Why paywalls makes free news better

Almost a year ago Rupert Murdoch started talking about how News Limited would start charging for news content online. It's interesting that he started doing this, not in a time of record profits for News Limited, but at a time when they were suffering record losses - this is the first hint that his idea may not be a good strategy, i.e. that it didn't come out of some noble concept of how to make news better, but rather out of a desperation in trying to turn a buck.

But the trouble with Murdoch's idea of paid news is that in simply setting up your business model, you help your competitors.

You see, at the moment, there are lots of free news services - and they're all competing for advertising dollars, which comes from eyeballs on websites. If Murdoch puts his quality content behind a paywall then that means more eyeballs for his competitors, who will then be able to offer better quality news.

Traditional media is struggling to turn a dollar in the online world, yet strangely enough new media companies seem to be quite comfortable with their online ventures - maybe the problem is not with the ability to turn a dollar in online news, but simply the expectations and preconceptions from old media moguls as to how online works.

Dropbox Security Problem - Data Leakage

Dropbox has an issue with the way it handles link sharing that could potentially lead to data leakage.

The problem is fourfold:

• Files outside of the Public folder can be shared
• Shared files leak data about the file structure
• Deleting and replacing the shared file with another allows the new file to be leaked
• Shared files can’t be revoked

This security problem is demonstrated below.

First of all I start by creating a file called ‘PrivateFiles’ in the ‘My Dropbox’ folder. I’m going to use this to store my most private of data.

Inside that folder I’ll store ‘MyPrivateFile.txt’:

As you can see, it has some very personal data in it:

I’ve got to use my iPad for the next step, because the PC or Mac client won’t let me share a file from anything other than the Public folder (in fact I’m not sure if allowing sharing from other than the Public folder on the iPad is an oversight or not – regardless, this is the first security concern – the sharing of files from outside of the Public folder on the iPad when other clients won’t let you).

So when I look at my iPad I see the PrivateFiles folder:

And inside that I can see MyPrivateFile.txt, including the correct contents of that file:

Next, I’ll share the file by emailing a link of it:

The link that is sent is actually a short link – in this case http://db.tt/GdBSei, which redirects to http://dl.dropbox.com/0/view/1xldjhg9mbrt95s/PrivateFiles/MyPrivateFile.txt

This demonstrates the next data leakage problem – i.e. that I can see the path ‘PrivateFiles’ – I didn’t choose to share this, I only chose to share the file – this path may not be something you wish to reveal.'

The major problem happens for me after I create new file in the same directory, in this case ‘AnotherFile.txt’…

Then delete the original file…

And now rename the second file to have the same name as the original.

Note that copying a replacement file into the directory will also work, all that matters is there be a file there with the same name as the original. Now when I open the file using the link I was emailed before I get:

I get the replacement file!! Is that what anyone expects to happen? I guess I did share a link to the file, not a copy of the file, but it still doesn’t feel right – it’s not the original file!!

What makes this problem worse is that Dropbox won’t allow me to revoke shared links. That means that I’ve now published a permanent copy of whatever file ends up sitting in that folder with that name. What if it is something like resume.doc where I don’t want people to see me editing the file? Or what if it is temp.zip? Whatever it is – it is now permanently out there, permanently shared for anyone to access – no dropbox account required to access it!

Anyone want to try running through filename combinations for that db.tt domain? You don’t need to have had it shared with you as no authentication is required, you just need to hit the right URL!

Australian Internet Filtering - what we should be doing

There's so much spin and mis-information about the Internet Filtering debate in Australia, and unfortunately many of those debating the current issues don't understand what is being proposed and why it won't work.

Unfortunately one-size never fits all and even more so when it comes to Internet Filtering. The Internet presents us with many content and law-enforcement challenges, that require different solutions to solve - this is a fact that seems to escape the current Australian Government, with Stephen Conroy and Kevin Rudd wanting to plow ahead with a single, mandatory, ISP-based Internet filter.

What I've identified below are the problems that (some people think) we need to solve, why the currently proposed Conroy solution won't work, and what will work.

