TechTakes

Net Neutrality: The FCC, Comcast and BitTorrent

There are plenty of ideologues and no lack of commercial interests engaged in the debate over "net neutrality," which at its core seeks to prevent de-facto monopoly providers from exploiting their privileged position. Requiring internet service providers to deliver content and bit-streams to competitors and entrepreneurs alike at regulated rates (or at a wholesale cost derived from their infrastructure costs without any supplemental costs added in) seems like a reasonable idea. There are many who argue that forcing internet service providers to open their networks in this manner will stifle innovation – that the ISPs won't make investments in upgrading the infrastructure, and the entire system will therefore lack innovation and quality will be degraded. This is a canard. A regulated rate of return is a guaranteed rate of return. CEOs and executives at ISPs will still take home very comfortable pay and benefits. Stockholders will get a safe and secure return, although the prospect for astronomical returns will disappear. But in a world of low interest rates and volatile financial markets steady performance and returns tied to the overall growth of the internet are still substantial goods.

Underlying this issue is the desire of the utility providers – the ISPs – to "monetize" their investment, becoming content providers rather than just service providers. Much of the debate in public forums focuses on peer-to-peer protocols such as BitTorrent, because beginning with Napster these protocols have been used to share music and video files that are bandwidth-intensive and often have been or are used to circumvent the legitimate intellectual property interests of the content owners. But there is another side to this that speaks more to the use of the internet for business and innovation, which is why the blunt public statement by Federal Communications Commission Chairman Kevin J. Martin, a Republican appointee of President George W. Bush, that Comcast is blocking internet traffic on a widespread basis is striking.

If you think that it's just kids sharing illegal copies of music and stolen Hollywood movies, what Comcast is doing might seem OK. But look at Amazon's data services for software developers – Amazon S3 and Amazon EC2. Taking advantage of Amazon's huge infrastructure and scalability, Amazon is selling its data center capacity to software developers at extremely low rates, enabling countless entrepreneurs, start-ups, and established companies to create virtual computing centers and storage clusters and to use the internet "cloud" as their network infrastructure – sharing data, applications, and solutions worldwide. This is innovation – and when developers using Amazon S3 and the BitTorrent protocol for transferring their data find that Comcast is throttling their bandwidth, Comcast, casting a wide net, is stifling innovation and business development. No matter whether the company is working on medical software to improve brain imaging, a new Facebook social network, or an online content-distribution system for Netflix or Blockbuster, Comcast is impeding progress when they slow down internet traffic simply because it is using a particular protocol.

As with the recent meltdown in the financial services industry, the question is less whether regulation is appropriate or necessary than what form that regulation should take. The question is whether a "Net Neutrality" law establishing broad government regulatory policies or more narrowly framed enabling legislation that makes clear the FCC's right and obligation to enforce some version of "common carrier" provisions on internet service providers will best serve both commerce and the public interest.

Web Injection Attacks Replace E-mail Threats: ISPs Endanger the Internet

Don't forget about email security – but it's no longer the primary security threat to your computer or network. Attacks are now web-based, according to Microsoft, and increased more than 55% in 2007. Faced with declining revenues due to signature-based security programs, criminal enterprises have turned to unpatched applications and zero-day exploits delivered through fake or corrupted web sites. And in the rush to "monetize" the internet and extract money from subscribers, your Internet Service Provider (ISP) may be one of the biggest culprits.

You trust mail from admin@yourisp.com don't you? So why not trust admin@server1.yourisp.com? That's the problem. "Serverxyz.yourisp.com" doesn't belong to your ISP – it's a site designed to deliver malicious software when you visit it, should your computer have unpatched software with vulnerabilities to exploit. All you have to do is be convinced by an innocent-looking email to visit a hacked or crooked web site, and thank you, your computer has been compromised. Maybe it's just identity theft, and your personal information and keystrokes are being spirited away. Maybe your computer is now one of thousands that collectively deliver billions of spam messages daily through "botnets" – messages socially engineered to trick others into making the same innocent mistake you just did.

Microsoft claims it is largely responsible for tamping down the "Storm" botnet during the last part of 2007 through its malicious software reporting tool, and recently issued its latest security report detailing its findings on threats and countermeasures. In the U.S. one computer out of every 100 is compromised – a sign that patching Microsoft applications alone is not enough to keep your systems secure.

