David Cassel

AOL Instant Messenger is hacked

Three 17-year-olds take credit for inserting pornographic images into America Online's widely used chat service.

  • more
    • All Share Services

Users of the latest version of AOL’s Instant Messenger (AIM) software started encountering an unpleasant surprise on Saturday morning: At least three crackers — malicious hackers — began inserting pornographic images into “AIM Today” and vandalizing content on at least four screens of the chat software.

Since last August, users who launched the latest versions of AIM also launched an informational “AIM Today” window — but as late as 4 pm PST Saturday, if users clicked on the “entertainment” link on AIM Today, followed by a click on any of the following three links advertising the chance to “Meet New People” who wanted to discuss the categories of “Celebrities,” “Soap Operas” or “Comedy,” they would pull up pages displaying pornography, as well as sound files apparently containing messages from the two crackers (“Yeah, fuck you, Sirk owns this shit” — “This is Neon, fuck you Sirk”).

No matter which of the top three “Meet New People” categories are chosen, the content appears to have gone haywire. At the Celebrities link, a series of four pornographic images cycles in an animated GIF. On the Soap Operas link, a Prodigy song plays in the background as a MIDI file. On the Comedy link, below a fifth pornographic image, are pointers to the Aryan group National Alliance.

The chatter and X-rated images appeared next to ads for TV shows broadcast on the AOL-owned Warner Brothers network, including “Charmed” and “Felicity.” AOL officials did not return phone calls over the weekend, but the incident occurred at the same time as the AIM home page was boasting: “Potential AIM Security Issue Resolved.”

An online chat interview with one of the crackers, who identified himself as Sirk, gave some clues as to the methodology. When new members join the AIM service, they can apparently include HTML code in their screen names. That code can include tags that call off-site images and sound files or display text — material that appears where the screen name should appear listed under “Meet New People.”

Sirk — whose name appears throughout the cracked pages — identified himself as one of three 17-year-olds from Connecticut who had been studying AIM for security holes. “I’m surprised somebody hadn’t thought of doing it sooner,” he messaged, “knowing that the AIM Today ‘meet new people’ section is all done through [HTML] links.” He says he hopes to write computer programs that will automatically generate the code to insert images and text into AIM Today — or even re-route AIM Today visitors to a Web page fishing for their password and screen name.

This is not the first time AIM has experienced security holes. Two years ago users discovered that their AIM accounts could be hijacked if the corresponding AOL screen name was not already taken. Sirk taunted AOL for their apparent security holes and their restrictive Terms of Services, but his motives appeared simple: “I’m doing it because I can, and I will.” But he did offer a bombastic message for AOL.

“I’m only hoping that they are upset, and realize that they can’t just program everything like 7th graders.”

He also had a message for AIM users worried about security: “Before using AIM, they should do a little research and find out that this is all part of the territory,” said Sirk. “If you are using a program that’s got as many loopholes and gaps as Swiss cheese, then prepare for the consequences.”

So long, Douglas Adams, and thanks for all the fun

The author of "The Hitchhiker's Guide to the Galaxy" was a geek's geek. The Net will miss him.

  • more
    • All Share Services

So long, Douglas Adams, and thanks for all the fun

As soon as the news began to spread that author Douglas Adams had died Friday from a sudden heart attack at age 49, tributes to the science fiction humorist began to blossom all across the Internet. There has always been a strong correlation between computer geekdom and science fiction, so it’s not that big of a surprise that the author of “The Hitchhiker’s Guide to the Galaxy” would be remembered fondly online. But Adams was more than just a science fiction satirist — he was also passionate about technology in the here and now, a geek’s geek who was paying close attention to current developments even as he focused his fiction as far ahead as the end of the universe.

On April 10, I had the chance to attend one of Adams’ last appearances, when he gave the keynote address for an embedded systems conference at San Francisco’s Moscone Center. He was clearly chosen because he knew how to appeal to geek sympathies, and he didn’t disappoint. Addressing a packed audience of more than 1,000 while standing in front of a black curtain speckled with twinkling white lights and models of Earth and Saturn, he delivered a speech filled with visions for the future, as well as eloquent defenses of both micropayments and peer-to-peer networking.

