[Az-Geocaching] [OT] Security Implications with Web Based Greeting Cards

Team Tierra Buena listserv@azgeocaching.com
Mon, 18 Nov 2002 22:16:03 -0700


This is a multi-part message in MIME format.

------=_NextPart_000_000B_01C28F50.15C171F0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit

Off-topic, yes, but I think it's important to get the word out on this.
 
Have you ever clicked on an End-User License Agreement without bothering
to read it? Me, too, but after reading this article I'll never let one
slip by again.
 
Steve
Team Tierra Buena
 
10/30/2002 Subject: Security Implications with Web Based 
03:32 PM Greeting Cards 


Have you been receiving and sending a lot of Web based Greeting Cards?
If
you do, as a co-worker told me today that he sends them to a lot of
people,
you may want to read this article.

* SNEAK ATTACK THROUGH A LICENSE AGREEMENT

Have you ever received a Web-based greeting card from a friend or
relative? They're common these days, and they seem to be taken for
granted, in that people trust the intent of someone who might send
them a greeting card. People like to be greeted with kindness, so
they're inclined to look at and read the greeting card. It's one of
the feel-good things that many people simply can't resist.

Have you ever wondered why a company would spend its Internet
resources delivering free greeting cards on behalf of people with whom
it conducts no business otherwise? How does such an entity profit from
those endeavors? What might its motives be?

Last week, a user posted an interesting message to our HowTo for
Security mailing list regarding one company that delivers Web-based
greeting cards. That company, Permissioned Media, runs a Web site
called FriendGreetings.com, which lets one person send another person
an electronic greeting card. The friendly facilitation seems simple
and harmless, but it has a rather insidious side.

When you receive a greeting from FriendGreetings.com, the message says
that someone sent you the greeting and that to read it, you must click
a URL that takes you to the Web site hosting the greeting. When you
click the URL, you're prompted to install an ActiveX control before
you view the greeting. As the greeting-card recipient, you would
probably assume that you must install the ActiveX control to view the
greeting; however, that's not the case. Instead, FriendGreetings.com
has designed the ActiveX control, complete with an End User License
Agreement (EULA), to interact with your mail client software and
harvest information about your email contacts. After the ActiveX
control obtains your private contact list information, it sends a
similar greeting card to everyone in your contact list, probably
unbeknownst to you!

If you took time to read the EULA from FriendGreetings.com, you'd
discover that the EULA clearly states Permissioned Media's intention
to do just that. A section of the EULA reads, "As part of the
installation process, Permissioned Media will access your Microsoft
Outlook contacts list and send an e-mail to persons on your contacts
list inviting them to download FriendGreetings or related products."
By accepting the EULA and installing the ActiveX control, you give the
company permission to perform that activity.

In essence, the greeting cards that FriendGreetings.com delivers
resemble many worms that travel the Internet: They're parasitic,
intrusive, devious, elusive, and most of all, probably unwanted. Even
some antivirus vendors issued warnings about the greeting card last
week. However, we can't completely blame FriendGreetings.com for its
use because, although the company counts on most users' acceptance of
the unread EULA, the EULA does spell out some of its intention. By
agreeing to the EULA, users agree to the ActiveX control activity.
Nevertheless, the lesson here should be obvious: When you encounter a
EULA, don't take anything for granted. Read it word for word to
understand exactly what you're accepting and think through what the
consequences of acceptance might be.

Permissioned Media bills itself as a "behavioral marketing network"
with more than 100 clients that advertise online. The company also
operates Cool-Downloads.com. You can read Permissioned Media's EULA at
the URL below. Take note that it grants the company "the right to add
additional features or functions to the version of PerMedia you
install, or to add new applications to PerMedia, at any time." Yikes!
http://permissionedmedia.com/license.htm

If you've received a greeting card from FriendGreetings.com and
installed the associated ActiveX control, you might want to remove its
software from your system. To find out how, be sure to read the
related news article, "Protect Your Contact List: Read the EULA!" in
this newsletter.
http://www.secadministrator.com/articles/index.cfm?articleid=27122


Source: Windows & .NET Magazine Security UPDATE--brought to you by
Security
Administrator, a print newsletter bringing you practical, how-to
articles about securing your Windows .NET Server, Windows 2000, and
Windows NT systems. (Contributed by Mark Joseph Edwards, News Editor)

------=_NextPart_000_000B_01C28F50.15C171F0
Content-Type: text/html;
	charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Dus-ascii">
<TITLE>Message</TITLE>

