Ca devait arriver. Les Belges étant les champions du monde de la copie des mauvaises idées, voilà donc qu’arrivent deux propositions législatives sur le téléchargement illégal sur Internet. L’une des propositions émane du sénateur MR Philippe Monfils, et est basée sur le même concept que la loi HADOPI adoptée en France il y a quelques mois et entend combattre le téléchargement en criminalisant les usagers du Net. Je reviendrai sur les faiblesses de cette proposition dans un autre article.

Ce qui m’intéresse aujourd’hui, c’est la proposition des sénateurs Ecolo Benoit Hellings et Groen! Freya Piryns pour l’instauration d’une “licence globale”, autrement dit une taxe sur les abonnements à Internet qui permettrait donc de télécharger des oeuvres protégées en toute impunité.

Notons que les deux propositions sont au départ basées sur la même constation dans le chef de leurs auteurs: le téléchargement illégal tue la création. Il faut saluer le travail remarquable effectué par les lobbyistes des majors du disque depuis des années.  A force de répétition tenant du lavage de cerveau version Révolution Culturelle, il sont parvenus à convaincre à peu près toute la planète du lien de causalité entre le téléchargement illégal et la chute de vente des CD et DVD. Read more…

Les modems BBOX2 qu’utilisent une majorité de clients de Belgacom TV comportent des failles de sécurité importantes. Belgacom revendiquait 589.000 clients pour sa plate-forme TV l’été dernier. Une majorité d’entre eux utilise ce fameux modem. Une combinaison de facteurs ouvre la porte à des actes malveillants, pouvant être commis par des personnes sans connaissances informatiques particulières et pas seulement des ‘hackers’.

1. Les modems BBOX2 sont tous livrés avec le même mot de passe d’administration. On peut très facilement le trouver via un moteur de recherche: http://www.google.com/search?hl=en&q=BGCVDSL2
2. Belgacom prétend bloquer l’accès à distance de ces modems via Internet. C’est partiellement exact. Cependant, ces modems sont livrés d’origine avec une connexion WIFI active et non protégée. N’importe qui passant dans la rue peut donc se connecter à une BBOX2 non protégée.
3. Muni de cet accès administratif, on peut télécharger le fichier de configuration du modem et décrypter les mots de passe qui s’y trouvent. Là aussi, on trouve le nécessaire sur Internet: http://www.webalice.it/zibri/Deobfuscate.html

Après avoir récupéré les identifiants d’un abonné  à Belgacom TV (identifiants de la connexion PPPoE, pour être précis), un pirate peut utiliser ces informations pour perpétrer des actes malveillants en se faisant passer pour cet abonné.

Toutes les informations ci-dessus sont en possession de Belgacom depuis longtemps. J’ai moi-même interrogé l’opérateur, qui n’a pas daigné accuser réception, et encore moins répondu ou proposé des solutions.

Notons également que si cela s’applique aux clients de Belgacom TV, certains abonnés Internet, chez Belgacom comme chez les opérateurs alternatifs qui utilisent le réseau VDSL2 de Belgacom sont également concernés. Le propriétaire du réseau impose en effet aux autres FAI l’utilisation d’un modem semblable au sien, également pourvu d’un mot de passe identique pour tous les abonnés.

Read more…

Santa has been kind to me. I just switched to a new ISP.  The results below speak for themselves.

2009-12-25

2009-07-20

That’s the good news. The less good one is that this whole VDSL2 infrastructure deployed by the incumbent telecom operator has some major security holes, on which I will post later, once I have finished my research.

Il y a un mois et demi, je signalais à VOO, fournisseur d’accès Internet en Belgique, un problème de configuration de leurs serveurs e-mail et DNS. Les messages que je trouvais dans mes logs disaient:

Sep 5 13:58:57 server Postfix/smtpd[30746]: NOQUEUE: reject: RCPT from
mirapoint21.brutele.be[212.68.199.158]: 450 4.1.8 <www-data@webvoo.voo.be>:
Sender address rejected: Domain not found;  from=<www-data@webvoo.voo.be>
to=<xxx@xxx.xx> proto=ESMTP helo=<mirapoint21.brutele.be>

En pratique donc, le serveur de VOO à l’origne du message initial ne possède pas d’entrée dans le DNS, et se retrouve en conséquence blacklisté par mon serveur de mail. C’est une tactique courante pour rejeter une partie du spam qui abreuvent nos boîtes aux lettres.

En bon petit soldat de l’Internet, j’ai donc suivit les indications de RFC 2142 concernant les adresess email de service, et qui précise que “ if a given service is offerred, then the associated mailbox name(es) must be supported”.