Adams drew applause from the audience when he said record companies were fighting the Napster file-trading program to protect a business model being rendered obsolete by technological advances. Napster users were building a peer-to-peer distribution network, downloading and uploading music files among themselves, but for all we know, Adams pointed out, they might have been willing to pay, given a chance. “Until we have digital micropayments,” said Adams, “I’m not sure we have the right to call these people thieves.”

Micropayment technology would enable vendors of intellectual property to charge fractions of a cent for individual uses. “Piracy would be pointless at those prices,” said Adams. He also confessed a grudging calculation he had performed when fans told him they’d read his book 10 times. “Yeah, but you only paid for it once.”

Adams’ focus on the unrealized promise of micropayments was a subtheme in a much larger message: the tendency of civilizations to be baffled by new technologies.

“Anything that’s invented after you’re 35 is against the natural order of things,” said Adams. The very young, in contrast, aren’t even aware of a natural order that’s supposedly being violated. “Anything that’s in the world when you’re born is considered ordinary and normal.” He illustrated his point with a story from his own family. When Adams eavesdropped on his 6-year-old daughter pushing her doll’s baby carriage, she was mimicking the satellite navigation system in her father’s car.

Future technological developments would no doubt be more baffling than ever before, he said. Adams dazzled the audience with a vision of a world where information devices are ultimately “as plentiful as chairs.”

“We are participating in a 3.5 billion-year program to turn dumb matter into smart matter,” said Adams. When the devices of the world were networked together, they could create a “soft earth” — a shared software model of the world assembled from all the bits of data. Communicating in real time, the soft earth would be alive and developing — and with the right instruments, humankind could just as easily tap into a soft solar system. Think of it: a peer-to-peer networked universe!

After the keynote, Adams worked his way through the auditorium for a book signing and drew a small cluster of fans. He cheerfully answered questions, and when I reached him he agreed to answer questions I e-mailed him about mobile technologies. True to his word, he shared his thoughts on hand-held systems, saying they hadn’t lived up to his expectations. The last PDA he’d really liked was the Newton.

But I noticed how his theme subtly changed through the presentation, from the curmudgeonly “Technology is our word for stuff that doesn’t work yet” to a more visionary pronouncement: “Technology is our word for stuff we don’t understand.” Adams pointed out that originally the telephone was envisioned as a device for alerting someone that you’d sent him a telegram. The role of the personal computer was also muddled as it progressed in its early days from adding machine to typewriter.

Ultimately Adams’ central message was that the only viable approach to surviving in the technological age is an open mind and some common sense — and he illustrated the message with a complicated anecdote from April 1976. He’d placed a package of cookies and a newspaper on the table in a Cambridge railroad station, across from another traveler. The mysterious stranger had reached across, opened the bag of cookies and started to eat them. There was obvious confusion over the cookies’ ownership, Adams remembered. “I did what any red-blooded Englishman would do,” he said. “I ignored it.” Both men exchanged meaningful glances as they alternately removed cookies from the bag, and it was only when the stranger left that Adams realized what had happened. Adams had placed his newspaper over his own bag of cookies and had actually been eating from the stranger’s bag.

Somewhere in England there was now another man telling the exact same story, Adams quipped, “except he doesn’t know the punch line.”

That story has been borrowed and retold by other inspirational speakers unaware of its origins, Adams pointed out, but he drew a much grander conclusion.

“The world is controlled in a top-down way by large hierarchies that have control over us.” The networked computers he’d envisioned promised “a bottom-up world,” and it would bring revolutionary changes.

World and industry leaders would do well to keep in mind the evolving new perspectives, Adams concluded.

“Otherwise, you’ll wonder why it seems that someone else is eating your cookies.”

Continue Reading Close

And justice for all

Metallica's pursuit of Napster inspires protests and parodies across the Web.

  • more
    • All Share Services

Metallica is currently Public Enemy No. 1 for many music-loving webheads — and the Net is throbbing with protests and parodies of the heavy-metal band that filed suit against Napster and demanded that more than 300,000 folks who have traded tunes like “One” and “Enter Sandman” online be blocked from the music-swapping service. Last week, as Napster won a Webby Award for best music site and Metallica drummer Lars Ulrich geared up to debate rapper and outspoken MP3 supporter Chuck D on “Charlie Rose,” there was hardly a corner of the Web that wasn’t riffing on Metallica’s attack and the Net’s ability to free the music. Here’s a quick roundup:

Someone called “Danzo” tried to auction “Metallica’s integrity” on eBay. (The auction has since been canceled — but a screen shot of the hoax endures.)

