More Blockbuster Security Problems

I got this security alert again when I was logging into the Blockbuster Online Web site last night.

I'm sure it's just a configuration problem on one of their servers, but my mom would freak if she saw this.

Comments

[manuel]

[Update from Mike: I was able to duplicate this error on 3 different computers in two locations. The screen capture is proof. Manuel also states below that Netflix is using spyware, and yet I have the assurances of 3 different sources at Netflix that they are not using spyware or adware. When you read his comments and visit his site you'll see that he distorts the facts and prints only one side of the story to support his hate campaign against Netflix.]

It's never happened to me and I bet I use BlockBuster more than you do. This is nothing compared to the security nightmare Netflix has created by paying spyware sites to infect users' PCs. Netflix has the audacity admitting using spyware to boost sales as reported by Adware Report and the Wall Street Journal. Both eXact Advertising and Claria use their spyware to steal customers from Netflix competitors yet their spyware doesn't stop there. eXact Advertising may collect any or all of the following types of information: (a) traffic or clickstream data, (b) cookies, (c) Internet Protocol ("IP") addresses, or (d) contact information and other personally identifying information.

Gator/GAIN can download and execute arbitrary code from its controlling server.

Gator/PDP, the installer control, can be directed by any web page to install code from Gator's servers.

Gator/PDP/3061, an early version of the installer control, has a critical security flaw: it allows any web page to download and execute code from anywhere, with no security checks.

Gator/PDP/5094, the latest version of the installer control, seems to contain code to work around the network security products Zone Alarm Pro, STOPzilla, Norton Internet Security and McAfee Desktop Firewall.

Claria says its spyware infected more than 40 million PCs at the end of last year. Also, eXact Advertising claims to have infected 10% of all web users' PCs.

Netflix should be ashamed damaging so many users' PCs with spyware. [Where are the screen shots, Manuel? Where is your proof that Netflix is doing this? Old articles and a researcher who is a paid expert against Claria? Full disclosure, please.]

[CashForFlow]

manuel,

"Netflix should be ashamed damaging so many users' PCs with spyware."

Collecting data is not damaging to a computer. The software doesn't overload your connection or delete files. It's part of business: if you want to use their website they’re going to load 'hellish' cookies on your system to survey your daily Internet use. Any company could do it.

Did you ever consider what they use the data for? I doubt it. It’s used to improve the site for your individual wants.

"Collecting data is not damaging to a computer. The software doesn't overload your connection or delete files. It's part of business: if you want to use their website they’re going to load 'hellish' cookies on your system to survey your daily Internet use. Any company could do it."

While I have never had any problems with spyware or any of that other stuff getting on my system I still find what you said to be wrong.

What you fail to mention is that they have NO F'N right to put that CRAP on our computers without us knowing what they want to do.

I hope all of the BA$TARD$ who use this spyware crap on us go to F'N hell and if anyone reading this is involved with the spyware crap you can kiss my F'N a$$!

[PlungeBob]

I must agree with the screamer....it is sleazy
to support such practices.

...and I hope they go to FN H8LL!! ;0)

[manuel]

"Collecting data is not damaging"

We're not talking about harmless cookies. We're talking programs that punch holes in firewalls leaving PCs totally defenseless. This is the type of damage Netflix is paying spyware companies for just to turn a bigger profit.

[Mike K]

Manuel,

Your information on Netflix and spyware is wrong. I asked Netflix about your claims and this was the response:

"Netflix does not use adware or spyware and we specifically forbid our affiliates from advertising Netflix via spyware or adware. If it happens, we crack down on it. That’s on the record."

You need to check your facts before you start making claims about a company.

You also need to present all of the facts, not just the negative side of the story.

- Mike

"I must agree with the screamer....it is sleazy"

Sorry if I came off like I was screaming, (although I was), but those kind of people really piss me off. They are no different that the scum-suckers that break into your home. I think the best way to get rid of them is to have an open bounty on those people. I, for one would be willing to contribute to that type of fund.

[CashForFlow]

"We're not talking about harmless cookies. We're talking programs that punch holes in firewalls leaving PCs totally defenseless. "

That statement doesn't make sense. A firewall is a program designed to stop that sort of traffic in particular. If a 'harmless cookie' is sending traffic through a firewall then get a better firewall. An easier/better idea is to modify your browser’s settings on how it handles cookies.

These spyware programs are way overblown to sell overpriced firewall software. In fact, getting a decent router is the best means of protecting your computer.

[Mike K]

BTW, I was able to duplicate the security problem this story is about on 3 different machines, using 3 different browsers (IE/Windows, Safari & Firefox). All 3 had the default settings.

