it: until slashdot gets article moderation, I am not coming back.
I decided to try this out. Mainly to see if the patch MS posted a few months ago to stop this sort of thing (i.e. ActiveX inserting arbitrary code into your StartUp directory) actually did.
It doesn't. Apparently all it does is stop *unsigned* ActiveX from inserting arbitrary code. Now, while that's certainly an absurdly necessary thing to have done--and it does stop the most major abuses of that ActiveX hole (eg. the Bubbleboy Outlook/OE virus)--I think it's pretty damn ridiculous to assume that any program should be able to stick arbitrary code in my StartUp directory just because it's signed. Or that it should be able to make changes to my registry without asking, as gohip's code does as well. (But don't worry--when you download their program to fix your registry (which does work, BTW), it pops up a cryptic looking dialog box asking if you really truly want to make changes to your registry.)
The sad thing is (flamesuit on) I actually *like* a lot of the ideas behind ActiveX--namely that it might be a good idea to store applets on the client side instead of having to download them every time you visit a web page--and I've seen some pretty nice uses of it. (eg. the dynamic hierarchical news menu on MSNBC. Of course, being ActiveX, don't bother trying to check it out unless you're running IE 4 or 5 on a Windows box--last time I checked, it doesn't even work in IE 4.5 for Mac.)
Unfortunately, its outrageous lack of cross-platform compatability and its moronic-to-criminal lack of safe security privilages have nearly killed off some actually sorta neat technology. Oh well.
Anyways, I hope this incident will point out to some people who've pretended otherwise what a farce "signed" code is. On the web, you don't know who to trust. As anyone who thought about it could have predicted, the danger isn't some 1eet hax0r somehow piggy-backing his trojan onto your connection with some Nice Commercial Website...it's the Verisigned trojan that Nice Commercial Website is asking your permission to install.
The new laws governing shrink-wrap licences not only make this legal, they also make articles like this, pointing out what is happening, -illegal-.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
That's why when I leave my house I leave all my doors and windows wide open with a security camera on each entrance - after all, I can always always figure out who took all my stuff later, right?
Similarily, when I step away from my car I leave the doors unlocked, keys in the ignition, nad the engine running - then I hand a camera and a notepad to some bystander (VeriSign) and ask them to please take a photo and ask for information from anyone that should enter my car.
How much do YOU trust VeriSign to really determine if the people getting certificates are who they say they are? Do you really support a protection racket that demands every company on the planet give them money to present the illusion of security?
I'm not advocating anything apart from a dislike of VeriSign.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Here's a link to a story on the Aureate mess a friend sent me.
Well, I read some of the stuff and then found advert.dll. Took me a while to get rid of it.... Tried to delete it, can't in use. Tried to use regsrvr32 to unreg it. Couldn't. Rebooted and it was still in use, even though no 'net apps had been launched! Finally booted to a c: prompt and deleted it from there. Geez.
---
DO NOT DISTURB THE SE
"Bear in mind that your signature on a public key certificate does not vouch for the integrity of that person, but only vouches for the integrity (the ownership) of that person's public key. You aren't risking your credibility by signing the public key of a sociopath, if you were completely confident that the key really belonged to him. Other people would accept that key as belonging to him because you signed it (assuming they trust you), but they wouldn't trust that key's owner. Trusting a key is not the same as trusting the key's owner."
This lesson is applicable to any public-key problem. VeriSign isn't to blame here - they did exactly what they were supposed to do.
Jerry Pornelle has a letter from Aureate Media about this.
Down in the second letter, the company responsible Aureate Mediab writes back.
Linux is only free if your time has no value. Windows is only free if you threaten to use Linux.
Thanks for the suitable reproof. As the author of the error I am suitably embarassed, but for good purpose.
One wonders whether I used 'reproof' correctly. Methinks it perchance ought to have been 'reprove.' But I know not of what I speak, me being a mere apprentice to newbies in the vineyards of computerdom.
Go to Preferences|AutoCorrect|Grammar and turn off Anal.
======
"Rex unto my cleeb, and thou shalt have everlasting blort." - Zorp 3:16
Sacred cows make the best burgers.
What entitles them to take such actions at all?
It might be vaguely arguable that anybody can come into your computer on the slightest pretext of having your consent, and change your homepage to theirs. That is intrusive, it is an imposition, but it is simply what _you_ see when you launch your browser. The most serious damage would be if you had a special homepage, kept no record of it and couldn't find it again: then you'd have suffered a loss due to this company's defacement of your property.
However- changing an _email_ sig? On the one hand this is just a line of text. On the other, it's a piece of text that is how you present yourself to the world, and the safe assumption is that this is a bit of text you intentionally chose to tell the reader something about yourself or what you consider important. In that light, the action this company takes is beyond inexcusable. It is like identity rape: to this company, not only is your computer's data not your property (so it can be freely tampered with for their benefit), but YOUR IDENTITY is not your property. The way you present yourself to others via electronic media is not your property! It is so inconsequential to them that they figure a mere 'sorry!' is all they owe you for hijacking parts of your IDENTITY for their own pleasure.
