Power of Thought

Nielsen, best-known for its rankings of TV programming, said Wednesday it is developing a system that would police Web sites for copyrighted material, and notify site owners and content providers when video has been posted without authorization.

Nielsen is developing the system with Digimarc, a provider of digital watermarking technology. The service, which the companies plan to start rolling out in the second quarter of next year, would tap into technology Nielson currently uses in the services it sells to advertisers and TV networks.

The system would first be used for policing the use of TV programs, clips of which are often posted on user-generated content sites, such as YouTube, which is owned by Google. Much of that content is uploaded without authorization or compensation to the content provider, which has led to tension between Internet companies and Hollywood studios. These tensions reached a peak in March whenViacom filed a $1 billion lawsuit against Google, accusing the company of massive copyright infringement.

The Nielsen/Digimarc system would be offered as a way to quickly discover unauthorized content on sites. To do that, the system would leverage Nielsen’s existing watermark technology, which is used on more than 95% of TV programming distributed today. The watermarks are used by the meters installed in people’s home to identify the programs they watch. Nielsen sells data from people’s viewing habits to TV networks and advertisers.

Besides watermarking, Nielsen also tags over-the-air TV programs intercepted by 700 installations across the nation. For those programs without watermarks, Nielsen creates a digital signature based on unique patterns in the audio signal.

Nielsen’s watermarks and digital signatures are stored in a database that would be used in the copyright-protection system. When a clip is posted on a Web site, the system would search for the watermark. If one doesn’t exist, then the system would create a digital signature. In either case, the identifier would be compared to what’s in the database to find a match. Once the program is identified, the Nielsen system could notify site operators and content providers when a clip is being shown without authorization.

While the system wouldn’t automatically delete unauthorized material, Web site owners could configure their systems to take that step. “The purpose of this system is not to be a policeman on the Internet, but to provide a system where the content provider can have confidence and knowledge of where their programming is being distributed,” Dave Harkness, senior VP of strategy and business development at Nielsen, told InformationWeek. “They also can develop a business relationship with the content distributor, which in this case is the Web site.”

Nielsen is confident it can convince many TV producers to buy into the system, since the company already has relationships with most of these businesses. Convincing Web sites may be more difficult, since many already have some kind of copyright-protection system in place or are developing one. Google, for example, is developing a system for YouTube. In general, most sites take down unauthorized content as soon as the owners notify them.

Nielsen believes it can turn many sites into customers by offering a system that’s ready to plug into their infrastructure, saving them the cost of building a copyright-protection system themselves, Harkness said. Besides generating revenue from the service, Nielson could also use it to track the use of video on the Web and sell the gathered data to advertisers.

If Nielsen launches its service it will have competitors, albeit smaller businesses. Those companies that provide services for policing the use of copyrighted content online include Audible Magic, Vobile, and BayTSP.

Read more »

Most people consider themselves prudent when it comes to workplace activities, but actions speak louder than words—especially when it comes to computer security.

A large gap exists between what employees say about computer security and how they practice it at work, according to the Information Systems Audit and Control Association, which polled 301 white-collar workers at companies of at least 100 employees.

For example, 15 percent of workers had shared files over a peer-to-peer network, which “is opening a big door at a large corporation,” says Kent Anderson, a consultant who serves on ISACA’s Information Security Management Committee. “Most of these file-sharing programs by default scan available files and serve those out to anybody who wants them.”

Eleven percent of workers had e-mailed confidential documents to the wrong person—yet only 60 percent considered the behavior risky. And 35 percent had knowingly violated a corporate IT policy.

“They think, even if I make a mistake, nothing bad is going to happen,” Anderson says.

One reason for the risky behaviors may be that employees tend to take workplace IT security for granted. More than 90 percent told ISACA they considered their offices secure. While they worry about the security of their home machines, they feel somebody else has taken care of security on their work computers, Anderson says.

Another reason may be that employees don’t understand the risks they’re taking with what may seem routine tasks and use. Anderson says corporate IT departments tend to write overly long or technical IT policies, then stick those policies on a shelf and leave them unenforced.

Security policies must be simple, he says, and employees must be able to follow them and still do their jobs.

ISACA recommends corporate IT departments make security training routine. They should train new hires, update training frequently, and let employees know when there are specific threats.

ISACA’s recommendations reflect the results of a recent Computer Technology Industry Association (CompTIA) survey that found 68 percent of businesses have no security training program, even though most are seeing an increasing number of security threats and incidents.

This is the first time ISACA has surveyed security practices at work, and Anderson wants to follow up on the results. He’s especially interested in how and why people knowingly violate corporate IT policies.

Checking personal e-mail at work may not seem like a problem, he says, but when you consider that 49 percent of workers clicked on a URL in an external e-mail and one-third downloaded files or software from friends, the risks grow quickly.

