Spyware Weekly Newsletter :· July 13, 2004

The Spyware Weekly Newsletter is distributed every week to 20,000 subscribers and read online by hundreds of thousands of visitors. Please read our Terms of Use for quoting guidelines. http://www.spywareinfoforum.info/newlsetter/july13,2004.

Wherever the term "adware" is used, it is referring to a category of software, not to any particular company or product.

Permalink | Top

This newsletter will be relatively short. Last week's newsletter never was finished because we had a little problem with the web site. One of the hard drives in our main web server at my Dixiesys host failed and the site was offline for about 12 hours. Thankfully the server has twin hard drives in a redundant RAID array, so nothing was lost. Then we discovered that the super DDoS-busting firewall at my Globalservers host was limiting the number of connections to far too small an amount and causing the site to load very slowly.

Both Dixiesys and Globalservers are doing a very good job keeping the site running. The admin at Dixiesys was up all night repairing the hard drives in the web server. Globalservers is doing a fantastic job of blocking a nasty, non-stop denial of service attack. They have a killer firewall that just shrugs off all attacks thrown at it.

And, without further ado....

Permalink | Top

X-Cleaner Spyware Remover is an award winning spyware detector that finds and removes commercial spyware programs. X-Cleaner also features a unique mobile active-x spy scanning utility so you can login through your member's center and use it from public terminals.

X-Cleaner soon will have all of the CWS removal capabilities of CWShredder, licensed from Merijn. That means that X-Cleaner will be able to remove nearly every single variant of the world's most widespread, stubborn and annoying browser hijacker.

No installation required - simply download and use or you may install if you choose. X-Cleaner provides courteous support via e-mail for registered users. Software is delivered instantly via digital download and you can download new versions as often as you like the first year.

You can even put this on a floppy disk and carry it to work in an envelope or in your shirt pocket. Insert floppy, scan and zap the keylogger or delete your surfing traces.

X-Cleaner was recommended by Kim Komando in her article for MSN, Danger, danger: 5 tips for using a public PC.

Features

1) New expanded detection and removal database.

2) General Interface Improvement- Users can now resize the program window to fit into their screen anyway they like, especially useful for the encyclopedia where they had to scroll right.

3) Bypass *hardware* keyloggers using onscreen keyboard for input- This is under the Expert tab for Deluxe Users only and makes use of the built-in based keyboard in Windows so that users can key in information without using physical keystrokes. This is very useful for sending sensitive material since hardware keyloggers (a growing threat X-Block is working on) evade anti-spyware which normally targets software loggers only. Given X-Cleaner's mobility in terms of file size, this is a useful little addition to have since you can go to an Internet Cafe- sweep for keyloggers (or use the full active-x scanner in the members area) and then use the software based keypad to evade hardware logging.

4) Direct link to online assistance integrated into software- as always X-Cleaner technicians are dedicated to providing prompt and professional e-mail support for even hard to remove cases of the spyware plague.

Permalink | Top

<Rant>

A bad law is worse than no law. Bad laws have the potential to make things worse. Don't believe me? Well then, take a look at your email inbox. Is there more spam or less spam now than before CAN-SPAM became law in the United States? CAN-SPAM addressed the issue without fixing it and, in fact, made the problem worse by making spam legitimate if it follows a couple of rules.

A bad law also can be abused for things it was not intended to address. Let's consider the DMCA, the Digital Millennium Copyright Act. The DMCA was intended to help copyright owners stop the theft of their intellectual property (IP). Has it worked? Download Winmx, do a search for Metallica and draw your own conclusion.

The DMCA more often is used to stifle fair competition than it is to stop theft of IP, an abuse not intended when it was passed by the US Congress. Here are some examples of this:

Russian programmer Dmitry Sklyarov was jailed for several weeks and detained for five months in the United States because of his work for Elcomsoft, a software company in Russia. Elcomsoft created software that allows the rightful owner of a protected Adobe e-book to convert the file to Adobe's PDF format.

The Sklyarov case is significant for two reasons. First, Sklyarov and the company that he works for are located on Russian soil, not American soil. Sklyarov was arrested for violating an American law while in Russia! Second, the software which Adobe claims violates the DMCA was written for use by the rightful owners of the e-books to exercise their rights of fair use. The software cannot be used by someone who does not own an e-book.

