Urging Smartphone Users to Browse Less?

December 12, 2009 · Musings, Technology · Comments Off

AT&T’s president and CEO of Mobility and Consumer Markets, Ralph de la Vega, has called out the smartphone crowd in recent comments to the press and investment analysts. In the days of more primitive phones, “mobile” versions of websites were necessary; small screens, small amounts of available memory, and poor image quality all brought forth trimmed-down sites and the .mobi TLD. Then came the iPhone.

Suddenly, carrying a smartphone was considered cool. Crackberries were no longer just for the business traveler, and Google felt threatened just enough to wade into the smartphone market by developing a phone OS. Today we have the Blackberry Storm, the Motorola Droid, HTC, and others as viable (and in certain features, better) alternatives to the Apple iPhone. With their big, vibrant screens came real web browsers and “apps” which could pull data from the Internet. While it’s hard to believe that AT&T didn’t think the iPhone would be a hit and end up in the hands of quite a few subscribers, the other carriers never had an excuse once AT&T woke the sleeping giant known as iPhone.

After the initial success of the iPhone, the carriers knew full well what they were dealing with. Just like the widespread availability of broadband Internet services to the home in the U.S. (cable, DSL, FTTP) caused an explosion in overall bandwidth, the average customer took advantage of the higher throughput rates. Those of us who remember the days of 56.6k or even 28.8k modems know how hard it was to listen to streaming audio, much less watch streaming video. (My sympathies for those who are still stuck with dial-up, out of the range of the CO for DSL.) Now that we have 10Mb, 20Mb, even 50Mb pipes coming to our homes, we don’t think twice about watching a Youtube clip or downloading the latest warez…er, buying the latest game on Steam.

de la Vega’s argument is simple: three percent of smartphone users make up 40% of total data usage on AT&T’s wireless network, and their usage is impacting other customers on the same cell tower. According to a Computerworld report, “We have to get to those customers and get them to recognize they have to change their patterns,” de la Vega said at a UBS analyst conference this past Wednesday, “or there are things we will do to change those patterns.” The Godfather-like tone was clarified by other statements indicating some sort of tiered or pay-per-unit pricing. He was quoted by Computerworld, saying “there’s got to be some sort of pricing scheme that addresses the [heavy] users.”

The New York Times quotes an “independent wireless analyst,” Chetan Sharma, as saying that data usage should be treated like voice usage. “You use more minutes, you pay more,” he said to the Times. And AT&T’s de la Vega said that “The first thing we need to do is educate customers about what represents a megabyte of data[...].”

Therein lies the problem: Sharma has fallen into the trap called non sequitur, and de la Vega wants customers to tally something that a human can’t estimate. The carriers don’t get it, and neither does this one analyst. (It’s hard to say whether the wireless analyst community as a whole gets it, as the Times only quoted Sharma, and Computerworld didn’t interview an analyst.)

First, to address the non sequitur: You use more minutes, therefore you pay more, so you use more data, therefore you pay more. In the U.S., most ISPs do not enforce a hard cap, i.e. a bandwidth limit for each billing period, instead warning high-usage customers and occasionally threatening disconnection or moving them to a more expensive “class” of service (either a faster tier or “business-class” tier). Customers generally pay based on max throughput, with a bigger pipe costing more, and for all intents and purposes the connection has unlimited bandwidth. This is neither what the carriers currently do (charging for a certain amount of bandwidth per month, or for “unlimited” service, without really offering tiers of throughput) nor is it what AT&T is proposing with tiered bandwidth pricing.

Second, de la Vega thinks this is an education problem. Teach a customer what a megabyte is, and they’ll consume less of them. Without pulling out the calculator, tell me how many megabytes the following are:

And how do you provide a real-world definition of a megabyte? A megabyte might get you 7 seconds of a standard-def TV show episode, or it might get you the full front page of Slashdot, or it might only give you the photos on the front page of CNN.com. And a picture at 1 MB could easy turn into 20 MB, if the smaller version from compressed from a RAW format; conversely, it could be squished into 100KB, if turned into a low-quality GIF.