A punk band released an MP3 of a song called “I Got Sued by Metallica.”

At MetallicaSucks.com, a site “chronicling the demise of one the greatest metal bands to exist [and] plotting their path from metal gods to has-beens,” Napster fans urged others to complain to Metallica’s managers and record label, providing the contact information to do so. The site also hosts parody songs, such as “Blame Metallica” and “Enter Napster.”

Meanwhile the MetallicaBoycott.com site urges — what else? — a Metallica boycott. “Is it not enough that we as fans have lined their pockets by purchasing their CDs?” it implores. The folks behind this site are apparently incredulous that the band could be demanding more money from its music-swapping fans.

Countless other sites are mocking the band’s decision to go after fans who have swapped its music. PayLars.com is taking donations for Ulrich and his fellow band members to make up for all the revenue Metallica thinks it’s losing to online MP3 trading. And the Pigdog Journal wonders if Ulrich, who expresses disbelief that people think they can listen to music free, has ever heard of radio.

NewGrounds even posted a spoof “movie” of Metallica members chatting about how they love it when fans pay ridiculous sums for concert tickets and T-shirts, but not when they swap songs. And the “skit” ends violently.

Meanwhile, the band tried to get across its point of view with an online chat at Artist Direct and by answering questions from Slashdot readers. But its position — that musicians own the copyright to their music and fans can’t simply listen to it without paying — faces some tough resistance. Two-thirds of online music shoppers expect free digital downloads, according to a recent poll by marketing research firm Greenfield Online.

Besides, as the creators of Metallicster, a yet-to-be-released “dedicated Napster clone for spreading Metallica media,” put it: “There’s no way anyone out there (including stupid bands) could ever come even close to stopping the worldwide distribution of MP3s and other such media across the Web.”

Continue Reading Close

Wazzup, Elian!

An AP exec gets a lesson in Net-age protesting and backs down on threats against makers of an Elian parody, which contained photos from the Miami raid and voices from a Budweiser ad.

  • more
    • All Share Services

The Associated Press photo was splayed across newspapers and magazine covers across the nation — little Elian, screaming with fear, as an FBI trooper points a gun in the direction of his head. Once the picture became a sensation, it was merely a matter of time before someone online turned it into a parody; and sure enough, someone did, animating the Elian photo to the soundtrack of the popular Budweiser “Wazzup!” commercial.

Within hours, the smart alecks behind the parody were engaged in a legal tiff with officials from the Associated Press, who forced them to take the site down. Now, however, the satirists appear to be winning concessions from a “chastened” AP.

On Tuesday night Sean Bonner, a 25-year-old Web designer for Playboy.com, and Chris Lathrop, a 33-year-old copywriter for the site, created the animation — on their own time. It features a host of characters in the Elian saga — including Elian, Fidel Castro, Janet Reno, second cousin Marisleysis Gonzalez and fisherman Donato Dalrymple — greeting each other in the convivial, if guttural, slang (“So what’s up, B.?” “Wazzup!”) recognizable by Budweiser fans across the nation. (Other lighthearted online Elian parodies include a satirical Elian Web log and fake movie reviews “penned” by Elian Gonzalez.)

According to a story on Playboy.com, Bonner and Lathrop’s handiwork received 600,000 hits by Wednesday night. Between Wednesday and Thursday the URL appeared in over 150 Usenet posts. Some 7,213 viewers took the time to vote on the movie’s quality when it was displayed at newgrounds.com.

But the Associated Press was not amused. On Thursday, David Tomlin, assistant to the president at the Associated Press, e-mailed the two parodists from his Rockefeller Plaza office in New York, warning that they could be liable for copyright infringement fines and criminal penalties for their use of the photographs. Sounding a bit like Reno, Tomlin warned, “We’ll go for whatever it takes to get our material out of your hands.” Bonner took down the parody and displayed Tomlin’s letter instead, on both his own Web design firm’s site and on another Web site at GeoCities where he’d been mirroring it.