- Mike

[manuel]

If so, Netflix needs to put out a press release. I hope you'll forgive me for doubting your word.

[Mike K]

Manuel,

Why would they need to put out a press release to address your claims?

Call or e-mail Netflix, which is what you should have done before writing your story.

Why do I even bother? You use this site as a forum to go off on Netflix on nearly every post. You're as bad as the "shills."

This site is for people interested in news about Netflix, not a forum for you to twist and distort things.

Why do you constantly take swipes at me? I can't belive you wrote: "I hope you'll forgive me for doubting your word." Why would I need to make this up?

I will again ask you to be fair and balanced in your writings on your site and in your comments here.

- Mike

[manuel]

"Your information on Netflix and spyware is wrong"

Is it?

PC Pitstop on Netflix being a Claria client:

http://www.pcpitstop.com/gator/advertisers.asp

Adware Reports on Netflix's admission of using spyware:

http://www.adwarereport.com/mt/archives/000159.html

Wall Street Journal on Netflix's admission of using spyware:

http://online.wsj.com/public/article/0,,SB112011691087873874-ZfLOkSgs26INqfMhlyBT6HDaB3A_20060701,00.html?

Benjamin Edelman's test results showing Gator targets BlockBuster for Netflix:

http://asp-cyber.law.harvard.edu/gator-sites/test.asp?host=blockbuster.com

Benjamin Edelman's research showing eXact Advertisng reroutes traffic meant for Netflix competitors:

http://www.benedelman.org/spyware/exact-advertisers/ads-highlights.html

Manual-

You need to learn to distinguish between Netflix and a Netflix affiliate.

It's the affiliate that's paying for the adware/spyware/whatever placement. This is specifically prohibited by the affiliate agreement. However, this agreement doesn't prevent an affiliate from trying.

[Aron]

Netflix Press Release: "We do not and have never used spyware of any form"

Manuel: They didn't say anything about which universe they were referring to.

Random Anime Character: WHAAA!!!!

[Megatron the Spyware Demon]

I WILL INFECT YOUR COMPUTER, AND THEN I WILL INFECT YOU. YOU HAVE NO TIME TO MAKE PLANS. IT IS TIME FOR ME TO RID THIS WORLD OF YOU. YOUR COMPUTER IS FIRST. I HAVE JUST SOME TIME TO ATTACK NOW WHILE HE IS NOT LOOKING.

WHAA!!!

THE FIREWALL WILL NOT STOP ME. I AM STRONGER. HERE I GO.

WHAAA!!!

[Mike K]

Manuel,

Speak with Netflix PR (I am not a Netflix employee and cannot answer on behalf of the company). I have been assured by 3 different Netflix employees this year that they do not use spyware or adware to promote Netflix.

I have been researching the spyware story on and off for a long time. I don't know the details of Netflix's past with Claria, but I do believe that they do not use spyware or adware now.

I also believe that it might be affiliates using spyware, which is in violation of the agreement they have with Netflix. I wonder if Netflix used Claria in the past for the Netflix popup banners we saw last year, but I don't have the full story yet. Claria has a number of products.

You've stated that Netflix is using spyware and adware, but if they are not will you post a retraction?

- Mike

[manuel]

When the Wall Street Journal posts a retraction so will I.

http://online.wsj.com/public/article/0,,SB112011691087873874-ZfLOkSgs26INqfMhlyBT6HDaB3A_20060701,00.html?

[Mike K]

Manuel,

The WSJ is not running around saying that Netflix is infecting computers with spyware. Read the story carefully:

"Incorporated in 1998, Claria has raised about $64 million to date, primarily from angel investors and venture-capital firms. The Redwood City, Calif., company says it had more than $100 million in revenue last year, from advertisers that included Cendant Corp., FTD.com Inc., Netflix Inc. and Orbitz Inc. Despite concerns about the practice, adware is remarkably widespread: Claria says its software was on more than 40 million PCs at the end of last year."

Hmm.. Netflix was an advertiser last year. Read it again. Where do they say that Netflix is using spyware or adware today, what relationship they had with Claria, or if they are even advertising with them now?

Have you contacted Netflix? No, why should you? You only want to write about what a horrible company Netflix is. You constantly twist and distort facts to support your hate campaign against Netflix.

