GoHip.com ActiveX Wreaks Havoc 244
This story popped in several times in the last couple days and it's pretty slow today so I figure it'll be good for a laugh. Apparently GoHip (no relationship to Goku or Gohan) had some sneaky ActiveX that a lot of people installed. Kinda a scary security situation right there. Makes me glad I don't have any of that OL- I mean CO- I mean ActiveX on this box.
Putting ActiveX on your machine is like... (Score:1)
Tasteless, tacky.... (Score:1)
Morale: Turn Off ActiveX (Score:3)
You think you're safe? (Score:4)
1) Read through all of the source of the installer, or
2) Have software that warns you about every change to your system,
there is a chance that the software is editing some part of your computer that it shouldn't. In short, this isn't just a company abusing ActiveX--this is a company abusing basic software practices.
Personally, I call software that changes my outgoing e-mail without my consent a virus...
~=Keelor
There's no such thing....... (Score:3)
Having read abvout what a nasty and insidious thing this company did, I went to their web site to see what they do. Before I hadn't heard of them. I'd be surprised if they didn't get a few more customers from this.
ActiveX... (Score:1)
ActiveX is a superb technology for intranets, but it has absolutely no place on the open internet apart from extremely high quality/high credibility sites. Then again despite all the anti-MS rantings that will undoubtably come of this, ActiveX is in a nutshell simply an EXE that can be embedded. There's nothing more insidious about ActiveX than that link of blooblemeisters.com "Download the new management console for your Linux machine here!".
As a sidenote: There's an ad running at the top of my machine for penguin computers showing a giant penguin stepping on the Redmond campas. Are all these companies so bloody insecure and defensive? Really these ads are pathetic. Is there an IS manager out there anywhere who is such a loser he'd buy a machine because the ad shows it stepping on Microsoft? That's uber lame gentlemen, and anyone who is motivated by such things should seek medical help.
Cheers!
NOW is when to use a DOS attack! (Score:1)
Horray for Pokey! [yellow5.com]
The REAL Morale (Score:3)
Trust nothing. Trust no one on the 'Net. You don't get something for nothing, so stay away from sites that offer anything "free." It's most likely a scam.
READ those agreements before you click on 'Accept.' You'd read a contract before signing it wouldn't you? Under UCITA those click agreements just might become legally binding.
Most of all, don't use IE and don't use Windoze. You don't need ActiveX or any of that other flashy shit to use the WWW.
Disable anything that allows some site to run code on your machine. Use SSH. Use crypto. Encrypt your hard drive. Lose your keys, and then your data is even safe from your own prying eyes.
Be paranoid, be very paranoid.
Install from source, not RPMS. Read every line of code. Make sure you understand what every line of code does in a package before you type "make." Know the code better than its maintainer before you even dream of running it.
Knowledge is power. Forewarned is fore-armed. An ounce of prevention is worth a pound of cure. Pick a cliche, any cliche, and apply it to evey situation.
The truth is...out there.
A couple interesting things... (Score:5)
First, in the article, those "fine print software agreements" were discussed...the legal validity of such have been under question for a while now. Due to various legal details, those "click Next to continue installing" agreements are considered by many to be too automatic and do not require enough action on the agreeing party to be legally binding...
Second, I was amused that GoHip.com considers what they do a Browser Enhancement [gohip.com].
Third, ActiveX ever since it's first incarnation has been horribly gigantic a gaping security hole [halcyon.com]. Anyone even remotely self-respecting computer security-savvy individual would never dream of having ActiveX enabled on their computer. Unfortunately, the average Joe might not know this...hopefully, they will be educated in time.
Here's one (of many) place I definitely like Java a whole lot better [princeton.edu]...
Fourth, in the end, this really isn't that big of a deal, as it was relatively benign. Hopefully, however, it will educate people as to the dangers of ActiveX, in general. I think David Kroll said it best: "I think it's pretty tacky what they did". Although he and Finjin [finjin.com] did get it wrong when they said: "this is the first time a company has used ActiveX to alter personal information on someone's computer." Just see the ActiveX Exploder link mentioned above! I think they'd be more accurate in saying this is the first time it's been done purposefully and on a large scale by a corporation.
Fifth, this reveals an interesting problem with "signing" such programs with things like Verisign. That signature doesn't really mean as much as most people think that is does, as Verisign said: "Verisign spokesman Gray Chapman confirmed that GoHip is certified by Verisign, but stressed that his company was not in the business of passing judgment on the business practice of its client."
Sixth, GoHip.com sounds horribly sketchy. No phone numbers, bouncing e-mail addresses...is anyone surprised?...But finally, I have to admit to being horribly amused at the final quote by one of the "infected" GoHip.com visitors: "I compliment GoHip for a fine marketing effort as I certainly know who they are. I hate them, but I know who they are". In the end, capitalism seems to be all that matters again...
VeriSign (Score:1)
What are the requirements for getting a digital signature? Has someone actually tested the control on their system and decided that the changes it makes are suitable or is the process more a foregone conclussion. Companies simply going through the motions to get the signature?
