Reflections on Brilliant Digital: Single Points of 0wnership

nweaver writes "Some reflection on Brilliant Digital's plans shows that they have inadvertently created a Single Point of 0wnership: a single machine or small group of machines which, if succesfully attacked, can be used to gain effective control of the Internet. The implications are rather scary: Even if you never touched KaZaA, your systems may be affected if someone manages to attack Brilliant Digital's update service. Who needs a Warhol Worm?".Updated by HeUnique: use these instructions to remove the Brilliant part.

Comments

Dumb..Very Dumb

[DCram]

Here at work I pointed a couple of coworkers toward the previous articles on Kazaa. There response you might ask?

As long as I can get good download speed and have a large mp3 base what do I care?

Does this type of thinking occure elsewhere? I thought I worked with some bright people but they seem to think of their machines as black boxes and if they work great.

sigh.

Re:Dumb..Very Dumb

[Anonymous Coward]

This thinking happens everywhere. People don't give a damn until something bad happens -- until they get owned. Everything is perfect until the day the world actually falls apart - even though it has been happening for a matter of years - everything is fine until the day it happens. That's the kind of thinking.

_
WINDOWS USERS CLICK HERE!

Re:Dumb..Very Dumb

[glwtta]

I'd say you would pretty much have to be insane to use any P2P client on your main PC. That's the reason I keep my Win2K partition around - I do nothing but file-sharing on it, it's chock-full of various types of spam (something even insalled that GAIN nonsense), oodles of all sorts of spyware and trojans and any other crap that came with these things. So what? I use it twice a week, and it doesn't even know my email address. If things get too cumbersome, and good reinstall every few months fixes that... just like running Windows in the good old day, come to think of it ;)

Re:Dumb..Very Dumb

[erroneus]

Well, it's unfortunate but that view is pervasively the norm. It doesn't apply to the technology arena alone. It's everywhere. People have convinced themselves that they don't want to know. They don't want to understand. They don't want to 'get it.' They only want the results and are not concerned about side-effects.

This is true in the food and drug arena. This is true in war and politics. This is true in biotech. This is true with trends in child-rearing. Somehow and somewhere, we have lost the notion of "wisdom." Not only have we forgotten how to become more wise, we are also underestimating (and ignoring) the value of the wisdom of others.

Socially, we're losing a lot of ground because we don't want to think any more. It's disturbing not only to watch, but also because I feel those trends infecting me as well.

"I don't care how we get it, just give me what I want." That's the growing mentality. "Rights!? I don't care about rights, just fight the evil demons in our midst!"

Okay... I'm going a bit too deep, but as a nation (I can't really say much about Europe or other places... I'm ignorant because I lack direct observational experience in the area) we're really getting too apathetic. It has been a long time in developing but our nation-wide apathy and our lack of long-term vision is affecting a lot.

I truly doubt that the RIAA and the MPAA are considering the long-term affects of their actions. Are they really so arrogant to think that their children will be any less affected than our children? Or is it that they aren't considering children at all... only themselves? Apathy. Lack of long-term vision.

Hehehe... what does this have to do with Brilliant Digital's Single Point of Ownership? Clearly, they have a lack of wisdom and long-term vision. If you want to own or control a large body from a single point, that single point bears the responsibility of DEFENDING it.

Defense is a responsibility that people tend to think is something they should pass off to government and law enforcement. Where did that moronic notion come from?!

Re:Dumb..Very Dumb

[Darren Winsper]

Well, I'm in the UK and I can't say things are much better. There was a big hoo-hah last year with the elections. Apparently turnout was somewhat low due to voter apathy.

Another problem we have is the sheep mentality. The Liberal Democrats got far less seats than they should have because many 'supporters' voted Labour because "we have to make sure the Tories don't get back in power" did the fact that Labour still have a huge majority escape them? They could have safely voted Lib Dem and Labour would still have won easily. However, they wouldn't have such a powerful majority.

Re:Dumb..Very Dumb

[G-funk]

Defense is a responsibility that people tend to think is something they should pass off to government and law enforcement. Where did that moronic notion come from?!

This idea came from the government, because it doesn't want the people able to defend themselves.

Re:Dumb..Very Dumb

[abahta]

I'd say you would pretty much have to be insane to use any P2P client on your main PC.

I disagree, although it definitely depends on the person. I ran Morpheus when it came out around June of last year almost exclusively until Streamcast ended the old Morpheus. It had a great combination of speed, file selection, successrul transfers, etc. Now that the old Morpheus is gone, I (and many others) look for any program that can come close to Morpheus.

For me, that's KaZaA. The fact that Morpheus didn't come with any spyware was probably the only reason I used it rather than KaZaA. But I don't mind the spyware THAT much.

While installing KaZaA, you can deselect about four bundled applications, and after installing it you can run your computer through Lavasoft Ad-aware and remove the rest of the junk (besides Cydoor, which is required). So what's the big deal?

I really don't care about the spyware that came with KaZaA (whatever is left after removing all I could) because it has no effect on me. It hasn't deleted any of my files. It hasn't annoyed me. It hasn't changed anything (that I noticed).

In the event that it caused some damage (such as several settings changed or some great annoyance), I have no problem at all with formatting. I have everything important (docs, downloads, media etc) off of my C:\ drive and all I ever need to do is format and reinstall windows to C:\ and I will be back to normal.

In fact I find myself reinstalling Windows every one to three months because it's nice to have a fresh start every now and then.

Anyway, back to what you said - I think it's going too far to say that someone would have to be "insane" to use a P2P client on their main PC. I have had one running near 24/7 for a long time...since the first days of Napster. In fact, I remember I installed Napster BETA 2 or 3 (one of the earliest versions) on a friend's PC a long time ago and it's still there.

Re:Dumb..Very Dumb

[halo8]

I Think this would make a good Poll
because really.. when it comes down to pretty much everything /. talks about (sssca, cbtdba?, dmca, copyright, open source, legal crap) its all about the uninformed, uneducated.. dont know dont wanna know masses.

Re:Dumb..Very Dumb

[snake_dad]

Happens all the time. "well i've got nothing to hide so they can hack me".

Then I explain what can be done with an owned box, they nod, uninstall kazaa, and merrily doubleclick the next .exe in their outlook inbox. Oh well.

Re:Dumb..Very Dumb

[Anonymous Coward]

Would you like to explain to the rest of us without the knowledge what can be done with 0wn3d box? I'd like to educate these ignorant people also.

Re:Dumb..Very Dumb

[Anonymous Coward]

One would have to be insane if they cared about their data. I worry about my data sitting on a single harddrive on a stable secure linux box, let alone a hacked up clusterfuck of commercial software designed to market my personal info. Simply put I don't trust commercial ventures and they have no concern for my data. Any sane person's main computer would be a raid file server in their closet.

Re:Dumb..Very Dumb

[Broccolist]

I've said it before and I'll say it again: things aren't getting worse. I agree that there's a sheep mentality, but it's been with us since the beginning of time. It's a well-known aspect of human psychology that we always tend to think the world is going down the drain and it was better before.

An Assyrian tablet from ~2000BC was found with words to that effect (e.g. kids aren't worshipping our pagan gods as much as they used to, the air is getting rotten, etc). The same thing has been said and re-said millions of times since. But it's just not true.

People aren't really getting more ignorant: we're more educated than at anytime in the past. If you think it's bad now, imagine how it was last century. Do you think those textile workers were curious to know how the sewing machines really worked? No, we should try to fight our innate tendency to think everything is getting worse, because in fact by most measures the state of humanity is getting better and better.

Re:Dumb..Very Dumb

[tchuladdiass]

&gt what can be done with 0wn3d box?

It's very simple. Your box is Unimportant(tm). If bad guy wants to break into Important(r) box, he/she will do it through your Unimportant(tm) box once it is owned. Now Mr. FBI agent comes a knock'n on your door, cause your computer broke into mr FBI man's computer.

Re:Dumb..Very Dumb

[iso]

The quote from the tablet to which you were referring:

"The Earth is degenerating these days. Bribery and corruption abound. Children no longer mind their parents, every man wants to write a book, and it is evident that the end of the world is fast approaching." - Assyrian stone tablet, c.2800bc

- j

Re:Dumb..Very Dumb

[Tessera]

Well, the converse of that in the US was the Nader Effect...

Re:Dumb..Very Dumb

[Telemakhos]

That was an excellent comment. The idea of wisdom and vision you mentioned seems to me most easily summarized, however, in the concept of independence or autonomous living, which requires both wisdom and will.

Early in American history, Jefferson praised the independent spirit, especially as found in the character of American farmers who provided for themselves with inititative and spirit; these same sort of men fought for independence during the American revolution. Horkheimer, Adorno, Marcuse, and others in twentieth century America lamented the common man's decline of interest in autonomous life as administered existence began to provide a higher standard of living -- people in general would rather be taken care of and have comfort than have to think and act for themselves.

As another poster pointed out, we always tend to idealize the past; in this case, however, we see a clear regression. The average Joe is becoming less and less autonomous, more and more childlike, in response to the increased allure of a higher standard of living.

To be specific (and to avoid that offtopic mod), man once made music for himself -- he sang, he played instruments, he created. Then came written musical notation, which allowed him to copy others' inventions by playing or singing songs he may never have heard; still he was making the sounds himself. Next, recorded music allowed him to spin a record/pop in a cassette/play a CD or .mp3 without any act of creation or imagination. Kazaa (and Napster before it) made procuring these mass-produced commodities, no longer created artisans per se but produced by a recording/culture industry, even easier -- he didn't have to pay for them or even leave the comfort of his desk.

In return, he has sacrificed various freedoms, by which I mean his power over the music. First, he gave up the power of creativity; now, he gives up the power over his own computer's spare CPU cycles. Our user gets easier downloading, but he surrenders control over part of his computer and (possibly) renders himself open to attack by hackers. Taken collectively as a society of freeloaders, we may be risking a chunk of the internet for easy .mp3 pirating.

This is not wisdom, and it is not independence. Those who read Slashdot are likely not covered here -- Slashdot readers tend to be the ones who build their own boxen, who write their own code, who value privacy and who see the importance of doing for oneself. Slashdotters tend to be autonomous. The majority, however, are heteronomous: willing to surrender their independence and unwisely to make unknown risks for the sake of allegedly "better" living through false needs, such as 100-gigabyte hoards of Britney Spears and NSYNC .mp3's.

Meanwhile, the recording industry attempts to take from us the right to fair use of what we have bought legally. Between our own childishness and their greed, we risk our computers and whatever increased standard of living mass-produced music has brought us. Beautiful.

This is the progress of Jefferson's America: from our forefathers' earning with their blood the right of liberty, to surrendering freedoms so we can steal the latest Backstreet Boys hit. It almost makes me want to cheer for the RIAA -- hoping that if they win, they'll shoot themselves in the foot by forcing cheapskates like myself, and many others, to go make music instead of consuming it.

Not that ranting here is going to help things a bit -- the unwashed and .mp3-hoarding masses won't listen anyway, and most don't read Slashdot. I'm done venting now.

Re:Dumb..Very Dumb

[MillionthMonkey]

"The world is passing through troublous times. Young people of today think of nothing but themselves. They have no reverence for parents or old age. They are impatient of all restraint. They talk as if they alone know everything. As for girls, they are forward, immodest, and unwomanly in speech, behavior, and dress." -Written by someone in 1274 A.D.

My grandad, viewing Earth's worn cogs,
said things were going to the dogs;
His grandad in the Flemish bogs
said things were going to the dogs;
His grandad in his old skin togs
said things were going to the dogs;
There's one thing that I have to state-
The dogs have had a good long wait!
-Anonymous

Re:Dumb..Very Dumb

[eg0n]

very interesting outlook.

Re:Dumb..Very Dumb

[Anonymous Coward]

I think Cicero said it best...
"Children no longer obey their parents and everyone is writing a book."

Some things never change ;-)

Re:Dumb..Very Dumb

[mvdwege]

It has been a long time in developing but our nation-wide apathy and our lack of long-term vision is affecting a lot.

Let me add an observation from Europe (specifically the Netherlands): it's not just the states. This attitude is becoming pervasive throughout the entire Western world.

Allow me to end this short reply with an appropriate quote from Douglas Hofstadter:

"Individual apathy translates to mass insanity"

We're getting there, slowly but surely, and I think of it like you, that's a very Bad Thing(tm). Mart

Re:Dumb..Very Dumb

[Darby]

Well, the converse of that in the US was the Nader Effect...

The idiocy of this statement is truly appalling.
The major problem with the US government is the 2 party system.
It doesn't matter much whether you vote for Bush or Gore. They are almost identical. The thing we need more than anything is a viable third party.
If there were only 3 candidates, a Republican, a Democrat, and a black (since I'm white) version of Hitler whose entire platform was "kill whitey", I would vote for the third choice because at least that is a choice. Only when more people vote for a candidate who is not a member of one of the two parties will anything good for the citizens of the US be possible.

Re:Dumb..Very Dumb

[clone304]

I had composed a very long and detailed rebuttal to your post, but either it was too long or it took me to long to compose it. I almost said, "Fuck it." But, then I read your post again.

I just had to say a few things:

Referencing a warning that predicts the death of a culture/civilization/way of life that is dead as proof that people who predict such things are wrong is rather unconvincing.

It's just that kind of "disaster never actually happens" attitude that causes more disasters to actually occur. Don't just stick your head in the sand. That's half-assed. Go ahead and stick it up your ass.