Hewlett Packard threatened a security group with a lawsuit under the DMCA after the group released software that demonstrated a long-standing flaw in HP software. HP knew about the flaw and had refused to fix it to protect their customers. HP backed down from their threats to sue the security group after massive and very negative publicity and threats of boycotts.

Censorware author N2H2 has tried to obstruct research to look for flaws in its software. Since the list of blocked web sites is encrypted, N2H2 claims the DMCA prohibits anyone from decrypting and reading it, no matter what the purpose is.

It should be noted that N2H2 has contracts to sell their filters to many public libraries. Demonstrating that its method of filtering is flawed might cost the company a considerable sum of money.

Niels Ferguson, a prominent Dutch cryptographer, has discovered a major security flaw with an Intel video encryption system known as High Bandwidth Digital Content Protection (HDCP). The aim of HDCP is to prevent illegal copying of video contents by encrypting the signal.

Fearing repercussions under the DMCA, Ferguson refuses to publish his research and as a result, the flaw still exists. Intel's copy-protection software still is flawed and leaves content producers at risk of piracy if they use it. If Ferguson were able to publish his findings, Intel would be able to fix their flawed encryption system and protect content as they advertise.

I should note that personally I would prefer that Ferguson shared his secret report with Intel before publishing so as to give them time to fix the problem. As I understand it, that was not Ferguson's intention, so this is a situation with both good and bad consequences.

Apple Computers threatened one of their authorized distributors with action under the DMCA when he offered software which allowed owners of older Apple computers to use new DVD burning software. Apple deliberately allows only newer computers to use that software. This is to force people into buying a new computer instead of simply upgrading the one they have. After learning about the distributor's software, Apple forced him to stop giving it out.

Typeface vendor Agfa Monotype Corporation threatened a college student with DMCA liability for creating software designed to allow people to embed his own custom fonts that he designed himself into other documents. This software was designed and intended to be used with his own creations, but a company that creates its own competing, commercial creations used to DMCA to hinder his ability to distribute the software.

Before the DMCA, it was legal to copy or reverse engineer code for the purposes of interoperability, to make the products of two different companies work together. However, some of the most disgusting and obscene abuses of the DMCA are carried out by companies trying to force out competitors and establish monopolies. Two examples of this are Lexmark versus Static Control Components and Chamberlain Group versus Skylink Technologies.

Lexmark sued under the DMCA to obstruct Static Control Component's ability to produce ink cartridges that would work in Lexmark printers. Lexmark wants to hold an absolute monopoly over ink cartridges that would work in their printers. Lexmark charges far more than fair market value for their ink cartridges. Fair competition would prevent this price gouging. Lexmark has since lost this lawsuit.

Chamberlain Group, maker of products that open garage doors mechanically, sued Skylink Technologies after Skylink started selling a competing remote controller that would activate their mechanical openers. Skylink controllers are superior to Chamberlain, working with a large variety of garage door opening systems instead of just one.

After several retailers removed Chamberlain's more expensive and inferior product from their shelves in favor of Skylink's product, Chamberlain invoked the DMCA. Chamberlain claimed that Skylink was circumventing their access control technology. Carrying this argument out to its logical conclusion, it is illegal for a home owner to open the door of his own garage if a Chamberlain opener is attached to it and he uses a remote control made by someone else. Chamberlain has since lost this lawsuit.

Finally, the most recent abuse of the DMCA. A company by the name of StorageTek has used the DMCA to prevent their customers from using other companies to provide maintenance for their products. It seems that StorageTek uses encryption to control access to a maintenance module of their software.

A customer called in their own preferred maintenance company to correct a problem in StorageTek's product. In doing so, the repair techs used the decryption key that allows access to the maintenance module. StorageTek claims that this is a DMCA violation and has petitioned the court to issue an injunction against the company. That sounds like a good enough reason to me to find another provider of storage software.

This has nothing to do with IP or IP theft. This is simply a company who does not want to allow their customers to use anyone but themselves for technical support of their product. Rather than competing for that business legitimately, StorageTek has decided to abuse an unrelated law to lock out competition.