Urging smartphone users to browse less is a bad PR strategy. Think about it: a customer has shelled out $150-$200 for a contract-tied phone, plus a “required” data plan usually costing $30 a month, and now you’re telling them to not use the phone’s features all the time? The natural Internet response is to create an online petition and vote with your feet. Sadly, because of the state of wireless networks in the U.S., hopping to a different carrier may not be viable (e.g. no coverage) and even the threat of a government investigation into text-message pricing hasn’t kept the major carriers from steadily increasing the rates over the past few years.

I call this looming AT&T policy a bad PR strategy because it’s unlikely that implementation will cause a mass exodus to the other carriers. Many customers are perpetually in contract for the subsidized phones, while others won’t budge because of a particular phone (e.g. the iPhone) or coverage areas or employers (work phones only serviced by one carrier, or employees get a special discount with a single carrier).

Captive audiences make a great business strategy. Only time will tell whether this is the future of wireless data plans, or if the carriers realize that metered data with a meter that no one can estimate or predict might draw the ire of legislators and government regulators.

(As a sidenote, if bandwidth caps are implemented, does that mean we get to run Adblock on our smartphones?)

Blue glass fountain pen

Putting Computers on One-Year Layaway

November 15, 2009 · Musings, Technology · Comments Off

A number of tech news outlets reported a Federal Trade Commission memo filed this past Thursday in an ongoing case in U.S. District Court (Southern District of New York) against a firm called BlueHippo. The FTC, which had successfully reached a settlement with the firm in April 2008, alleges that the terms of the agreement have been violated, and attorneys for the FTC are not amused — they are seeking restitution for customers, as well as a ban to prevent the company from offering financing with goods or services, selling consumer electronics, and regulating its refund practices.

BlueHippo touts itself as a consumer electronics seller, offering weekly payment plans and financing options without a credit check. For products which offer the payment plan and finance option, the customer agrees to pay an initial fee plus 52 weekly payments, and after 6 to 13 weeks’ worth of payments, BlueHippo will ship the product, as if it had been traditionally financed. In fact, they even offer to report your payment history to the trio of credit reporting agencies if you want the good karma on your report. Their FAQ states that they are not a rent-to-own or leasing company.

Before getting into the current legal tussle in U.S. District Court, let’s consider a few things:

  • At a minimum, you’re putting up an initial fee plus 6-13 weeks’ worth of payments before they order your computer. This alone is playing with fire — unlike Kmart, you don’t get to hand over the physical product at the store, and you have no way of verifying that they physically have your product as you make the payments.
  • The people at BlueHippo don’t know what the $*&# layaway means. (Clue: get a dictionary.) Consider the following sources:
    • Oxford English Dictionary: the word “lay-away” has a vague definition in the 1997 update, nothing more. Unusual, so we take a quick trip to Wikipedia to see if there might be a geographical (i.e. U.S./U.K.) difference in spelling.
    • Wikipedia: now we find a more specific definition, but it’s Wiki…so not using it as a valid source. However, it does point out that there is a different term for some countries, including Great Britain. Time to head back to the trusty OED with “lay-by”…
    • Oxford English Dictionary revisited: the word “lay-by,” according to definition 2b, specifically states that the customer pays an initial deposit and then pays the full price over time, while the seller holds the product until it is fully paid off. This is not what BlueHippo is doing — it is letting customers have their computer with less than 25% of the product paid off, not to mention they don’t hold the computer while the layaway payments are being made. They do state that they are financing the balance of the purchase price, but that means the customer would never make 52 “layaway” payments, only 6 to 13.
  • They expect users to use their Social Security number and mother’s maiden name as their username and password on their online account system. In fact, they let you retrieve “forgotten” login information given certain combinations of the following:
    • SSN (!)
    • Home phone number
    • House number
    • ZIP Code
    • Bank account number (!)
    • Password (!)
  • Their computer prices are only slightly higher than the manufacturers’ MSRPs. For instance, take the HP Mini 5101, which is sold in two configurations at $399 and $425. The BlueHippo price is $466.76 — it’s unclear which model is being sold, since they don’t provide specific model numbers — which is a 10% to 15% markup on MSRP. Using the cheaper model, HP would finance the same laptop over 24 months with a $1 buy-out option for $19/mo. or $456 total. Since BlueHippo is offering a shorter term, one would expect the BlueHippo price to be lower.