J’ai envoyé un message à postmaster@voo.be et à webmaster@voo.be . Les messages me sont revenus avec un non-delivery report.  Le DNS de VOO est, en principe, géré par hostmaster@brutele.be .  Du moins c’est ce qu’indique le SOA du DNS. Comme je devais m’y attendre, hostmaster@brutele.be n’existe pas et les emails sont revenus itou. Bon, VOO ne respecte pas les standards et malheureusement, ils ne sont pas les seuls.

Read more…

Ainsi donc, l’ICANN tiendra une réunion à Bruxelles en juin 2010. Toutes mes félicitations à Marc Van Wesemael et l’équipe d’Eurid.

Lors de la conception du projet de la réunion ICANN à Luxembourg qui se déroula en 2005, j’avais un temps envisagé de l’organiser à Bruxelles, tant il me semblait logique que la capitale de l’Europe accueille une telle manifestation. Le contexte était cependant différent.

A l’époque, le coût de la manifestation était entièrement supporté par l’organisateur local et ses partenaires. Le fractionnement institutionnel de la Belgique, avec ses multiples niveaux de pouvoirs aux compétences redondantes et en concurrence directe rendait tout simplement la participation des pouvoirs publics impossible. De nos jours, l’ICANN a compris qu’elle ne pouvait plus compter sur des tiers pour ouvrir leur portefeuille et finance elle-même la majeure partie des coûts.

Il n’en reste pas moins qu’il sera intéressant de voir qui seront les orateurs lors de la séance inaugurale. Aura-t-on un ministre fédéral ? Les télécoms sont une compétence largement régionalisée. On pourrait donc avoir un ministre bruxellois. Oui mais, Bruxelles est aussi la capitale de la Flandre. Aura-t-on peut être un ministre flamand ? Le responsable  du protocle va s’arracher les cheveux.

I just bought a Linksys WAG160N ADSL modem/router that I am going to bring back to the retail store. The main reason it that it will not connect to my Nokia E61i phone on anything more than the old-fashioned (and insecure) WEP. My phone works fine with WPA2 on real Cisco APs; it also works with competing products, including the AVM Fritz!Box that was using earlier – and was partially destroyed by a thunder strike on the street telephone cabinet where my DSL phone line connects.  My phone just does not work with the Linksys WAG160N. This is actually a known issue that I found out too late. however, it does not seem to be solved and no indication shows that it was acknowledged, even less on the way to be fixed.

I work with a lot of Cisco products in my day job. I have the pleasure to know many folks at Cisco. Most of them were telling me that Linksys somehow usurpts the Cisco label with inferior quality products. How right they were. I should have listened to what  Cisco’s own staff was telling me.

My online chat with the Linksys support staff did not resolve the issue. WEP works, but who dares to use WEP these days ? My advice to John Chambers and all those at Cisco who care about the company image is to stop your subsidiary from using the Cisco name.

Many software applications rely on validation routines to check the validity of domain names. By validation, I mean here to test the string submitted by the user and see if it matches a pre-defined pattern. A typical example are web forms that need to validate e-mail addresses.

This is by no means a new issue. It first appeared with the introduction of the .info TLD. Before that TLDs were only two or three letters long, and many validation routines could not cope with the 4 letters of .info. At the time, ICANN had developed a testing tool which allowed developers to test if their code took into account the requirement for 4 letters. Still, you find today on the Internet tons of library routines that do not support 4 or more letter TLDs.

Some of these routines also rely on a hard-coded list of TLDs. Even today, I sometimes find that some web sites cannot deal with my .eu domain, which was introduced 4 years ago.There are hundreds of thousands of these routines written in Javascript, PHP, Perl, ColdFusion, ASP and just about any programming or scripting language you can think of.

Read more…

The ICANN IRT working group has published its final report, which I decided to analyze a bit further. I already made a few comments last month, both in the At-Large Advisory Council framework and on my own.   There are several issues raised by the recommendations of this report. The URS is one.

Reliance on e-mail

Among the issues is the fact that most of the URS process relies on e-mail for notifications to the registrant, to the registry operator, etc.  Let’s face it: e-mail has become unreliable for critical applications. With more than 90% of e-mail being catalogued as spam, identifying the one important e-mail that you are not expecting is like searching a needle in a haystack.  Some techniques like DKIM, S/MIME signing, etc might help getting through the spam filters, if only the latter are well-configured. Most users do not have fine-grained control on the configuration of their spam filter, and none at all on the one used by their ISP.

Where this matters is that “A Registrant has fourteen (14) calendar days from the date of the initial email notification to submit an Answer“.  If the e-mail was caught by your spam filter, or if you are on vacation, travelling or more simply not reading your e-mail on a regular basis, you are out of  luck. You might lose your domain name without you even noticing it before it is too late.