Surprisingly, one of the vectors for infection is your ISP – the gateway to the internet. Unhappy with simply providing a conduit and performing a utility function, ISPs are trying to turn their own internet presence into revenue opportunities extending beyond network provisioning. eWeek Security Watch reported that EarthLink, Quest, and Verizon have been identified as putting their subscribers at risk by Dan Kaminsky, a noted security researcher. In the tangled web that is the Web, Comcast gets part of its network from EarthLink, who in turn outsources the work to a company named Bare Fruit. Follow that? When you put together that pastiche of service providers and have the ISP trying to "inject" advertising onto its subscribers, customers who visit well-known and common sites such as eBay, the Associated Press, MySpace, Facebook and others are suddenly at risk.

The Secunia Software Inspector remains a valuable tool for finding insecure and end-of-life applications, and providing links to the appropriate secure download sites for updated versions. It's free for personal use, and has a nominal licensing fee for business use.

Reading: E-mail and beyond

Not everything in Randall Stross's recent New York Times article "Struggling to Evade the E-Mail Tsunami" is immediately useful, but it's good to know about the varied approaches to managing mail flow from ClearContext, Xobni, and Boxbe. ClearContext has a great calculator tool that provides ROI information; you'll be surprised at how much it costs to process email, wanted and unwanted. Xobni looks like a very promising way of having instant access to all communications with a particular correspondent (a mini-CRM email handler). Boxbe manages the frontier, and provides a means of controlling access and categorizing e-mail into hierarchies ranked by importance.

Most interesting, and a wonderful piece of eye candy, is RapidReader. Stross mentions its ability to increase your reading speed for e-mail up to 950 words per minute. But RapidReader is more than that – it can feed your eye with web page text, Word documents, PDFs – and it works on Windows, MacOS and two flavors of mobile devices, Palm and Nokia. I'm waiting for the Windows Mobile 6 version so my smartphone can make me smarter. The first time you try the demo at 500 words per minute (normal reading speed is perhaps 140 wpm, and drops to about 100 wpm on-screen) you'll feel like you're doing everything in fast-fast-forward. At 950 wpm you'll have an AHA! moment and suddenly understand subliminal advertising. But after "flooding" your eyes and brain with these high speeds, a more likely reading speed of 300 wpm will feel comfortable – and that's three times faster than you might otherwise read those documents.

Millions and Millions of Malware

In the past couple of days one security vendor (F-Secure) said that they expect the number of unique malicious software releases to exceed one million items by the end of 2008. Then Symantec released its Internet Security Threat Report and concluded that there are already more than 1.1 million pieces of malware in the wild. Security vendors agree that the criminal elements engaged in producing malware are increasing organized and that the number of threats has increased dramatically since mid-2007. Symantec's report says that nearly 500,000 new unique threats emerged during the last six months of last year; and Sophos claims that of the total number of threats it has measured over the past 20 years some 25% were identified in the past six months.

You might think it's email – but that is getting to be a tougher route for malware perpetrators to follow. Spam filters and antivirus software are more effective and effective updates are released more quickly. Coupled with more vigilant users, email threats are short-lived and offer relatively low returns. Web sites – often mimicking legitimate webs sites but containing exploit code – are now the preferred attack vector. It's more important than ever to keep operating systems, applications, browsers and plug-ins fully patched. For the bewildering variety of software this includes, a tool such as Secunia's Software Inspector for noncommercial environments or its companion the Network Software Inspector for businesses is indispensable.

Apple’s Safari: A Journey You Should Not Take

If you have computers running Windows operating systems on which Apple's QuickTime and iTunes for Windows are installed, beware! Now Apple is including Safari, its Windows browser, by default in automatic updates for Quicktime and/or iTunes for Windows. Users who don't unselect the check box get a new piece of software. Implied consent, or shady tactic? I vote for the latter. Even Adobe got smart and stopped automatically downloading PhotoShop elements and other software when computer users installed the ubiquitous free Reader software. And many vendors with online installs of their software offering are only offering to install the Google Toolbar for Explorer or Google Desktop rather than doing it by default.

Apple is acting as though they took a play from Microsoft's playbook before the Redmond giant got whacked by antitrust lawsuits and hit by multibillion dollar fines. Remember when Netscape was the darling of technology investors and Microsoft killed it by bundling its Explorer browser with the operating system, exploiting its monopoly position? Users didn't have a choice: buy or run Windows, get Explorer. Despite the resulting lawsuits and decisions against Microsoft, Netscape died, Firefox and Opera were born, and Apple touted its simplicity and security compared to the bruising browser wars in Windows.