Re: (Score:1)
Exploits & Corporations - Same holes... (Score:4)
On a practical note, here's what I keep telling the people;
1. Turn off these everywhere...
HTML (except the browser)
Java
Java Script
Active-X
VBA or macro features
Anything similar to the above
2. Cookies - Delete it and recreate a new unreadable cookies file.
3. Never open any message unless you...
Know the person sending it
Expect the message
4. Move all mail to a Spam/Suspect/Trash folder automatically if the mail doesn't pass these two rules at a minimum...
It's from a known and trusted person or mailing list
It's addressed to one of your valid mail addresses; it's not from a mailing list
5. Remove all personally identifying comments from programs that have net access (Netcape's Mail Identity page, ...)
6. Don't give out your email address unless it's REALLY NECESSARY.
7. Use different email addresses for different types of mail; business, personal, ....
8. If you have to give out an email address for one-time use, tag it; /. asks, use something like slashdot_yanky@hotmail.com or some such (or better yet, get your own domain and mail server...quite handy!)
The best way to handle this is a firewall with filters. Remember, Procmail For Security and good ipchain rules are your friends!
But for the long term solution.. (Score:1)
The long term solution is to set your bios to boot from A floppy first, put in the RedHat install floppy and the install CD, and your troubles are gone for good. With the Gnome interface that comes with RH 6.1, Windows users will have no trouble coming up to speed.
The only "downside" is that you will be able to tell who is using broken MS software: their apostrophes will be displayed as question marks.
And no, I'm not trying to exclude distros other than RH. It's just the one I am familiar with, and have found very easy to install. So I think it's a good choice for the new user.
Re:Goku? Gohan? (Score:2)
Way to go, CmdrTaco!
Another Reasson Active X is a Bad Idea (Score:2)
Actually I'm lying, the real reason ActiveX is a bad idea is that it gives waaaay too much power to in-browser apps. Why would I want a plug in I download from a website (not an application or
I was livid when I found out... (Score:3)
There is no longer a web browser available under Win 95 on my system. My guest will just have to overcome their "fear of flying" and surf under an OS that I can lock down.
Re:Goku? Gohan? (Score:1)
why disabling Active-X won't work (Score:4)
The only real solution I see for myself personally is to simply have a separate computer for browsing the net. Computer are cheap these days, and how much resources does a computer need to browse the net? Since nothing important is kept on the net browsing computer these security issues don't really matter much to me. And having to reboot periodically isn't a problem either, since all the real work is being done on a more powerful machine else.
It makes for a lot less stress too. Heck if I did all the things some people advocate whenever a story like this comes up I'd be a paranoid cave-dwelling hermit!
Re:You think you're safe? (Score:1)
Is there anything equivalent to tripwire or tcpwrappers for Windows? For *nix based systems, these are indispensible tools to track the integrity of your systems.
At a securty conference I went to about a year ago, everyone was complaining that they were not available for win32 systems. Has that changed since then?
Re:There's no such thing....... (Score:1)
Sad, but true. Pretty much the same thing happened to me with the decision about the ditto search engine [slashdot.org]. I had never heard of the company until someone sued them, but when I went to their site to see what the fuss was about it turned out that they were pretty cool. Now I know were to go if I want to search for jpegs on the net- and it's all because someone sued them and tried to run them out of business.
Re:Morale: Turn Off ActiveX (Score:3)
Definately. Even if you set signed component to prompt, a Microsft signed Active X component doesn't ask you if it should install. It d/ls then just installs anyway (see bugtraq [securityfocus.com]). cuartango put up a demo [angelfire.com] of this.
--locust
cookies (Score:3)
Well, since you're posting on slashdot as a logged in user, you're obviously hypocritical on this one. Why not instead tell them to run something like junkbusters [junkbusters.com] that'll actually let them control what cookies they want instead of just blindly and across-the-board killing them all?
funny how no one mentions... (Score:4)
I don't see GoHip forcing people to their website and forcing them to download this stuff. Yet another example of personal responsibility taking a vacation within the walls of slashdot.
Re:You think you're safe? (Score:1)
Abuse is bad enough - but someone making it easier for others to abuse you (or your system) is even worse, don't you think?
Re:Exploits & Corporations - Same holes... (Score:1)
Who the hell is going to expect email? I don't expect email from my friends at specific times. When it comes I read it. Simple. I don't call them up to check: "Hey, I have an email from xxx with xxx timestamp, is it yours?".
I think you're going way overboard, why not just disconnect from the net completely. Don't forget to disconnect your fd0 and cdrom or someone could install a exploit.
AKA "adam & eve channel" + Contact Info (Score:2)
Registrant:
Alchemy Communications (GOHIP-DOM)
9610 DeSoto Ave.
Chatsworth, CA 91311
US
Domain Name: GOHIP.COM
Administrative Contact, Technical Contact, Zone Contact:
Administrator, DNS (JH334) dnsadmin@ALCHEMY.NET
Alchemy Communications
9610 Desoto Ave
Chatsworth, CA 91311
(818) 718-0366 ext. 402 (FAX) (818) 700-2835
Record last updated on 14-May-1998.