You claim that we're more educated than ever before. How so? Because more people have basic reading skills? More people can count? More people know the latest celebrity gossip? Bullshit. People today, as in the past, are "educated" with respect to the things that they need to know to survive. By contrast, if you take away the conveniences of our pampered modern society, how many people would be qualified to survive? Very few, IMO. Yet, the "uneducated" people of ancient cultures managed to learn many complex skills that allowed them to survive despite challenges that would easily best most people that I know. So, who's educated? It seems to me that rather than more educated, today's people have become more dependent on experts to provide them with the tools to survive. In the past, practical knowledge was passed down directly from people who knew to people who would HAVE to know. How many people do you know that know how to build a microwave from scratch. How many people do you know that can even cook a good meal? Forget about actually acquiring food stuff from the wild. Compare our people with the people of past generations and you'll find that they are invariably less capable human beings on the whole. And further, they don't even learn anything from the inadequate "education" they do recieve. And, do most of them learn anything from their parents? Likely not, since their parents are away working overtime at mindless corporate jobs all day. Instead, children learn that their parents are suckers (which is not far from the truth) by contrast with the cool, glamourous people that populate the lessons taught to them by their teacher: television.

I had to quote you on this one:
"Do you think those textile workers were curious to know how the sewing machines really worked?"

I'm really not sure what you're referencing here. Which textile workers? Are we talking ancient times textile workers? I don't think they had sewing machines. Looms, maybe. How much do you know about looms, smarty pants? Today's textile workers? You mean the sweatshop laborers that provide us with cheap designer knockoffs at K-Mart? I'd venture a guess. I think they know more about how a sewing machine works than YOU do. Who do you think makes sure that that machine keeps knockin out cheap crap? They may not be curious, but they damn well do know how to keep that sewing machine running. That sewing machine is their livelihood. Have you EVER met a starving motherfucker who didn't make it his business to know what he needs to know to keep getting fed?

Things ARE getting worse, or at least more dangerous. We "may" not have more ignorant people on a percentage basis than in the past, though this is extremely debatable, but every single one of our current ignorant bastards has a billion times more destructive power.

Shit, all you have to do is be an unrepentant American consumer and you're already wasting a completely unsustainable amount of natural resources. Ignorance, apathy, complacency, and greed will make sure that this destruction continues.

So, say it and keep saying it. All you're really saying is that you are yet another one of the ignorant fools who are unwilling to see the writing on the wall until you drive into it at 60 miles per hour. Ignorance is bliss, right? Does it feel good?

.

Re:Dumb..Very Dumb

[-brazil-]

Ya know, I first read your posting as "The Earth is degenerating these days. Britney and corruption abound"... Makes sense, too!

Re:Dumb..Very Dumb

[hagardtroll]

You are so right, but what you said could have been summed up better by...

Kazaa users: "Ga ga Goo goo, I want my mp3s. Mommy! I want my MP3s! Bwaaaa waahaa hwaaa!"

Re:Dumb..Very Dumb

[Anonymous Coward]

It is possible that some things are better and some things are worse. You used to be able to drink and smoke on the job.

One of the worse things is that we spend so much time working. We work less than industrial workers at the beginning of the industrial revolution but much more than workers before the industrial revolution. Where are all our productivity gains going?

Re:Dumb..Very Dumb

[ncstockguy]

"The state of humanity is getting better and better". Agreed, except in the area of nuclear proliferation. The state of humanity, it could also be said, is getting dimmer and dimmer...
http://www.thebulletin.org/media/curren t.html

Re:Dumb..Very Dumb

[guinsu]

Yo, that guy isn't talking about killing all white people, just one specific white guy. Whitey, Deluca, his old manager. He wasn't even that white, he was Italian. One of those olive complexion mutha fucekers.

Re:Dumb..Very Dumb

[Shadarr]

The end of the world may not have come, but do we know when the end of their world came in relation to this tablet? Sure, the lump of rock called Earth keeps spinning just fine, but societies and empires rise and fall constantly. The fact that a civilization 5000 years ago was at the same stage as we are is not proof that everything is staying the same.

Re:Dumb..Very Dumb

[Citizen of Earth]

"If it doesn't cause a traffic jam, most people won't care." -- Dan Rather(?)

subject

[Anonymous Coward]

"Any program which downloads automatic updates should be scrutinized..."

Mozilla does this now...

Re:subject

[Cenam]

so does every app i have ever written, and things liek starcraft, diablo, warcraft, borland c builder. theres a simple reason, as long as the company keeps thier programs up to date they can't be held liable for damages, since any known bugs are fixed, in fact i think i heard several times here on /. that companies should update thier code and force updates so that people will have those security holes blocked up, funny how you change your mind..

Re:subject

[_Knots]

Automagic updates are all well and good, as long as there's good authentication, preferably good encryption, and at least some amount of "Hey, User, you want to install this?" with the default being [Yes], not no, and of course a pointer to more information.

Brilliant here has (apparently?) done away with all three. They just do it (like Nike), and from the sound of the article, they are not even very secure about the way they do it.

The reassuring thing (for the moment) is that so far these tactics of behind-the-scenes trojans have been confined to leaf nodes - to my knowledge, no routers etc. have had this kind of shit happen to them. As long as the major routing backbones of the internet never become 0wned, there's a modicum of hope for restoring order to the network (banning IPs at the fringes of the backbones until they shape up?) should an emergency occur (banning IPs always scared me, so I don't necessarily like that solution, but it's the easiest and the one that jumped to mind first. I'm sure people more clever than I can think of better ones).

OTOH, 1M fringe nodes can, as the article says, be unstopable. If somebody were truly evil and wrote a decentralized worm (never called home, only talked with other copies of itself), it would be incredibly hard to stop such a beast, and the DDOS commands could be given in an anonymous, untrackable way (can anybody imagine the worms playing Dining Cryptographers? ^_^) [Dining Cryptographers would be anonymous as long as the line wasn't tapped. And I'm sure with some good encryption over the links, it'd be anonymous for all practical purposes anyway.]

Y'know, as bad as it'd be, I'd want to see such a worm (just it's source, I *swear* - I'm not about to go risking the internet's well-being - you have to admit it'd be an interesting read). Maybe the vx community has something similar as a proof of concept?

-Knots

Come on

[Slash Veteran]

If you use KaZaA, with all of its spyware, worm-like auto-updating, and history of escalating privacy invasion, you don't have a clue. You deserve to be 0wn3d d00d.

Already Exists

[nuggz]

MS has been doing this for years, many tools check for updates and install them.
I noticed Need for Speed Porsche did this too.

These friendly autopatchers could all be hacked.

This is a serious risk with new subscription based services too.

Re:Already Exists

[CrackerJackz]

However, none of these are installed on millions of PC that (mostly) have always on - high speed connections, also this Trojan is specifically engineered to "server data" most of the patch engines simply receive an update to certain files. If this is as insecure as it seems (and do you honestly think the company put an ssh connection or even a checking mechanism on this??) then this could very easily be used to launch the largest DDOS ever ...

Re:Already Exists

[powerlinekid]

Actually the linked articles talk very much so about some of the biggest warhol exploitation possibilities come from ms's updater. But again, I'll trust MS over Brilliant anyday. Brilliant really doesn't have anything to lose from bad pr, because well noone really knows who they are anyway.

Re:Already Exists

[cscx]

No, see, Windows Update has security signatures on all of its packages. Plus, you are discounting that the auto-update feature is only available Windows ME and XP, and even so, it doesn't automatically install updates unless you explicitly set it to. That really narrows down the population. Don't forget all the corporate users who are subject to Windows Update corporate edition, where the admin decides which updates to install.

On the other hand, how many people are running Kazaa in comparison (on Win95, for example)? A lot more. What is worrysome is the corporate user running Kazaa behind an improperly set firewall. If he is on a large pipe, that can spell trouble. Imagine that problem multiplied by the number of users running Kazaa. Can you say "imagine a Beowulf cluster of DoS zombies?"

Re:Already Exists

[nuggz]

I'm running Win95b with IE 5.5, IE does check for updates every time I start it

Re:Already Exists

[shyster]

I'm running Win95b with IE 5.5, IE does check for updates every time I start it

Then change your home page and or options. Assuming you don't want it to. And, evidently, it doesn't auto install the updates or you'd presumably be running IE6.

Re:Already Exists

[cwiegand]

I have a problem with that sig:

If IE's Windows integration is a monopoly, then I'm all for the removal of Konqueror from KDE.

KDE is a desktop (and browser). IE is a desktop (and browser).

Windows (OS) REQUIRES IE (desktop/browser) to function.
Linux/FreeBSD (OS) does NOT require KDE (desktop)or Konqueror (browser) to function.

Re:Already Exists

[zmooc]

Not only MS. Debian and Red Hat have been doing the same. They don't install automatic tools (at least Debian), but nobody checks anything before upgrading so that's basicly the same.

Re:Already Exists

[Anonymous Coward]

I belive you cant run IE6 on Win95b

Re:Already Exists

[Anonymous Coward]

Signatures are no guarantee AT ALL. There was a case (sorry, I don't remember the web) of a particular who got access to Microsoft's private key (I feel it was a Verisign error). There was a "security update" from Microsoft with a new public key. So, I mean, signatures give us some degree of confidence, but, remember, they can also be hacked. So the "single point of 0wnership" is an issue. The problem is that it is not a "single" point, but a lot of points (imagine inserting this kind of code in Half-Life updates or Starcraft). Anyway, this point do not allow you to control/own the whole internet, but allow you to affect all the internet.

Any comments?

[Anonymous Coward]

Isn't the Internet's DNS system essentially the same thing? I mean, if I were to attack the Internet root dns servers couldn't that cause all sorts of problems - isn't that is a sense a single point of ownership to some degree? I know ISP/other DNS servers do caching as well.. but still. Comments?

_
WINDOWS USERS CLICK HERE NOW!

Re:Any comments?

[Slash Veteran]

I mean, if I were to attack the Internet root dns servers couldn't that cause all sorts of problems

The difference is: we TRUST the owners of the root servers to keep their systems secure. The owner's of KaZaA don't have the same track record.

Re:Any comments?

[DCram]

From the article the other day on root DNS servers.
Story
For the "internet" to be greatly affected multiple root servers must be brought down.

"The DNS is built so that eight or more of the world's 13 master root servers would have to fail before ordinary Internet users started to see slowdowns, according to John Crain, manager of technical operations for the Internet Corporation for Assigned Names and Numbers (ICANN)."

Re:Any comments?

[Anonymous Coward]

That's a good point - but still, you can trust someone to keep a system secure but things still happens - right? Sure the chances are cut, but it doesn't rule anything out. The safest way to design a system is to make it safe *by design* in addition to maintaining the safety. Wouldn't a valid argument be made for the Internet root DNS servers or am I totally off-base?

_
WINDOWS USERS CLICK HERE!

Re:Any comments?

[anthony_dipierro]

For the "internet" to be greatly affected multiple root servers must be brought down.

Or just one has to be hacked into and have the IP addresses rerouted. Really, do you think people check to make sure they're using https when they connect to "www.chase.com"?

Re:Any comments?

[Slash Veteran]

His comment was for DoS'ing the root servers, not compromising them.

If you DoSed up to 8 root servers (crashing them, overwhelming them with bogus requests, etc.) the remaining roots could sustain the load.

If you compromise a single root server, and poison its database, every single computer that looks up a hostname via that root server will be dorked. OK, so only 1 out of 13 of your DNS requests are poisoned...believe me, your surfing experience (think goatse.cx instead of cnn.com) will be "altered." Not to mention redirecting e-commerce traffic to trojan sites in order to capture passwords, credit card numbers, etc.

Re:Any comments?

[sarcast]

The owner's of KaZaA don't have the same track record.

But I thought they were on the FastTrack...nevermind.

Re:Any comments?

[DCram]

I totaly agree with this assesment.

One can only hope that if someone hacks the zone files on the A.ROOT-SERVERS.NET server or any other of the servers that major DNS providers would be notified as to change say A.ROOT-SERVERS.NET to M.ROOT-SERVERS.NET. But I think having www.microsoft.com have an authorative answer of goatse.cx. The other good thing about an attack like that is that the root servers dont rebuild there zone files and push that often.

Re:Any comments?

[Slash Veteran]

The other good thing about an attack like that is that the root servers dont rebuild there zone files and push that often.

no, no, no. You're missing the point.

If I compromise and poison D.ROOT-SERVERS.NET, it remains poisoned until the next push (twice daily). Anyone who does a DNS lookup, on average, refers to D.ROOT-SERVERS.NET once out of every 13 lookups, and therefore is subject to poisoning 1 out of 13 lookups. You'd never know, except when goatse shows up on your screen instead of microsoft.com ;)

There is no system in place (at least, publicly known) whereby the root servers (or other major internet sites) compare the root servers' databases. They are simply trusted as "correct."

Poisoning the master (A.ROOT-SERVERS.NET) would be even more disasterous, since, on the next push, it would corrupt the remaining 12.

Similar end games exist for poisoning the trusted certifying authorities (root CAs) for RSA certificates. In the end, you have to trust something, and that something needs to be secure.

Re:Any comments?

[DCram]

I see.

So does the A.ROOT-SERVERS.NET sync up with anyone? Or is it the case that once it corrupted all the other ROOT-SERVERS.NET will become corrupted if not fixed before the twice daily push?

And as another question how does the A.ROOT-SERVERS.NET get updated at all?

DJ

Re:Any comments?

[Slash Veteran]

No, yes, and very carefully :)

The A.ROOT is the master of them all. That's the one that they _really_ worry about, and the one referred to in that article (with all the security, etc.)

If it gets corrupted, even accidentally, the results would be disasterous. Although, I'm sure as soon as they realized it's been hosed, they'd cancel the next push (to the other root servers, keeping them "sane") and take the A.ROOT offline.

The A.ROOT is updated manually by Verisign engineers, after (I'm sure) meticulously checking the new database for errors. There's no room for a cronjob here. The database is generated on several other computers housed in that secure facility, compiling the changes from the various ICANN registrars around the world. Each registrar's changes are checked for consistency and compliance (the .au registrar can't change .com entries, etc.)

cheers.

Re:Any comments?

[zulux]

For the "internet" to be greatly affected multiple root servers must be brought down.