So now on to the legal fight between the FTC and BlueHippo. The firm had previously been sanctioned for not shipping products when promised and not disclosing that installment payments were non-refundable. To ensure that they were in compliance with the settlement, the court ordered BlueHippo to provide a compliance report and various other documents; the court found them in contempt and forced BlueHippo in April 2009 to cough up $12,500 in sanctions (five days) before it filed the compliance report, and $20,000 in sanctions (four days) in May 2009 before providing responsive information to FTC requests. An information request in May 2009 remains unanswered, despite the Court ordering BlueHippo to produce responsive information.

These FTC requests provide insight into why the commission has been so aggressive in pursuing legal action. In the memo filed on Thursday, the FTC discovered that customers “pay an activation fee (generally $99) and then make weekly payments of approximately $35 or bi-weekly payments of approximately $70 for a year.”  You don’t even need to do fuzzy math to realize that those numbers add up to a very expensive computer. (It’s $1919, given the previous numbers).

Of over 36,000 computer orders that the FTC examined through responsive documents, only one was financed. However, the FTC doesn’t even consider that single computer shipment to be accurate — according to the memo, “The shipment of this computer was most likely in error [...]. The consumer [...] only paid $185.32 towards a computer with a total sale price of $2,515.00 and never entered into a financing agreement.” BlueHippo finally shipped computers once the company was found in contempt, ordering most of the computers during the three-month reporting period over the course of just seven days, or over 3,300 computers. Thrown bone, meet FTC and court.

Then there’s the matter of the firm’s return policy. Consider the following policy:

  • Cash refunds within 7 days, store credit after 7 days. Cancellations permitted until order is shipped. Second part is pretty standard; first part is restrictive (usually see 14-30 days on refunds) but not outrageously so.
  • Store credit cannot be used on shipping, handling, and taxes. Anyone who has used a gift card knows this is not standard. This is not disclosed on the website.
  • Costs not covered by store credit must be paid in advance via money order. Yes, they really don’t care that you’re buying a $14 gaming controller and have $300 in credit — you’re paying the shipping, handling, and taxes out of your own pocket, plus the money order fee, and they won’t ship until they receive your payment. Again, not disclosed on the website.
  • Only one order paid with store credit will be accepted at a time; order must be delivered to customer before a new order can be placed. [There's just nothing to be said for this.] Not disclosed on the website.

Like the computer orders, the majority of customers who have store credit didn’t agree to paid the extra fees to use their store credit, and the majority of those who did order with store credit never had their orders fulfilled.

In addition, the FTC alleges that BlueHippo was not permitted to represent itself as a financing company or extend credit on the basis of preauthorized bank account transfers. The company apparently logged revenue of at least $15.1 million on unfulfilled orders, a truly shocking amount. It looks like BlueHippo has hit the end of the road, especially after thumbing its nose at the court multiple times, but then again, consider how long it took for SCO Linux (ding dong, la de da de da) to finally bite the dust.

Computers have become relatively inexpensive in the past year or two, especially due to the success of the so-called “netbook” market segment. (I don’t consider most of the computers in this group to be netbooks, but clearly the retailers disagree. It’s an argument left for another post.) It’s not uncommon to find a laptop in the netbook category for $300, and desktops can still be found in the sales circulars for $400 and $500. You’d be better off saving ahead of time than playing around with layaway and financing if you just need a cheap computer for the Internet, e-mail, and a few documents here and there. It isn’t worth risking your money with firms like this out there, and there are better ways to fix your credit, if that’s the goal.

Blue glass fountain pen

Live CDs Not an End-All for Online Banking

October 15, 2009 · Technology · Comments Off

Washington Post computer columnist Brian Krebs posted an October 12 article (picked up by Slashdot the following day) urging small and medium-sized businesses to protect their bank accounts by accessing online banking through a Linux live CD instead of a Windows workstation, due to the abundance of sophisticated malware targeting the Windows operating system. He points out that a live CD eliminates the Windows malware issue, plus it wipes the system RAM clean when shut down. Some commenters correctly pointed out that virtually all Linux OSes only mount modern (i.e. NTFS-formatted) Windows hard drives and partitions in read-only mode, so malicious software and hacking attempts can’t “flow” down to the Windows OS.