Record created on 14-May-1998.
Database last updated on 26-Feb-2000 12:35:37 EST.
Domain servers in listed order:
NS1.ALCHEMYFX.COM 209.132.221.21
NS2.ALCHEMYFX.COM 209.132.221.22
About Alchemy, GoHip's host/ Parent Company
:Alchemy Communications
1200 West 7th Street, Suite L1-100
The Garland Building
Los Angeles, CA 90017
TEL: 213-596-3000
FAX: 213-596-3004
Email: goldensales@alchemy.net
PTO Trademark Registration for GOHip
Word Mark GOHIP!
Owner Name (APPLICANT) GoHip, Inc.
Owner Address 8306 Wilshire Boulevard, #54 Beverly Hills CALIFORNIA 90211 CORPORATION CALIFORNIA
Re:You think you're safe? (Score:2)
As much as I hate to admit it (because of who makes it), perhaps one of the best programs I have found to this type of monitoring is Network Associates Uninstaller 5. It detects the launch of 95% of installers, and if it doesn't you can launch it manually.
It snapshots your registry before an install, and when the installation is done, it snapshots it again and stores the differences for you to examine (if you know what you are looking for) and backout of you don't like.
Aside from that wonderful bit of functionality, it actually creates transport files of installed software that can be transported to another machine and then exploded there to duplicate the install. Try doing that with most windows programs
All in all, if you have to use windows, might as well assemble a few tools to make your life easier and more secure. This is definitely a good one, and cheap
New MS motto... (Score:1)
Where did our software take you that you didn't want to go today?
kwsNI
Patching Netscape & IE... (Score:1)
Obviously we can't trust users, crackers, or corporations to keep things safe. If a service is available in the browser or the OS, it will be abused and the user -- who is responsible -- will only get confused when things go wrong. They are to blame for not doing something, but we all know they won't do anything till it's too late.
What's left? Patch the browser using a binary editor or other tools. Here are some things to do to get started. But, what to patch? (I had a list of 6 places to patch, but can't find it on this machine...maybe the one at home.)
To give you an idea, a quick check of main netscape binary (Linux) shows 200+ points where Java Script functions might be patched, let alone Java;
strings netscape | grep "JS_" | wc -l
Re:Exploits & Corporations - Same holes... (Score:2)
something like slashdot_yanky@hotmail.com or some such (or better yet, get your
own domain and mail server...quite handy!)
Or get a SpamCop [spamcop.net] account, run all your publically-known addresses through that and keep your private address secret. Spam ends up in a web-based in tray, from which you can automatically send complaints to relevant parties at the touch of a button.
I'm not connected with SpamCop's operators; I've been using it for several months now, and so far have seen only about 3 spams make it through (and those were soon dispatched via a URL in the headers). I highly recommend SpamCop.
Re:Goku? Gohan? (Score:1)
(removes all traces of expresstion from the face)
"I am your father".
Re:VeriSign (Score:1)
The process is designed to protect against, say, a hacker breaking into the web server and replacing the ActiveX control with a trojan version. He could do that, but the trojan would not bear the signature.
But it won't prevent someone who works at the company from creating the same trojan and getting it signed.
In a nutshell, it tells you where it came from, not what it is.
Re:cookies (Score:3)
Well, since you're posting on slashdot as a logged in user, you're obviously hypocritical on this one.
I am? That's kinda harsh.
The advice I give to others isn't detailed -- most people won't follow that. To handle /., you can either login each time or login with cookies enabled, save the necessary /. cookie, and then make the file read only.
Why not instead tell them to run something like junkbusters that'll actually let them control what cookies they want instead of just blindly and across-the-board killing them all?
I use Junkbuster. Handy tool. Most people won't go through the hassles...however minor.
Re:Exploits & Corporations - Same holes... (Score:1)
You're gonna ruin the whole fun of the Internet for those who you tell these rules to.
Not necessarily true. If you want to add/comment on a specifc rule, go right ahead. "Rules are for fools to follow, and the wise to use as guides."
Who the hell is going to expect email?
You do. If you get email, it tends to follow a pattern. If you recieved a message about "NEW MONEY MAKING DEAL! $$$" from an email address you use for either chatting with a friend, or as a web site contact only, your expectations will be different.
[rest of rant deleted]
Is this necessary?
Added bonus! GoHip will also gladly send you spam (Score:3)
I especially like the part under "E-Mail."
Your acceptance of the "Free Video Update" browser enhancement constitutes your agreement to receive periodic communications from GoHip! and THIRD PARTIES, via e-mail.
So, you have no choice but to let them sell your email address to spammers. In fact, you agree to this when you click "Accept" on the license agreement that nobody reads. This has nothing to do with ActiveX security of course, but it's just more evidence that GoHip is run by criminals.
moderate this, asshole (Score:1)
Hey. did I say almost as bad as Pokemon? Actually, the animation is worse. ;-)
I am the Lord.
Re:You think you're safe? (Score:2)
Re:You think you're safe? (Score:2)
Software that warns you about every change to your system, such as rpm or dpkg?
