Apple blocks iTunes hack

Found on CNet News on Sunday, 20 March 2005
Browse Software

Apple Computer says it has closed the hole that let people buy iTunes songs without any copy-protection technology attached. According to the company, anybody who wants to buy music from the store now will have to upgrade at least to the 4.7 version of iTunes.

The biggest hole is still open and cannot be patched at all: people can listen to the music. And as long as they can do that, it is possible to get the music without any DRM. So, in order to create a secure DRM environment, the music players will have to disable all audio hardware. Whops, I think I just gave the music industry an idea...

CSS Support Could Be IE's Weakest Link

Found on Microsoft Watch on Wednesday, 16 March 2005
Browse Software

Microsoft will be doing a lot to make developers and customers happy with its pending Internet Explorer release, if partner sources with inside information on the IE 7.0 browser are right.

The company will continue to drag its feet by refusing to provide full support for the CSS2 (Cascading Style Sheets Level 2) W3C (Worldwide Web Consortium) standard, Microsoft partners say.

Sources claiming familiarity with Microsoft's IE 7.0 plans said the company will add some additional CSS2 support to its new standalone browser.

But Microsoft isn't planning to go the whole way and make IE 7.0 fully CSS2 compliant, sources said.

One partner said that Microsoft considers CSS2 to be a "flawed" standard and that the company is waiting for a later point release, such as CSS2.1 or CSS3, before throwing its complete support behind it.

CSS2 cannot be more flawed than MS products. Other browsers support CSS2 and don't complain. Plus, it should be easy for MS to upgrade to CSS2.1 or CSS3 later along with the normal bugfixes. Another interesting point would be the size of IE7. IE5.5 (incl. SP2) was a 84MB download; compared to others, eg FireFox with not even 5MB, this is quite a lot. But since I won't touch XP, and don't have W2k3, it doesn't really affect me now.

AOL's Terms of Service Update for AIM

Found on eWEEK on Saturday, 12 March 2005
Browse Software

America Online, Inc. has quietly updated the terms of service for its AIM instant messaging application, making several changes that is sure to raise the hackles of Internet privacy advocates.

The revamped terms of service, which apply only to users who downloaded the free AIM software on or after Feb. 5, 2004, gives AOL the right to "reproduce, display, perform, distribute, adapt and promote" all content distributed across the chat network by users.

"You waive any right to privacy. You waive any right to inspect or approve uses of the content or to be compensated for any such uses," according to the AIM terms-of-service.

Although the user will retain ownership of the content passed through the AIM network, the terms give AOL ownership of "all right, title and interest in any compilation, collective work or other derivative work created by AOL using or incorporating this [user] content."

"In addition, by posting content on an AIM Product, you grant AOL, its parent, affiliates, subsidiaries, assigns, agents and licensees the irrevocable, perpetual, worldwide right to reproduce, display, perform, distribute, adapt and promote this content in any medium," it added.

No thanks. I was pondering whether to install AIM too, since some people I know are using it. Now there's another reason to stay in IRC. If I should change my mind about AIM, then the installation would definitively include encryption. I think it's possible to use SSL certificates in AIM; but then there is always GAIM, which supports RSA.

Microsoft Windows LAND Attack Denial of Service

Found on Secunia on Monday, 07 March 2005
Browse Software

The vulnerability is caused due to improper handling of IP packets with the same destination and source IP and the SYN flag set. This causes a system to consume all available CPU resources for a certain period of time.

This kind of attack was first reported in 1997 and became known as LAND attacks.

Microsoft Windows XP with SP2 and Microsoft Windows 2003 have been reported vulnerable.

Looks like MS is recycling old bugs. I remember some MS exec talking about how SP2 would be secure and end all security problems once and for all. And now they have bugs from 1997. So much for that.

Microsoft: Activation shift won't be a pain

Found on CNet News on Tuesday, 01 March 2005
Browse Software

Microsoft's plan to halt some Net activation for Windows kicked in Monday, with the software maker assuring customers that the antipiracy measure will not prove a problem for legitimate users.

As reported earlier, the updated program calls for the top 20 PC makers to activate Windows XP on every system before it ships. If a customer has to reinstall the operating system, as long as they use the restore disks from the original equipment manufacturer (OEM), activation will be automatic, said Keith Beeman, director of worldwide license compliance for Microsoft.

The company has a plan to check that people's operating systems are properly licensed before allowing them to download certain updates. The plan, known as the Windows Genuine Advantage initiative, was introduced in January.

It will be a problem for legal users; not directly tho. Illegal versions will remain open and unpatched and can be easily turned into zombies to spew out spam. Users who do not want to activate their product, or have no (or just modem) Internet access are left out too. And then there are those who cannot even update without running into troubles (SP2 for XP anyone?).

Windows anti-spyware to come free of charge

Found on CNet News on Saturday, 19 February 2005
Browse Software

Ending speculation about whether it was shifting to a paid model, Microsoft said on Tuesday that it will provide customers with its new anti-spyware software for free.