I applaud Krebs’ push to educate users about information security. But he may also lead those same users to a dangerous (and wrong) conclusion — that Linux live CDs are an end-all solution to online banking.

The major flaw in this is the MITM attack, and the blame can be placed on PEBKAC. Got it?

Home users may only have one computer hooked up to residential DSL/cable/FTTP, in which case a “man-in-the-middle” (MITM) attack isn’t possible with a live CD; there’s nothing that can be placed in the middle, unless you make the case for one of the ISP’s DNS servers getting hijacked or someone in your subnet spewing spoofed DNS or ARP packets (both are unlikely), and even if the Windows system were hijacked, it’s not active with the live CD running. However, business users (who certainly have multiple workstations) and some home users are at risk; if any computer in the subnet (workstation or server-class) has been compromised and is an active MITM, you’re toast.

MITM is simple — listen to the network, intercept every communication, and force all of the traffic to go through a single point where it can be monitored, analyzed, and even modified. A primitive example: ssume a network has two workstations and a cable/DSL router. The workstations go through the router to get to the Internet, and the workstations use the router as their DNS server, which in turn uses the ISP’s DNS server. A user types in bankofamerica.com — the workstation asks for the address of the router (the way out to the Internet) and then asks the router for the address of bankofamerica.com. Ordinarily, the router asks the ISP’s DNS server and returns an answer, e.g. 1.2.3.4. If the second workstation were compromised and conducting an active MITM attack, that workstation would be flooding the internal network with data stating that it is the router, a tactic known as masquerading. When the first workstation asks for the router’s address, the second workstation pre-empts its response and the first then asks the second for the address to bankofamerica.com. Instead of answering 1.2.3.4, it answers 20.30.40.50, the address of a Russian hacker. Not only is the second workstation redirecting bankofamerica.com, it is getting all of the first workstation’s traffic and can even modify it. Notice that there is no discussion of operating systems or live CDs — that’s because MITM bypasses these issues.

All it takes is a single compromised computer inside the network (specifically, the subnet)  for this sense of security to be torn apart. To make matters worse, it isn’t limited by operating system or purpose. This is where PEBKAC — human error — comes in. Computers get compromised because we intentionally do something risky (download …stuff… on Kazaa while connected directly to the cable modem on Windows XP SP1) or unintentionally circumvent good security practices (place a workstation into a router/firewall’s DMZ before verifying that the workstation’s firewall is configured correctly and turned on) and give the bad guys an easy way in.

There are no end-all solutions in information security. There will always be some level of risk that must be accepted, and in general, a higher level of mitigation yields more complications and annoynaces, leading to a higher chance that someone tries to bend the rules. Just remember: if you can access your data, someone (or something) has to be able to equally access it at the other end to do anything useful with it.

Blue glass fountain pen

Sidekick Trips, But Blame It On the Cloud?

October 12, 2009 · Musings, Technology · Comments Off

Quite a few T-Mobile subscribers are steaming after a recent meltdown of the infrastructure supporting the Sidekick mobile phone, culminating in a dire warning: keep your device powered at all times and do not restart them, or lose all of your data. Apparently Microsoft/Danger, the phone’s developer and data service maintainer, screwed up translating the Mayan calendar, because The End as We Know It isn’t for a few more years.

It’s a classic datacenter horror story — a hardware and/or software failure corrupts data, but by the time it’s noticed, it’s too late; recent backups are toast. Or, to make matters worse, the backups are overwritten so often that there isn’t a backup to restore from. Oh wait, your idea of backups was ten racks of matching RAID-10 SANs to match the ten racks where the production data is stored? Silly rabbit, RAID is for redundancy!