But Tomlin’s letter galvanized its own intense display of public resistance. Tomlin received hundreds of phone calls and hundreds of e-mail messages defending the satirists’ use of the photos. “We finally had to close [his e-mail account] to keep the incoming mail from overwhelming my system,” Tomlin says, adding that he even received an anonymous death threat — which he didn’t take seriously.

Lathrop has found the wave of supporters heartening. “If they perceive it that way, they have every right to be angry about it,” he says. “I think it’s encouraging, just from a grass-roots standpoint.”

And, although Tomlin points out that the AP does need to defend its intellectual property and is rarely pleased when its photos are doctored, he is now describing himself as “chastened” by the negative responses his letter provoked — many of which took the AP to task for its hypocritical interpretation of First Amendment rights.

“We do care about free expression, and being in the position of seeming to suppress it is something that has given me some second thoughts about how we responded,” Tomlin says. “I read my note on the Web now, it certainly looks every bit as heavy-handed as some of my critics have said it was. I don’t think that’s the right way to start a thoughtful debate about what’s appropriate and what’s not.”

Tomlin also admits that it’s difficult to protect a digital image that can be endlessly copied by online fans. “Right now, obviously, if there’s a communal will on the Internet to display this material, it’s going to get displayed,” he shrugs.

And sure enough, on Thursday afternoon there was at least one Web site still mirroring the clip. In addition, the parodists sought protection from their employers at Playboy.com, who have agreed to display their satire in its entirety. “Our legal guy didn’t seem worried about it,” says Lathrop, “and quite frankly, if he’s not worried about it, I’m not.”

Continue Reading Close

The HampsterDance comeback

The dancing hamsters that took the Net by storm are back, and gunning for a career as rappers.

  • more
    • All Share Services

Did you think the HampsterDance was one of those odd, fleeting phenomena that temporarily titillated the Net’s funny bone and then disappeared into the ether? Well, you were wrong. The HampsterDance is back in town and, if Deirdre LaCarte has her way, on its way to becoming a media empire.

LaCarte, creator of the wildly successful Web page filled with animated dancing rodents, recently unveiled her new “interactive” hamsters. At HampsterDance2.com, viewers can speed up and slow down both the music and the dancers. Individual hamsters can even be dragged to different locations on the screen; clicking on them pauses their motion so the dance steps can be started at different times.

The hamsters have also learned to rap. The familiar “Dee dee dee, doo doo, do-do doo” now burbles over a thrumming synthesizer and electronic percussion — part of a longer track you’ll soon be able to purchase on the “Official and Authorized” HampsterDance CD. Over a driving techno beat, the speeded up voices shout: “All right everybody, now here we go. It’s a brand new version of a dosey-do!” Several rhymes later, it culminates with a speedy “Yi-ha!” and an announcer’s voice saying “Let’s try it” before the familiar yodeled refrain …

But you can’t teach an old hamster new tricks. European fans of the hamster chorus know that the original site was sampled by a U.K. band in April 1999. The Cuban Boys mixed the ditty with their own techno beat and sound clips of voices; after it was played on John Peel’s influential radio show on BBC One, the tune quickly became the show’s most-requested song in over 20 years. The band landed a contract with EMI and has sold more than 200,000 copies of the single since it hit stores in December. Titled “Cognoscenti vs. Intelligentsia,” and promoted with an offbeat video, the song remained in the top 10 for three weeks, and was released across Europe on Jan. 31.

This was all particularly galling to LaCarte. The British Columbia art student and martial arts instructor had assembled the original HampsterDance page from materials she’d collected around the Net as a tribute to her pet hamster, Hampton. She contacted a management company called “Big Fun Media,” which in turn hired an independent production company to create the “Official and Authorized” CD. The hamsters now dance under a banner ad for WorldlyInvestor.com. The humble GeoCities page where LaCarte started it all now points to the new domain at HampsterDance2.com, where the registered trademark symbol appears six times.

Meanwhile, the original Hamsterdance.com site has become a casualty of the reshuffling. After over 60 million visitors, the Web-hosting company Tilted Planet, which served HampsterDance.com for LaCarte, appears to have taken down the frolicking hamsters. (Last summer CEO George Vuckovic complained that they were having trouble keeping up with the site’s popularity — and generating enough revenue to cover the costs.) HamsterDance.com now leads instead to an assortment of other dancing critters (the fishydance, the leprechaun dance, the turtle dance, the armadillo dance) plus a card trick and jokes like the “magic Web cam.” LaCarte is now pleading with Hampster fans to boycott the errant site.