DON'T WORRY! If the DNS servers go donw, you can just fire up your friendly MSN Explorer on your Windows XP box, and serf on over to Netsol.com. Then select the tab names "Whois" and type in the wesite that you want - you the can ge the IP address of your favorite Microsoft website.

Re:Any comments?

[shird]

I think there is a big difference between what Brilliant is doing and the root DNS servers. With the DNS servers, we are making use of a service they are offering, at our will, ie were asking them a question, and relying on their answer. If we become unhappy with this service, we can theoretically choose not to use it. But with Brilliant, they have control of our systems and could potentially do whatever they like, and it wouldn't be initiated by us, but by them.

Re:Any comments?

[Anonymous Coward]

that's bullshit. load on the root servers is _significant_.

Re:Any comments?

[rhizome]

The root DNS servers aren't all *run* by one company. They are all run by a variety of voluteers who work for different companies and can't be said to have the same opinion of Verisign or whoever is governing the TLDs these days.

The good side

[InsaneCreator]

Maybe we could "attack" everyone with outlook express/IE patches, so we finally stop recieving all those self forwarding worms in our e-mail.

Re:The good side

[FaithAndReason]

I've heard that idea floated a few times - most recently with reference to patching IIS against Code Red. The idea never seems to go anywhere - perhaps the fact that it's illegal has something to do with that...

Re:The good side

[glwtta]

pah! 50% of what we do with our computers nowadays is technically illegal (the other 50% are blatantly illegal), that doesn't seem to stop people.

Re:The good side

[Anonymous Coward]

User info > Homepage preferences > Get out of this hellhole and join a real Linux community
***
You, sir, are a terrorist.

Re:The good side

[MillionthMonkey]

It's not just illegal. It's stupid. It's well known that this is not a responsible approach. There's no way to prevent such a program from causing network congestion and affecting computers that it isn't supposed to.
It's a bad idea that sounds like an attractive concept. But good intent only matters so much with self-replicating programs. They can have unexpected results. Xerox PARC experimented with "good worms" in the early eighties. They wrote worms to do things like clear printer queues and install software packages. Then they wrote a worm with a bug in it, and discovered that even worms you write yourself can create a path of destruction across your network.
There are other reasons why it's a bad idea. A "good worm" can be modified into an evil worm very easily. Also, you don't want to send mixed messages to an easily confused public, and make people think they can sometimes "trust" a worm. At least one malicious Outlook worm has been seen in the wild that pretends it's antivirus software from Symantec.

The article might be slightly more impressive...

[Crag]

...if the author had closed his h3 tag.

The page shows up all bold and centered on mozilla.

As to the actual content, an event like this would last about as long as the time yahoo et all were DDoS'd. The media would play it up as a big deal, and we techs would just fix it.

I'm not impresseed.

Distributed Computing on Kazaa

[Kargan]

Ok, from what I understand, Kazaa is going to be attempting to get their users to give up their spare CPU cycles to help drive advertisements and other income-based projects for Kazaa?

Ok, not only would this concept be likely considered unwelcome even by casual Kazaa users, but think of all the other possibilities for an already heavily established (as those things go) P2P app like Kazaa...

In other words, they could try to get their users to share a distributed computing project working towards, say, the cure of a deadly disease or other medical project, then give ( or sell, which would be more likely) the results to whatever foundation would actually be able to use the data?

That way they could make money, a name for themselves, and generally the rest of humanity a bit happier.

Re:Distributed Computing on Kazaa

[rob-fu]

In other words, they could try to get their users to share a distributed computing project working towards, say, the cure of a deadly disease or other medical project, then give ( or sell, which would be more likely) the results to whatever foundation would actually be able to use the data?

Not trying to stray offtopic, but United Devices does something like this with cancer research.

Then again, _you_ download the client, and they don't sell the results to anyone; as i understand it they collaborate with the Dept. of Chemistry @ the University of Oxford.

Kazaa using this technology (with the consent of the user, of course :) would be a great idea, IMO. They could stick it in there with all the extra third-party partner software that the installer prompts you for. Combine that (the UD client) with Kazaa's user base, and that's something worthwhile.

Number of aliens contacted by SETI@Home: 0

Re:Distributed Computing on Kazaa

[rblancarte]

This sort of raises the question - how is Kazaa's "Single Point of Internet 0wnership" really any different than UD, distributed.net, SETI or anything else like this? This article talks about how this system could be hacked and someone would quickly have 100K machines doing his bidding. Um, the same is true with these systems. too.

So tell me - how are these different?

RonB

Re:Distributed Computing on Kazaa

[bilbobuggins]

As I understand it, SETI etc. are clients that download/upload data only, where as these auto-updates actually d/l executable code (and even cause it to be run).

Re:Distributed Computing on Kazaa

[Anonymous Coward]

As much as the spyware stinks, there are more people on Kazaa - 1.6 million and file sharing is 1600TB.

Hopefully some of these people converted to kazaa lite - a spyware free install hack.

Re:Distributed Computing on Kazaa

[CTho9305]

But how do they determine unused CPU cycles? My machines run scientific calculations at lowest priority, and I dont want anything taking time away (low priority so they have minimal impact on system performance). I consider nice processes to be in fact important and used CPU cycles.

Good for them

[knuu]

I think I understand their plan now:

1. Plant studip spamware on a gazillion computers worldwide

2. Head for a small island state somewhere in the middle of the Pacific Ocean and start blackmailing governments the world over by claiming to "0wn j00r 1nt4rw3b!". A gazillion children addicted to warez, pr0n and AIM complain to their respective parents, who demand action from their governments. Governments pay up.

3. Profit!

Then again, governments do have armies with guns and ships and stuff so things might get messy in the process. *shrug*

Re:Good for them

[taniwha]

Head for a small island state somewhere in the middle of the Pacific Ocean

No - they're australians .... they'll just go home ....

Re:Good for them

[FrostyWheaton]

2. Head for a small island state somewhere ...

, Wow! someone finally figured out Phase Two!

Re:Good for them

[screwballicus]

Dr. Evil: Gentlemen, it's come to my attention that a malicious distributed computing scheme called Brilliant Digital will be setting into motion their trojan in a few days. Here's the plan. We R00T their server, and we hold the world ransom...
(dramatic pause)
Dr. Evil: ...FOR ONE MILLION DOLLARS!

Number Two: Don't you think we should ask for more than a million dollars? A million dollars isn't that much money these days.

Dr. Evil: All right then...
(dramatic pause)
Dr. Evil: ...FIVE MILLION DOLLARS!

(uncomfortable pause)

Number Two: Jon Katz alone makes over nine billion dollars a year.

Dr. Evil: Oh, really?
Dr. Evil: One-hundred billion dollars.
(pause)
Dr. Evil: OK, make it happen. Anything else?

Re:Good for them

[s20451]

start blackmailing governments the world over by claiming to "0wn j00r 1nt4rw3b!"

Or, in the immortal words of Jeff K., "HAHAHHAHHAHAHHAHHAHAHAHAHAH HOW DO YUO LIEK THEM APPALS FELLOWS?!? GRABUALsA!!!!"

Re:Good for them

[Skirwan]

I think I understand their plan now:

This is actually a huge improvement over their original plan:

Phase One: Collect underpants.

Phase Three: Profit!

--
Damn the Emperor!

Re:Good for them

[abischof]

Just for my own sake, could someone explain this phrase? As I haven't heard of it here (which happens to be USA), I'm guessing that it's of foreign origin?

Granted, it's hilarious :), but it just throws be for a loop as to where the apples bit comes from.

Idiocy upon Idiocy

[Anonymous Coward]

So, basically, they inadvertnatly created a cluster that can be hit and effectively screw everybody over.

Then this guy announces that he's found the cluster and that the reward for hitting these servers is beyond that previously imagined by HaX0rs.

The /. points to this report and hypes the reward for the attack.

Are we just begging for the |33 to attack? Please! Please! Please cripply and deciminate viruses! Things have gotten kinda boring?

This is about as bad as the AP publishing Daniel Pearl's kidanapper's email address.

Re:Idiocy upon Idiocy

[Anonymous Coward]

So you'd prefer security by obscurity?

Re:Idiocy upon Idiocy

[Hektor_Troy]

So you want security through obscurity?

If this guy figured it out, don't you think there's at least a moderate chance, that some |33 h@x0r figured it out as well?

By going public, and as a neat bonus having /. place the story on the front page, Nicholas Weaver is essentially forcing the people behind Brilliant Digital to fix their security problems ASAP.

If they chose not to do anything, Brilliant can't claim, that they didn't know about it, if/when some |33 h@x0r hijacks 2 million computers and wreaks havoc on every single US government site just for fun, and they will (at the very least should) be held accountable as aiding and abetting terrorist activities, by not fixing the problems when they had the chance.

Security through obscurity is like not telling the world about AIDS. There's no cure for AIDS, so there's no need to tell people to be carefull, because that would not cure AIDS.

Cooperation is key

[jmulvey]

Interesting article. I think it effectively shows that Brilliant Digital -- along with just about 95% of our industry -- needs to learn that they can't just shove software down people's throats. Most interesting to these companies should be the legal liability questions raised.

I'd expect these companies to start adding stuff into their installation legalese with something to the effect of, "You agree not to reverse-engineer anything we might be doing with your computer. You agree to sit back and relax while we adjust the horizontal and vertical"..

Re:Cooperation is key

[erroneus]

You're absolutely on-target with that assertion.

I tend to look at our internet and our computing power on the level of 'health.'

Software designers should understand that they aren't just writing programs any more. We're not building new calculators with cool new functions. We're writing a great deal of software that interacts with a public network that affects the lives of everyone either directly or via the health of business and information exchange.

Business and commerce are now more tightly bound to our ability to exchange, gather and disburse information as a commodity.

I'll use Microsoft as an example but it's not limited to Microsoft... Cisco could easily be used as an example of a "responsible player" but I'm illustrating an "irresponsible player" at the moment.

Microsoft in putting out unstable software on the server side (and putting out clients that include servers to unaware owners) has severely affected the health of our public internet and I believe they should be held liable and responsible for their negligence on the matter. There is no law that says "you're a criminal if you write bad software" but there is law that says you are criminally responsible if, through negligence, have endangered public security. And in that respect, Microsoft should be held as criminally responsible for their negligence. And no amount of EULA protection should be allowed on this matter.

I suggest that Cisco wears a white hat in this simply because of reputation. They are not known for their security problems. They are not known for having 'viruses' or being vulnerable to attacks. Of course they are vulnerable. Of course they have bugs and weaknesses. But due to the fact that they are both huge and still manage to remain 'untargetted' is some indication that they are taking their public responsibility seriously and are successful at it.

If Microsoft behaved more like Cisco in that respect, I think the world would still be in love with Microsoft today though not nearly as appreciated because it's not in out nature to appreciate, but to find fault and hate.

Re:Cooperation is key

[Moonshadow]

I hearby motion that Brilliant Digital be renamed Not-So-Bright Digital.

All in favor?

preview misleading...

[kritikal]

perhaps the whole situation isn't as bad as it seems. having read the article, one would realize that the author only hypothesizes on whether or not the network is secure. brilliant could have implemented all the things that he questioned as insecure. this is not a review of their technology, but rather a blatant guess at how their technology will work.

Re:preview misleading...

[layingMantis]

This is true...........and, won't we just uninstall this Kazaa shit once the courts decide that Fastrack's so-called P2P network is basically another Napster and they shut it down? (their control of, and ability to profit off, the network is )

Or will the trojan/spy software still be lurking on the hard drive?

--all this deception and greed is perturbing.........but DAMN the mp3's are still flowin' (and Gnutella still sucks).

Re:preview misleading...

[JetScootr]

With rapid changes in technology, Security is a matter of timing, not an absolute. Make it as secure as technology allows today, and it's just a matter of time - weeks or months, seldom years - until the security is easily cracked or is completely broken.
Because of this, and the logistics inherent in updating the security on 20+ million PCs, and you get the MSIE / Outlook express situation.
The author's comment about "single point of ownership" is valid no matter what security is used on this.

Re:preview misleading...

[NonSequor]

It's not just another Napster. It has pirated movies in addition to pirated music.

Re:preview misleading...

[taphu]

Well, that's no fun is it? Their network MUST be insecure, it's more entertaining that way.

Redundant? [OT]

[Anonymous Coward]

Uhm, since there is no other posts with the full text, how's the post redundant?

Overrated, at score:1 - sure, the server isn't slashdotted yet.
Troll, nah.
Offtopic, nope.
Flamebait, hardly.
Redundant? Moderators on crack.

Re:Redundant? [OT]

[Anonymous Coward]

the server isn't slashdotted

... therefore another copy of the text is redundant.

Doesn't XP already do this?

[bc90021]

With the ability to remotely control a user's computer built into Windows XP in order to provide "tech support", isn't a good portion of the world already vulnerable to a well-written worm? See "Remote Assistance" at http://www.microsoft.com/windowsxp/home/evaluation / eatures.asp.

Re:Doesn't XP already do this?

[Anonymous Coward]

That's certainly a security risk with XP, basically they've extended RDP (which was available in W2K Server) onto the desktop. From an administration point of view this is a god-send. Additionally, I would note that by default RDP is not enabled on systems, and by default when you enable it, it's to allow someone you know to access your system, to whom you send an e-mail with a special link/key and then give them a password through a separate (we hope secure... but that's the end user's own issue) method. So far I haven't seen any proof-of-concepts for a sever compromise via RDP, and realistically speaking, this is a lot like SSH is to *nix... it gives you access to the 'command line' of windows... the gui... Certainly RDP is a security risk for everyone running it, but so is connecting to the Internet - from what I've seen there are many more, much larger vulnerabilities in m$ products than this one poses.

Re:Doesn't XP already do this?

[Darren Winsper]

I personally think the remote assistance is one thing MS got right in XP. I think the invite system is very nice indeed and the fact that it's default off saves clueless people from themeselves (You know the type, the ones who can't be bothered to type a password). Perhaps someone should create a similar system for X (hint hint).

