Security – Page 8 – Digital-Lifestyles

UK Gov Wants Your Views On Content Protection And More

Ladies and Gentlemen, start your word processors …

The House of Commons’ Culture, Media and Sport Committee today announced a new inquiry into the challenges and opportunities for the creative industries arising from the development of new media platforms.

For the purposes of the inquiry, the term “creative industries” includes music, visual broadcasts, sound broadcasts, film, graphic art, design, advertising, fashion and games software.

The Committee is particularly interested in receiving evidence on the following issues:

The impact upon creative industries of recent and future developments in digital convergence and media technology
The effects upon the various creative industries of unauthorised reproduction and dissemination of creative content, particularly using new technology; and what steps can or should be taken – using new technology, statutory protection or other means – to protect creators
The extent to which a regulatory environment should be applied to creative content accessed using non-traditional media platforms
Where the balance should lie between the rights of creators and the expectations of consumers in the context of the BBC’s Creative Archive and other developments

Written submissions are invited from any interested organisation or individual by Thursday 19 January 2006.

UK Gov Wants Your Views On Content Protection And More Submissions should give the name and postal address of the person sending the memorandum and should state whether it has been prepared specifically for the Committee. If the memorandum is from an organisation rather than an individual, it should briefly explain the nature and membership of the organisation. The Committee may publish some of the submissions it receives.

For more guidance on the preferred format, see http://www.parliament.uk/commons/selcom/witguide.htm

Submissions should be sent to the Clerk of the Committee at the address below.

Kenneth Fox
Clerk of the Culture, Media and Sport Committee
House of Commons
7 Millbank
London SW1P 3JA
[email protected]

Luke Gibbs writes for Ofcomwatch.

Big Problems For Sony Continue, Now EULA

Big Problems For Sony Continue, Now EULA This weekend, there’s been lots of furious chat on blogs and Slashdot about the EULA that comes with SonyBMG’s audio CDs.

An EULA? What’s that? I hear you cry. An End User Licensing Agreement (EULA) is something that has been shipping with software packages for a very long time – the cold-hearted view of them is they impose restrictions on the purchaser while absolving its producers from any liability.

To have an agreement shipping with an _audio CD_ in itself is pretty strange. The EULA may well be related to the software that is shipped on the protected CDs, not the music – but this is now unimportant as the generally held view is that it is for the music.

It certainly has got the goal of a few – but it’s the terms of this 3,000 word EULA that has most up in arms. Some of the highlights/lowlights of it are

If you move out of the country, you have to delete all your music. The EULA specifically forbids “export” outside the country where you reside.
If you file for bankruptcy, you have to delete all the music on your computer. Seriously.
You can’t keep your music on any computers at work. The EULA only gives you the right to put copies on a “personal home computer system owned by you.”

The full list is detailed on the EFF site.

All of this builds up on the now huge story of SonyBMG’s choice of software on some of their US released audio CDs. Called XCP, originally designed to ‘assert’ SonyBMG’s rights over their music CD’s, it installs itself on any computer where the audio CD is played. The user of the disk isn’t asked if this is OK, or even told that the software is installing itself. The software then hides itself using something called “rootkit.”

The really big problem for SonyBMG is that virus writers are now using this rootkit exploit to deliverer their viruses.

Big Problems For Sony Continue, Now EULA Many have reacted to RootKit by saying that they feel it is ‘safer’ for them to download their music from unlicensed file sharing services, as they aren’t exposing themselves to unauthorised pieces of software installing on their machines.

SonyBMG have said they will stop selling music CD’s using XCP, but the damage to the Sony name has been done.

It’s all going wrong
A while back Sony, the parent company, had a revelation – that they needed to look outside their Sony Silo and start of embrace open formats. We saw MP3 being supported on their music players, where they’d always insisted on using their propriety content protections scheme ATRAC3. I even saw DivX supported on their DVD players, where DivX had previous been thought of as the content pirates tool.