Read more »

Bill Gates was wildly optimistic when he said in 2004 that the problem of spam would be “solved” by 2006. The volume of junk e-mail transmitted worldwide is still enormous. But a remarkable trend is underfoot, according to Brad Taylor, a staff software engineer at Google: The number of spam attempts — that is, the number of junk messages sent out by spammers — is flat, and may even be declining for the first time in years.

Google won’t disclose numbers, but the company says that spam attempts, as a percentage of e-mail that’s transmitted through its Gmail system, have waned over the last year. That could indicate that some spammers have gotten discouraged and have stopped trying to get through Google’s spam filters.

Other experts disagree with Google, pointing out that overall spam attempts continue to rise. By most estimates, tens of billions of spam messages are sent daily. Yet for most users, the amount of spam arriving in their inboxes has remained relatively flat, thanks to improved filtering.

Brad Taylor is on the front lines of the war on spam. He has served as the chief watchdog of Google’s spam filter since 2004, when Gmail first launched. His history with spam goes back much further, though: He’s been fascinated with it since 1994, when he received his first spam e-mail at a work account. Before he joined Google, he worked at an anti-spam startup.

Taylor denies he’s obsessed with junk mail, but his actions speak otherwise: For his own amusement, he Googles the gobbledygook at the bottom of spam messages to see where the text comes from. (Some are from Harry Potter books, he says. He also found one that was an English translation of a Russian science-fiction novel).

“It’s fun,” he says of catching spammers. “Sometimes I think, ‘Oh, wow, that guy’s really clever.’”

The chase may be exciting, but Taylor’s real dream is to return e-mail to the “pristine experience it used to be.”

Chenxi Wang, an analyst at Forrester Research, scoffs at the idea that spam attempts could be on the decline.

“I’m seeing that the overall trend is up,” Wang says. “We’re not seeing a drastic increase, though. And we’re also seeing an increase of targeted spam instead of blanket spam that hits everybody in a large population. Today, for instance, you see spam messages on saving (on) prescription drugs targeted to seniors.”

For its part, Yahoo, too, says the overall amount of spam transmitted is on the rise, but the percentage of spam that reaches its users’ inboxes is down. (Yahoo would not disclose specific numbers.)

Regardless of the overall spam attempts, David Daniels, vice president of Jupiter Research, predicts the number of spam messages that actually reach a typical inbox will remain roughly flat over the next three years. And for most people, that’s what really matters.

“We’re forecasting that the number of spam messages that annually reach the average inbox will hit 4,351 in 2007. For 2010, we think that number will essentially be flat at 4,403. The growth will be very, very small,” Daniels says.

There are a couple of reasons for the lack of growth in spam deliveries. For one, e-mail providers like Google, Yahoo, AOL and Microsoft’s Hotmail use sophisticated filtering algorithms that are constantly updated based on spam reports from individual users. Google says it can delete all instances of a single spam message across the Gmail network in seconds.

New anti-spam technologies are also always under development, and there are already countless anti-spam services and technologies available to consumers, including disposable e-mail addresses.

It’s by no means a perfect system, though. And spammers are, if nothing else, persistent.

In a bizarre twist, Daniels thinks that instead of receiving spam offers from penny-stock pushers, mailboxes will increasingly be filled with marketing messages that we choose to receive, such as promotional e-mails from a favorite clothing store or a bank. He thinks the average number of messages from marketers that individuals receive annually will grow from 2,715 in 2007 to 3,335 in 2010.

“We expect people to spend as much time on e-mail as they have, but we think people will receive more e-mail from legitimate marketers. So there will be more competition to get consumers’ attention in the inbox, but it will be more like competition between The Gap and J.C. Penney as opposed to The Gap and a Viagra salesman.”

Read more »

Amit Klein recently released details on DNS server cache poisoning attacks that affect both BIND (Berkeley Internet Name Domain) and Windows DNS servers. It goes to show that every time you think a problem with a well-known protocol or service has been solved, it may not be.

DNS has been with us since 1983 ??? nearly as long as the Internet. And although DNS RFCs have come and gone, DNS is still very similar to its original specifications. Certainly it has grown in feature set and complication, but it still has the same underlying security problems it did when it was invented by Paul Mockapetris. The biggest problem is the lack of default authentication. Several security mechanisms have been created for DNS with varying degrees of success (and failure) to solve the authentication problem, but it is still relatively easy to fake a DNS packet to either a DNS server or an unwitting client.

Klein’s last find involved two discoveries, both of which allow important parts of a DNS server packet to be forged with trivial effort. The first implementation error involves the DNS UDP source port. Although it should be randomized to prevent forging, it turns out that the source port never changes the whole time the DNS server is up and running. The second, and more important, problem is the trivial predictability of the transaction ID value. Both errors allow DNS server packet information to be predicted and forged.