Re:Doesn't XP already do this?

[oyenstikker]

What about me putting vnc server on my non-geek friends' computers (Yeah, I know you don't believe i have non-geek friends, but for the point of the argument) so I can help them out when they've changed all their settings accidentally? Crackers can't get in, they don't know the password. Wouldn't Microsoft put some security into it?

Oh yeah. Its Microsoft. Sorry.

Re:Doesn't XP already do this?

[Anonymous Coward]

Does not Unix allow you to do this also? Telnet?

Re:Doesn't XP already do this?

[The trees]

Shortly after the XP release, a Microsoft representative came to campus to preach the virtues of XP. When we asked him about the security of the Remote Access feature, he refused to give us a straight answer. He neither assured us it is secure nor did he admit he didn't know if it is secure or not. Makes me suspicious.

Re:Doesn't XP already do this?

[Rogerborg]

• basically they've extended RDP (which was available in W2K Server) onto the desktop

Yeah, and they failed the laugh test on that one too. Did you see the open ports on the IIS machine that Microsoft belatedy moved their We Have The Way Out *nix bashing site to? Port 5900 was open and exposed to the outside world. That's vnc, a freeware open source remote desktop viewing system that does everything that RDA does... only without the encryption. It's recommended to run it over ssl or similar, but apparently that's a bit complicated for the bulging brains at Microsoft.

That shows that Microsoft don't use their own products, that they happy to use "insecure" open source products when it suits them, and (once again) that they neither know nor care about security. But at least they set a good precedent: the first thing I did to my WinXP box was to make sure that RDA was off, and to download and compile VNC (checking that there's no back doors) - but only after I'd set up zebedee, an ssl tunnel, for it to run on. Sigh.

what nonsense

[Artifex]

Even if you never touched KaZaA, your systems may be affected if someone manages to attack Brilliant Digital's update service.

How? If I never touch Kazaa (that means, never install it), this article doesn't tell me how it can affect me. In fact, the article doesn't seem to say anything we haven't already heard in Slashdot before, about attacks through the use of DNS redirects or man-in-the-middle, etc. But how does it affect me, when I haven't installed the program?

they have inadvertently created a Single Point of 0wnership: a single machine or small group of machines which, if succesfully attacked, can be used to gain effective control of the Internet.

Okay, now this is total FUD. You're telling me that if they get hacked, the entire Internet is at the mercy of the hackers. Why is that?

Re:what nonsense

[Yottabyte84]

DDoS attacks could kill major backbones.

Re:what nonsense

[Anonymous Coward]

How? If I never touch Kazaa (that means, never install it), this article doesn't tell me how it can affect me.

DDOS. Jeez, seems obvious to me.

Re:what nonsense

[hingleton]

We're assuming that someone compromising this system is "evil and nasty and horrid and bad", right? I'm guessing that the concern may partly be for DDoS attacks.

Okay, maybe "the entire internet" is a bit of an overstatement, but if script kiddies who get lucky when distributing their bots can take down an IRC network for days on end... well, compromising this network would get you ever so slightly more remote hosts to control.

If it did happen, and for some random reason *you* were the target - so what if you didn't download KaZaA... :)

Re:what nonsense

[FrostyWheaton]

How does it affect me, when I haven't installed the program?

The answer to this question is painfully simple: You are connected to and attempting to use the same network. Internet users, slashdot readers especially, should appreciate the effect that(tens/hundreds of) thousands of "other people" can have on such a network.

" You're telling me that if they get hacked, the entire Internet is at the mercy of the hackers. Why is that?"

Because, the actions of millions of compromised machines have the ability to bring internet traffic to a standstill. millions of boxes, spread throught the world all participating in a coordinated DoS attack, would be, as the article states, "unstoppable"

Re:what nonsense

[FaithAndReason]

A couple of observations:

1. I was temping at Microsoft when NIMDA hit (flame me later.) The entire campus was more or less out of commission for a few days, and was having difficulty for at least a few weeks after that.
2. Check out the link regarding a "Warhol Worm". What if somebody wanted to write a virus with a REALLY destructive payload? Starting from a base of 10 million PCs would allow for a previously unheard-of propagation rate. Sounds perilously close to "effective control of the internet" to make.
3. I don't have any hard data, but I'm going to guess that Kazaa users tend to be more likely than the average PC user to have high-speed, always-on connections; yet they are significantly less concerned than the average PC user about privacy and security (since they don't seem to mind running an app with a known Trojan!). This makes the Kazaa network a far "juicier" target than anything we've seen to date.
4. In addition, the infrastructure to do a rapid "update" of arbitrary malicious code is already just sitting there, waiting for some black hat to take advantage, no social engineering required (BDE has done that hard bit already.)

Re:what nonsense

[Anonymous Coward]

> How? If I never touch Kazaa (that means, never install it), this article doesn't tell me how it can affect me. In fact, the article doesn't seem to say anything we haven't already heard in Slashdot before, about attacks through the use of DNS redirects or man-in-the-middle, etc. But how does it affect me, when I haven't installed the program?

Imagine you being the target of an attack based on several *million* zombie hosts, a la' Steve Gibson's little adventure. No, you don't have a trojan, but you still get screwed.

Re:what nonsense

[TotallyUseless]

kazaa is on *millions* of computers. that is infinitely more bandwidth and computing power than most script kiddies ever get access to with their ddos attacks. if someone executes a successful hijack of all those machines, they arent going to be taking down an irc network... they are going to go from backbone to backbone, and more than likely, successfully flood them

Re:what nonsense

[RovingSlug]

How does it affect me, when I haven't installed the program?

The answer to this question is painfully simple: You are connected to and attempting to use the same network. Internet users, slashdot readers especially, should appreciate the effect that(tens/hundreds of) thousands of "other people" can have on such a network.

You are blatantly ignoring the context of "How does it affect me". The intended context is: Does it directly compromise my system and my data? The context you address is: Does it affect remote resources that I'm accustom to having access to?

The article summary implies the former: direct compromise of a system. ("Even if you never touched KaZaA, your systems may be affected if someone manages to attack Brilliant Digital's update service.") If it's actually implying the latter remote resource issue, then it's irresposible reporting.

And, I agree with the first poster. There's no evidence to suggest that assuming control of Kazaa machines gives access to non-Kazaa machines.

Re:what nonsense

[Anonymous Coward]

I guess it depends on your system, and how it's used. For many systems, not having access to the Internet could seriously affect them.

Re:what nonsense

[redhatbox]

Ummm... you *really* didn't read the article, did you? It's a good piece, certainly better than your knee-jerk reaction here.

People can frequently answer their own questions with a minimal amount of research; News Sites make this even easier by directly linking to the answers.

Re:what nonsense

[Thing 1]

2. Check out the link regarding a "Warhol Worm".

I did. (For the lazy .)

Pretty amazing. It's great to have relevant data like that, and I appreciate that he will not remove the page; however, it screams "script kiddie" to me -- detailed instructions on how to create the "protocol" and forms of attack for the worm writer, along with relevant source code.

The next step: write a worm which can travel back in time and infect computers prior to the worm existing.

(There was a great series of books starting with "Red Limit Freeway" (forgot the author) which had a "map cube" of the universe which only existed in a loop -- the (older) main character gave it to the (younger) main character. Neat plot device.)

(PS Cool /. fortune currently "If you can survive death, you can probably survive anything." Relevant both to time travel and to the "lifetime" of the worm.)

re: what nonsense

[Anonymous Coward]

Okay, now this is total FUD. You're telling me that if they get hacked, the entire Internet is at the mercy of the hackers. Why is that?

Because they can then hose you with the combined bandwidth of 10^(large) number of Warez/Mp3 freaks. This would be the SubSeven to end all SubSevens.

As it is a framework for distributed computing, I think It's a safe bet that it has facilities for opening connections and pumping data at people. What more do you need?

Re:what nonsense

[Anonymous Coward]

imagine millions of machines brute forcing your passwords...

Re:what nonsense

[Anonymous Coward]

Doesn't count. Remotely "brute forcing" (guessing) passwords is a function of the comptuer being brute forced. Yeah, like my computer has enough resources to serve out 1,000,000 "Invalid password" messages every millisecond. Nevermind the madnatory delay between invalid passwords, and quite passibly an account lockout after too many bad guesses.

deciminate?

[Anonymous Coward]

I'm not sure what that means, but it sounds rather forbidding. We have GOT to stop this deciminating of viruses.........

Alarmist: Servers down != Internet Down

[redelm]

OK. So KaZaa is a Trojan that could be hijacked by Black[er]Hats. So they can do DDoS against some sites. Why should I get my shorts in a knot?

Some domains will get banned, and some sites will go down. The Internet carries on. Packets still get through.

Yes, Trojans are bad. Hijackable Trojans are worse. Enough good reason to avoid them without hysteria.

Sleeze.

[mindstrm]

You know, EULA or not... what Kazaa did is slimy. VERY slimy. They decieved people into installing something and giving up something they know people will not realize they are giving up. It is deception, whether it fits the legal definition or not.

I'm realistic... most people do not know or care of the difference, but they should.

So my question is...

What can we realistically do in order to force a bit more honesty in software providers?

Re:Sleeze.

[glwtta]

Not use their friggin software, when we don't like what the do? What a concept!

Re:Sleeze.

[norton_I]

The problem is, that doesn't work until you have already started using their software. How can we have checks on vendors honesty before everyone and his brother starts using their software?

I use free software almost exclusively, and use almost no zero cost commercial software, which seems to help, but is there anything people who need/want to use commercial software can do about this?

Re:Sleeze.

[asobala]

Only use free software, where we know what it's doing!

Re:Sleeze.

[Anonymous Coward]

Image that, a company that for the most part exists solely to distribute pirated files is sleezy. Who would have thunk it.

Re:Sleeze.

[SuiteSisterMary]

Oh yeah?

Re:Sleeze.

[VasilyPupkin]

What can we realistically do in order to force a bit more honesty in software providers?

Since when did we start to force honesty? Sounds like "let's force some free speech!"

... Imagine a label on WinXP machine "Honesty enforced and compatible" or "Honesty Inside"

Just my 10 kopeks.

Re:Sleeze.

[Mad Bad Rabbit]

What did you expect?

You install shady software to get music without
paying for it, and surprise, surprise, it has a
trojan in it. That's how /real/ "karma" works...

Re:Sleeze.

[Anonymous Coward]

What can we realistically do in order to force a bit more honesty in software providers?

You can use Open Source alternatives, and if your are still paraniod, compile the thing yourself after looking at the code...

Or just install a firewall

Re:Sleeze.

[Shemp]

I don't agree with their actions either, but you can't call them dishonest. They spelled out everything in their EULA. People are supposed to read those things before they click throug. What is Kazaa supposed to do, send everyone a registered letter?

Re:Sleeze.

[Niten]

It seems very unlikely that we will ever be able to ensure that software providers will be completely honest and forthcoming in the distribution of their software. While a worthy goal, I think that the best way to ensure a system's security is not to be able to trust application software providers, but to be able to sandbox these applications - to remove the need to trust them in the first place.

In my opinion, UNIX in general is far closer to reaching this security goal than any other operating system class, although more work needs to be done in this area. Applications, including those compiled from source, need to be easer to install under user accounts. I know personally that OpenOffice's installation process makes great strides toward this...

We will never be able to ensure that all software vendors will comply with any given security or privacy standards... and even if we were able to succeed there, we would still have to worry about trojans not released by "vendors". Better to focus on making systems secure than applications trustworthy...

Re:Sleeze.

[Anonymous Coward]

That hack doesn't work if you have a "clean" compiler. Which we have, since we've read and compiled the major free compiler (gcc) on more than one system and on more than one compiler (some of them less than free).

Re:Sleeze.

[Anne Thwacks]

I thought the American constitution guaranteed a "citizen's right to slease". The courts and government seem pretty determined to defend it.

Its one of the reasons the rest of the world is so unhappy with America!

Re:Sleeze.

[Rogerborg]

• What can we realistically do in order to force a bit more honesty in software providers?

Root their distribution server, zombie all the machines, and pop up a message box saying "Your machine has been compromised by software installed with your consent but not your knowledge by [Insert home details of Brilliant and Kazaa directors]. If you would like to protest against private companies taking control of your machine, please click HERE.". Then you email Kazaa, Brilliant, the NDA, the FBI, the FTC, the Whitehouse and the real target, Oprah. She'll kick their pasty white butts.

Superb slashdotting!

[sfrenchie]

This is great, I've never witnessed a prominent university's server get slashdotted so fast!

Looks like those cs students will have to go back to the old drawing board!

beowolf please

[Anonymous Coward]

Great now anyone can utilise over two million PC's to perform intensive numerical computation for free. If there smart enough to get in that is.

Not on this scale...

[FaithAndReason]

Need for Speed isn't installed on 10 million PCs. And, unlike Kazaa (I refuse to type that #$%@ capitalization), it's probably not running more or less 24/7 on a good percentage of those boxes.

True, windowsupdate.microsoft.com is a big fat target too, but at least that was designed primarily with security in mind, and AFAIK it hasn't been hacked yet in the 4 years since it was introduced. Also, Windows Update will NOT install anything without your explicit consent. (Now, as for Windows Media... it says right in the EULA that MS reserves the right to update your codecs without your permission, at the very least...)

Re:Not on this scale...

[Anonymous Coward]

The first wave of codered got a few boxes in the windowsupdate cluster. Of course, being an automated attack, it didn't use the servers for anything other than more scanning/propagation.

Of course, I would hope that the windowsupdate boxes would not have MS's private signing key on it. Both a compromise of MS's key (see: verisign stupidity), and a compromise of the windowsupdate servers have occured, just not at the same time.

Re:Not on this scale...

[Tim Browse]

True, windowsupdate.microsoft.com is a big fat target too, but at least that was designed primarily with security in mind, and AFAIK it hasn't been hacked yet in the 4 years since it was introduced.

You obviously missed this.

Tim

Re:Not on this scale...