Sony had (I stress had) started to claw back against Apple and the other companies that they’d been losing out to. As of now, it looks like they’ve slipped even further behind. For goodness sakes, they’ve even got groups of people suggesting Boycott Sony and 3488 have, so far, signed an anti-Sony petition.

Sadly for Sony, it doesn’t end there
In digging through SonyBMG’s code, Finn Matti Nikki has located references to LAME, an open source, MP3 encoder library, within the code used by SonyBMG’s version of the XCP software.

As Matti says, “I’d say this indicates that the executable has been compiled against static LAME library, which happens to be LGPL. I don’t have any further evidence about this, other than lots of data from libmp3lame being included and easy to find.” Let us translate – the LGPL (Lesser General Public License) provides certain freedoms and restrictions in the use of the software covered by it.

These include needing to make the source code to the open-source libraries available and the source code and executable code of their programs.

Without abiding by these rules, they are breaking the licensing terms of the content. Carrying out the exact act they the music companies are loudly decrying in their customer.

Where now for Sony?
Big Problems For Sony Continue, Now EULA SonyBMG have managed to completely undo the small, patient steps that Sony, the hardware business, has been taking to gathering favour with the equipment buying public.

The idea of Sony owning content and hardware businesses always appears to be a great idea – they’d win all around. The reality is turning out to be very different.

There is a tension between the content business, who want to restrict movement of content, and the hardware business that wants to set the purchaser free. Whether a comfortable balance between these can ever be struck is unclear.

What is clear is that it appears that this CD story is nearly out of control for Sony. Someone at the most senior level at Sony needs to grab hold of this and do something radical. Our suggestion for a surefire, credibiliy-straightening maneuver? Reject DRM.

LGLP
SonyBMG on XCP
Wikipedia on LAME
LAME
Slashdot – Sony’s EULA Worse Than Its Rootkit?

Vodafone Licenses Intertrust DRM

Vodafone Licenses Intertrust's DRM Intertrust must have though that all of the xmases came at once on the day Vodafone confirmed their licensing deal. It’s not every day that the World’s largest mobile operator signs a deal like that with you.

The Open Mobile Alliance (OMA) specified DRM (Digital Rights Management)contains what they refer to as, the essential patents – the minimum required to run the very basics of the content/rights protection.

Vodafone Licenses Intertrust's DRM The Vodafone deal goes well beyond these basics and licenses all of the technologies and patent that Intertrust have available.

When we asked which of the Intertrust pieces of technology they were planning to use, Vodafone became unusually very shy, explaining that they didn’t have definitive plans as to which parts would and wouldn’t be used.

Vodafone Licenses Intertrust's DRM Both Vodafone and Intertrust declined to reveal the value of the transaction, but given the need for separate deals with the handset companies, it may be here that Intertrust make most of their money. This will not be optional if the handset manufacturers want to be on the Vodafone service and offer content.

The length of the deal has been loosely described as ‘Long-term licensing’, but Vodafone didn’t reveal how long this was by the time we went to press.

Intertrust
Vodafone

Grokster U-turns And Closes Service

Grokster U-turns And Closes Service Grokster, the online music sharing service, much legally embattled, has decided to shut the service and pay $50 million to settle claims against it.

Visitors to their site will now see the following message

The United States Supreme Court unanimously confirmed that using this service to trade copyrighted material is illegal.
Copying copyrighted motion picture and music files using unauthorized peer-to-peer services is illegal and is prosecuted by copyright owners.
There are legal services for downloading music and movies.
This service is not one of them.

Quite a turn around from their previous stance and not exactly expected.

AP is reporting that the settlement

permanently bans Grokster from participating, directly or indirectly, in the theft of copyrighted files and requires the company to stop giving away its software.

You would think that this would pretty much be the end of them, but no.

Grokster U-turns And Closes Service There is a plan to launch a service that they say will be a “safe and legal service” under the name Grokster 3G.