HampsterDance2 has included a page for the original hamsters. (Though Friday they were dancing without their trademark ditty.) But LaCarte’s management company has big plans for the little animals. “As we get the site up to speed we will add a ‘forum page’ so that visitors will be able to interact with other visitors,” says Jeffery Lane, the company’s president. “E-cards will also be offered that will allow the fans to create and customize greeting to their friends and family.” They’re even planning to introduce new female characters.

Lane says that the critters are receiving 200,000 visits per day and thousands of e-mails. They’ve also been featured in a commercial for EarthLink. But fame has its pitfalls. One webmaster has already created a Web page titled “Die, Dancing Hamsters, Die.” Nuke that rapping rodent before it causes any more pain!

Continue Reading Close

Even “MacGyver” is no match for an AOL security breach

A computer security consultant loses his Instant Messenger account to a hacker, who finds the screen name too good to give up.

  • more
    • All Share Services

Habeeb Dihu chose the name “MacGyver” for his America Online instant messaging account because, like the TV detective, he was adept at tinkering with equipment. But on Feb. 8 the Chicago computer security consultant encountered a problem even the real MacGyver would have a hard time solving.

“I suddenly got a message saying my screen name was being logged off of AOL Instant Messenger because I’d logged in elsewhere,” he says. Two weeks had passed since AOL said it had plugged a security hole which allowed unauthorized access to AOL Instant Messenger (AIM) accounts, but someone was demonstrating that the hole was still open — and had claimed Dihu’s account.

For the next 17 days, Dihu, a senior principal at Diamond Technology Partners, confronted this fraudulent “MacGyver,” who identified himself as a teenage hacker. Dihu opened another AIM account and messaged his own MacGyver screen name, only to receive a reply moments later, which he says included the screen name of a friend whose messages the account thief had apparently received.

Dihu complains that he spent several hours on the phone with AOL support staffers trying to get his AIM identity restored — but to no avail. Making the situation worse: Dihu was consulting with major automakers on a deal for a new Web site. “It’s already causing chaos for me,” he lamented at the time, “as my business and personal associates try to reach me via my I.D., only to have the hacker politely respond.”

In late February TangentX, the hacker who first publicized the security hole, said via e-mail that the original hole that allowed people to take over others’ AIM accounts had “never stopped working.” But he declined to demonstrate it. “The AIM hack still works,” a second hacker added. Even the unauthorized holder of the MacGyver account, whom I messaged after Dihu had alerted me to his troubles, boasted of stealing other AIM identities.

The half-dozen calls I’ve made to AOL over the last month have gone unanswered. AOL spokespeople said they didn’t want to comment until they had spoken to Dihu directly. But Elias Levy, chief technology officer at SecurityFocus.Com, says that security holes often remain open after companies deploy patches. “It’s not unusual for a company to fix a problem and not fix it at its root. And then hackers find a way to go around the fix.”

Meanwhile, Dihu found that, unlike MacGyver, his technical expertise couldn’t bail him out. “I work with all sorts of organizations to assist them with their security,” he says, “but it’s irrelevant when you’re confronted with an outside force you can’t control, who won’t work with you to correct these things when they occur.” SecurityFocus’ Levy echoed his concerns. When asked what AIM users can do in a situation like this, he replied “Not much, really. It’s all in the hands of AOL to fix the software.”

Dihu even resorted to asking the thief in control of his account, “Now that you’ve proven your point, mind turning it back over?”

“Nope … Sorry,” came the reply. “Too much of a priceless name.”

Finally, after I had alerted the public relations office to the problem with all my calls seeking comment, AOL spokesman Rich D’Amato called Dihu on Feb. 25 to say the MacGyver account had been returned to him and “locked” to his e-mail address. “When I asked him if they found out what it was,” recalls Dihu, “he said they weren’t quite sure what happened, and that they were still looking into it.” Dihu is happy to have the account back, but he’s still not sure why TV’s MacGyver can disarm a missile with a paperclip, but despite his technical prowess he couldn’t hold onto his AOL Instant Messenger account.

Continue Reading Close

Page 1 of 3 in David Cassel