I looked at the Bejamin Edelman stuff earlier this year, but realized that much of it's from 2003. The following dates were found on the Edelman pages you link to:

"These results were retrieved from Gator servers as of 6/4/2003 2:03:15 PM (Eastern)"
This is from one of the pages your link to as a source: http://asp-cyber.law.harvard.edu/gator-sites/test.asp?host=blockbuster.com

"Last Updated: June 7, 2003"
From this from another page you use a "source" for your story: http://cyber.law.harvard.edu/people/edelman/ads/gator/

Did you disclose that Edelman was involved in a lawsuit against Gator/Claria? Why should you? It doesn’t support your story. He made a full disclosure.

Even the WSJ talks about LAST YEAR. Hmm... Have you done any of your own research? I guess facts, research, and current information isn't that important to you when you're on a mission.

Where is your proof that Netflix is doing this today? Yet you make these claims. Even Edelman says it might be affiliates: “Through so-called "affiliate programs," eXact receives commissions from hundreds of online merchants, often without those merchants understanding what eXact is doing and without those merchants specifically consenting to eXact's methods.”

It’s not wonder that you won’t allow comments on your site. Somebody might actually post something positive about Netflix.

The two major differences between you and the WSJ are research (more than a few quick Google searches), and when they are wrong they WILL print a retraction.

- Mike

P.S. I've tried to tell you that you several times now that you need to do more research before you write a story but you won't listen.

[manuel]

Yes, Edelman plans on revealing Claria's current client list once litigation is over.

[manuel]

For those of you offended by Aron's anime mockery, try GreenCine.com or RentAnime.com: They welcome anime fans.

[Aron]

Aron: [thinking to self] Curses! My anime mockery has backfired and I have driven countless numbers of subs away from Netflix. Manuel's powers are much stronger then I thought.

[Aron begins summoning great galactic energy for enraged shocking backhand fist of the tiger]

Megatron the Spyware Demon: WHA !!!!!! I have emerged from somewhere dark and mysterious where I used to be before I emerged ! You will now fall unhappily before me in agonizing defeat!

Aron: Oh no! I can't fight you AND Manuel at the same time!

A Clutch of Netflix Shills: WE CAN HELP YOU ! JOIN US ! WE ARE STRONG AND NUMEROUS !

[manuel]

August 15, 2005

Netflix Settles Over Infringement Of Spyware Patents

BTG plc, a British IP solution firm, has "dismissed all claims against [Netflix] and granted Netflix a non-exclusive license to patents covering technology for tracking the navigational path of a user through the internet." The amount of the settlement was undisclosed. The spyware was created by Infonautics with patents # 5,717,860 and # 5,712,979.

[Mike K]

Manuel,

I have again checked with Netflix (have you?) and they said that the BTG license did not involve spyware. Read the patents and notice the part about "tracking" and "referrals." These are basic things companies do to monitor customer behaviour.

You also neglect to mention that Barnes & Noble, Amazon and Overstock are also being sued over the same patents. Hmm... Now you're accusing Amazon, etc?

I guess fact checking is unimportant. You'll write anything to promote your hate campaign against Netflix, eh?

- Mike

[manuel]

"I have again checked with Netflix (have you?) and they said that the BTG license did not involve spyware."

That's not how I interpret it nor do other subscribers. Marjorie Sterne also had the same take on this story last year:

http://entrepreneur.typepad.com/news/2004/09/online_retailer.html

Netflix has no business tracking what web sites I visit nor will I give my consent.

[manuel]

Take a look at Netflix's privacy policy. It makes no mention of tracking web sites subscriber's visit:

http://www.netflix.com/PrivacyPolicy

Yet, Netflix has acquired the rights to use spyware that does exactly that. Moreover, BTG claims Netflix has already used this technology without their permission.

[Mike K]

Manuel,

Hmm... I guess you still haven't contacted Netflix. For someone that writes about them as much as you do, I figure you'd at least want to get their side of the story for once, or at least contact one of the companies involved in the story.

Why are facts important when you can find sources that include random bloggers and paid consultants like your buddy Edelman. Articles and stories from 1 - 2 years ago? You only print the side of the story that backs up your hate campaign against Netflix, and ignore the rest of the story. You twist and distort what facts there are beyond belief.

You've suggested that I might be a shill, and I've proven that wrong. I think you work for Blockbuster. Prove me wrong. Where is your coverage of the case against Blockbuster for misleading advertising that was settled for $630,000!?!?

You constantly accuse Netflix of all of these horrible things and yet you ignore Blockbuster. This story is about a security problem on the Blockbuster site and you try to dismiss it and turn it against Netflix. I have screen shots. Where are yours? Where are your facts? Who's the shill?

I know your site is a place for you to post your opinion about Netflix, but your credibility goes out the window when you print half the story to promote your agenda against Netflix.