Again, it's one thing to examine the security implications, and the ways in which ActiveX can be used to build this behavior deeply into the system, making it hard to remove. But when did personal property become so meaningless that a stray click on a web page _allows_ a company to totally butcher your personal data for their own benefit?
Do you have a right to have your data for your homepage untampered with unless you explicitly and knowingly give permission for it to be altered?
If not, do you have a right for all of your writing to be untampered with, for instance if you downloaded some sort of grammar checker only to find that it runs and edits every ASCII file on your system that it can open? Is this a case of 'you should have kept backups' (let's hypothesize that it goes and edits all the backups too) or does this begin to look more like destruction of personal property?
Along the lines of this article, do you have a right for your email signature to be _your_ choice? Is it allowable for any joker who can get you to click on a clickwrap license to sneak in their own agenda, sigged to your mail as if it was your own agenda, so your friends can assume that you choose to 'push' this product or service? If so, is it then allowable for the clickwrap license to authorise the software to _send_ MLM-like mail to addresses on your mailing list, intentionally assuming your identity for the purposes of marketing, all in the background so the first you know of it is that you lose your ISP account for spamming, or lose friends over what they think you started doing?
It is informative and disturbing that this company already goes _almost_ to that extreme, and not as a joke. Surely the next step is intentional impersonation of a computer user, and marketing emails sent as if they were from that person- all sanctioned by the clickwrap license. It's almost here- just one tiny step from what GoHip is doing. It's so close...
And when that happens, I hope more people understand that this is not a security issue. It's not _about_ whether or not you are willing to psychologically barrier yourself in a concrete bunker, defying anyone's attempts to harm you.
Instead, it's about property rights, or a citizen's rights. It's about whether a regular person should even have to be concerned about these abuses. At the moment, in the computer industry, when you read about abuses like this, the first thought is "Security, so that you can stop people doing this to you, as they will no doubt try to do!". And that tells you something- because you never see anything to the effect of, "Screw security- this action is a crime against the person's property and an abuse of his identity. Click or no click, this is criminal! You're not allowed to hijack a person's identity and use their reputation as a marketing tool while trying hard to not alert them to it, and fighting their efforts to stop it happening!"
Am I off base here? Is it really so much to ask, to suggest that a person's arrangement of computer data is property, or at LEAST that the person's reputation and interactions with others is their property, and there is no intrinsic right to hijack that for profit? Not everything that is _possible_ and _profitable_ is legal. In this case, I can't think of a single thing more clearly property than a person's interaction with others, and their ability to determine how they express themselves. Suppose these same bright sparks at GoHip chose to globally replace the word 'video' with 'video (speaking of which, you have to check out GoHip.com! They're great with video)'? That is absolutely trivial, not so far from what they're doing now, and is absolutely, unarguably identity rape.
Is anybody ready to argue that this is defensible, or is strictly a 'security' issue where you only deserve the freedom you're ready to actively fight for? Does anybody seriously think this is 'opt-out' territory, that it's legitimate or right for any person's self-expression to be hijacked for commercial purposes?
If this goes on, forget watching TV and seeing 'the wrong' huge billboard on ESPN or in Times Square- it will be a world where you cannot even trust your own friends. Any of them could be speaking through a software filter that drastically changes what they say, and they would have no right to argue with this and no recourse except total paranoia. Even then, can you control _all_ the points your message passes through? What good will your security do you when your recipient has inadvertently installed a filter that changes your message _coming_ _in_, so that to their eyes, _you_ are the one saying "video (by the way, GoHip kicks ass!)."
Security is _such_ the wrong perspective to take on this stuff. This is civil liberties territory- and already shockingly close to paranoid fantasy. Yet it's not fantasy- people are _already_ having their identities and personal reputations hijacked by GoHip for marketing purposes, and this is seen as legitimate behavior, nasty but legal to do. How much farther do they have to go before the real issues are obvious?
I wouldn't have a problem with Microsoft Active X components installing automatically no matter what the browser preferences. Unlike every other company in question, I am already running Microsoft software, probably at least 150 megs of it, if I have IE with ActiveX. Does anyone know how to modify IE so that it identifies itself as the Mac version?
ActiveX controls are not any more of a security hole than any other executable.
The problem is that many Microsoft programs (such as Windows, MSIE, Office, etc.) blindly trust certain kinds of ActiveX controls, allowing them to install and run, without prompting, even if you have ActiveX "disabled" in MSIE.
Regular programs don't do that.
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
I still fail to see the qualitative difference between an ActiveX control and a Netscape plugin...
How about the fact that a Netscape Plugin cannot download and install itself without your permission?
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
Someone at slashdot.org, please fix up Extrans posting - having to use HTML for everything (or not using formatting at all) is annoying.
:-)
Apparently (this is guesswork), someone at Slashdot had them switched around by mistake for the longest time, but noticed recently and "fixed" it.
Plain Old Text pre-processes your comment, adding <BR> tags at the end of every line, but otherwise leaving things unchanged. Thus, you can mix text-style fixed formatting with HTML tags, as the tags are still interpreted by the client's browser.
