Slashdot Mirror
MSN Censors Your IM
Jamie ran across a story about censorship on MSN. Essentially, a number of suspicious strings result in silent failure of delivery. The strings are unsurprisingly things like .scr and .info. They've started maintaining a list if you're interested. Personally, I'd rather they fix the vulnerabilities that make those strings dangerous in the first place: it's not like IM is the only place a URL can get on your machine.
From an article that is linked to from this one:
Or for that matter, http: //tinyurl.com/z35a5.
Kind of reminds me of our software filter where I work. They blocked firefox.exe from running. My solution? I renamed the file to iexplore.exe. Worked like a charm.
It's also probably worth noting that the messages are blocked on the server, not the client. That means that it will block the message whether you're using the MSN client, Pidgin, or any other client to access MSN.
My advice: Get a frickin' Google mail account already and use Google Talk instead.
"Nothing for you to see here. Please move along."
I'm guessing they're using that as a way to make sure only subscribers can get first post now? It wouldn't load for me until someone had posted.
As for the IM... I don't care what it is, it's not their job to censor it. Virus check attachments, sure... But not sensor the chat. Absolutely ridiculous. Reminds me of games that try to filter out all 'bad' words and end up filtering out words like 'fanny' because they mean 'butt' in the US and apparently refer to women's genitalia in the UK. How people NAMED Fanny deal with that, I can't imagine. There were quite a few more commonplace words that mean odd things in other languages or countries and were filtered as well. Ridiculous.
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
And simply renaming worked? Your IT department is pretty inept.
---- Booth was a patriot ----
Since the day I became almost crazy when I was trying to pass a URL which included 'download.php?' to a friend from a well trusted website. All of my messages sent back to me. PITA.
Fortunately, it's kinda easily fooled if you randomly place a space and add "delete the space" at the end of the sentence. If they trust me in the first place, what prevents them from copy-pasting it and deleting a character as I requested?
My 0.02 cents
This isn't censorship; it's just a poor firewall. The difference is that the former is for stifling human communication, while the latter is to protect machines from malicious software.
Do you really think they're diverting resources away from fixing bugs so that they can add "censorship" features to IM? Perhaps this is just one effort among multiple efforts to correct problems AND mitigate their effects? If it's going to take X weeks to fix the bug, but Y days to implement a filter that will stop some large percentage of infections, don't you think that both avenues are worth exploration at the same time? There's more to slowing and preventing the spread of malware than fixing the defect that allows them to propagate.
This also assumes that the same organization even owns the bug in question. Not all of these defects may be Microsoft's problem to begin with. This might even be a MORE reasonable action for them to take, since they're doing "everything in their power" to fight the problem rather than just sitting on their hands waiting for a 3rd-party to correct their bug, and sitting on their hands longer waiting for the end user to update their software.
I don't suppose it's occurred to Microsoft that .info is a perfectly valid TLD used by a significant number of legitimate web sites, and a perfectly appropriate string to include in an IM discussion.
http://alternatives.rzero.com/
Do they block those scary executable .com files too?
Here's one it started doing since the recent MS security drive. Any file that could possibly exploit a hole in any piece of software seems to be treated with serious suspicion. Somehow, this seems to include GIF files. So, when someone tried to send me a GIF file, I get this warning. I download it anyway, and it's sitting on my hard drive. I can copy it somewhere else, open it, etc.
However - and this is the kicker - when I click on the blue link to the file in the MSN chat window, I get this dialog. Yeah, it actually DELETED the file I just downloaded. After I copied it using Explorer. And I have full access to it. Dunno who implemented that piece of genius.
== Jez ==
Do you miss Firefox? Try Pale Moon.
The first person that got infected wiht something would bitch that Microsoft didn't do enough.
Not that im fond of them either, but it seems they cant win either way these days.
---- Booth was a patriot ----
Personally, I'd rather they fix the vulnerabilities that make those strings dangerous in the first place
At least their trying something (albeit a weak approach) to stop automated scripts from sending viruses all over their chat protocol.
When you work on 1000+ college student laptops, you learn a lot of things about software students use in general, and one of these things you learn is:
1) AIM is a Virus downloading service disguised as a chat protocol.
I know that AOL doesn't do this on purpose, but it is so easy to hack that it might as well be. it's great when a 12 year old downloads a virus that infects Aim thinking it was some game (probably from AIM i might add), it sends "Hey check this out!" to his sister at the college containing an infected link or program, and the next thing you know you're running Aimfix and cleaning Zlob off on 300 PC's.
