Tuesday, July 31, 2001

Totally hip with spyware Recently it was discovered that the Mac software "Livestage Pro" by Totally Hip software has been reporting back its license, usage, and environment to its manufacturer via a covert http dialogue. The company has refused to respond to the discovery "officially", but one of their staff members has been corresponding publicly on the popular Mac website at http://www.macintouch.com/spyware.html. There he's expressed surprise that anyone is concerned and asserts his business has the full right to include this sort of tracking, that it is noted deep in one of the readme files and permission to "electronically verify their serial number " is specified within the software license. The non-representative goes on to state that in the future Totally Hip intends to somehow secure the collected information and this is all simply a legitimate anti-piracy effort. Finally he's taken the Web site to task for posting letters that detail how to block the reporting function (edit one's hosts file), likens it to supporting software piracy and closes with "Honestly we are not an evil conspiring company." This isn't an isolated incident for Mac software developers; powerhouse Adobe has been installing a mysterious file of their own that regularly "calls home" for reasons unknown. Adobe has promised to explain this new feature, what it does and what it is communicating but to date have not followed through. ["Michael F. Maggard" via risks-digest Volume 21, Issue 56] 0:00 # G!

Techs must report child pornography Source: Associated Press http://www.washingtonpost.com/wp-srv/aponline/20010727/aponline203146_000.htm In South Carolina, a new law on education standards for day-care workers has a requirement that private technicians tell police if they find child pornography when servicing computers. Think of the possibilities. You're servicing computers, and you get the idea to have some fun. You take a client's computer, roll the date back, access some child pornography web site(s), reset the date, and call the cops. Carrying it one step further, imagine that this as a political "dirty trick". It might just be the mayor or some legislative representative who gets victimized. Who would believe any protestations of innocence? --Brien Webb ["Brien Webb" via risks-digest Volume 21, Issue 57] 0:00 # G!

No Appleplexy needed (Re: RISKS-21.55) The Apple-DNS-hacked item in the latest risks is not a hack - it's a "legitimate" use of the NIC records. Someone has registered hosts with the NIC who just happen to have apple.com in their name. The same thing has been done to Microsoft: ; whois microsoft.com@whois.internic.net [whois.internic.net] MICROSOFT.COM.Z---HELLO-FROM-SIBERIA---I.Z3S.COM MICROSOFT.COM.WILL.NEVER.SATISFY.A.TRUE.TELNETJUNKIE.COM [... and so on into the night] [This was noted by MANY readers. TNX. Sorry for my immoderate lapse. PGN] [Dave Stringer-Calvert via risks-digest Volume 21, Issue 56] 0:00 # G!