Extrans pre-processes your comment, converting all HTML symbols to their escaped equivalents (e.g., < is converted to <). Thus, you comment will be displayed exactly as you entered it, character for character.
HTML Formatted doesn't do any pre-processing at all, other then to remove some HTML tags Considered Harmful.
Get it?
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
I have a friend who uses CVS to maintain his Windows partition. (CVS is a program which is normally used to manage large trees of source code and keep track of changes made to them). That way, he can see all the changes an installer makes, and he can just roll the changes back if he doesn't like them.
perl -e 'fork||print for split//,"hahahaha"'
You know.. Verisign did nothing wrong here.. but here's my beef with the way certification is handled these days. The public accepts what it shouldn't. Here's why.
When browser came of age, and security was of great concern, if you recall, the main hubub was about credit card information, and how SSL protected it. In other words, ask joe average internet user what certificates are for, and he'll say 'for encryption, so my credit card doens't get stolen by hackers listening in on the line'. That's what the press implied, and that's how people thought.
Now.. the REAL reason the certificate system works as it does is a bit different. It's not for the encryption, but for the authentication. A properly signed Verisign certificate, presented by CDNow.com is supposed to let you know that CDNow.com *IS* CDNow.com, and not an imposter. It's supposed to let you konw that they are a real business, and that they have proven this, with legal documents, to Verisign. This is why Verisign 'signs' the certificate.
You see, it was never supposed to be about granting encryption priveleges; only about authenticating the merchant.
So. Technically, we think it's kind of necessary to have a Verisign for commercial transactions.. but they rose to power based on the fact that people thought it was necessary JUST FOR ENCRYPTION (and hey.. if you didnt' have a verisign signed cert, browsers would bitch... so in the publics eye, you were not trustworthy if you didn't have their signature).
Fine. For financial transactions, fine. My security and piece of mind comes from knowing that Verisign says this company is real, and I have someone to chase down when they overcharge my card.
Now.. software... Verisign signing software? Why? To prove it came safely from the download site to my HD? WHy do I need a verisign to do that?
IN E-commerce, verisign fills a need.
With downloadable software... like Active-X, where the security model kind of SUCKS, it would make much more sense if that signature implied omsething, like the software provider has guaranteed that this software follows certain guidelines... etc.....
I did that a year ago. It's occasionally irritating not having DOS/Windows, but it's well worth it for the security alone. I think people who are smug about how secure their Linux partition is, but who run windows some of the time, are under a false sense of security. It would be easy to write an ActiveX virus which, say, fiddles with your Linux
perl -e 'fork||print for split//,"hahahaha"'
Regular programs require more work to install. Remember that while the Joe Sixpacks of the world might remember running an install program, they probably won't remember allowing an ActiveX control to run and they'll have no way of knowing that, because they checked the "Always trust $CORP" box six months ago, they just ran arbitrary code a few minutes ago. The problems come when you consider how many people have checked the "Always trust content from Microsoft". As pointed out on BUGTRAQ, this will allow controls from Microsoft to be installed transparently. Bad, but it's not the end of the world, right? Consider that someone could use this to install an older version of a Microsoft control with a known vulnerability. Ooops. Maybe IE6 will fix it.
18 USC 2701. Unlawful access to stored communications
(a) Offense. - Except as provided in subsection (c) of this section whoever - (1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or (2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided in subsection (b) of this section.
(b) Punishment. - The punishment for an offense under subsection (a) of this section is -
- (1) if the offense is committed for purposes of commercial advantage, malicious destruction or damage, or private commercial gain - (A) a fine under this title or imprisonment for not more than one year, or both, in the case of a first offense under this subparagraph; and (B) a fine under this title or imprisonment for not more than two years, or both, for any subsequent offense under this subparagraph; and
- (2) a fine under this title or imprisonment for not more than six months, or both, in any other case.
This was probably drafted to protect E-mail services, but now that there's a lot more electronic communication, it has broader applicability. A computer running a web browser is certainly "a facility through which an electronic communication service is provided". And altering the user's selection of a home page fits within the phrase "alters, or prevents authorized access to, a wire or electronic communication". And notice there's an extra penalty when commercial gain is involved, indicating that Congress foresaw the possibility of businesses committing this crime.The main Federal computer crime act only covers some computers, basically government and bank systems. (Most computer crime prosecutions take place under state laws.) But this one is broader.
Conveniently enough, even us Windows users can help ourselves with three minutes of regedit time. Aureate creates it's own key directory (two locations), and it's helpfully named "Aureate."
Deleting the entire key and doing a "Find File" to clean up any other niggling and dangling files seems to do a very good (albeit inelegant) job of rooting this shite out.
Rafe
V^^^^V
Rafe
Opinions expressed by the author may not actually exist in the wild.
Well I'm pretty sure you enter it somewhere along the way. Many normal users will just enter their email in the online registration without thinking twice about it (assuming there's an online reg., I didn't really want to find out).
However, it wouldn't be beyond them to root around your system to find it though!
-CausticPuppy "Of all the people I know, you're certainly one of them." -Somebody I don't know