[MindStalker]

Well verisign gave the guys a new key with MS's name on in, Windows update is set to look for a specific key, not just any key with MS as the owner. All that hack did was allow them to post code that would tell the user "This is owned by Microsoft" "Do you want to trust this key from now on?"

MS Windows isn't installed on millions of PCs?

[nuggz]

I think that MS Windows and MS IE are installed on millions of PCs.
They may not be mostly on high speed connections, but who cares, there are just so many of them it could cause HUGE messes.

Re:MS Windows isn't installed on millions of PCs?

[CrackerJackz]

True, (and belive me this is hard for me to say this next sentence...) I put more trust in Microsofts updater than Brilliants ... ick I cant belive I just said that :)

Re:MS Windows isn't installed on millions of PCs?

[ipfwadm]

I think that MS Windows and MS IE are installed on millions of PCs.

Sure windows is installed on millions of PCs, but how often does the average cl00bie run windows update? Many (most?) don't even bother running it at all, and for those that do, it's so infrequent that chances are good that the problem would be found before reaching a huge number of people. And, as another poster said, this is one case where I trust MS more than the other guy.

Re:MS Windows isn't installed on millions of PCs?

[Vikki_R.]

Well, the thing is, at least on Windows ME, you can set the OS to download & install patches/updates automatically whenever M$ releases one. It even has a wizard to set it up the first time (wizards are a Windows luser's best friend). Personally, I have it set to ask my permission to download, but probably the average Win luser would set it to automatically download, no questions asked.

However, there is one problem with the patch downloader-- it doesn't tell you the size of the file it's actually downloading. Granted, you can click on the link at the end of the patch summary to read an in-depth description of the patch and the security problem it's patching, and sometimes the file size of the patch is given, but not always. Personally, I'd feel a little more sure of those patches if the correct file size were listed in the summary, and I could see the file size of the actual file to make sure they match.

But, then again, I could just be overly paranoid. I'm not so much afraid of M$ in this case, but I'm afraid some smart-ass punk will get the bright idea of creating a worm/virus that floats around looking for patches (I don't know how it would identify them, but someone would figure out a way), and when it finds one, attaches to it and piggybacks into someone's (my) computer.

BTW, does anyone know what the difference is between a worm and a virus?

Lawyer's heaven

[Eric Damron]

If I were part of Brilliant Digital, I would be bracing myself for lawsuits. The first DoS attack that comes from someone taking control of their trojans will open them up for big legal liability.

No matter how many "We will not be held responsible" statements they have in their license agreement, they won't be held harmless from the damage done to a third party.

When you think about it, any program that automatically goes out and updates itself could be a problem if a blackhat is able to fool the client into installing the blackhat's update.

Re:Lawyer's heaven

[GSloop]

What do you want to bet that Doofus Digital is somewhere that UCITA has passed. (I.E. Virginia, and one other state...)

That basically exempts the manufacturer from liability in situations just like this.

UCITA - just the start of scummy legislation that screwes us all over. The saving grace with UCITA is that it hass to pass through all the states. This makes lots more hands to grease, and thus the corps that would love to see us screwed, have a much harder time of it.

Cheers!

Re:Lawyer's heaven

[Anonymous Coward]

Like MS got sued into the ground for all their "trojan" programs like allowed for DoS worm attacks. Oh wait, they didn't get sued. N/m..

Re:Lawyer's heaven

[catfood]

What do you want to bet that Doofus Digital is somewhere that UCITA has passed. (I.E. Virginia, and one other state...)

Maryland.

That basically exempts the manufacturer from liability in situations just like this.

No it doesn't. UCITA doesn't have anything to do with third-party liability.

If I sell you software in a UCITA state, my EULA which disclaims all liability is binding... on you. Not anyone else.

Think about normal life. You buy a high-performance sports car, the manufacturer makes you sign a waiver or has a EULA-equivalent that says they're not responsible if you hurt yourself with it, some defect in the car that the manufacturer should have known about causes you to plow into pedestrians on the sidewalk. You might be without a case, but the pedestrians aren't party to the EULA and can sue whoever they want, and likely win.

I am not a lawyer, yadda yadda, do not take this as legal advice, etc.

Re:Lawyer's heaven

[GSloop]

True, about the 3rd party liability - I think, UCITA has some weird stuff in it.

It effects the uniform commercial code, and it could effect that portion of the law relating to 3rd party liability - I just don't know. Persuing several hundred pages of legaleese isn't high on my list of pleasureable things to do.

Anyway...

Cheers!

What can we conclude?

[sam_handelman]

As such, all three proposed usages: Secure and secret storage, secure and secret computation, and secure content delivery, are all inherently flawed.

This is all to true. Therefore, given Brilliant digital's wicked corporate pedigree, we conclude that they must have a secret, sinister master plan that they're not telling us about.

They've been clever enough to use evil plans as a smokescreen - the plans they've described are just wicked enough that you might believe that they really are brilliant digital's brilliant evil plan. This means that the real evil plan must be extra... brilliant.

Basically, we can divide the possible real evil plans into three categories:
1) Defense related. They're going to hack into NORAD, and hold the world hostage from skull island. The fact that this is physically impossible (because NORAD isn't connected to the public 'net, and so on) never stops Dr. Evil, so it shouldn't be a hindrance for Brilliant Digital.

2) Biblical. Enumerate the billion secret names of god, conjure forth their lord and master, Satan himself. You all saw Warlock, right? Like that.

3) Astrononomical. I know that if I had the computing power of fiteen million consumer level CPU's at my disposal, I'd use it to pull the moon into the earth. 'nuff said.

Either way, we're talking countdown to doomsday, here, and only one man can stop them. I hope Brilliant Digital CEO Kevin Bermeister's mistress is played by Zhang Ziyi; she is so hot.

Re:What can we conclude?

[Anonymous Brave Guy]

1) Defense related. They're going to hack into NORAD, and hold the world hostage from skull island. The fact that this is physically impossible (because NORAD isn't connected to the public 'net, and so on) never stops Dr. Evil, so it shouldn't be a hindrance for Brilliant Digital.

Unfortunately, you're failing to account for the four star CO who decided he must have his e-mail access to his wife from inside the mountain, and ordered his IT officers to install it against their recommendation...

(Don't laugh too much; there are documented cases of serious military security breaches due to exactly this combination of rank and technical naivety.)

Re:What can we conclude?

[HoldenCaulfield]

3) Astrononomical. I know that if I had the computing power of fiteen million consumer level CPU's at my disposal, I'd use it to pull the moon into the earth. 'nuff said.

Well, we know that with ~3 million consumer level CPU's, people like to look for aliens

Re:What can we conclude?

[Zspdude]

Well, we can definately that if 15 million consumer level CPUs are capable of pulling the moon into the earth, than it should be a piece of cake for Brilliant Digital to hack into Norad, public net connection or not. In regards to number 2, they're too late. Hasn't M$ already done that with XP and its registration keys?

is the posting....

[C_nemo]

...saying "Ownership" or "0wnership"?

Re:is the posting....

[Anonymous Coward]

Yes.

The use of zero instead of O is l33t hackerspeak.

0, not O

[*xpenguin*]

anyone else notice how the article title has a zero instead of an 'O'?

Re:0, not O

[Anonymous Brave Guy]

Erm... It meant exactly what it said.

Actually, I thought it was quite amusing (in a poignant kinda way)...

Re:0, not O

[supermoose]

j00r 4r71cl3 wuz 0wn3d!

Now excuse me while my 15-year-old friends and I H4X0R YOUR COMPUTAR!!

Congratulations to nweaver

[Cally]

...for slashdotting his own site

The post is a rant!

[JDizzy]

I took the time to read the linkage, but was very disapointed at the substance..... This was nothing more than a rant from a disgruntled college student. Obviously he is more emotional, and passionat than he was logical, and compelling. The arguments he raises have little weight, or simply state the obvious. There was zero information about anything pratical, just conjecture, theory, and a bunch of what-if's. The person who wrote the rant is nothing more than a Teachers aid, at Berkley... he is not anybody worth listening to, at least not until he gets his degree, and a few more years of wisdom.

I think everyone can aggree that Brilliant's sleeper software is dubious at best, a straight up violation of law at the worst. However, this persons rant doesn't help anybody.

Re:The post is a rant!

[chialea]

Um... nick's a grad student. he's not disgruntled. he's about to get his PhD, just finishing up the thesis. I'd also submit that dismissing people is not always a good idea, and dismissing all grad students is certainly not a good idea. I'm willing to bet a lot of money that there are some of em who are smarter than you are, at any rate, just as there are certainly some who are more intelligent than I.

Lea

Re:The post is a rant!

[JDizzy]

Well, the guy is most certainly smarter than me. I do respect him. However, rant is rant, despite the velvet on the emperor's robe. The whole text is nothing more than a rant, and conjecture. I hope his thesis papers are not written this way. It is sad when people, with good intentions, discredit themselves in this way. People don't know what they don't know. and nobody knows anything about Brilliant's sneak-ware. For him to create a thought-experiment of what he believes to be true(or false), and rant about it, doesn't afford him any credibility. So until he actually disassembles the Kazza sneakware, there is nothing to write about. The only good part of the text is his questions to ask about Kazza. The rest is hot air.

Re:The post is a rant!

[Repton]

I'm reading GEB at the moment, so maybe I'm seeing self-references under every stone, but...

Was anyone else struck by how self-descriptive the above post is?

Re:The post is a rant!

[JDizzy]

lol.... I actually know what your talking about... and yes.. I have read GEB... I took a psychology class or two before I dropped out. Anyways, what is so "self descriptive" about the text? I'd like to hear what somebody, who doesn't know me personally, has to say about what I write. Well, from a psyc perspective anyways.

BTW- I wouldn't totally disagree with you, just curious. I know that I probably fullfill my own prophecy from time to time, but I didn't think I was describing myself each time I talk about other people.

Re:The post is a rant!

[Anonymous Coward]

So until he actually disassembles the Kazza sneakware, there is nothing to write about.

Maybe he has done this but is "forced" to only "rant" by the DMCA etc. You may see an increasing number of "rants" from PHDs in the future as they will be left with few other ways of saying these things, that is if they are even allowed to "rant"!

Re:The post is a rant!

[Anonymous Coward]

Amazing - another recursive /. posting title!!!

Re:The post is a rant!

[Chester K]

The only good part of the text is his questions to ask about Kazza. The rest is hot air.

And not to mention a heaping helping of FUD.... gloom and doom predictions based on nothing but conjecture. The exact same stuff we jump down MS and other companies' throats about; it's trolling from them, but from this guy its supposed to be insightful?

I wonder why he didn't point to up2date or any of the other various Linux updating utilities as examples of single points of failure? The impression I got was that he simply has an axe to grind, and picked his favorite enemies (Microsoft's mentioned, natch) as targets.

Re:The post is a rant!

[JDizzy]

Thank you... exactly... your so correct. I think you jsut found a new fan..

Re:The post is a rant!

[maxpublic]

I agree the article is mostly rant with little, if any, empirical observation. However, discounting someone simply because of their educational status or occupation, especially in the computer biz, is something only a fool would do.

Some of the best and brightest have no degree and nondescript occupations. In fact, given my extensive experience with college students I'd hazard a guess that getting a degree, especially in computer science, is absolutely no indication of skill or inborn talent whatsoever.

Max

Re:The post is a rant!

[JDizzy]

That is true.... but I don't doubt his smarts... in fact.. I bet he is very smart.. just a bit to passionate about the issue.

Hmmm..

[ZaneMcAuley]

Actually, I would hope this does happen. Why? Because it would put the frightners on FUTURE SPYWARE being installed and FORCE a GOOD SELF-DISCLOSURE POLICY STANDARD.

It would kill EVERY SPYWARE ON THE PLANET.

Re:Hmmm..

[Aanallein]

Right. Just like every previous Outlook virus killed all other outlook viruses that worked on the same principles, and just like every worm making use of long-known IIS vulnerabilities killed all other worms that made use of other well-known IIS vulnerabilities.

The only thing this happening would cause is make some people commit suicide because they wouldn't be able to play Everquest anymore ;-) - and perhaps if trouble lasted long enough it might make other people start to read a good book for a change. :-)

Re:Hmmm..

[ZaneMcAuley]

Well, if they had a few million zombies ready to take out some BIG host or essential service. More oomph and publicity and something might be done. Im not talking about some lame worm or virus here. I mean complete outtage. Think bigger.

Here's how to uninstall

[RadioheadKid]

c|net has an article on removing this stuff, and kazaa will still work afterwords. Not much info besides goto add/remove programs and remove b3d, but at least they list what files should be removed.

Re:Here's how to uninstall

[ArsonPerBuilding]

Thankyou for the link, I needed it.

Re:Here's how to uninstall

[ZaneMcAuley]

Just run www.kazaalite.tk

No need to remove it :D its NOT there in the 1st place :D

Same program, just all packaged up with NO crapware.

Re:Here's how to uninstall

[Anonymous Coward]

this procedure assumes you are willing to remve kazaa off of your computer (which you should definitely do anyways if you're concerned with your systems security)

NOTE: if you are not familiar with windows os and/or the ms windows registry DO NOT mess around with these directions. get some geek that you know or buy and read the book "Windows 98 Annoyances by O'reilly publishers) and study the Registry chapter. If you screw up and your system crashes/dies it is YOUR problem for messing around with what you shouldn't have messed with!! this is an appended version of an earlier /. post by someone else.

In Windows, when you download the latest version of the client from kazaa.com you'll be forced to install the bde 'stream' thing, which gives you, wait for it, a talking woman on the front page of the application. Yipeee.
You can go to Add/Remove programs and kill it, but in true crapware tradition it doesn't actually delete the files. Go into the system folder and you'll find a bunch of DLLs prefixed with 'bde', both DLLs and EXEs. (my system had these files in c:/windows/system after uninstall: bdedata2.dll, bdedownloader.dll, bdefdi.dll, bdeinsta2.dll, bdeinstall.exe, bdesecureinstall.cab, bdesecureinstall.exe, bdeverify.dll, bdeverify.exe) Delete them. (make sure you don't kill anything that belongs to the Borland Database Engine if you have it installed - check the DLL versions). There are two EXEs with fuzzy green icons.