Neither of them will overwrite existing files without telling the user.
Guess most of us are safe...
Re:A couple interesting things... (Score:2)
"Of course I trust them!"....NOT!
Pablo Nevares, "the freshmaker".
One more thing (Score:3)
Pablo Nevares, "the freshmaker".
Re:funny how no one mentions... (Score:1)
So What?
If its like i think it is, and it has those lines in there after the legalese its akin to false advertising. Most people don't read the fine print on the ads on TV, and thats what this is probably like.
Re:There's no such thing....... (Score:2)
Automatic protection from operating system? (Score:2)
Applications which want to be persistent on a user's machine will have to ask for permission, and if they further want access to certain system resources, they will have to ask the user for permission to hook into those resources (and which resources they are hooking into) - all protected by the operating system.
Of course, this will not protect naive users from social engineering, but the _default_ behavior will be of protection rather than being wide open - and in the case of multi-user systems, then the administrator will be able to control how much access each user will allow the outside net to access system resources.
Re:A couple interesting things... (Score:1)
By certifying GoHip, they are endorsing their business practices. This statement is a cop-out. The credibility of Verisign wil be damaged by the actions of GoHip, unless they take action.
As for 'passing judgement', there is little that needs to be said in judging any organisation who distributes of trojans like this.
Re:ActiveX... (Score:2)
I disagree. A superb technology would be cross-platform so at least everyone can use it.
Is there an IS manager out there anywhere who is such a loser he'd by a machine because the ad shows it stepping on Microsoft?
I don't think so, and I don't think that's what the ad is supposed to do. Banner ads are there to make you click on them to find out more, and I'd think this ad achieves just that.
The stuff that's supposed to make you buy is on the page you're led to.
P.S.: Someone at slashdot.org, please fix up Extrans posting - having to use HTML for everything (or not using formatting at all) is annoying.
Education, Education, Education. (Score:3)
Re:Goku? Gohan? (Score:1)
Nice. ;-) (I was the Gendou at Otakon 99.) [geocities.com]
(...well, there were a couple others. But they were only there on Saturday morning. So I win.)
I'll be there again this summer. Unfortunately, the number of Reis is diminishing, so I'll have to start molesting Lains. Lain is the theme this year, so I'm sure to have better luck.
I am the Lord.
If you think this is bad, there is already worse.. (Score:5)
I could post a list of exactly which vendors install this thing, but it's too long. (GetRight and Globlascape Cute** probably being the most ocmmon source). If I were you, and using any windows based o/s, I'd look for advert.dll. Deleting it only partially solves the problem, but it's betetr than nothing.
Re:A couple interesting things... (Score:2)
If you believe the above, you probably believe that GoHip's ISP should be dropping their service because of their business practices; and that Network Solutions (or whoever) should revoke GoHip's registration. Both these companies are allowing them to do business in this fasion as well, and are in the above logic losing credibility because they're allowing GoHip to continue.
Pablo Nevares, "the freshmaker".
Re:A couple interesting things... (Score:1)
Everyone here is talking about ActiveX and stuff, but I'm just simply PISSED at this company! Wouldn't you just love to get a baseball bat and sock these guys a homerun? That's how I feel about it, I can't explain my frustration with the situation, it just deeply angers me that they'd do this. I am so goddamn sick of stupid assholes like this. Yesterday I was at my friends house for an hour disarming his virus. I've had enough of these kids. I want them in the ring, with my baseball bat.
- Mike Roberto
-- roberto@apk.net
--- AOL IM: MicroBerto
EVANGELION!!! (Score:1)
Yes another Evangelion fan. Have the two movies been released in the U.S. ? Some excellent computer graphics and risk taking in the film versions.. had a special meaning for lots of psychologically scarred Japanese youths. Female characters are interesting too.
Is there a way to view this page without crashing your computer?
Re:cookies (Score:2)
Actually, you don't need cookies to post under a registered name. You can type in your name and password and hit "Submit". Without cookies. (If you hit "Preview", you'll have to type them in again before you post.)
You only need cookies on Slashdot if:
Because I'd rather turn cookies on when I really do need them, instead of keeping them on all the time and having some third-party app prompt me every two seconds.
I only turn cookies on when I'm using a shopping cart. Cookies on, buy goods, cookies off. Very quick and easy. . .
. . .in Netscape, obviously. MSIE users have a tougher time, becasue IE5 hides the cookie settings in a slow "Security level" dialog. Sometimes I think that MS made that dialog slow just to discourage people that switch their settings a lot. <flamebait>But then I remember that all M$ software sucks, so I should stop being paranoid.</flamebait>
(Just kidding. Not all MS softare sucks. Notepad is pretty nice. ;-)
I am impressed, however, that Junkbusters offers the source.
I am the Lord.
Re:Added bonus! GoHip will also gladly send you sp (Score:2)
And how in the world do they get your e-mail address? Should they add a line in there saying
Pablo Nevares, "the freshmaker".
Re:ActiveX... (Score:2)
A little unclear on the concept of intranet are we?