As you would expect with such a massive turn around, the record industry is pretty happy. Mitch Bainwol, Chairman and CEO of the Recording Industry Association of America (RIAA) explained their position, “As the Court articulated in no uncertain terms, there is a right way and a wrong way to conduct a business. This settlement makes clear that businesses are well aware when they are operating on the wrong side of that line.”

The fallout from this sudden turn-around by Grokster is far from clear. They were originally one of the strongest proponents of the right to run a P2P service without restricting the content that is exchanged on it.

Certainly, it will put significantly more pressure on StreamCast Networks Inc., which distributes Morpheus, and Sharman Networks Ltd., which distributes Kazaa, who were co-defendants of the original court case.

What is not certain is if Grokster will be able to pull any of their current users over to their new Grokster 3G service – effectively ‘doing a Napster’. We suspect that it’s highly likely that many of the current Grokster’s will feel betrayed by their change around.

Grokster

BitTorrent File Sharer Arrested

BitTorrent File Sharer Arrested A Hong Kong doleboy has been slapped down by The Man after he was found guilty of distributing three Hollywood films using BitTorrent’s peer-to-peer file sharing technology.

A report in the Taiwanese English-language newspaper The China Post named unemployed Chan Nai-Ming in what is believed to be the first case of its kind.

The 38 year old used BitTorrent to distribute “Miss Congeniality”, “Daredevil” and “Red Planet” and heard the knock on the door from customs officers in January 2005.

Nai-Ming pleaded not guilty to copyright infringement but was convicted after a four day trial. He will be sentenced on 7 November, 2005, although some Websites are reporting that he’s already been fined $641 (~£360, ~E529).

The Hong Kong government is claiming the action as its first successful action against peer-to-peer file sharing, with Hong Kong Commerce Secretary John Tsang confident that it would deter other potential file-sharers.

Since the arrest, the Hong Kong customs department said that illegal file-sharing had plummeted by 80%.

BitTorrent File Sharer Arrested The OpenSource BitTorrent software has become one of the most popular means of downloading large files, with the technology allowing users to download fragments of a large file from multiple users, rather than in one hefty lump.

Initially, the program needed centralised tracker files to manage this process, but BitTorrent’s creator, Bram Cohen announced that they were no longer needed in the last year.

As it’s grown in popularity, BitTorrent has garnered the unwelcome attentions of spyware and adware pushers along with the corporate might of recording companies and movie studios.

Thousands of peer-to-peer downloaders using software like Napster and SoulSeek have already been sued for copyright infringement over the past few years, with the US Supreme Court ruling last year that peer-to-peer makers could be sued if they encourage users to copy material.

We expect the corporate-profits-defending big boot of The Man to be seeing a lot of door-kicking action in the upcoming months.

BitTorrent
MPAA to pursue film file-sharers

FUD Encouraged By Macrovision Report

Destiny Media Technologies Updates Promo Only MPE Macrovision, a company who sell content protection (DRM) system, have today released a report they commissioned into content copying.

The findings? That ‘Casual Piracy’ is “a Growing Challenge in the Entertainment Industry” and that “mass market penetration of digital recording devices and broadband/file-sharing networks are prompting many entertainment brands to enrich their content protection strategies and influence bottom line performance.”

Let us translate. Digital Rights Management (DRM) is coming and the public had better start getting used to it.

FUD Encouraged By Macrovision Report This is on the basis of what to us appears, from a quick once over of this report, a pretty unscientific approach, as the following paragraph from page 10 illustrates.

“In order to estimate exactly what effective content protection represents, respondents were also asked to estimate how many units/titles were copied (burnt) for each 100 sold and how many were illegally downloaded for every 100 sold.”

How can someone write “estimate exactly” without seeing the paradox? They just have well asked them “How paranoid are you about content copying?”

Their conclusion directly under this nonsense? “None of the figures make for comfortable reading.” WHAT?!?!? Just because these figures are presented in a table in a report with graphs next to them, doesn’t elevate them from what they are – guesses. At this point we stopped reading this report – we had some drying paint that needed watching.