Next under the windows folder there will be a directory called 'BDE', IIRC. Delete that too.

Finally, go into the registry and look for the 'bde' and 'brilliant' strings. After verifying that they're not something else, delete those too . . . if you don't know the windows registry system first educate yourself at http://www.regedit.com/ then read below . . .
go to start/run and type: regedit to access registry editor. Click on edit/find (Ctrl+F) and on my system i found these reg "directories" (b3dini_auto_file, b3ds_auto_file, BDEPLAYER.BDEPlayerCtrl, BDEPLAYER.BDEPlayerCtrl.1, BDESmartInstaller.BDESmartInstaller, BDESmartInstaller.BDESmartInstaller.1, {67925165-C4B6-11D2-B9C6-0000E84F59A6}, BDEinstaller, Brilliant Digital Entertainment, )

For Their Own Good

[Jucius Maximus]

D'you reckon someone should do some DNS hijacking and send code out via Brilliant Digital's 'Singularity' to wipe Kazaa user's hard disks? It would be better than a ten million user DDOS attack against who knows where, sent by a cracker with less ethical aspirations. And on the plus side, the Kazaa users would learn a lesson and remember it because it hurts to lose all your precious mp3, and maybe (IANAL) they would get to sue Brilliant Digital for negligence. Thus, three birds killed with one stone. (Bird 1 = Security Risk, Bird 2 = Ignorant Kazaa Users, Bird 3 = Brilliant Digital itself.)

Re:For Their Own Good

[Anonymous Coward]

> D'you reckon someone should do some DNS hijacking and send code out via Brilliant Digital's 'Singularity' to wipe Kazaa user's hard disks?

Well, the RIAA were talking about hacking in to users computers... hrmmm.... :-)

Re:For Their Own Good

[Tim C]

You forgot Bird 4: whoever does this is tracked down, fined a huge amount of money and given a long jail sentence, and is hit with a civil suit or two from the users whose they machines they toasted.

I can understand your desire to demonstrate that quietly installing software like this will not be tolerated, but it's not really the Kazaa users' fault. All they've done is fail to read an EULA properly. If that were a crime, we'd all be in trouble...

Cheers,

Tim

Re:For Their Own Good

[Jucius Maximus]

"You forgot Bird 4: whoever does this is tracked down, fined a huge amount of money and given a long jail sentence, and is hit with a civil suit or two from the users whose they machines they toasted."

I was more making a joke than suggesting a real course of action ... but I certainly did not forget bird 4 ;-)

Advice

[Anonymous Coward]

it would help to read the article before posting. otherwise you come across as a shallow-minded, knee-jerking reactionary naysayer. Kinda like you seem to be right now, as a matter of fact.

[OT] I know - I can't spell

[Anonymous Coward]

But hey - chances are, that I'm better at English than you are at Danish, so there ... :-p

This all applies to Grokster as well

[markh1967]

Just to make people aware that the trojan is also distributed with other FastTrack browsers such as Grokster. It is not just confined to KaZaa. I've never downloaded or installed KaZaa but I am running Grokster (with the spyware removed and dummy cydoor dll in place) and I was infected as well. If you're running Grokster check out your Windows directory. If there's a folder in there called BDE and you aren't running the Borland Databse Engine then you're infected as well.

Re:This all applies to Grokster as well

[Thing 1]

If there's a folder in there called BDE and you aren't running the Borland Databse Engine then you're infected as well.

This Brilliant tempest is giving Borland/Inprise/Borland a lot of press. I haven't heart of the BDE in years, but in the past week I've seen mention of it at least a dozen times.

What's really cool is the extent to which the instructions go to make sure you aren't deleting something useful.

Re:This all applies to Grokster as well

[suss]

You could have avoided this by adding the following lines to your hosts file:

127.0.0.1 www.brilliantdigital.com
127.0.0.1 desktop.kazaa.com
127.0.0.1 shop.kazaa.com
127.0.0.1 www.bonzi.com
127.0.0.1 www.b3d.com

c:\windows\hosts for Win9x
c:\winnt\system32\drivers\etc\hosts for Win2000/XP

I guess they didn't think of using IP numbers instead for importing their trojans?

Warhol, Flash, and Extortion worms

[TimFreeman]

The next evolutionary step after the Warhol Worm is the Flash Worm and the Extortion Worm.

To all crackers the world over

[Treeluvinhippy]

Just do it.

Can you imagine...

[Anonymous Coward]

...a Beowulf cluster of these?

Not just KaZaA!

[mcrbids]

What about the Red Hat Network? I subscribe 'cause it makes my job as admin SOOOO much easier - but the RHN largely consists of servers with BIG, FAT PIPES.

(Who'd use RHN over a modem line!?!?)

Seems like this also might be an excellent point from which to launch a big DDOS attack, no? How closely does RH watch their servers?

Re:Not just KaZaA!

[Indras]

What about the Red Hat Network? ... Seems like this also might be an excellent point from which to launch a big DDOS attack, no?

<SARCASM>
Actually, what you are proposing is impossible. Everyone knows that all hackers and virus writers prefer to code in Visual Basic. They would have too much trouble trying to get Wine to run their virus so they could take over RHN, and they'd just give up.

Does that make you feel any better? I didn't think so. Hey, it was worth a try.
</SARCASM>

Re:Not just KaZaA!

[Peter H.S.]

What about the Red Hat Network? I subscribe 'cause it makes my job as admin SOOOO much easier - but the RHN largely consists of servers with BIG, FAT PIPES.

As I understand it, it won't be easy to sneak a trojan into RHN, just by cracking RH's RHN servers, since all the RPMS are gpg /pgp signed (+md5sum). So an altered rpm-file, will fail the Up2date agents gpg check against RH's public key, and AFAIK therefore not be automatically installed.

So installing Red Hat rpm's, even from "untrusted" mirrors, should be safe, provided that RH can keep their private key secret, and you actually verify the gpg signing (easy to do).

Seems like this also might be an excellent point from which to launch a big DDOS attack, no? How closely does RH watch their servers?

I do think that RH actually monitors their servers (and bandwith), but perhaps much more important, I am quite sure, that they will respond quickly, if people reported a DDoS attack from their IP-range.

IMHO a big part of the DDoS /SPAM /skript-kiddie problem is, that so many boxes, are running totally unattended and / or administrated by less than entirely competent people, who may not even read mail adressed to eg. postmaster@example.com, or without the skills to comprehend the described problem.

A 2 hour DoS is nuisance, a 10 day DoS a disaster.

Re:Not just KaZaA!

[rosewood]

Reading his rant you would know that yes, any auto-updater has these potential risks but why Kazaa?

1: Shitload of users (lots more then RHN and WinUpdate, etc.)
2: Likelyhood that there is no security authentication (dig sigs, etc).

Re:Not just KaZaA!

[Tazzy531]

3) Less educated users (RHN is mostly tech-oriented people whereas Kazaa is typically teenagers and college students) 4) Many leave it on whether or not they are actually using it, not realizing the ramifications of this.

Re:Not just KaZaA!

[rosewood]

Thank you for continuing this

I was in the middle of that comment when the server we were working on that took 9 hours to boot (or IPL if you are an IBM dork) changed so I had to run so I just hit post instead of waiting for it :

Where do i sign up

[bpb213]

There is nothing which prevents a misbehaving client from only serving banner advertisements which say "Brilliant Digital and Doubleclick Can Bite My Shiny Metal Ass".

Please, where do i sign up? :)

I stand corrected.

[FaithAndReason]

I'm not terribly surprised that the Windows Update site was hacked; I know Microsoft's security holes perhaps a bit too well (see my other post to this story.) What I meant was that to my knowledge, Windows Update has never been "taken over" in the manner described in the article.

Re:Alarmist: Servers down != Internet Down

[Anonymous Coward]

> OK. So KaZaa is a Trojan that could be hijacked by Black[er]Hats. So they can do DDoS against some sites. Why should I get my shorts in a knot?

Imagine that "some sites" include all the major root servers for DNS, and the major backbone providers. Launching an attach from several *million* zombies would effectively bring down the Internet due to the inability to do any of the rerouting efforts you cheerfully assumed here.

Bah - hack Windows Update

[nazgul000]

Seems to me that the most obvious "single point of attack" on the Internet is anything having to do with the Windows Update mechanism hardwired into Windows XP and, one would assume, all future versions of the OS... MS-bashing aside, I am certain that Microsoft has taken all reasonable precautions to prevent the co-option or subversion of this channel into millions of computers, but the fact remains that Windows Update is proprietary "security through obscurity..."

on a related note, does anyone have any insight as to HOW the MS Windows Update mechanism works, and how it is secured? Seems as though it must run on a massive server installation, given how much traffic it has to handle...

Re:Bah - hack Windows Update

[evilquaker]

MS-bashing aside, I am certain that Microsoft has taken all reasonable precautions...

Why would you expect that? Recall that Windows Update got infected with Code Red, even though a security fix was available a month earlier...

Re:Bah - hack Windows Update

[shird]

At the very least, it relies on some form of code-signing. What this means is clients which connect to this site to download updates, will only install them if they have been signed with the appropriate keys (the complementry one of which is included with the OS). So even if the site were hacked, it would still be neccessary to sign any rogue updates with a key which is apparently kept very secure.

I can only hope Brilliant is doing something similar. But I wouldn't trust even their code, given that they've already 'snuck' this onto my system and plan on using my computer for their benefit. I am currently contemplating doing some auditing / reverse engineering on their system, and am quite confident I (and others) will uncover some quite unpleasant surprises.

Re:Bah - hack Windows Update

[Anonymous Coward]

Recall that Windows Update got infected with Code Red [theregister.co.uk], even though a security fix was available a month earlier... , if only they had visited windowsupdate on those servers, The irony is so thick you would almost miss the point that nimbda also put infected dll`s in shared folders so if nimbda had infected executables instead of the office riched32.dll trick and the microsoft techs uploaded their new patches trough a share on the windowsupdate server, then everyone atempting to update his or her iis server would be.... f**ed..

just think of it, the only condition for this would be:
-nimbda infecting exe`s, like most old dos virri
-lazy windowsupdate techs who put their updates (which are always exe`s never pgp signed zips with a human readble installer so you could at least see what you are installing) on the download servers through a share without checking a crc/md5 of the actual update before adding it to the update scripts.

Re:Alarmist: Servers down != Internet Down

[TotallyUseless]

if they get access to 1, 10, 15, or 20 kazaa clients for hijacking, why couldnt they get the other millions that are out there. i would be willing to bet that someone from almost every isp on earth has downloaded kazaa... at least one of their customers has it... so when it starts going into ddos mode, you going to ban everyone's isp out there? or just a few million IPs? neither one sounds workable to me.
if someone actually pulls this off, they more than likely wont attack individual websites, they will attack major providers, with millions of attacks, from IPs scattered around the globe, and more than likely from many many many ISPs

A thousand points of Not Bright

[infonography]

It's too easy for the script kiddies to highjack. Any distributed system that has more then one single purpose (i.e. Seti) is going to be used by someone else.

Download the app

fire it up

watch the port activity. Get the code.

Seti's FAQ

"The data server doesn't download any executable code to your computer. "

Can we trust Brilliant Digital to build in such safeguards? I trust Seti mostly for pure motivation.

I have thrown a lot of time and effort into securing my systems. I am not going to drop my pants for some lame deal like this. Just say NO to distributed DOS...

--

Just say No to Religion.

Expect more of this!

[MavEtJu]

Early 90's, the (usenet) world was shocked by the fact that somebody abused the network to send spam.

Early 00's, the (slashdot) world is shocked by the fact that people don't care about installing spyware / trojaned software.

Be afraid, be very afraid.

Re:Expect more of this!

[symbolic]

Here's my take on it...people either have been warned, or have been too careless to find out exactly what they've installed on their system. Let them suffer for their mistakes. Sometimes a little hardship is the only thing that will teach them.

Re:Expect more of this!

[Tazzy531]

Until one day all the DDoS attacks shut down all your root name servers and a good chunk of the backend routers. I guess you should suffer also [through the lack of a usuable internet] because you didn't do anything about this before it happend.

Not to run around and shout the sky is falling or anything. This is potentially a major problem. When a company's business plan focuses on tricking the user to install their application, you know they care relatively little about security or the damage that they can do.

The sky is falling, the sky is falling.

[Pedrito]

The internet has been relatively insecure since day one. It's no one particular company's fault or one particular person's fault. The internet protocols weren't originally designed to prevent massive DDoS attacks. It wasn't designed to be particularly secure on the individual machines because when it was originally created, the network was secure by the fact that every computer on it was known. The number of computers didn't extend into the thousands, probably until the 90s, and even then, it was about 98% educational institutes, DOD, and companies.

Any competent programmer, familiar with several TCP/IP protocols, and TCP/IP programming, could easily bring the internet to a grinding halt. The fact that it hasn't happened in years (1988 with Robert Morris' infamous internet worm) is what astounds me.

The server won't BE slashdotted

[MillionthMonkey]

Come on. Look at the page. There are no banner ads or images. It's all handwritten HTML, totaling up to less than 8K of static content! The guy probably designed the page to withstand a slashdotting. Control-V posts are helpful in some cases. Like when the site requires "free registration", or when people are actually bitching they can't read it and you have it in your cache. If this particular Control-V gets modded up, it's proof that the moderator hasn't even tried to read the article.

Re:The server won't BE slashdotted

[Hektor_Troy]

DOH!

I'm just so used to using add-filters and not surfing with pictures (Opera) that I just assumed, that it would get slashdotted.

"Everyone knows, when you make an assumption, you make an ass out of u and mption."