The news coverage keeps calling the Sidekick infrastructure “cloud computing,” that “Web 2.0″ term that’s all about “software as a service” and “thin clients.” One of the cool features of cloud computing is the ability to run applications on the server side — instead of a mail client, word processor, or Photoshop installed on your computer, just hop onto any computer with a browser (though you may need a plugin like Flash here or there) and log on to mail.google.com, officelive.com, or photoshop.com. The application, the data, the processing are all handed “in the cloud,” i.e. through some Internet-facing infrastructure that you only know as the domain name. To you, the user, it doesn’t matter whether they have hundreds of homogenous servers and you’re sitting on (for example) mail1420.google.com versus mail3293.google.com, or if they have separate clusters of application and data servers with clearly-defined tasks; you’re asking for the service, nothing more.

Say it with me: Sidekick is not cloud computing. Never has been, never will. You aren’t free to access it from any Internet-enabled device, which goes against the whole concept of cloud computing being more flexible for the user. So stop calling it a failure of cloud computing.

Where does the blame fall, then? Certainly on Microsoft/Danger, but for a shoddy backup system. As cited in an earlier example, the data corruption would have forced the customer to accept a week-old backup — not acceptable, but at least they could offer a backup. It’s not clear what happened, and Microsoft engineers have told T-Mobile there is an “optimistic” chance of recovery for their users’ data according to The New York Times, but if your first response to a data corruption problem is “I think all of our backups are screwed,” then as the meme goes: Backups, ur doin it wrong. And stop blaming it on the cloud; it wasn’t the one who kicked your kitten and flipped bits on the fiber channel switch.

(By the way, T-Mobile is showing the Sidekick as temporarily out of stock. How surprising.)

Blue glass fountain pen

Identity of an IP Address

July 11, 2009 · Technology · Comments Off

In a story first run by Media Post News on July 6 and picked up by Slashdot on July 8, Judge Richard Jones of the U.S. District Court based in Seattle handed down a decision that defined how identifiable an IP address was. His determination: it isn’t identifiable information, as it  “identifies a computer” rather than a person.The case involved a class-action lawsuit filed against Microsoft that claimed it violated end-user agreements by logging IP addresses, which are perceived to be identifying information by several electronic privacy groups; the EU ruled recently that IP addresses are identifying, and a case in New Jersey last year resulted in a ruling that ISPs must protect IP addresses from unauthorized disclosure, much like the rest of its customers’ data.

Quite a few in the tech industry would agree that an IP address on its own is not useful; a quick WHOIS reveals what organization owns the block containing the IP, and it may be possible to geolocate the IP through a traceroute, as quite a few ISPs name their routers with geographic names. If a user on your forum consistently posts under the same IP, you can be fairly certain that “dragonslayer1728″ can be tied to that IP, and if you saw that same IP pop up in the logs of your new Facebook application, you can likely tie that IP, username, and Facebook profile together to “John Doe.”

That’s quite a bit of information to make an IP address identifiable. But the quote from Rotenberg in the Media Post article has the key point: “the significance of the IP address or the reason it was collected.” It really comes down to what information Microsoft collected: did they also keep installation IDs, which patches were installed, the locality of the Windows installation? These things are not personally identifiable on their own (the install ID, if you’re wondering, is only tied to a name if you register with Microsoft) but one could argue that in this example, all of this data is unnecessary and jeopardizes users’ privacy. The one thing that’s clear: Jones’ ruling makes the identity of an IP address a little more cloudy.

Blue glass fountain pen

When Ringtones Perform

July 5, 2009 · Technology · Comments Off

ASCAP is continuing to pursue a lawsuit against AT&T for music-based ringtones; it’s a story that’s made its way across the Web by now, with Ars Technica (http://arstechnica.com/media/news/2009/06/ringing-up-cash-ascap-suing-att-for-ringtone-performance.ars) being one of the larger outlets to pick the story up. It’s an intriguing legal argument: a ringtone that is from a song can be played in public, and should therefore be treated as any other public performance of a song (e.g. playing a radio or a CD in a cafe) which requires a royalty payment to ASCAP, an organization that represents artists and music publishers.