I still fail to see the qualitative difference between an ActiveX control and a Netscape plugin other than that the latter is more hassle, less efficient, and therefore less peopl are inclined to develop or use them.
Re:A couple interesting things... (Score:3)
But these security problems are not inherent to ActiveX, and ActiveX is not specifically designed with poor security. ActiveX is a set of COM interfaces that a particular library must implement. Personally, I think COM and interfaces are an excellent idea (in and of themselves -- I'm not refering to a sepecific implementation). COM allows programmers to write libraries that perform a service. And if someone wants to implement that service in a different way, they are free to do so -- they just have to implement the same interface. And because of GUIDs, it's completely distributed -- there's no central authority.
The only thing that COM (and ActiveX) doesn't address is untrusted components. That is a shortcoming, but until that's fixed, it's up to the user to trust or not trust the components that he/she is putting on his/her system.
GoHip is the untrusted source in this article, not COM.
Re:Exploits & Corporations - Same holes... (Score:2)
Also, turning off Javascript turns off style sheets; that may or may not justify leaving it on, depending on your browsing habits. Javascript is, I belive, less of a risk than Java, and orders of magnitude less of a risk than ActiveX.
Good advice for attachments, but for plain text or HTML formatted (assuming scripting, objects, and applets off) e-mail messages there's no danger. Otherwise you're getting so paranoid that the net becomes useless. Again, I think that's overly paranoid. I want people to be able to reach me: forI take a few anti-spam precautions. My address above is given in a spam-proof fashion, and so is the one on my web site (interestingly, it appears that many spambots read only the text of the page and don't parse the contents of a "mailto" URL). When I do get spam, I usually send it to the appropriate postmasters and the account is revoked within hours. And I use slocal (part of MH [uci.edu]) to filter incoming mail and autobounce a few rouge domains.(Although now that I'm running my own genuine domain instead of a forwarded virtual one, I can make sendmail do the work.)
Re:EVANGELION!!! ( Hey, pal, over here... ) (Score:1)
Re:But for the long term solution.. (Score:1)
Re:cookies (Score:1)
Lynx Does It Right - there is no cookies file, and it warns you about promiscuous cookies.
I am currently logged in using a cookie, and posting this message - in Lynx. :o)
Re:One more thing (Score:2)
echo 'user_pref("network.search.url", "http://www.google.com/");' >> ~/.netscape/prefs.js
--
Re:cookies (Score:1)
That's the best way to do it with netscape in Windows. Just leave cookies enabled and set cookies.txt R/O. What happens is you will be able to use yahoo mail type sites while in the same session but your roomate won't be able to snoop your emails after you close the browser. Most sites won't give you those stupid "you must have cookies" messages as well. Beats the hell out of "prompt before accepting"...
mcrandello@my-deja.com
rschaar{at}pegasus.cc.ucf.edu if it's important.
Re:funny how no one mentions... (Score:2)
Their licensing [gohip.com] is actually fairly specific (though it is at the end of the license.)
Very sleazy business practice, in my opinion, but they -did- tell you. Another good reason to read through licensing agreements.
Re:ActiveX... (Score:1)
A Netscape plugin isn't a perfect way to do something either (same reason - enforcing one browser on everyone; but better, at least Netscape will run on several OSes).
Re:offtopic? (Score:1)
Re:Other Moral: ARTFP (Score:1)
Idiot that I am... (Score:3)
It doesn't. Apparently all it does is stop *unsigned* ActiveX from inserting arbitrary code. Now, while that's certainly an absurdly necessary thing to have done--and it does stop the most major abuses of that ActiveX hole (eg. the Bubbleboy Outlook/OE virus)--I think it's pretty damn ridiculous to assume that any program should be able to stick arbitrary code in my StartUp directory just because it's signed. Or that it should be able to make changes to my registry without asking, as gohip's code does as well. (But don't worry--when you download their program to fix your registry (which does work, BTW), it pops up a cryptic looking dialog box asking if you really truly want to make changes to your registry.)
The sad thing is (flamesuit on) I actually *like* a lot of the ideas behind ActiveX--namely that it might be a good idea to store applets on the client side instead of having to download them every time you visit a web page--and I've seen some pretty nice uses of it. (eg. the dynamic hierarchical news menu on MSNBC. Of course, being ActiveX, don't bother trying to check it out unless you're running IE 4 or 5 on a Windows box--last time I checked, it doesn't even work in IE 4.5 for Mac.)
Unfortunately, its outrageous lack of cross-platform compatability and its moronic-to-criminal lack of safe security privilages have nearly killed off some actually sorta neat technology. Oh well.
Anyways, I hope this incident will point out to some people who've pretended otherwise what a farce "signed" code is. On the web, you don't know who to trust. As anyone who thought about it could have predicted, the danger isn't some 1eet hax0r somehow piggy-backing his trojan onto your connection with some Nice Commercial Website...it's the Verisigned trojan that Nice Commercial Website is asking your permission to install.
Re:You think you're safe? (Score:2)
~=Keelor
Sadly... (Score:2)
The new laws governing shrink-wrap licences not only make this legal, they also make articles like this, pointing out what is happening, -illegal-.