I'm still wondering why you printed my full name and where I work on your Web site. What was that all about? What does that have to do with your opinion of Netflix?

- Mike

[manuel]

The blog you have discredited is run by professors and students at University of Wisconsin Law School.

http://entrepreneur.typepad.com/about.html

But, I suppose academia means nothing to you. Wait, aren't you a professor somewhere?

[Mike K]

Manuel,

You are running around and making wild statements like, "Netflix should be ashamed damaging so many users' PCs with spyware."

How can you say these things without proof?

Do you really think Amazon, Barnes & Noble and other companies being sued with Netflix are using spyware?

Still haven't contacted Netflix, have you? You just love running around with a few facts and making wild statements.

You should be ashamed.

- Mike

[Mike K]

Manuel,

Your only response to the entire comment was to focus on my "random bloggers" reference. I'm not discrediting them, but the story is from a year ago and was written by what appears to be a law student on a blog. Hardly the WSJ. You surely have a better source or proof that Netflix is infecting computers with spyware, as you claim?

What about the other questions? Are you a Blockbuster employee or consultant?

Professor? I've taught few classes but not recently. You seem to know a lot about me (and I would prefer if you didn't post it on your Web site like you have in the past).

- Mike

[Aron]

Poor Manuel..

The BTG technology is simply a method of encoding the name of a website into a hyperlink so that when a user clicks it the destination site knows where they came from. This basic process is repeated for nearly all advertising on the web. Netflix has to know who to pay commission. Do you really think this is spyware?

Did you bother to read the patents? They were filed in 1995. What they are covering is BASIC BASIC BASIC stuff.

There is nothing installed on your computer.
There is no information harvested from your computer.

http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=/netahtml/search-bool.html&r=1&f=G&l=50&co1=AND&d=ptxt&s1=5,712,979.WKU.&OS=PN/5,712,979&RS=PN/5,712,979

http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=/netahtml/search-bool.html&r=1&f=G&l=50&co1=AND&d=ptxt&s1=5,717,860.WKU.&OS=PN/5,717,860&RS=PN/5,717,860

The blog article you reference sloppily and lazily bundles this under the category 'spyware'. That's a ridiculous expansion of the term. They then transition into describing serious forms of spyware which are completely unrelated (but probably had you pissing your pants thinking it was somehow useful).

Poor manuel, poor poor manuel..

[manuel]

"There is no information harvested from your computer."

WRONG!

The fact this spyware is not installed on a user's PC does not prevent the collection of sensitive data. For example some web users are aware web sites can identify them by their Internet Protocol (IP) address. This is a privacy issue for users who opt using software such as GhostSurf or online services such as Anonymizer.com to cloak their IP address. It's like having an unlisted phone number. Just imagine if Mike started listing our IP addresses on our posts here at HackingNetflix--I doubt there would be much participation.

Aron, Mike, and Netflix have done a good job minimizing the reality of what this program is. Netflix is recording what site you came from and what site visited after using Netflix. This is most definitely a privacy issue. Lamprey is a similar program that runs off the host's CGI bin built with the purpose of tracking users on the Internet. However, the makers of Lamprey acknowledge this program may give rise to security breeches and misuse.

Quote:

A tracking technology such as Lamprey gives rise to a number of sensitive privacy and security issues. For example, since all forms submissions go through Lamprey, there exists the possibility of intercepting and recording information included in these forms. While secure protocols such as S-HTTP and SSL can be used to keep this from happening, most web-based forms are still submitted across standard HTTP and are subject to this tracking. It is also possible to hide the fact that Lamprey is active through extensions of commonly used browsers.

The potential for misuse of such tracking technology needs to be addressed explicitly by the Internet community. In our implementation, we announce Lamprey's tracking activity on every page the user sees. A banner inserted across the top of the page reminds the user that activity is being tracked, and gives the user the option to stop the tracking mechanism at any time.

End Quote

I hope you'll notice neither of the patent descriptions of Netflix's spyware uses the HTTPS protocol (secured server) or SSL (secure socket layer). You'll have more than just Netflix checking out what sites you visited. Also, when I order my online rentals from Netflix and their competitors, I usually do it at the same time. Tracking your competitors was not listed on the patents. Netflix seems to be crossing all ethical boundaries.

Minimize away. I don't think subscribers will be too happy when they learn about this.

[Aron]

HAHA, Can't argue with that!

[Mike K]

Manuel,

Give me a break. Almost every Web site owner wants to know where their traffic is coming from. Tell me you don't read your referral logs. You even noticed before I did when I dropped off of Google, so I bet you read them every day.