What’s notable about this case is that AT&T already pays royalties for the right to distribute a portion of these songs in digital form, but unlike other wireless carriers, AT&T has refused to pay royalties for performance rights. And as Fred von Lohmann points out on the EFF’s Deeplink Blog, they have had good reason to refuse. Consider the following scenarios:

  • A song plays on a cell phone (as part of a ringtone) while in a store
  • A song plays on a car radio, with the car stopped at a light and with its windows down
  • A song plays through a laptop’s speakers, its owner searching for earphones in his/her laptop bag
  • A song plays through an MP3 dock in a house, with the windows open so that a passerby can hear the song

The “public performance” of each song is incidental and not intended to be infringing. In each scenario, there is no assumption of a public performance:

  • A cell phone user may put their phone on silent/vibrate whenever they are in “public”
  • A driver might turn their radio off while they have the windows down
  • A laptop user might keep their sound muted until they connect their earphones
  • A person might not open their windows while playing music inside

The most recent legal brief filed by ASCAP claims that ringtones are real-time transmissions which are fully controlled by the wireless carrier, and that the mere capability of a ringtone to be transmitted to the public constitutes a public performance.  And, to make matters worse, the carrier is “jointly and severally liable with its customers.” It’s a slippery legal argument, and from assorted legal commentary, not going to make it past any judge.

Let’s hope we don’t all find ourselves on the receiving end of a lawsuit because someone didn’t pay performance royalties on our ringtones.

Blue glass fountain pen

SANS ISC Reports Apache 1.x/2.x DoS Tool

June 18, 2009 · Technology · Comments Off

You can find the technical details at http://isc.sans.org/diary.html?storyid=6601 as reported by handler Bojan Zdrnja today on the ISC diary.

It’s a surprisingly simple attack (the handler points out that even an attacker on a slow connection could easily DoS an Apache server on a fast connection) but considering that it affects the older 1.x branch of Apache, one wonders how it could have taken this long to give rise to a tool and subsequent report. Then again, one wonders why IIS 6 and 7 aren’t affected — did Microsoft ignore the specifications for HTTP requests, or, like the report claims, does IIS act more like a reverse proxy with the web server behind it, preventing the DoS from occuring?

Blue glass fountain pen

No Matching For You: NYSE’s Matching Engine One Sputters

June 12, 2009 · Markets, Technology · Comments Off

The New York Stock Exchange (NYSE) found itself a little quieter close to noon today when its order-matching system decided to head to the Hamptons a few hours early. The string of notifications from NYSE (which will move to the archive; click the plus sign next to “Archive of System Status Notifications”) show that the first signs of trouble showed up about a quarter to 11am, and by 11:40am trading in the 242 affected stocks had been halted on NYSE while their tech staff did a server switch. Trading resumed about a half-hour later, according to reports from Bloomberg.

I was actually at my desk today watching the markets and my open positions when the news came across CNBC. Now, the cool thing about NYSE is that it’s a hybrid market; while the main floor of the exchange is quiet compared to just a few years ago, it is still notable for its combination of human and electronic trading. Trades can go through the NYSE system, where humans (specialists) handle the trades, or through NYSE Arca, formerly Archipelago, an electronic trading platform purchased by NYSE several years ago. In today’s outage, the computer systems that support the regular NYSE system glitched. And since there are multiple over-the-counter platforms like NYSE Arca, trading continued as normal in the electronic world. If one part of NYSE goes down, there’s an alternate platform to temporarily take its place.

What makes this interesting? First, the speed of the server switchover. According to Steve Grasso, one of the NYSE floor traders who regularly contributes to CNBC, most of the delay was caused by specialists having to redo what’s called “price discovery” — the process of collecting bids and offers on a stock to find the equilibrium price, hence “discovering the price” — which usually only happens at the market open. (This is why if you’ve ever followed stock prices at 9:30am, it can take some time to get a quote on NYSE listings.) Obviously NYSE’s tech staff know how to throw the switch quickly, if you will, but it’s pretty impressive that outages of this magnitude happen so infrequently on an infrastructure designed to handle anywhere from 8 to 10-billion shares of volume in a day.

Second is the paradox of the hybrid system. Grasso praised NYSE’s acquisition of Archipelago as a way to avoid a total halt of floor trading. He pointed out the opposite, too; if NYSE Arca went down, the “old” human system meant that trading on NYSE could continue. Sure, it might mean the specialists can’t push through as many shares, but as Grasso pointed out, computers suck when it comes to price discovery; the spreads on NYSE tend to be better than on electronic markets like NASDAQ. I don’t have a source handy but I remember some articles and analysis a few years back supporting those claims. Yet this hybrid system of man and machine is, under the hood, really machine and machine. It’s possible for specialists and traders at NYSE to work without computers; again, a few years ago, I remember them resorting to whiteboards and pen and paper for some reason. (Some of the stocks didn’t get a 4pm print until 4:20pm, and people were still doing settlement paperwork past 5pm.)