Anti-Virus Programs

[Reknamorken]

I would guess that nearly 100% of /. readers have an Anti-Virus scanner of some sort loaded on their desktop/laptop. These all have systems that are designed to automatically d/l updates, including core functionality/engines.

I have seen TrendMicro's PC-Cillin d/l executables before.

So, while Brilliant Digital is out of line and while Weaver makes good points, the reality is that this threat has been around for a very long time.

For that matter, have you considered what might happen if someone 0wns the Akamai system?

Re:Anti-Virus Programs

[Anonymous Coward]

I would guess that nearly 100% of /. readers have an Anti-Virus scanner of some sort loaded on their desktop/laptop.

Considering the number of Slashdotters who use Linux for a desktop OS, I doubt it's anywhere near 100%.

Re:Anti-Virus Programs

[lkaos]

I would guess that nearly 100% of /. readers have an Anti-Virus scanner of some sort loaded on their desktop/laptop. These all have systems that are designed to automatically d/l updates, including core functionality/engines.

Huh? What's an Anti-Virus scanner? Oh, a virus is that thing that can damage your computer if you are stupid and run everything as root or run an operating system that lacks any security mechanisms.

I guess I'm part of the 0% of /. readers who use a real operating system and therefore do not need Anti-Virus scanners.

All I know is that if someone hijacks one of these networks, my computer and all my data will be fine.

Re:Anti-Virus Programs

[TheOnlyCoolTim]

I certainly don't have a virus scanner running, and I'm even on Windows.

You just have to be careful about what executables you run and don't do stupid shit like use outlook express, and you don't get Viruses / Adware.

Tim

Re:Anti-Virus Programs

[Anonymous Coward]

Slashdot referrer logs show 98% of readers coming from Windows machines using IE 4.0 or higher.

Re:Anti-Virus Programs

[Anonymous Coward]

Touché, alebit a little harsh.

Re:Anti-Virus Programs

[Anonymous Coward]

I used to think this way, but then I got nailed.

I think it was by some obscure virus on our network. I might have double-clicked some random file and got hit. My bad, but it still sucked.

I dunno, you can probably get virus protection for free or cheap. I love Norton AV. It sucks major system resources, but it works hella well. eTrust seems to be good and quite cheap, and uses less resources. Not sure it's quite as effective though.

You could always try KaZaA and search for an AV program for free too.

Re:Anti-Virus Programs

[Feanturi]

Yep, me too, running Windows with no virus scanner, except maybe once a year just to make sure. It's always clean. Virus scanners use resources that I could be using on other things. Read before you click, know your file extensions, and think a bit about what you're putting in your computer, and you too may shrug off the performance ball-and-chain of virus scanners. I would expect that the statistic of /.'ers who *need* virus scanners is much lower than the almost-100% suggested.

As for the average PC-user, I feel sorry for them. They need virus scanners, but don't know how to use them correctly. I work with average users everyday, installing cable internet in their homes, installing a NIC in their machine if necessary, and fixing up various problems if I have time. I observed Norton Anti-Virus fail horribly one day:

When I got to the customer's home she informed me that her computer had the SirCam email doo-dad. She knew because she'd questioned the email she'd gotten from a friend, who had discovered the infection and warned her (too late) about it. I had already researched this one as my girlfriend had recently fallen prey to it (*sigh*), and knew what had to be done to remove it properly. But I noticed Norton sitting smugly in the systray and decided to put it to the test. I ran Liveupdate and made sure it had the latest dat files, did the scan and lo and behold, it found SirCam. So now what? The user is prompted to Clean, Delete, Quarantine or Ignore. Clean failed. I knew that Delete or Quarantine were bad because of how this worm hides, (if you simply delete/move the file, Windows is no longer able to run any .exe files) so what the fuck?? How is the average user supposed to realize that they should immediately go look up the named virus in the online databases and figure out what to do from there? I had expected Norton to have the capability of changing the registry as part of the proper fix, or at least to advise that there was a removal tool available on their website. Nope.

So, the advanced user doesn't need virus protection, and to use virus protection properly you need to be an advanced user. Ummm, yeah...

Re:Anti-Virus Programs

[shepd]

>You could always try KaZaA and search for an AV program for free too.

Or you could click the link in my post and enjoy a free (as in beer) A/V scanner that might run in DOSEMU, and certainly does run in a DOS box of all windows I've tried it on (3.1-9x-NT-XP), and is updated quite often. This is one of the last true shareware programs I've seen on the net that's actually receiving updates (sad really that shareware turned into adware turned into spyware has now turned into trojanware).

Re:Idiocy through obscurity

[MillionthMonkey]

So, basically, they inadvertnatly created a cluster that can be hit and effectively screw everybody over.
Then this guy announces that he's found the cluster and that the reward for hitting these servers is beyond that previously imagined by HaX0rs.
The /. points to this report and hypes the reward for the attack.
Are we just begging for the |33 to attack?

Quit wasting your time on Slashdot and get back to writing those IIS security patches. :^)

Yes!!

[Anonymous Coward]

Finally an intelligent post! Zhang Ziyi *IS* really really hot!!

Ximian Install and RedCarpet are the same

[psychosis]

Since installing Ximian is "conveniently" performed by running "lynx -source http://go-gnome.org | sh" (as root, of course), what happens when someone registers go-gnom.org or similar typos? (Credit to my brother for thinking of that one.)
Now I did issue the above command, but ensured that the DNS records were compliant and my local DNS server reported the same distant end IP as the authoritative one for the domain, but I doubt many folks do the same.
Also, when installing packages via RedCarpet (again, has to be done as root), what are the cryptographic signatures checked against? (Note: I haven't even researched this. Just typing off the top of my head...) I would hope that the proper response from GPG is hard-coded in the red-carpet binary...
Basically, I think that a lot of new update technologies are vulnerable to this - from windowsupdate.microsoft.com as mentioned in the article to more trusted (by this community, anyway) sites. Semi-automatic updating is great, but it still takes people at the keyboard to think before they do something. Not likely to see a widespread change in that mentality for some time to come.

Re:Ximian Install and RedCarpet are the same

[zerocool^]

Make sure your /etc/apt/sources.list is accurate and up to date. If you do this, than you can't go wrong -

The one you should be using for red carpet is
http://red-carpet.ximian.com/debian
as in: line in sources.list
deb http://red-carpet.ximian.com/debian stable main

apt-get update
apt-get install task-helix-core
apt-get install task-helix-gnome
apt-get install task-ximian-gnome
...depending on what you're after and what you have.

If you misspell the commands, nothing will happen except that it will tell you incorrect syntax (or that you're not root, you bastard). Just make sure the master list is correct.

Here, i'll even write you a shell script:

#!/bin/csh

set sources=`grep http://red-carpet.ximian.com/debian /etc/apt/sourc es.list` | wc -l

if ("$sources"=0) then
echo "deb http://red-carpet.ximian.com/debian stable main" >> /etc/apt/sources.list
endif

echo `apt-get update`
echo `apt-get install task-ximian-gnome`
echo "all done"
exit
###end of file

Re:Ximian Install and RedCarpet are the same

[bcaulf]

echo `apt-get update`
This is a useless use of backquotes and echo. This line would do just the same thing:
apt-get update

Security Question

[Anonymous Coward]

Is it possible to make a **secure** system, where it's centraly administered?

Yesterday's Ad-Aware update 5.71 uninstalls this

[Mushy]

Just an FYI.

Re:Dumb..Very Dumb (mod parent up!)

[erroneus]

....too bad I can't mark this one as insightful... 'cause you're right. I hadn't really looked at it that way.

We do tend to idealize the past beyond its reality. Still... apathy harms.

Add a signature to AV software

[shird]

If this 'Brilliant' software presents a serious threat to the security of your system, (ie a trojan), AV vendors will add a signature to their database which should detect and remove the trojan. They do afterall detect and remove rogue distributed.net clients which are distributed maliciously, so why not this?

The only difference - this is being spread by a known company, and is likely to retaliate with lawsuits etc if the AV vendors do add it to their database. I personally have had some of my programs marked and detected as trojans by AV vendors (password revelation software, and clearly marked and distributed as such), but I can see these guys getting away with it though.

How?

[Anonymous Coward]

"..a single machine or small group of machines which, if succesfully attacked, can be used to gain effective control of the Internet."

Again.. How? One might argue types of control.. Obviously, 'total' control might be by sending ground forces in to secure all root servers. Yet, even then, that problem could be remedied.

One might seize the holdings of AT&T and such. Now there would be real tangible control. If you own the pipes, you can destroy them. Without connection, internet protocols are useless.

But.. how does a distributed client offer 'control' of the internet? Am I missing something? Am I hallucinating and misreading the post? Sure, if someone manages to gain access to their update systems, a lot of boxes could be affected.

But 'a single point of ownership' could 'gain effective control of the Internet'..?

Even Microsoft doesn't spread FUD like that.

Re:How?

[Todd Knarr]

The Brilliant client gets executable code downloaded from the Brilliant servers and download of the code is under the control of the servers, not the client. If someone got control of the Brilliant servers they could download code to your machine that either used your access or exploited a security hole to gain admin access and completely compromise your machine. It could then set up a server like Back Orifice and wait for orders.

Scenarios like that are one reason I refuse to install software that does things under the control of someone else's servers. I can control my machine and what I do, I can't control their servers and what they do, and if I don't have control I have no way of insuring that nothing happens that breaks security.

Privacy loss can be staggering

[DebianGeek]

All Brilliant Digital has to do now is read your hidden log files to find out where you've been, what you've seen, etc. Checkout http://www.fuckmicrosoft.com/content/ms-hidden-fil es.shtml"

Information overload

[HiThere]

The root cause of this problem is information overload. It used to be that most people couldn't know everything, but it wasn't really impossible if you didn't do anything else. Those days are centuries past.

Today everyone, no matter how smart, is submerged in a tide of information. The only way to survive and get anything out of it is to filter it. But how should one construct the filters???

Don't pat yourself on the back too hard, just because you understand computers. There's a lot more to this civilization than computers. And the rest is just as important.

All I've been able to do is demarcate a small area that I try to understand, and try to find other people that I trust to understand other areas for me. I don't know of a better method, even though that one is clearly flawed. Note that this is the same technique that almost all people adopt.

One of the critical flaws in the process is:

How does one choose trustworthy authorities? I sure don't have an answer. The best I can do is pick people that I don't know to be wrong for reasons that are unknown or unacceptable to me. This isn't great, but it's something. One of the good points about this system is that it distributes authority (I see centralized authority as inherently evil: consider that the central authority will have the same limitations [mentioned above] as anyone else, and the people that the central authority chooses to trust will have every motivation to give self-serving advice [as long as they aren't caught at it.])

Re:Information overload

[Anonymous Coward]

"Today everyone, no matter how smart, is submerged in a tide of information. The only way to survive and get anything out of it is to filter it. But how should one construct the filters???"

Metal Gear Solid 2 has a similar plot, in that some giant super-AI or somethign was being built to censor all information that we as humans recieve. Go get the game, it's quite good.

Re:Information overload

[alcmena]

How does one choose trustworthy authorities?

I like the idea of political duty. Think of it like jury duty, only longer. It basically states that random people will be picked to server as politicians (house menbers, senate members, etc.) for a period of time. They are then released and a new crop is picked. There are many problems with this, but there are many problems with the way things are done now.

If the policitial duty was truly random, the views of the population are more likely to be represented. Though it would take a lot of effort to ensure the process is random and is not corrupted.

Doesn't Unix already do this?

[Anonymous Coward]

Ever heard of telnet? Sheesh.

i'm not a criminal, but i play one on tv

[drik00]

Far be it from me to do anything of the sort, but some of these "hacker" groups should make themselves useful and attack Brilliant's systems, instead of Yahoo or something *beneficial* to the Internet.

I say hit 'em, and hit 'em hard...let them know what we think.

To paraphrase Malcolm X,

We didnt land on your advertising, you crammed your advertising down our throats without asking, bitches

Re:i'm not a criminal, but i play one on tv

[DaCool42]

Yahoo is beneficial? I haven't looked at it in about 8 years. Although they use google's engine now right? I guess they are providing google with some cash.

Solution to the Kazaa problem

[tempest303]

Instead of following HeUnique's instructions to get rid of Kazaa's spyware, try this:

DON'T INSTALL IT TO BEGIN WITH. ;P

tempest303, continuing his crusade to troll people that think fair use means never paying for media.

not totally disagreeing, but...

[amarodeeps]

People aren't really getting more ignorant: we're more educated than at anytime in the past.

Yes, but also one can observe that as we've acquired more and more knowledge, that hasn't necessarily led to an increase in wisdom. So if we are getting more educated, then we aren't necessarily putting that to work, and things are the same as they have always been--which really just supports your first point, but without the corollary (that in contrast, things are actually getting better).

Do you think those textile workers were curious to know how the sewing machines really worked?

I would imagine that neither do the slave-wage laborers in southeast Asia, and they don't seem to be get more educated, but less...and I don't see how things are in general getting better and better. In the United States, perhaps, our standard of living has been getting better and better. But when I think of the millions of people who have contracted HIV in Africa without access to the necessary expensive drug cocktail that would allow them to survive, the people around the world put to work for pitiful money to support the consumer machine that is western 'culture,' etc., I can't help but think things are, if not getting worse, then determinedly staying at the same level of overall mediocrity for most of humanity.

Re:not totally disagreeing, but...

[Anonymous Coward]

Things aren't getting better? Then how come more and more countries have clean water to drink? Why isn't cholera a problem in England anymore? Why are fewer Indian women having children? Why are more inner city kids better educated than ever before (despite still being less educated than suburban kids)? Because things *are* getting better.

Re:not totally disagreeing, but...

[Broccolist]

also one can observe that as we've acquired more and more knowledge, that hasn't necessarily led to an increase in wisdom.