It's at root the same tactic used by criminals who lure unsuspecting users to a web site and then execute "drive-by installs" of malicious software. Corporate network administrators suddenly find a new browser on user desktops, one that is notoriously insecure, and not approved for network environments. (Apple may still try to claim better security on its own native Macintosh systems, but it has proven no better and may be worse at writing software for Windows than other vendors). End users who think they are simply updating QuickTime and iTunes to keep up with security patches find that they overlooked Apple's decision to install Safari – a new piece of software – by default. This is a bad practice, bad ethics, and at the moment, many experts claim that it's bad software. Beware.

2007 Internet Crime Report: incidents down, losses up. Men the biggest losers.

Although the number of reported internet crimes decreased in 2007, the dollar losses increased by $40 million, according to the just-released 2007 Internet Crime Report. Published by the Internet Crime Complaint Center (a partnership between the FBI, the Bureau of Justice Assistance's National White Collar Crime Center, the report identifies the U.S., the United Kingdom, and perennial winner Nigeria as the leading sources of internet crime reports. More than 90,000 incidents (from a total of some 206,000 reports) were referred to local law enforcement. Men, on average, lose more than women, even though women's online purchasing activity now surpasses that of men. Robert Macmillan reported some of the details of average losses in Computerworld's coverage of the report: investment fraud, $3,500; check fraud, $3,000; Nigerian letter fraud, $2,000 (hard to believe this one still works so well!!!), and auction fraud, $480.

A Back Door to Saving Money on Windows Vista

As reported in Windows Secrets and picked up by Computerworld, it appears that you can get a full copy of Windows Vista that will pass Microsoft's Genuine Advantage inspection simply by buying an upgrade copy of Windows Vista with Service Pack 1. That means a savings of somewhere around $100. The catch? You have to install the software twice – ignoring the request for a product identification key the first time, then re-running the upgrade installation and using the product key supplied with the upgrade version. So Vista SP1 installs without requiring a valid product key – a circumstance that gets you an operational copy of Vista but one that can't be validated with Microsoft. To pass validation with Microsoft, you run the install a second time and enter the product key – and now you have a copy that will pass muster. Oh, yes – it appears that Microsoft deliberately left this "back door" open, although publicly the company says that using this approach doesn't meet licensing guidelines. Check out the media reports and make your own decision.

Microsoft Open XML Achieves International Standard Status

Blunted for more than a year by opposition from industry rivals and the votes of a number of countries, Microsoft won its battle to have its OpenXML specification designated an international standard on par with the Open Document Format (ODF). While this opens the doors for continued sales and use of Microsoft products by large organizations and countries that have started requiring standardized document formats to facilitate data portability and security, it also means that small and medium businesses and individual consumers will enjoy lower costs, greater security and higher productivity as they migrate to Office 2007 and other Microsoft applications that use XML formats. The formal announcement designating Microsoft OpenXML an international standard is expected to come today from the Organization for International Standardization, which is based in Geneva, as reported by Kevin J. O'Brien in today's New York Times.

Apple not keeping up with security

For years the wars have been running – Apple computers are more secure than computers running Microsoft Windows. At the recent CanSecWest conference, however, the newest Macbook Air was the first to be hacked; Apple's OS X failed first, within two minutes. Next to fall was a computer running Microsoft's Windows Vista – but only after hackers were allowed to use exploits aimed at third-party applications. Vista held up – and the Windows computer was compromised due to a flaw in Adobe's Flash Player. If this scares you, start looking to use Linux and its Ubuntu flavor.

Apple took another hit when a Swiss research group released findings that Microsoft does a better job of patch management than Apple, as reported by Information Week. "Security through obscurity" is no longer a safe haven for Mac users – as Apple gains market share (and it should, because the ease of use is still compelling for many computer owners) it is a higher-value target for hackers. Organized crime is indifferent to the type of computer you own – like any business they want a return on investment, and when there are enough Macs out there to make identity theft and other kinds of fraud profitable, the exploits will come.

The underlying lesson is that computer owners remain the weakest link in the security system. Every day a system is unpatched is a day when security vulnerability increases – no matter whether the application that is not patched is Java, Flash, Acrobat reader, AOL Instant Messenger, RealPlayer, Quicktime or any other. The CanSecWest conference showed that even fully patched systems can be exploited quickly; there's not much a typical end-user can do to avoid Zero-day exploits even if they have a full suite of security measures employed. But keeping everything patched and then being careful about succumbing to social engineering tricks that fool users into opening email with malicious payloads or visiting web sites with drive-by downloads is about the best one can hope for.

I recommend Secunia's Software Inspector for regular audits; it's free for personal use.