A bad law is worse than no law. Why do I bring this up here? Because a bad law now is sailing through the US House of Representatives. Congresswoman Mary Bono's SPI ACT is closer than ever to being passed. At first, I was excited that someone in the government was willing to pass laws restricting spyware. And then, I read the act.

First of all, it becomes entangled trying to define spyware, then regulating that. It would be better to regulate the behavior that is causing so much chaos and anger among consumers than trying to define a word. The US Senate's SPYBLOCK Act avoids the definition of spyware altogether. Instead, it focuses on the problems caused by spyware and other parasites.

For that matter, "spyware" does not cover most of the software people actually are complaining about, no matter how you define the word. Coolwebsearch arguably is the worst parasite out there at the moment. However, as bad as coolwebsearch is, it is not spyware and would not be illegal if Bono's bill were passed into law.

Second, the SPI Act specifically preempts all existing state laws on the matter. I find that to be distasteful. I don't like the Federal government violating the sovereignty of the individual states that way. That's right, I believe in state's rights. Blame it on my Southern heritage if you like.

The Federal CAN-SPAM law not only makes the spam problem worse by legitimizing unsolicited email advertising, it also overrules existing state laws that did much more in stopping the problem. Last year, a tough California law prohibiting banks and credit companies from providing an individual's personal information to third parties was rendered unenforceable after the industry spent millions lobbying for a Federal law that trumps it.

In contrast, the SPYBLOCK Act doesn't mention states at all, except to say that the states' attorneys-general can file suit against infringing companies. Of course I am not a lawyer, but I take that to mean that existing state laws, such as Utah's Spyware Control Act, would not be preempted.

To be honest, Bono's bill scares me. If it passes and SPYBLOCK does not, it gives a free pass to the worst software out there. C2 Media LTD would not be impacted. Coolwebsearch would not be impacted. The worst, most disgustingly abusive software out there would not be regulated under SPI Act. I consider it to be little better than CAN-SPAM and I hope it does not pass. A bad law is worse than no law at all.

The US Senate's SPYBLOCK ACT is much better and I fully support it. SPYBLOCK concerns itself with behavior, not with definitions. I would like to see SPYBLOCK pass into law.

</Rant>

Permalink | Top

I do not intentionally link to web sites that require registration before allowing visitors to read the article. At the time I read these articles, I was not required to register. If one of these sites requires that you register before allowing you to read the article, please let me know and I will blacklist that site.

http://www.sportbusiness.com/news/index?news_item_id=155023&region=global :: MLB IN SPYWARE CLAMPDOWN

http://www.mercurynews.com/mld/mercurynews/news/breaking_news/9050586.htm?1c :: Banks lose bid to overturn financial privacy law

http://www.fcw.com/fcw/articles/2004/0628/web-tsa-06-30-04.asp :: TSA exempts systems from Privacy Act

http://www.internetnews.com/security/article.php/3375661 :: Spyware Sneaking into the Enterprise

http://zdnet.com.com/2100-1104-5253029.html :: Adware's going mainstream, report says

http://hr.blr.com/Article.cfm/Nav/5.0.0.0.30590 :: Big Brother is Watching, But How Often?

http://www.computerworld.com/softwaretopics/software/groupware/story/0,10801,94246,00.html :: Spyware Gets Top Billing

http://news.tbo.com/news/MGB086487WD.html :: Foes Of Public Voter List Say Privacy May Be At Risk

http://www.spectrum.ieee.org/WEBONLY/publicfeature/jul04/0704over.html :: We like to watch

http://zdnet.com.com/2100-1104-5258824.html :: California privacy law kicks in

http://www.dmeurope.com/default.asp?ArticleID=2247 :: Dutch Parliament to go after autodialers, spyware

http://www.clickz.com/news/article.php/3377851 :: "Hooked on Phonics" Firm Settles FTC Privacy Charges

http://www.nj.com/news/times/index.ssf?/base/news-2/1089448550238510.xml :: Panel urges phone, address restrictions

http://news.zdnet.co.uk/internet/security/0,39020375,39160180,00.htm :: Australian parliament fights spyware outbreak