And that's why we have the omniscient VeriSign... (Score:3)
Similarily, when I step away from my car I leave the doors unlocked, keys in the ignition, nad the engine running - then I hand a camera and a notepad to some bystander (VeriSign) and ask them to please take a photo and ask for information from anyone that should enter my car.
How much do YOU trust VeriSign to really determine if the people getting certificates are who they say they are? Do you really support a protection racket that demands every company on the planet give them money to present the illusion of security?
I'm not advocating anything apart from a dislike of VeriSign.
Re:Another Reasson Active X is a Bad Idea (Score:2)
But the power that ActiveX has is really no different than the power that any other plugin for any other browser has. Anyone that's ever downloaded a plugin for Netscape has put themselves in exactly the same danger that someone downloading an ActiveX control has put themselves in.
That's the thing that I don't get about people who complain about ActiveX -- In reality, downloading an ActiveX control is basically exactly the same as downloading a plugin, but incredibly more convenient.
I suppose the main problem will be people just clicking 'OK' when the 'Install ActiveX control?' dialog box pops up, no matter what site they're on -- But if that same site popped up a window saying "You need a plugin to view this site, click here to download," don't you think the exact same thing would happen? Is there a real difference?
Re:Details? (Score:3)
Re:A couple interesting things... (Score:2)
Re:If you think this is bad, there is already wors (Score:2)
---
Re:cookies (Score:2)
Not to say that UN*X is the only OS but any usefull OS these days should have the the concept of a user, per user prefernces and file permisions. I just don't the read only permisions for any other OS.
Re:Sadly... (Score:2)
--
Re:VeriSign (Score:4)
"Bear in mind that your signature on a public key certificate does not vouch for the integrity of that person, but only vouches for the integrity (the ownership) of that person's public key. You aren't risking your credibility by signing the public key of a sociopath, if you were completely confident that the key really belonged to him. Other people would accept that key as belonging to him because you signed it (assuming they trust you), but they wouldn't trust that key's owner. Trusting a key is not the same as trusting the key's owner."
This lesson is applicable to any public-key problem. VeriSign isn't to blame here - they did exactly what they were supposed to do.
Re:If you think this is bad, there is already wors (Score:2)
Down in the second letter, the company responsible Aureate Mediab writes back.
The morale of the storie (Score:2)
Thanks for the suitable reproof. As the author of the error I am suitably embarassed, but for good purpose.
One wonders whether I used 'reproof' correctly. Methinks it perchance ought to have been 'reprove.' But I know not of what I speak, me being a mere apprentice to newbies in the vineyards of computerdom.
Go to Preferences|AutoCorrect|Grammar and turn off Anal.
======
"Rex unto my cleeb, and thou shalt have everlasting blort." - Zorp 3:16
Re:A couple interesting things... (Score:2)
By certifying GoHip, they are endorsing their business practices.
Nonsense. Verisign is simply verifying that they really are GoHip and the the ActiveWrecks came from them (both of which are true). Verifying who someone is is not an endorsement. Consider picking someone in a police lineup or pointingh them out in court.
MS et. al. have certainly lead the public to a different conclusion in attempting to hide the fact that activeX is a gigantic security problem. (Oh, don't worry about that, they all have to be signed.)
This isn't about security. It is about PROPERTY. (Score:2)
What entitles them to take such actions at all?
It might be vaguely arguable that anybody can come into your computer on the slightest pretext of having your consent, and change your homepage to theirs. That is intrusive, it is an imposition, but it is simply what _you_ see when you launch your browser. The most serious damage would be if you had a special homepage, kept no record of it and couldn't find it again: then you'd have suffered a loss due to this company's defacement of your property.
However- changing an _email_ sig? On the one hand this is just a line of text. On the other, it's a piece of text that is how you present yourself to the world, and the safe assumption is that this is a bit of text you intentionally chose to tell the reader something about yourself or what you consider important. In that light, the action this company takes is beyond inexcusable. It is like identity rape: to this company, not only is your computer's data not your property (so it can be freely tampered with for their benefit), but YOUR IDENTITY is not your property. The way you present yourself to others via electronic media is not your property! It is so inconsequential to them that they figure a mere 'sorry!' is all they owe you for hijacking parts of your IDENTITY for their own pleasure.
Again, it's one thing to examine the security implications, and the ways in which ActiveX can be used to build this behavior deeply into the system, making it hard to remove. But when did personal property become so meaningless that a stray click on a web page _allows_ a company to totally butcher your personal data for their own benefit?
Do you have a right to have your data for your homepage untampered with unless you explicitly and knowingly give permission for it to be altered?
If not, do you have a right for all of your writing to be untampered with, for instance if you downloaded some sort of grammar checker only to find that it runs and edits every ASCII file on your system that it can open? Is this a case of 'you should have kept backups' (let's hypothesize that it goes and edits all the backups too) or does this begin to look more like destruction of personal property?