An attacker can send a malicious Web page link and induce an end-user to click on the link. The clicked link sends off a DNS client query, which can be forged, sending the end-user to a bogus location. DNS has been found vulnerable in the same way before. In fact, Klein laments, “It is saddening to realize that 10-15 years after the dangers of predictable DSN transaction ID were discovered” that DNS software is still susceptible to transaction ID exploitation.

Klein reported his findings to BIND’s caretakers, the Internet Software Consortium (ISC), in late May and to Microsoft in April. Both the ISC and Microsoft have released patches or updated software. Thanks are due to Amit Klein for his research and responsible disclosure.

Overall, Microsoft’s DNS implementation has been relatively secure. The last major security update to Windows DNS was in Windows 2000 SP2 and SP4, as well as Windows Server 2003 (nearly five years ago). BIND is the most popular version of DNS server software used on the Internet, and its overall security track record has been a bit more active over the years, as one would expect with more popular software. BIND versions 8.x and 9.x have had at least six different vulnerabilities published.

The most secure version of DNS is considered djbdns, named after its author, Dr. Dan J. Bernstein, one of the most prominent voices for security over functionality in computer software. Although djbdns (also known as tinydns for one of its daemons) is not nearly as functional as Windows DNS or BIND, it is run by some of the world’s largest companies. Dr. Bernstein claims that more than 1.8 million .com addresses use djbdns. And though Dr. Bernstein has been offering a $500 reward to anyone who can find an error in its 7,000 instructions, there has yet to be a successful claim. Unfortunately, djbdns is built only for Unix and could not be used efficiently to support an Active Directory domain.

Besides making sure your DNS servers are running up-to-date versions of DNS, I think Klein’s findings bring up another interesting point. Open source advocates are always touting how open source software allows programming and security bugs to be found faster than with closed source software. It certainly makes sense ??? there’s source code to review, and more eyeballs to review it. But as Klein’s research shows, it doesn’t make that much of a difference. In the 10 to 15 years that have gone by, nobody (publicly) found the bugs in either the closed source or open source versions inherently faster. Both errors went undetected for more than a decade until one person got interested in the research.

There are dozens of cases just like this, where open source bugs remained unfound for a decade or more, until one lone individual on their own personal quest did some digging. You can look at any of the popular protocols (such as SMTP, SNMP, HTTP, FTP, ASN.1, and so on) and find vulnerabilities that went undiscovered for over a decade. Heck, people are still finding problems in IPv4 packets that have been around for 20-odd years. And as far as I can tell, whether or not the product was open source didn’t really play a part in the finding or the fix, albeit the open source fixes are consistently coded faster when the problem is located. What mattered most was a single person (or company) that cared enough to investigate. To the responsible bug disclosure people, I salute you!

Read more »

Software developers, sharpen those No. 2 pencils. A standardized test on your knowledge of secure programming may soon be coming your way.

The Secure Programming Council unveiled Tuesday a proposed standard for companies to test their software developers’ knowledge of secure programming. The aim is to create a situation in which companies can ensure that their developers, whether in-house or outsourced, have a base level of knowledge about wrapping security into software applications.

The council is rolling out its “Essential Skills for Secure Programmers Using Java/JavaEE” (PDF), the first of six standards initiatives. It plans to later add skills tests for C and C++, as well as languages .Net, PHP, and PERL.

The council is opening up the Java/JavaEE proposed standard for public comment via e-mail over the next 60 days.

Some of the proposed areas of testing will include data handling, authentication, and session management and access control. For example, under the data handling task, Java programmers must be able to write programs that read input from interfaces, properly validate the data, then disseminate it. The programmers would also need to be familiar with such malicious-attack scenarios as cross-site scripting and SQL injections.

The skill testing is designed to not only ask developers whether they know what encryption is but whether they understand the differences between PKI encryption and other forms of encryption, said Ryan Berg, co-founder of Ounce Labs and a member of the Secure Programming Council’s Java and JavaEE steering committee.

More than 40 companies, government agencies, and security firms have participated in helping to establish the standards, largely coming from the financial services, manufacturing, aerospace, military, and outsourcing industries, said Alan Paller, director of research at SANS Institute.

“One large financial institution has told its developers that they had to pass the test by August 1, or they won’t touch a line of code,” Paller said. “The financial industry is taking the lead because they have the most to lose.”

SANS will administer the tests, which are scheduled to begin on December 5 in London and continue for the next eight months in cities through out the United States and Europe.

The tests, which don’t actually require a No. 2 pencil, cost between $50 and $450, for participants ranging from students to employees of large corporations.

Read more »