It's certainly valid to point out that not all our new knowledge is in some sense valuable. But, literacy is at unprecedently high levels. Although there is no way to measure "wisdom" (not too sure what you mean by that, BTW), it would seem highly plausible to infer that it increased along with literacy, since there is an obvious link between capacity to read and capacity to get informed.

As for your second point, life in the third world actually has, in many ways, been getting progressively better in the past decades. The UN food aid organization says the number of starving people (defined as 55% calorie intake above subsistence) has decreased from 917 million in 1970 to 792 million in 1997, despite a population increase of over a billion. Of course, 792 million is still nothing to cheer about, but it is better than before, which was my point. Life expectancy in the developing world has also gone from 53 in 1970 to 65 now (despite AIDS which has brought it down). I don't have any facts on education, though, but I'd be very surprised if it had gone down.

This is a bit off-topic to the discussion, but since you brought it up, I don't see what's wrong with people working for "pitiful money." Nobody's forcing people in the third world to work in sweatshops. They want to work there, because having no work and starving is worse. We should encourage business in the third world, because stimulating their economy is the only way they'll ever get out of poverty.

The guy is right. It's serious.

[Animats]

He's right. Brilliant is a push-type peer to peer auto update system. (See page 11 of the Brilliant SEC filing..) This allows an attack to hit a huge number of clients in a short period of time, with no user intervention and no user visibility. Worse, because it's a peer-to-peer system, clients know where to find other clients and can talk to them, so propagation would be far more effective than for most viruses. That's much more powerful than sending "I send this to you to get your advice" to everybody in the Outlook address book.

There's no need to take over the Brilliant servers. An attacker should be able to do it all from any suitably modified Brilliant client.

If someone writes an effective Brillant-based attack, it might contaminate most of the clients in a very short period of time. And most of them woudn't even notice, until it was too late.

Brilliant isn't exactly a tech-savvy company, either. Their previous business was producing hip-hop videos. They have 18 employees. Plus one software consultant. (Read their SEC filing.) They have no track record of producing secure systems. They make no claim that their product is secure against external takeover. And they don't have enough assets that if they screw up, they'll be able to pay for the damage.

If you have responsibility for any computers that do anything important, scan them all for this program immediately, remove it, and block it at your firewall.

It's possible that the Brilliant "projector" is so secure that it can't be used as a pathway for an attack. But without independent verification of its security, it has to be viewed as highly dangerous. All it takes is a buffer overflow and some carefully crafted "ad content" to use this as a virus distribution system.

Some of the same potential vulnerabilities apply to other peer-to-peer systems. Netnews/NNTP, for example. But Netnews is typically run on UNIX machines under its own userid, so even if an exploit in it exists, it can be contained within the Netnews world. And it's a mature system; the obvious holes were plugged long ago. Most of the other peer-to-peer systems, like Gnutella and Freenet, are pull-type systems; they only bring in content when the client asks for it in response to a user request. That slows down propagation and associates it with specific content, like an ordinary virus. But Brilliant, from their description of what they do, pushes automatically and peer to peer. That's much more dangerous.

Re:Alarmist: Servers down != Internet Down

[bsartist]

you going to ban everyone's isp out there?

No - just the one that's not getting attacked. That will be the one the script kiddie is using, because he won't want to bring down his own access.

Kazaa exec defends sleeper software

[TheDarkRogue]

When it wakes does it Yell "THE SLEEPER HAS AWAKEN!" ?

Lame? yes, but I couldn't resist :)

Porn

[NineNine]

All I can figure is what they're *really* planning is the world's best porn-harvesting tool.

Genius.

Re:Porn

[Anonymous Coward]

But you have already linked to it! Why duplicate this effort?

No you don't.

[haeger]

You deserve to be 0wn3d d00d.

Whoever modded that to insightful must be drunk. You dont "deserve" anything like that.

Women dont deserve to be raped, no matter what they are wearing (or not wearing) or how drunk they are.

I don't deserve to have my car broken into just because I parked it in the street one night. Even if I left my shiny new laptop in there.

Running Kazaa ignoring the spyware, for women to put themseles at risk or to leave my computer where it coule dasily be stolen is stupid in all cases, but never deserved.

.haeger

Re:No you don't.

[Anonymous Coward]

You're right, but all the same: people need to take some responsibility for themselves and do a better job of COVERING THEIR ASSES.

Face it, if you don't cover your ass you're going to get fucked -- and it won't feel good.

Windows security problems -- Oh my!

[darkonc]

From the article: And yes, this problem has existed for a considerable period of time, with Microsoft automatic updates (starting with ME and continuing in XP) being the most widespread possibility. But this is the first time we have had a company with such willful ignorance of security (based on their business plan) distributing an autoupdating piece of code.

Er, uhm. Is he talking about Microsoft here, or the Kaza people??

Intentional Attack??

[pod]

Any attacker who can control 100,000 machines is a major force on the internet, while someone with a million or more is currently unstoppable: able to launch massively diffuse DDOS attacks, perform needle in a hayfield searches, and commit all sorts of other mayhem...

Doesn't take an attacker to bring about mayhem. I think we can safely trust BD to screw up their very first release (if it ever gets that far). I bet their little P2P scheme will DDoS SOMETHING purely unintentionally through incompetence (of which they're shown plenty so far).

Grokster does NOT contain BDE!

[ROThompson]

I am a Grokster user and I also checked with several others and they do not have any BDE folders/files. Also, see Grokster's comments on this at:

http://www.grokster.com/brilliantdigital.html

You must have received them another way.

Re:Grokster does NOT contain BDE!

[markh1967]

Now that is strange. I can't think where else I could have picked it up from but I have not downloaded KaZaa so I must have got it through another program. How many other programs are infected with this trojan?
For the record, I have run Morpheus (both the old FastTrack version and the new Gnutella-based one), but they wouldn't do this, what with their 'no spyware' policy, would they?

Re:Solution to the TROLL problem

[Anonymous Coward]

*sigh*

If you're going to troll at least do it well...

Did you mean 'continuing his crusade to troll people that think fair use means never paying for content ' ??

Unless, of course, there is a huge problem in shoplifted/ripped off CD Blanks/harddrives/flash cards that /. hasn't reported.

:)

Resistance is useless

[Anne Thwacks]

Actually, about 30 years ago, a bunch of people in America, England, Holland, and quite a few other places I have not been to, decided to get off the boat. They were the Hippies. They did not subscribe to the "A million Lemmings can't be wrong" theory, and decided to try other ideas instead.

They got a very bad press from the lemmings, and the lemmings clearly just thought they were another bunch of lemmings with their own cliff. Since most people get their data from the Lemming Press (TM), they assumed that they might as well follow the blind man in front of them, rather than another, probably blind, man somewhere else.This is not surprising. America was founded by a bunch of rebels, and lets face it, they are mainstream lemmings now!

The main difference between now and "the good old days" is that there is no longer anywhere you can go that is out of reach of lemming based civilisation. Even the Taliban's rather foolish attempt failed, and lets face it, they were armed and dangerous. You wont get far with a VW bus and some magic mushrooms today - but at least you can download "The Greatful Dead" with Kazaa.

Anybody know if "The Furry Freak Brothers" and Fat Freddies Cat" comics are available online?

Re:Alarmist: Servers down != Internet Down

[TotallyUseless]

dammit, i have mod points, and if you weren't replying to my post, i would give you a funny boost :)

Re:Alarmist: Servers down != Internet Down

[Anonymous Coward]

DDoS against some sites. Why should I get my shorts in a knot?
Oh, i dont know I mean all script kiddies have found intresting ddos targets so far is yahoo becouse so they figured it is the sign of the "sell-out" of the internet and the chat sesion of the dutch royal family becouse they wanted to prove their provider (kpn) wrong when they garanteed that their service could survive no mather what.
Its not like they will move on to root dns-servers, and routers of the really important backbones or anything.... I mean why would we worry they have only attacked webservers so far why would they move on to more valuable targets anytime soon, its not like there is *anyone* on this planet who like to be known for cousing the most intentional internet downtime ever (perhaps a record hold by the moris worm when the internet was not as big so there was large percentage of downtime? that is if you forget microsoft with its avarage of ten nimbda/code-red/code-red II infections a server a day ofcource ;-)).

stupid troll

[Erris]

No, see, Windows Update has security signatures on all of its packages.

That's so comforting! Err, no it's not.

This whole scam is possible because MicroShaft designed an operating system they could push on. You know, no real user accounts, IE and Outlook running as "Administrator" and other stupid stuff like that. Everyone told them it was wrong to connect machines of that nature to the internet and that they should change their practices to the best available. They chose to sell adverts instead, so they made sure they own your machine. The results are that any interested third party can own your M$ machine at anytime.

What part of the M$ EULA don't you understand? The intent is clear enough with revocation possible at anytime. All else beyond that is lagnape.

Re:stupid troll

[Anonymous Coward]

no real user accounts, IE and Outlook running as "Administrator"

Everyone told them it was wrong to connect machines of that nature to the internet

interested third party can own your M$ machine at anytime.

you are one ignorant motherfucker, know that? go jack it to some open sores crapware.

Exchange PGP signatures

[KjetilK]

Make sure your /etc/apt/sources.list is accurate and up to date.

That's all well and fine, but what if somebody is able to put malicious code on the real servers, in the binaries we download in a man-in-the-middle-attack, then we would all be in deep trouble.

I always check the signatures of software I download, but it doesn't mean anything other than that somebody signed it.

We need to contract the PGP web of trust, folks, so that there are few hops between users and and those who sign the software we use, so that we can really check if the signature belongs to a person we trust.

I'm in Oslo, Norway, I'd love to exchange signatures with anybody I can meet face to face, so if somebody happens to be close, drop me a note.

Spyware and recording monopolies

[sergeaux]

The problem is that P2P really impacts sales of recording monopolies a lot. So, the confounded spyware hype is created to divert people from using P2P tools.

It is the recording companies who make those who develop P2P networks include spyware into their client software, and not for the sake of the information this software can collect (though it is quite useful too), but TO MAKE PEOPLE AFRAID OF INSTALLING P2P BECAUSE OF SPYWARE.

Sic

Re:Alarmist: Servers down != Internet Down

[Anonymous Coward]

Hey, man, if I can shut down AOL by hijacking Brilliant's little Trojan Net, then LET'S GET IT ON!!!

To paraphrase Megadeth

[Anonymous Coward]

"If you root a server, you're a script kiddie. Root many, and j00 r 1337. Root them all, and YOU ARE A GOD."

possible solution to all this stuff

[jacquesm]

Every worm has a payload, you can make a signature
of the payload packets, then you could instruct
several backbone routers to drop packets that
match that signature. This would move the response to virii from the end user to the
maintainers of the backbone, and it would slow
down the propagation of a worm or virus once
detected.

Of course such a system could also be hacked :)

Re:possible solution to all this stuff

[vsavkin]

Backbone routers are very inflexible things, as are most other appliances. Do something unusual to them, and their CPU utilization will rise, effectively making them stop their work. And this is just what we're trying to prevent, do we?
You will have much better luck with this sort of things on your edge routers, based on your $UNIX_LIKE_OS_OF_CHOICE

Brilliant' real business plan

[Bastiaan]

It just occurred to me that there's one party that's very interested in getting access to the machines of all those "KaZaa pirating bastards".
Rather than playing out Dr. Evil scenarios to attack NORAD, Brilliant simply sells its assets to the RIAA, so they can finally finish that distributed processing run of 'format C:'

I wonder...

[iwrigley]

...what Brilliant's response would be if anti-virus companies added definitions to their software that would seek and destroy the client. Or if Microsoft created a 'security patch' that disabled/removed the software.

Re:Solution to the TROLL problem

[tempest303]

Heh... very true. My bad! (I live with a "mass media" [read: mass comm] major, so my vocabulary is all warped. ;)

ah but ...

[Clansman]

I agree with your basic idea - that the further back you go, the more likely it is that individuals had more primary survival skills that we do today. That even within the world today, there are people who have those skills because they *need* them.

Fine - except that you are equating world for world - in order to *escape* from having to all farm our own pigs, we've specialised in different ways.

Perhaps an interesting line of thought would be to explore equivalencies of skills and the "volume" of skills that individuals take on throughout each generation and between generations. This might be especially visible in migrant populations. People coming from the rural third world to europe or america might seem lost but their children take on new skills to cope with the new society and culture. Now - how many skills do they forget in the process?? Do they add the ability to job hunt *and* remember how to hunt boar?

So - to conclude a bit of a ramble - each age or era has low skilled bare survivors and high skilled leaders and "winners". If we were to see, say , a nuclear war that lead to societal collapse, for sure we'd have to learn fast but that seems to be our forte as a species - the survivors would soon learn the hard way how to keep pigs (or hunt for boar!)

J

University of California issues security alert

[Animats]

See this alert. They view the Brilliant system as unauthorized commercial use of University of California resources.

• You may receive offers for gift certificates and free videos in exchange from Brilliant Digital, or a subsidiary, for permission to use your computer and network connection for use of your computer and network resources. Please be aware that commercial use of university computing and network resources that has not been authorized by the University of California is a violation of the campus acceptable use policy. In addition, granting an external organization permission to use your computer could jeopardize the integrity and availability of your computer and data as well as impose risks to your personal privacy.

  If you permit your computer and a UC Davis network connection to be used for unauthorized commercial use, such use will be a violation of the campus acceptable use policy (PPM 310-16, Exhibit A). We advise you to respond negatively to a Kazaa, or Kazaa affiliate request to use your computer and UC Davis network connection for commercial use that has not been authorized by the University of California.

  A violation of the campus acceptable use policy could result in the temporary or permanent loss of access privileges or the modification of those privileges. Violators may be subject to disciplinary action up to and including dismissal or expulsion under applicable University policies and collective bargaining agreements. Violators may be referred to their sponsoring advisor, supervisor, manager, dean, vice chancellor, Student Judicial Affairs, or the Misuse of University Resources Coordinating Committee or other appropriate authority for further action.