FUD Encouraged By Macrovision Report I hope that each time a ‘report’ or so called research like this is published, that it is gone through with a fine tooth comb pointing out its weaknesses. This kind of nonsense needs to be countered.

FUD rules
I have, for years, been questioning the content industry – How are you going to sell DRM to the public when what you’ll be selling them some less good/useful than they had before? The answer has always been a resounding silence.

When I asked a very senior person at Fox (his name escapes me) why DRM would be required when the vast majority of their customers are fair, reasonable and trustworthy, his response stunned me – “We take the opposite view, we treat everyone as dishonest.”

To me, that summed up both the arrogance and distain of the company, and possibly that of the current ‘entertainment’ industry. Any company that has such a low opinion of their customers, will eventually come to a sticky end – and it’s quite right that they do.

Through the sheer panic of suddenly waking up to the changes that technology has been bringing to media for decades (hell, I had digitised audio tracks on my Mac Plus, soon after it was released in 1984), the ‘entertainment;’ business has been listening to technology companies, who by strange co-incidence have something to sell – content protection systems.

That combined with the universal truth that fear is contagious, leads to a point where we are now. The current media companies being near terrified that _all_ of the customers are waiting to steal from them, so they must be restricted – and DRM-selling companies are more than happy to help them in their fear.

Their perceived need to restrict their customers is costing them _huge_ amounts of money and it will continue to … and to what gain?

They stop their customers from using their purchases how they feel fit – well, at least until the latest hack removes the protection – and in the process, further alienate their customers, building resentment.

Why don’t they spend all of this effort, time and money creating new content – engaging their audience further?

I wonder if the ‘entertainment’ companies have spared a thought as to what would happen if their businesses did fail? Do they not see that generally the technology companies are going to win anyway even without them?

PDF of complete report.
BTW, don’t try copying text out of the report, it’s protected unsurprisingly.

SanDisk ‘Gruvi’ TrustedFlash: Content On Memory Carts

SanDisk 'Gruvi' TrustedFlash: Content On Memory Carts SanDisk have unveiled their “fingernail-sized” new TrustedFlash cards, a technology that embeds Digital Rights Management (DRM) and decryption technology into memory cards, and also includes a subscription manager enabling the cards to be used for digital subscription music services.

Speaking at the CTIA Wireless show, SanDisk Chief Executive Eli Harar said, “We think this will be a disruptive technology, but will enable a whole new world of opportunities in the mobile market.”

“Today content is locked to play back on one device. Now we have the freedom to enjoy content on whatever device consumers want to use,” he added.

Harar stated that the TrustedFlash card would act like current SD cards, with the technology able to be extend into on-demand content such as feature films and online games.

Despite their speck-like proportions – a mere 18 mm long and 2g in weight – the cards can offer enough storage space to hold thousands of DRM-protected MP3, films, photographs or games.

The “Gruvi” (what?!) cards use the micro SD card interface so they can be slotted into mobile phones, GPS devices, MP3 players and computers.

Users of the card could, for example, buy a video online, view it on their home PC, save it to the TrustedFlash card and then slap the card into their PDA/smartphone for watching on the move later.

SanDisk are also hoping that content providers like music companies, film suppliers and mapping data companies will ship preloaded Gruvi cards with the content protected against copying by TrustedFlash.

The first batch of cards using TrustedFlash will be preloaded with the Rolling Stones’ new CD “A Bigger Bang,” due for a November release with the 265MB card costing $39.95 (£22, €33) – What?!? How Much?!?

The Stones’ release will also hold four additional albums that can be unlocked for an extra fee.

SanDisk hopes that the new cards – expected in the UK by Christmas – will eventually reduce the costs of buying music.

Pedro Vargas, SanDisk’s director of mobile entertainment, said that the price was justified by the extra capacity and flexibility on offer, and that he expected prices to drop over time.

In the future, the cards could be used to play content from subscription music services such as Yahoo Music and Napster.