Along the lines of this article, do you have a right for your email signature to be _your_ choice? Is it allowable for any joker who can get you to click on a clickwrap license to sneak in their own agenda, sigged to your mail as if it was your own agenda, so your friends can assume that you choose to 'push' this product or service? If so, is it then allowable for the clickwrap license to authorise the software to _send_ MLM-like mail to addresses on your mailing list, intentionally assuming your identity for the purposes of marketing, all in the background so the first you know of it is that you lose your ISP account for spamming, or lose friends over what they think you started doing?
It is informative and disturbing that this company already goes _almost_ to that extreme, and not as a joke. Surely the next step is intentional impersonation of a computer user, and marketing emails sent as if they were from that person- all sanctioned by the clickwrap license. It's almost here- just one tiny step from what GoHip is doing. It's so close...
And when that happens, I hope more people understand that this is not a security issue. It's not _about_ whether or not you are willing to psychologically barrier yourself in a concrete bunker, defying anyone's attempts to harm you.
Instead, it's about property rights, or a citizen's rights. It's about whether a regular person should even have to be concerned about these abuses. At the moment, in the computer industry, when you read about abuses like this, the first thought is "Security, so that you can stop people doing this to you, as they will no doubt try to do!". And that tells you something- because you never see anything to the effect of, "Screw security- this action is a crime against the person's property and an abuse of his identity. Click or no click, this is criminal! You're not allowed to hijack a person's identity and use their reputation as a marketing tool while trying hard to not alert them to it, and fighting their efforts to stop it happening!"
Am I off base here? Is it really so much to ask, to suggest that a person's arrangement of computer data is property, or at LEAST that the person's reputation and interactions with others is their property, and there is no intrinsic right to hijack that for profit? Not everything that is _possible_ and _profitable_ is legal. In this case, I can't think of a single thing more clearly property than a person's interaction with others, and their ability to determine how they express themselves. Suppose these same bright sparks at GoHip chose to globally replace the word 'video' with 'video (speaking of which, you have to check out GoHip.com! They're great with video)'? That is absolutely trivial, not so far from what they're doing now, and is absolutely, unarguably identity rape.
Is anybody ready to argue that this is defensible, or is strictly a 'security' issue where you only deserve the freedom you're ready to actively fight for? Does anybody seriously think this is 'opt-out' territory, that it's legitimate or right for any person's self-expression to be hijacked for commercial purposes?
If this goes on, forget watching TV and seeing 'the wrong' huge billboard on ESPN or in Times Square- it will be a world where you cannot even trust your own friends. Any of them could be speaking through a software filter that drastically changes what they say, and they would have no right to argue with this and no recourse except total paranoia. Even then, can you control _all_ the points your message passes through? What good will your security do you when your recipient has inadvertently installed a filter that changes your message _coming_ _in_, so that to their eyes, _you_ are the one saying "video (by the way, GoHip kicks ass!)."
Security is _such_ the wrong perspective to take on this stuff. This is civil liberties territory- and already shockingly close to paranoid fantasy. Yet it's not fantasy- people are _already_ having their identities and personal reputations hijacked by GoHip for marketing purposes, and this is seen as legitimate behavior, nasty but legal to do. How much farther do they have to go before the real issues are obvious?
Re: If you have IE, you trust Microsoft (Score:2)
Wrong. ActiveX is worse. (Score:2)
The problem is that many Microsoft programs (such as Windows, MSIE, Office, etc.) blindly trust certain kinds of ActiveX controls, allowing them to install and run, without prompting, even if you have ActiveX "disabled" in MSIE.
Regular programs don't do that.
ActiveX vs Netscape Plugins (Score:2)
How about the fact that a Netscape Plugin cannot download and install itself without your permission?
Re:One more thing (Score:2)
--
Re:Automatic protection from operating system? (Score:2)
Extrans, HTML, Plain-Old-Text (OFF-TOPIC) (Score:2)
Apparently (this is guesswork), someone at Slashdot had them switched around by mistake for the longest time, but noticed recently and "fixed" it.
Plain Old Text pre-processes your comment, adding <BR> tags at the end of every line, but otherwise leaving things unchanged. Thus, you can mix text-style fixed formatting with HTML tags, as the tags are still interpreted by the client's browser.
Extrans pre-processes your comment, converting all HTML symbols to their escaped equivalents (e.g., < is converted to <). Thus, you comment will be displayed exactly as you entered it, character for character.
HTML Formatted doesn't do any pre-processing at all, other then to remove some HTML tags Considered Harmful.
Get it?
Re:Another Reasson Active X is a Bad Idea (Score:2)
In the process of downloading a browser plugin, you get a lot more information about the plugin and a lot more opportunity to find out more about it. That's a security feature. And that's why plug-ins are much less evil than ActiveX.
Of course, proper sandboxing, as in Java and Tcl, is the best answer.
Re:A couple interesting things... (Score:2)
I really don't understand people who think just because a company is good at making profit, that the company is working in the consumer interest. The free market is good for consumers because that *sometimes* holds. But it often doesn't.