If Aim would simply filter out the bad traffic (and they should be able to know if a client is spamming the servers like crazy by heuristics alone) it would stop a lot of scams dead in their tracks.
In Soviet Russia, Trojan exploits YOU!
This has been known about for years. Here's a digg posting from over a year ago...
You can set up your own server, you can control your own IM stuffs, and really ... it's just a better solution. You could still go with GTalk if you want access to the Jabber network without setting up a server or doing anything fancy, but in that case I'd recommend encryption for your conversations (you should probably do that anyway). If you just want to set up a new Jabber account on one of the public servers, head on over to jabber.org and pick one out.
Perl.
Still, the administrator of a server running PHP 5 can get scripts to run without having .php in the URL by using various forms of content negotiation:
Anyone who knows me knows that I haven't used windows since 1999. I simply can't stand the system, nor can I stand the corporation behind it.
.. should we try to protect, or should we ignore those that do not upgrade their systems? The cynic in me tells me : "Let them be cracked". The humanitarian in my tells me: "Well, think of the victims of the DDOS attacks from the botnets of previously-vulnerable people".
.. or IRC for that matter. Heck. PLEASE go back to IRC. It's still the best means of communication there is.
However. I'm also interested in computer security.
It _MAKES SENSE_ to block stuff that has been observed in automated worms. It's a simple solution. It's not something that will make all systems invulnerable - but it _MAKES SENSE_. It's a quickfix. A quickfix that works.
This is only "censorship" insofar that it actually prevents stupid automated worms to spread. It's a defensie measure. Not a perfect one, but one.
Oh, and patching the holes. Sure. You can patch the holes. Then everyone has to update
I'm dead tired of _idiots_ who thinks that any preventative measure is evil! censorship! bad!
Microsoft is simply trying to help in this case. If you do not like it, use another IM service. Like Yahoo!
So, please you censorship-screaming morons:
SHUT UP! STOP USING THEIR SERVICE IF YOU DO NOT LIKE IT. THEY ARE TRYING TO DO THE RIGHT THING IN THIS INSTANCE !
*phew*. Now I have to go wash my brain. I've just defended satan.
"Rune Kristian Viken" - http://www.nwo.no - arca
Someone want to tell me how you fix a user who downloads and runs untrusted executable code?
I've seen plenty of Linux n00bs get tricked into running rm -rf /. Or lynx -source example.com | sh
MSN implementing filters on certain strings is just a small measure in a huge arms race any major IM system has to deal with.
PS. You can save yourself the trouble of replying if you're going to tell me Linux only allows the user to destroy all of his files and not the entire OS.
Worse, after they get their own machine hacked, they'll blame MSN. They'll contact whatever 'customer service' facility is provided and scream bloody murder. If they manage to get fired as a result they may even sue. Don't doubt that there are employers capable of getting litigious with MSN over it, also.
Sadly, this is the reality of operating an IM/Email/SMS service today. Look carefully at that graphic realize that it is not an exaggeration.
Lurking at the bottom of the gravity well, getting old
The solution?
Apply some idea of "common carrier" status to MSN. Like the telephone companies, as long as they do not attempt to edit or censor the content that passes through their networks, in any way, then they are not responsible and cannot be held liable for any damage caused by such content. But the moment they start taking measures like this to try to "sanitize" the content of the network, make them legally liable to pay damages for any successful attack/exploit that they are unable to prevent.
Overnight, this stupidity would go away. It would also set a great precedent for any other companies that wish to do this.
It is a miracle that curiosity survives formal education. - Einstein
Also the php files are in the document_root directory (or whatever you want to call it).
Yeah, on the server - then they could exploit the server hosting them... Why on earth would MS care about that? They're doing the filtering to protect the end-users from exploits of vulnerabilities in the MSN client. It doesn't matter the least bit if it's PHP, Perl, Ruby, ASP or whatever that runs on the server-side - it's what is returned from the server-side that matters. I'll have to agree with the guy guessing that PHP is usually the first choice of scripting language for script kiddies.
And as the first poster noted, TinyURLs get through just fine, plus it'd be the least of problems to make a HTTP redirect, so http://example.com/harmless.script points to http://example.com/malicious.script?that=pwns&MSN= users. This way of "fixing" bugs is nothing but retarded - it fixes nothing and it hassles end-users a great deal - some of those substrings that are getting blocked are VERY common.
"Live free or don't."
kakaroto from the amsn project somehow obtained the full censored regexp list. There are about 90 in total.
t =157&postdays=0&postorder=asc&start=30
http://www.amsn-project.net/forums/viewtopic.php?
....msmsgs.exe