<META content=3D"MSHTML 6.00.2719.2200" name=3DGENERATOR></HEAD>
<BODY>
<DIV><SPAN class=3D505280905-19112002><FONT face=3D"Book Antiqua"=20
color=3D#0000ff>Off-topic, yes, but I think it's important to get the =
word out on=20
this.</FONT></SPAN></DIV>
<DIV><SPAN class=3D505280905-19112002><FONT face=3D"Book Antiqua"=20
color=3D#0000ff></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D505280905-19112002><FONT face=3D"Book Antiqua" =
color=3D#0000ff>Have=20
you ever clicked on an End-User License Agreement without bothering to =
read it?=20
Me, too, but after reading this article&nbsp;I'll never let one slip by=20
again.</FONT></SPAN></DIV>
<DIV><SPAN class=3D505280905-19112002><FONT face=3D"Book Antiqua"=20
color=3D#0000ff></FONT></SPAN>&nbsp;</DIV>
<DIV><SPAN class=3D505280905-19112002><FONT face=3D"Book Antiqua"=20
color=3D#0000ff>Steve</FONT></SPAN></DIV>
<DIV><SPAN class=3D505280905-19112002><FONT face=3D"Book Antiqua" =
color=3D#0000ff>Team=20
Tierra Buena</FONT></SPAN></DIV>
<DIV><SPAN class=3D505280905-19112002>&nbsp;</SPAN><BR>10/30/2002 =
Subject:=20
Security Implications with Web Based <BR>03:32 PM Greeting Cards=20
<BR><BR><BR>Have you been receiving and sending a lot of Web based =
Greeting=20
Cards? If<BR>you do, as a co-worker told me today that he sends them to =
a lot of=20
people,<BR>you may want to read this article.<BR><BR>* SNEAK ATTACK =
THROUGH A=20
LICENSE AGREEMENT<BR><BR>Have you ever received a Web-based greeting =
card from a=20
friend or<BR>relative? They're common these days, and they seem to be =
taken=20
for<BR>granted, in that people trust the intent of someone who might=20
send<BR>them a greeting card. People like to be greeted with kindness,=20
so<BR>they're inclined to look at and read the greeting card. It's one =
of<BR>the=20
feel-good things that many people simply can't resist.<BR><BR>Have you =
ever=20
wondered why a company would spend its Internet<BR>resources delivering =
free=20
greeting cards on behalf of people with whom<BR>it conducts no business=20
otherwise? How does such an entity profit from<BR>those endeavors? What =
might=20
its motives be?<BR><BR>Last week, a user posted an interesting message =
to our=20
HowTo for<BR>Security mailing list regarding one company that delivers=20
Web-based<BR>greeting cards. That company, Permissioned Media, runs a =
Web=20
site<BR>called FriendGreetings.com, which lets one person send another=20
person<BR>an electronic greeting card. The friendly facilitation seems=20
simple<BR>and harmless, but it has a rather insidious side.<BR><BR>When =
you=20
receive a greeting from FriendGreetings.com, the message says<BR>that =
someone=20
sent you the greeting and that to read it, you must click<BR>a URL that =
takes=20
you to the Web site hosting the greeting. When you<BR>click the URL, =
you're=20
prompted to install an ActiveX control before<BR>you view the greeting. =
As the=20
greeting-card recipient, you would<BR>probably assume that you must =
install the=20
ActiveX control to view the<BR>greeting; however, that's not the case. =
Instead,=20
FriendGreetings.com<BR>has designed the ActiveX control, complete with =
an End=20
User License<BR>Agreement (EULA), to interact with your mail client =
software=20
and<BR>harvest information about your email contacts. After the=20
ActiveX<BR>control obtains your private contact list information, it =
sends=20
a<BR>similar greeting card to everyone in your contact list,=20
probably<BR>unbeknownst to you!<BR><BR>If you took time to read the EULA =
from=20
FriendGreetings.com, you'd<BR>discover that the EULA clearly states =
Permissioned=20
Media's intention<BR>to do just that. A section of the EULA reads, "As =
part of=20
the<BR>installation process, Permissioned Media will access your=20
Microsoft<BR>Outlook contacts list and send an e-mail to persons on your =

contacts<BR>list inviting them to download FriendGreetings or related=20
products."<BR>By accepting the EULA and installing the ActiveX control, =
you give=20
the<BR>company permission to perform that activity.<BR><BR>In essence, =
the=20
greeting cards that FriendGreetings.com delivers<BR>resemble many worms =
that=20
travel the Internet: They're parasitic,<BR>intrusive, devious, elusive, =
and most=20
of all, probably unwanted. Even<BR>some antivirus vendors issued =
warnings about=20
the greeting card last<BR>week. However, we can't completely blame=20
FriendGreetings.com for its<BR>use because, although the company counts =
on most=20
users' acceptance of<BR>the unread EULA, the EULA does spell out some of =
its=20
intention. By<BR>agreeing to the EULA, users agree to the ActiveX =
control=20
activity.<BR>Nevertheless, the lesson here should be obvious: When you =
encounter=20
a<BR>EULA, don't take anything for granted. Read it word for word=20
to<BR>understand exactly what you're accepting and think through what=20
the<BR>consequences of acceptance might be.<BR><BR>Permissioned Media =
bills=20
itself as a "behavioral marketing network"<BR>with more than 100 clients =
that=20
advertise online. The company also<BR>operates Cool-Downloads.com. You =
can read=20
Permissioned Media's EULA at<BR>the URL below. Take note that it grants =
the=20
company "the right to add<BR>additional features or functions to the =
version of=20
PerMedia you<BR>install, or to add new applications to PerMedia, at any =
time."=20
Yikes!<BR>http://permissionedmedia.com/license.htm<BR><BR>If you've =
received a=20
greeting card from FriendGreetings.com and<BR>installed the associated =
ActiveX=20
control, you might want to remove its<BR>software from your system. To =
find out=20
how, be sure to read the<BR>related news article, "Protect Your Contact =
List:=20
Read the EULA!" in<BR>this=20
newsletter.<BR>http://www.secadministrator.com/articles/index.cfm?article=
id=3D27122<BR><BR><BR>Source:=20
Windows &amp; .NET Magazine Security UPDATE--brought to you=20
by<BR>Security<BR>Administrator, a print newsletter bringing you =
practical,=20
how-to<BR>articles about securing your Windows .NET Server, Windows =
2000,=20
and<BR>Windows NT systems. (Contributed by Mark Joseph Edwards, News=20
Editor)</DIV></BODY></HTML>

------=_NextPart_000_000B_01C28F50.15C171F0--