Subscribers could download the DRM-protected songs onto the chip and play them back on any suitably equipped MP3 player, with the DRM continually checking the subscription status (so if the subscriber hasn’t kept up with their payments – whoosh! – no more music!)

SanDisk are producing the new cards in capacities ranging from 256MB to 4GB and expect them to debut in October followed by a complete rollout to be completed by March 2006.

SanDisk

Sony BMG Rolls Out Copy-Restricted CDs

Sony BMG Rolls Out Copy-Restricted CDs Sony BMG Music Entertainment has announced that it intends to add copy-restricting software to its latest CDs.

The software is designed to limit consumers to making no more than three copies of a CD, and marks Sony’s determination to bolt on restrictions to a twenty year-old music format that currently makes copying and digital distribution a breeze.

This year has already seen more than two dozen copy-restricted titles released – including albums from the Backstreet Boys, the Foo Fighters and George Jones – and Sony has flagged its intention to beef up their anti-copying campaign.

Rival US companies haven’t been too impressed with the restrictive software thus far, saying that the software was too easily defeated and that working versions did not allow consumers to transfer music to portable devices and music players as freely as the industry would like.

Instead, they’ve been badgering Apple Computer to amend its software and “make its technologies compatible with copy-prevention tools”.

A major sticking point is that the restrictive software used by Sony BMG is currently incompatible with Apple’s popular iPod.

Sony BMG Rolls Out Copy-Restricted CDs This doesn’t affect Apple computer users – they can freely copy and transfer music from the restricted CDs to their iPods – but consumers using Microsoft’s Windows software won’t hear a note, although they will be able to transfer music to Windows Media-supporting devices.

Thomas Hesse, president for global digital business at Sony BMG, said Apple could “flick a switch” to amend its programming to work with the restrictive software.

“It’s just a proprietary decision by Apple to decide whether to play along or not,” Hesse said. “I don’t know what more waiting we have to do. We think we need to move this forward. Time is ticking, infringement of intellectual property is happening all over, and we’ve got to put a stop to it I think.”

Analysts suspect that Sony is playing to the gallery a tad here, seeing as a Web site set up by the company will happily despatch emails to users explaining how they can unlock the CD’s software and make music files available for unlimited copying and transferring.

Mike McGuire, an analyst at Gartner G2, summed up the move by Sony BMG by describing it as a “very interesting public negotiation”.

New software may sink music pirates (via NY Times)

Ericsson And Napster Team Up For Mobile Music Service

Ericsson And Napster Team Up For Mobile Music Service After a long cuddle on the sofa, Napster and Ericsson have announced a global partnership to offer a fully integrated new digital music service aimed at mobile phone customers around the world.

The service – yet to be given a snappy name – will combine elements of Napster’s popular PC offering and Ericsson’s personalised music service and serve up iTunes-like song downloads with a monthly subscription plan.

Scheduled to go live in Europe over the next 12 months, the service “accommodates mobile operator participation in all revenue streams” and will initially be offered to operators in selected markets in Europe, Asia, Latin America and North America.

“Ericsson’s world-leading wireless and telecommunications solutions experience, along with their exceptional client base, make them the ideal partner to deepen Napster’s presence in the global mobile arena”, entoned Chris Gorog, Napster’s chairman and CEO.

“Ericsson and Napster are uniquely suited to offer mobile operators a simple, cohesive and personalised digital music experience for their consumers”, he added.

The new joint service will let users coordinate wireless and PC downloading of digital music (in both subscription and a la carte models) with songs downloaded via the phone playable on the user’s home PC.

The service works on most suitably equipped handset models and networks, with next-generation phones being able to support the digital rights management stuff.

The service is designed to deliver a “complete digital music solution under one brand”, with users benefiting from a consistent user interface and integrated billing from their mobile operator.

Ericsson And Napster Team Up For Mobile Music Service The two companies hope that their service will allow mobile operators to get their grubby mitts on the “growth opportunities for personalised digital entertainment on the mobile phone and PC” and will, no doubt, include the usual slew of lucrative, downloadable offerings like ringtones, master tones, images, wallpaper and video content.