Problem	Why Conroy’s Solution Won’t Work	What Will Work
Children accidentally finding inappropriate content (porn)	Only the worst-of-the-worst pornography sites will be blocked by the filter	PC-based filtering. Government should pay the ISP $x per month, per client that has it installed – let the ISPs profit from it & it will get rolled out
Children deliberately finding inappropriate content (porn)	See above – under Conroy’s solution, children will still be able to browse porn sites	Voluntary ISP-based filtering that all ISPs must offer to their users. Funded by the Government, parents will be able to opt-in at no cost. Note: A determined, Internet-savy child, will still be able to bypass this, so an education campaign (for parents) is vital as well.
Child pornographers accessing child pornography	Child pornographers don’t visit normal websites to access and share material; they get it from peer-to-peer networks, private networks, or hacked websites. This material will not be able to be found or blocked by the Conroy filter.	Law enforcement. Undercover agents. Raids in the middle of the night. People smashing down doors.
People accessing refused-classification (RC) material	First of all – it isn’t illegal to create or to view RC material, you’ll only get in trouble from distributing it. But this material will only get classified as RC once its submitted to the classification board. The classification board doesn’t have enough reviewers to review the entire, dynamically changing Internet. But the stuff they review and classify as RC will be blocked. But bypassing the block will be as easy as buying a $50/year VPN connection to the United States, or visiting an anonymising site before you look at the RC material.	Nothing will work will well. The Conroy filter will be able to block RC material, but then all the provider of that material needs to do is change the content to website.com/rcmaterial to website.com/rcmaterial2 and the entire 3-month review cycle with the classification board will start again. Of course, in the real world, RC material continues to get distributed anyway from friend-friend (i.e. peer-to-peer)

So my 3-step plan for cleaning-up the Internet in Australia is:

1. Net Alert: Continue to provide filtering software for people’s PCs. The Government pays the ISP enough to allow the ISP to make a profit & the ISP will then be incentivized to make people know about it.

2. Government funded ISP filters: ISPs will be required to implement them, but users can opt-in or opt-out to particular content.

3. Law enforcement: We’ll always need the police to bash down bad guy's doors

Auscert 2010 IBM USB Key Malware email message headers

Microsoft Mail Internet Headers Version 2.0

Received: from xxxxx ([xxxxx]) by xxxxx with Microsoft SMTPSVC(6.0.3790.4675);

Fri, 21 May 2010 16:31:28 +1000

Received: from xxxxx ([xxxxx]) by xxxxx with Microsoft SMTPSVC(6.0.3790.4675);

Fri, 21 May 2010 16:31:15 +1000

Received: from xxxxx (xxxxx [xxxxx])

by xxxxx (Postfix) with ESMTP id 9858F2120B2

for ; Fri, 21 May 2010 16:31:32 +1000 (EST)

Received: from emx02.extremedns.net ([203.62.184.74])

by xxxxx with ESMTP; 21 May 2010 16:31:11 +1000

Received: from EXC04.extremedns.net (180.189.153.2) by emx02.extremedns.net

(203.62.184.74) with Microsoft SMTP Server (TLS) id 14.0.694.0; Fri, 21 May

2010 16:31:04 +1000

Received: from EXC04.extremedns.net ([fe80::755b:17ce:21aa:a1e7]) by

exc04.extremedns.net ([fe80::755b:17ce:21aa:a1e7%14]) with mapi; Fri, 21 May

2010 16:31:56 +1000

From: AusCERT

To: AusCERT

Subject: AusCERT Important Information - Malware on IBM USB

Thread-Topic: AusCERT Important Information - Malware on IBM USB

Thread-Index: Acr4rxjUKocJyYVwR1+gPZTcHpAWOg==

Importance: high

X-Priority: 1

Date: Fri, 21 May 2010 06:30:25 +0000

Message-ID:

Accept-Language: en-AU, en-US

Content-Language: en-US

X-MS-Has-Attach:

X-MS-TNEF-Correlator:

Content-Type: multipart/alternative;

boundary="_000_DD6937D5F83D404E8B4851E00EEC6F8004A04950exc04extremedns_"

MIME-Version: 1.0

Return-Path: auscert2010@conferenceit.com.au

X-OriginalArrivalTime: 21 May 2010 06:31:15.0495 (UTC) FILETIME=[36BF4370:01CAF8AF]

--_000_DD6937D5F83D404E8B4851E00EEC6F8004A04950exc04extremedns_

Content-Type: text/plain; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

--_000_DD6937D5F83D404E8B4851E00EEC6F8004A04950exc04extremedns_

Content-Type: text/html; charset="us-ascii"

Content-Transfer-Encoding: quoted-printable

--_000_DD6937D5F83D404E8B4851E00EEC6F8004A04950exc04extremedns_--

Auscert 2010 IBM USB Key Malware letter

Dear AusCERT Delegate

At the AusCERT conference this week, you may have collected a complimentary USB key from the IBM booth. Unfortunately we have discovered that some of these USB keys contained malware and we suspect that all USB keys may be affected.