Should we compliment serial rapists because they have a good evolutionary strategy? Some of their victims will become pregnant, and some of those won't have abortions, so the rapist's genes get passed on. (Obviously I'm not condoning rape, just criticising the reasoning that the GoHip visitor used).
Use CVS to maintain your Windows partition (Score:2)
Certificatesin general. (Score:2)
When browser came of age, and security was of great concern, if you recall, the main hubub was about credit card information, and how SSL protected it. In other words, ask joe average internet user what certificates are for, and he'll say 'for encryption, so my credit card doens't get stolen by hackers listening in on the line'. That's what the press implied, and that's how people thought.
Now.. the REAL reason the certificate system works as it does is a bit different. It's not for the encryption, but for the authentication. A properly signed Verisign certificate, presented by CDNow.com is supposed to let you know that CDNow.com *IS* CDNow.com, and not an imposter. It's supposed to let you konw that they are a real business, and that they have proven this, with legal documents, to Verisign. This is why Verisign 'signs' the certificate.
You see, it was never supposed to be about granting encryption priveleges; only about authenticating the merchant.
So. Technically, we think it's kind of necessary to have a Verisign for commercial transactions.. but they rose to power based on the fact that people thought it was necessary JUST FOR ENCRYPTION (and hey.. if you didnt' have a verisign signed cert, browsers would bitch... so in the publics eye, you were not trustworthy if you didn't have their signature).
Fine. For financial transactions, fine. My security and piece of mind comes from knowing that Verisign says this company is real, and I have someone to chase down when they overcharge my card.
Now.. software... Verisign signing software? Why? To prove it came safely from the download site to my HD? WHy do I need a verisign to do that?
IN E-commerce, verisign fills a need.
With downloadable software... like Active-X, where the security model kind of SUCKS, it would make much more sense if that signature implied omsething, like the software provider has guaranteed that this software follows certain guidelines... etc.....
Re:Use fdisk to maintain your Windows partition (Score:2)
I did that a year ago. It's occasionally irritating not having DOS/Windows, but it's well worth it for the security alone. I think people who are smug about how secure their Linux partition is, but who run windows some of the time, are under a false sense of security. It would be easy to write an ActiveX virus which, say, fiddles with your Linux
You overlooked a key element (Score:2)
This may be a federal crime (Score:3)
18 USC 2701. Unlawful access to stored communications [cornell.edu]
(a) Offense. - Except as provided in subsection (c) of this section whoever - (1) intentionally accesses without authorization a facility through which an electronic communication service is provided; or (2) intentionally exceeds an authorization to access that facility; and thereby obtains, alters, or prevents authorized access to a wire or electronic communication while it is in electronic storage in such system shall be punished as provided in subsection (b) of this section.
(b) Punishment. - The punishment for an offense under subsection (a) of this section is -
- (1) if the offense is committed for purposes of commercial advantage, malicious destruction or damage, or private commercial gain - (A) a fine under this title or imprisonment for not more than one year, or both, in the case of a first offense under this subparagraph; and (B) a fine under this title or imprisonment for not more than two years, or both, for any subsequent offense under this subparagraph; and
- (2) a fine under this title or imprisonment for not more than six months, or both, in any other case.
This was probably drafted to protect E-mail services, but now that there's a lot more electronic communication, it has broader applicability. A computer running a web browser is certainly "a facility through which an electronic communication service is provided". And altering the user's selection of a home page fits within the phrase "alters, or prevents authorized access to, a wire or electronic communication". And notice there's an extra penalty when commercial gain is involved, indicating that Congress foresaw the possibility of businesses committing this crime.The main Federal computer crime act [cornell.edu] only covers some computers, basically government and bank systems. (Most computer crime prosecutions take place under state laws.) But this one is broader.
Re:Automatic protection from operating system? (Score:2)
To save most "clueless user"s from most of these attacks, the platform needs to support an virtual machine "jail" BY DEFAULT, and no matter WHAT is executing (including buggy JVMs!) - and make it more difficult for people who don't understand what's going on to allow these processes to escape the jail.
To do all that, with any hope of a "bulletproof" solution, you need support from the operating system. Trying to make every one use a "verifiably-safe platform" is a ridiculous solution.
If you really want to try and fit it into a "verifiably-safe" platform paradigm, then just think of the operating system-provided jail as "lazy" safe-platform verification - you get the indication that the code is not safe WHEN the code tries to escape the jail...
Re:Sadly... (Score:2)
Re:A couple interesting things... (Score:2)
Re:If you think this is bad, there is already wors (Score:2)
Deleting the entire key and doing a "Find File" to clean up any other niggling and dangling files seems to do a very good (albeit inelegant) job of rooting this shite out.
Rafe
V^^^^V
Re:Added bonus! GoHip will also gladly send you sp (Score:2)
However, it wouldn't be beyond them to root around your system to find it though!
Re:Automatic protection from operating system? (Score:2)
Instead of spending effort on promoting an "alternative platform" like JVMs which won't stop anybody who operates outside of that platform, those resources would be much better spent _implementing_ the "proper" operating system support.
Re:Exploits & Corporations - Same holes... (Score:2)