"Just as spyware is something that we have to nip down today, we have decided that all licensed Windows users should have that protection at no charge," Gates said.

While Microsoft turned its attention to general software security three years ago with its Trustworthy Computing Initiative, the spotlight on consumers began a year and a half ago, after the MSBlast worm infected millions of home PCs. The worm taunted Microsoft's founder with the message, "billy gates why do you make this possible? Stop making money and fix your software!"

While it's a good decision from MS to do something against spyware, the "distribution" model is questionable. First of all, it will only be available to licensed users. MS should be interested to reduce threats for all Windows machines, even when the owner didn't pay for the OS; the whole net would benefit from that. This is not a "buy or die" deal. Next thing: it can only be installed on 2k/XP machines with IE6. What about people who still use 98 or refuse to install IE6 (like me)?

New technology helps curb online DVD piracy

Found on Xinhua Online on Tuesday, 15 February 2005
Browse Software

A Silicon Valley company unveiled Tuesday a new technology that it claims to be able to block 97 percent of the DVD-copying software used by Internet pirates, without interfering with a DVD's paly ability or picture quality.

Macrovision Corp. said its RipGuard system, which can be included in personal computers, DVD players and DVD recorders, would plug the digital hole through which unauthorized versions of DVD films can be easily copied on a computer and then "burned" to other discs or put online for downloading.

"Macrovision RipGuard DVD is designed to dramatically reduce DVD ripping," Steve Weinstein, head of the company's entertainment technologies unit, said in a statement Tuesday.

Ok, but that still leaves 3%. While it might stop some homeusers from making copies, it won't put an end to sharing. What makes me wonder is this: "can be included in personal computers". So I'd have to install it first? Hello? It sounds like this can be "cracked" with the Shift-key again...

Hackers sued for tinkering with Xbox games

Found on The Register on Thursday, 10 February 2005
Browse Software

In the first case of its kind, a California video game maker is suing an entire community of software tinkerers for reverse engineering and modifying Xbox games that they legally purchased.

According to the complaint, Greiling and Glynn were webmasters of ninjahacker.net, an online forum dedicated to creating custom content and modifications for certain video games.

The lawsuit claims the ninjahacker.net users decompiled the code to several Tecmo titles, including Ninja Gaiden, Dead or Alive 3, and Dead or Alive Xtreme Beach Volleyball, and figured out how to create their own "skins" that change the appearance of game characters.

"Most of the skins posted on the Message Board by defendants show Tecmo Characters with appearances that are different from the original Tecmo designs," the complaint notes. "Several... are designed to make Tecmo Characters appear naked."

"Hackers, if they're allowed to do this kind of thing, will be allowed to hack into any game, anywhere," Pfeiffer warns. "We spent millions of dollars to develop these games, and people are coming in and changing the code to their liking, and that's illegal."

Tecmo's Pfeiffer says the company is seeking $1,000 to $100,000 in damages for every custom skin swapped over the website.

What, they made game characters *gasp* nude?! How could they?.... Oh come on, how puritan can you be? Nobody has been harmed (financially, and that's all that matters for a company); I also doubt that their reputation has suffered. To me, it sounds more like an effort to jump the lawsuit bandwagon and try to extort some people.

Banking Trojan disables MS Anti-Spyware

Found on The Register on Tuesday, 08 February 2005
Browse Software

The first piece of malware to attack Microsoft's new prototype anti-spyware product has emerged. The BankAsh-A Trojan disables Microsoft AntiSpyware Beta in an attempt to suppress any warning messages the package might display. It also deletes files within the program's folder. Unlike other items of malware, BankAsh-A makes no attempt to turn off anti-virus apps.

The main function of BankAsh-A is to steal online banking passwords from unsuspecting Windows users. The Trojan targets users of UK online banks such as Barclays, Cahoot, Halifax, HSBC, Lloyds TSB, Nationwide, NatWest, and Smile. The malware records passwords and keystrokes once users of infected machines visit targeted websites.

First SP2 problems, now AntiSpyware. Earlier, MS released 13 patches, 9 of them for critical bugs. Honestly, I'd expect this from a beta version.

Video games ban wanted

Found on The Inquirer on Sunday, 06 February 2005
Browse Software

According to Detroit News, politicians are starting to listen to groups who are terrified about the effect of selling games such as Grand Theft Auto series, Halo 2 and Mortal Kombat have on children. They think that there is a direct line between video games as Grand Theft Auto and crime.

So far legislation that banned sales of the games to minors has been struck down in the courts on free-speech and other grounds.

Other problems with such a law is if a store refuses to sell a game, the kids often come back with their parents to buy it.

Or copy it. No wait, that would be illegal. And we all know that law-abiding kids would never do such a thing. Could I be wrong there? Anywhere, I don't understand why so many get bonkers about violent games. After all, they are just games. What's next, banning Monopoly because it supports capitalism? But then, capitalism isn't responsible for social problems and violence. Or could I be wrong there too?