With doe-like eyes, Ericsson CEO Carl-Henric Svanberg praised Napster as “the strongest digital music brand in the world”, adding: “With Napster we are uniquely positioned to deliver the easy to use, complete suite of music offerings our customers are asking for.”

It’s anticipated that the announcement could stir things up in the accelerating mobile music sector, driven ever-onwards and upwards by the growth of high-speed networks in Europe and Asia.

ERicsson And Napster Team Up For Mobile Music Service More and more mobile operators are already cutting themselves a slice of the mobile digital music services pie, with the largest Korean mobile phone operator recently purchasing a controlling stake in the country’s biggest record label.

Napster’s no stranger to the world of mobile music either, offering limited access to its service through selected US phone networks and operating a ringtone download store.

If the joint venture manages to persuade mobile phone operators that customers are going to lurve the integration between handsets and online services, the two companies could be on to a winner.

Sony Ericsson
Napster

GNER Publishes Passwords In Customer Magazine

GNER Publishes Passwords In Customer Magazine Hot on the heels of yesterday’s story about the ‘world’s greatest military hacker’ comes this tale of advanced doltery from train operator Great North Eastern Railway (GNER), who managed to publish their system passwords in a magazine available to thousands of passengers.

The April/May edition of their freebie passenger magazine, Livewire, positively invited hackers to come and do their devilish work, with an article on their operator’s control centre in York being illustrated with photographs showing mainframe and computer passwords written on a whiteboard.

Red faced and flapping like Fred McFlapster wearing flares in a gale force wind, William Higgins, editor of Livewire, surprised us all by declaring that including the picture was a mistake, insisting that the highly competent GNER technology team had already rectified any problems.

Martin Grey, technical services manager in GNER’s information systems department, claimed that passwords were changed before the magazine was published, ‘We quickly changed the passwords and user accounts so no one outside could get into our corporate data.’

‘The procedure in terms of our internal security was not being followed and we took quick steps to remedy that,’ he added.

A GNER spokesman later confirmed passwords were no longer being written bold and large on whiteboards and – presumably – their photographers will no longer be invited to go around snapping confidential information for free magazines.

GNER Publishes Passwords In Customer Magazine GNER, owned by the Sea Containers Group, provide high-speed intercity train services along Britain’s East Coast main line, linking England and Scotland along a route of almost 1,000 miles.

Of their annual 15 million passengers every year, eight million are calculated to be business travellers, with the free magazine enjoying a circulation of more than 100,000.

A deeply unimpressed Phil Robinson, chief technology officer at security specialist Information Risk Management, commented that it was unusual to see passwords emblazoned on whiteboards, although it’s commonplace to see office monitors flapping with Post-it notes containing security information.

‘Mainframes are a sensitive part of any organisation and contain the crown jewels of data a business might want to protect,’ he warned.

Robinson suggested that companies need to work out a coherent security password policy and insist that employees use secure – but memorable – passwords, with a lock-out policy stopping repeated wrong password entries.

Microsoft’s ‘At Work’ site offers a series of tips for creating passwords, advising against using combinations of consecutive numbers or letters or adjacent letters on a keyboard such as “qwerty.”

The site also recommends avoiding any word that can be found in the dictionary, in any language, or replacing letters with numbers or symbols that look like the letters such as M1cr0$0ft or P@ssw0rd as hackers are wise to these tricks.

Instead, Microsoft advises coming up with a passphrase – a sentence you can remember, like “My son Aiden is three years older than my daughter Anna” – and then using the first letter of each word of the sentence to create ‘msaityotmda.’

It then advises mixing and matching a combination of upper and lowercase letters, numbers, and special characters that look like letters to come up with a hacker-challenging password like M$8ni3y0tmd@.

(Your writer now hastily goes off to change his own passwords…)

GNER
Creating stronger passwords