Netflix has stated several times this year that they are not using spyware. Have you bothered to contact them? Ask them about this?

Did you consider that they could be licensing the patents because non-spyware applications infringe on them?

BTW, how much do you really know about this stuff you're talking about? This is wrong:

"I hope you'll notice neither of the patent descriptions of Netflix's spyware uses the HTTPS protocol (secured server) or SSL (secure socket layer). You'll have more than just Netflix checking out what sites you visited."

Where is your proof to back these claims up? Facts? Screen shots?

Or is this just your opinion of what you think they are doing?

- Mike

For all of you delusional conspiracy enthusiasts, why don't you actually go out and do some investigative work?? Go get a job at a Netflix distribution center (or send an unemployed friend, relative, whatever) and find out firsthand. Instead of posting wild accusations with nothing but opinion and hearsay evidence, why not go out and get proof if you're so sure you "know" what is "really" going on at Netflix. Bring back an employee training manual or recording of a Netflix supervisor telling you to throttle a heavy users DVD's. Lets see some written or spoken proof that Netflix tells its employees to knowingly send out unplayable DVD's to heavy users. Show us a copy of an internal memo that specifically states that return envelopes with addresses for distant distribution centers should be used for heavy renters. If you're going to continue to post such accusations, then lets see some evidence that backs it up.

[manuel]

Mike asked, "Where is your proof?" when I posted Netflix's spyware collects data through an unsecured server.

1 On Internet Explorer 6.0, Click the "Tools" button on the toolbar.

2 Click "Internet Options."

3 Select the "Advanced" tab.

4 Click "Restore Defaults."

5 Click "OK"

6 Test your navigation through Netflix. Go to "Your Account:" http://www.netflix.com/YourAccount

7 Click "View Billing Activity."

You should get an security alert telling you, "You are about to view pages over a secure connection." Assuming Netflix is using patent # 5,717,860, they are spying on visitors who have just entered Netflix's web site. Visiting Netflix's homepage, your queue, and many other links is done so on a non-secure server. Any collection of personal information on these pages can be seen by anyone. Again, you'll have more than just Netflix checking out what sites you visited.

FYI: Netflix is already publicly using this spyware. "Netflix is licensed under United States Patent No. 5,717,860."

http://www.netflix.com/Affiliates

[Mike K]

Manuel,

This is getting really old. What you are describing is Web server security and it has nothing to do with spyware.

Spyware, according to the Wikipedia, is:

"Spyware is a broad category of malicious software intended to intercept or take partial control of a computer's operation without the user's informed consent. While the term taken literally suggests software that surreptitiously monitors the user, it has come to refer more broadly to software that subverts the computer's operation for the benefit of a third party."

Please explain how Netflix is using spyware, not how their site is supposedly unsecure (remember the security story you thought was so serious and how that turned out?).

Do you really understand what you are talking about?!?!

You can say what you want on your "opinion" site, but I would like you to post facts to back up your story here.

- Mike

[Mike K]

Manuel,

Sorry, I missed the reference in your post to the Netflix affiliate program. You're just confirming what I've been saying all along!!

The patent refers to the tracking of customers so that an affiliate can get credit for sending the order to Netflix. If you click on the Netflix banner on this page, I get credit for you signing up. This technology infringes on the patent, so Netflix had to pay.

This is NOT spyware and most major vendors offer affiliate programs, so you're saying that anyone with an affiliate program is distributing spyware? Amazon? Barnes & Noble?

Please show proof that Netfix is distributing spyware.

- Mike

[Aron]

Manuel, you should probably give up on technology analysis. It does not appear to be a natural skill for you.

If you weren't so stubbornly hellbent on being one-sided I might have more sympathy for you.

[Mike K]

I just realized that since I'm a Netflix (and Blockbuster) affiliate Manuel can claim that I'm spreading spyware.

Wait -- Blockbuster has an affiliate program, too. Are they spreading spyware?

Hmm...

- Mike

[DKNY]

Patent 5,717,860 involves tracking web traffic between sites, just like Mike and Aron have stated.
BTG does not develop software; all they do is buy out patents and sue companies.
As a software engineer, I find this counter-productive to say the least.

"Earlier this year, BTG filed suit against Microsoft Corp. and Apple Computer Inc. for a patent related to Web-enabled software update technologies (see story). Although the company is prepared for litigation, BTG gets the majority of its income from licensing and royalty revenue, Burrows said. BTG holds some 3,500 patents in its portfolio and brought in revenue of about $90 million in the last full year."