The language issue is also an important one. It may be that English is the lingua franca of the business community. However, it may not be a language understood by the domain name registrant and he may, in good faith,  discard the notification message. Read more…

Picture this: the still state-owned (51% of shares) Belgian incumbent telecom and Internet operator, Belgacom, is not a dominant player on the ISP market, according to the Brussels appeals court (see also here).

It is obvious to every inhabitant of Belgium that the incumbent is everywhere. It owns all the copper pairs to homes and  a good deal of the fibre. No single Internet or telephony operator can get into the business without transiting through the Belgacom network at some stage. As expected, the infrastructure owner is not keen to open up its infrastructure to competitors and has used every trick in the book to slow down competition. As a result, alternative operators, be it in telephony or Internet access,  have a ridiculous market share. Belgacom has a more than 70% share of the residential Internet access market.  Belgium has one of the most expensive Internet access offer in Europe, nearly twice the price of France, for example.

The telecoms regulator, IBPT,    is often depicted as a weak one and often accused of favouring Belgacom.  It came with some surprise a few months back that the regulator ruled that Belgacom had to open up its ADSL and VDSL infrastructure to the competition. Under the EU competition rules, it is foreseen that the infrastructure owner and dominant operator has to open its infrastructure to allow competitors to offer their services, too.

Belgacom wishes to diversify its income sources and launched an ambitious project to deliver triple play services. This includes high definition and pay TV.  For this to happen they needed to upgrade their DSL network. They embarked in an infrastructure project to lay  fibre optic cabling up to street cabinets (FTTC) and deliver VDSL2 connectivity from there to the customers premises.   This has actually proven very successful. Belgacom was greatly helped by the fact that the cable TV operator in the Southern part of Belgium, Voo, has an outdated and poor quality network.

It may be that IBPT  did not make a rigorous enough study of the marketplace. Still, I cannot understand judges refuse to see what is obvious to all. The net result is that Belgacom’s competitors will have even less opportunities to offer quality services and that the incumbent’s market share will grow even more. For customers, this will mean less choice and higher prices. This is sad news in a country where the unemployment rate have risen quite sharply due to the global economic downturn. It is nearly impossible these days to apply for a job if you do not have an Internet connection and e-mail address.  The most vulnerable part of the population will be the first victim.

The IRT has released a draft report.  The composition of the  team is strongly biased towards North American intellectual property interests. Unfortunately, individuals were not represented.  Neither were potential new gTLD operators.  There was only one US-based registrar present and only one incumbent US-based registry.  In summary, this report is partial, both because it does not cover the whole picture and because it is strongly biased towards the interests of a specific group.

Quite confusingly, it was published on 24th April, with a 30 day comment period. However, one needs to comment before 6 May if it wants the IRT to consider the comments. Strange tactics.

As others have pointed out, the effective 7 day comment period over this draft report is way too short. It may be wise that the ICANN board does not consider this report before the community has had a real opportunity to comment.

I totally support Michele Neylon’s comments on the whois model  contemplated by this report. It would be in breach with many privacy regulations throughout the world. Further, if the ability to comply with the whois recommendations, as set forth in this report, would become one of the evaluation criteria for the new gTLD applications, this would favour registry operators located in countries with little or no privacy laws. This would put at a competitive disadvantage those businesses which need to comply with local laws. Questions to the IRT:

• Did the IRT consider if their recommendations regarding the whois were actually compliant with relevant legislation throughout the world ?
• Will the ability to comply with the whois recommendations, as set forth in this report, be a part of the evaluation process of new gTLD applications ?

Regarding the IP clearinghouse, it is stated that “The recommendation should not result in unnecessary or undue costs, either to trademark owners or to legitimate users and consumers”. Does this mean that the registry operators will have to bear all the increase of their operating costs for protecting third parties interests? The net effect of this is that operators will need to shift the increasing cost among all their customers, including those who have no IP rights to protect. This will mean raising the unit price of domain names for every customer, making the TLD less attractive and potentially be a cause of registry failure. In the case of community-based TLDs that focus on a limited market through a not-for-profit model, this may simply mean that the potential costs  and legal risks may be disporportionate for them to bear.

There is a major concern that different levels of protection for marks may put the registry operator in a position to have to arbitrate between second level domain name  applications and become legally involved in disputes between third parties. Unlike trade marks, which can be multiple according to industrial sectors and geography, domain names are by nature globally unique. As technical operators, registries should have no business in deciding who is the legitimate intellectual right owner.

If such IP clearinghouse system is put in place, it should, at a minimum:

1. Be automated and implementable at a marginal cost by registries and registrars
2. Exempt the registry operators from further legal consequences if it has demonstrated that it queried the database at registration time.

In addition to the above, I think it would be only fair that whatever policies are decided as a consequence of this process are also made mandatory for the existing gTLDs. The new entrants should not be the only ones having to bear the weight and costs of these policies.