So, if a technology failure in something like SuperDOT or Matching Engine results in a trading halt, can you really call the floor system a human alternative to electronic trading?

Blue glass fountain pen

Mini “Great Firewall” For Every Chinese PC

June 8, 2009 · International Relations, Technology · Comments Off

The Wall Street Journal obtained a copy of a notice from China’s Ministry of Industry and Information Technology that indicates the government’s desire to bundle a software agent (Loretta Chao, “China Squeezes PC Makers,” 8 June 2009, page A1) with every personal computer sold in China which will block access to objectionable websites. According to the report, the software, called “Green Dam-Youth Escort,” is developed by Jinhui Computer System Engineering Co., which has partnerships and agreements with the Chinese government, and company and government officials say that the program poses no additional risks to users and hasn’t caused problems on test systems. The New York Times adds that the vendor’s website claims 3.2 million downloads of the software and that Chinese PC manufacturers have agreed to install the agent on PCs they sell domestically. That website, which offfers the software for download, also has a bulletin board that, according to the Times, had reviews from users claiming that the software did not block some pornographic material or slowed down their PCs. Many of those messages were deleted hours later.

Ignoring the political and free-speech debates surrounding this reported move (the notice has not been publicly circulated or announced by the Chinese government), there are a few inherent flaws with this attempt to block “objectionable” content. As any student of information security knows, you can never guarantee absolute security, only find a balance between security risks and availability. Applying Occam’s Razor makes the question “How do you bypass such a requirement?” a rudimentary exercise:

  • Purchase a non-Windows machine (the software agent is only designed for the Windows operating system)
  • Build your own PC (how could hard drive manufacturers load the agent without Windows being pre-installed?)
  • Format the hard drive and install a retail copy of Windows (unless the government forces Microsoft to integrate the software agent with all copies of Windows)
  • Swap the hard drive and install a retail copy of Windows (same stipulations as above)
  • Format the hard drive and install a modified copy of Mac OS X or another OS (e.g. Linux)
  • Delete or uninstall the software agent (a company official, Zhang Chenming, told the Times that the agent could be deleted or temporarily turned off, adding that “a person can still use this computer to go to porn”)
  • Toss the CD with the software agent (the Times and WSJ mention the agent possibly being included on CD rather than preinstalled)

I don’t doubt that there are some smart people working inside the Ministry for Industry and Information Technology. The implementation of this notice is not about fixing a technological loophole in the full-size “Great Firewall,” which can be bypassed with a bit of research. When the vendor admits the software is easily deleted or turned off, and when there are so many simple workarounds, any claim that the software will satisfy those crying “think of the children” and shield those inside China from pornography is dubious.

What is frightening from an information security perspective is the risk that such a software agent poses. We know that malware frequently filters victims’ Internet access, preventing them from accessing the websites of anti-virus and anti-spyware vendors. If the software is closed-source — and I have seen no mention of the code being open-source — then there is no definitive way to audit every bit of functionality. If the software has an update mechanism, it has the potential to be hijacked — imagine someone poisoning a major Chinese DNS server so that a malicious person could serve a tampered update. If vulnerabilities exist in the software, which is designed to work in a network environment, imagine the possibilities of remote attacks — for instance, a buffer overflow leading to a DoS or, even worse, remote access and/or privilege escalation.

It would be interesting to see an industry expert’s analysis of the software program. To the vendor’s credit, it is impossible to test a Windows program on every possible combination of hardware (compared to software for Mac OS X, where the available hardware configurations are much more limited) and it is very possible that the negative comments on the bulletin board were from politically-motivated users. However, for this kind of a program, it isn’t hard to imagine how it could result in system instability.

Again, while there are very obvious political and free-speech issues involved, I am trying to approach this from a technology perspective.

Blue glass fountain pen