The malware is detected by the majority of current Anti Virus products [as at 20/05/2010] and been known since 2008.

The malware is known by a number of names and is contained in the setup.exe and autorun.ini files. It is spread when the infected USB device is inserted into a Microsoft Windows workstation or server whereby the setup.exe and autorun.ini files run automatically.

Please do not use the USB key, and we ask that you return it to IBM at Reply Paid 120, PO Box 400, West Pennant Hills 2120.

If you have inserted the USB device into your Microsoft Windows machine, we suggest that you contact your IT administrator for assessment, remediation and removal, or you may want to take the precaution of performing the steps below.

Steps to remove the malware:

1. Turn off System Restore

[StartProgramsAccessoriesSystem toolsSystem Restore]

Turning off System Restore will enable your anti virus software to clean the virus from both your current system and any restore points that may have become infected.

2. Update your antivirus tool with the latest antivirus definitions

[available from your anti virus vendor of choice].

3. Perform a full system scan with your AV tool to confirm the existence of the infection. If malware is detected allow your AV to complete a clean.

4. On completion of this process, complete a second scan using a different anti virus product. Free anti virus products are available from known companies such as AVG, Avira, Panda Software, or Trend Micro.

5. Once a second scan has been performed and it is determined that your workstation is free of any known malware, as a precautionary measure we recommended that you perform a back up of all vital files on your workstation and perform a full re-installation of the operating system. This process will remove the risk of other unknown or undetected malware that may be present on your machine.

If you experience difficulties with the above steps, please contact the IBM Security Operations Team at secops@au1.ibm.com. An IBM technical support person will contact you by phone to assist you.

We regret any inconvenience that may have been caused.

Glenn Wightwick

Chief Technologist

IBM Australia

No more twitter SMS love

Twitter have announced that they will no longer be sending SMS updates through their European server, which means no SMS love for many including those of us in Australia.

Twitter without SMS updates is pretty much useless as the whole point of it is as a fast micro-messaging platform.

I'm currently trying to hack something through Yahoo Pipes and an RSS to Email gateway so that I can at least get updates on a few of the people I follow sent to email, but even if I get that to work its still doubtful if it will be a workable solution.

I only hope that they can negotiate a deal with a phone company in Australia to enable the sending of SMSs and doubly hope that that deal will mean those on Optus can get messages.

Apple iPod Touch 2.0 firmware

The 2.0 firmware for the Apple iPod Touch is now installed on my device - this is the same firmware that is installed on the new Iphone 3G. After initial problems with downloading through the first 24 hours of release (Apple didn't seem to have the infrastructure to keep up with the load from the new release of the iPhone 3G) I finally managed to get it installed.

The installation required the device to be completely wiped, i.e. music/videos and all. The update process took care of doing a full backup and starting the restore of all my data afterwards. Given that I had around 16Gbytes of data, the whole process took close to an hour.

So now that I've been playing with the new firmware a bit, this is how I feel about it:

• The ability to install applications is a killer feature, there are some great applications out there, but many of the free games are quite ordinary & many of the really good applications will require at least a data connection - but this can be taken care of if you're in a wifi area or have some other method of getting your iPod Internet connected (I use JoikuSpot).
• So apparently the iPod touch has had an external speaker all along - previously the only out-loud message it would make is the 'click' when you typed, but now it plays a little tune when you receive new email - I wonder what else this little speaker can do.
• (Not really a 2.0 firmware update but actually an iTunes 7.7 update) I can now synchronise by GMail contacts with the device rather than just Outlook contacts.
• On the downside, the method of fast-forwarding through videos has changed. The old method was better whereby the first 10 seconds of fast forwarding were just sped-up audio, but now they skip through the audio meaning that you can't even fast forward for short pieces without missing out on what is being said. Also, the fast-forwarding now takes much longer to kick into a higher-speed fast forward. Maybe I'll get used to this but for now its just an annoyance.
• My Wifi connection now seems to be much more stable - I have always had problems with my iPod connecting to my home wifi, particularly since I juiced up the output power of my wireless access point for another purpose - my use of the iPod since the 2.0 update has shown a much faster & more reliable wifi connection.
• Lastly, the email application on the device is a little bit more usable with only a slight change to the interface.

Overall I love the update, but will be looking forward to being able to jailbreak it again as there are some apps for the device that aren't in the iTunes store that I'd really like to use again.