Spy bot (Community)

Spy bot // Community

1  ...  4  5  6  7  8  |  

ananas

Feb 24, 2002, 8:14pm
When I started the thread I was quite alarmed, because
CarolAnn told me what she had there in her log and I
checked several other world logs for the same occurance.

When it turned out that AW caused the trouble, it
reminded me very much on things about microsoft's and
other companies spyware or hidden backdoors in programs.
I'm really, seriously mad when I see things like this,
in my eyes it is misuse of a priviledge, that is necessary
for technical reasons.

In my job I often have confidential informations on servers
(intranet) where I have to trust the admin and he has to
trust me. There are special priviledged technical users
and real users who know the passwords of the technical
users. If any of the real users would misuse the password
of a technical user and anyone would find out, it would
be the last day of this person in this company, and I'm
sure she/he would have trouble to find any IT related job.
Same for the admins, they have access to these confidential
and private data, but would never use these priviledges for
anything but for technical help.

The web is a really unsecure place. If someone has special
priviledges on computers that he does not own or maintain,
and these priviledges are needed for a technical reason,
he should not use these priviledges thoughtless, except he
has been asked or invited to use them.

Once the trust is violated, it is not easy to restore it.

I do not accuse MrGrimm to have stolen any information, but
he has used his priviledges really thoughtless. His bot was
not allowed in the worlds, because there was no need for it.

[View Quote] --
"_
|
/\
\ /
__/ /_

dion

Feb 24, 2002, 8:52pm
It's not a backdoor at all, any CT can see the world features dialog
information.
[View Quote]

ananas

Feb 24, 2002, 8:58pm
Any CT can, yes. And any citizen can extract the
informatios from his cache, and I have no problem
with that. The information isn't secret.

But still the technical user ID of a universe owner
(cit. #1) is a backdoor. Not an illegal one, but it
should only be used when it is necessary.

[View Quote] --
"_
|
/\
\ /
__/ /_

zeo toxion

Feb 24, 2002, 9:38pm
Its not a backdoor unless it wasn't made to do that and it is neccesary to
build the database. The bot will be used in the future for updates and we
can't have an eruption of threads every time it happens. Its not coping our
builds or anything its just collecting a few things which will benefit the
cmmunity but the community has to jump on every little thign AW does and
make them look like malicous hackers. Why can't you just accept that they
know what thay're doing (and they do) and leave it alone.

[View Quote]

macb z@x.y

Feb 25, 2002, 12:18am
[View Quote] > Its not a backdoor unless it wasn't made to do that and it is neccesary to
> build the database. The bot will be used in the future for updates and we
> can't have an eruption of threads every time it happens. Its not coping our
> builds or anything its just collecting a few things which will benefit the
> cmmunity but the community has to jump on every little thign AW does and
> make them look like malicous hackers. Why can't you just accept that they
> know what thay're doing (and they do) and leave it alone.
>


What definition of BACKDOOR are you using? Something that does
something that it was not intended to do is usually referred to as a
"Side Effect".


Check this:

--------------------------------
http://www.webopedia.com/TERM/B/backdoor.html

BACKDOOR: Also called a trapdoor. An undocumented way of gaining access
to a program, online service or an entire computer system. The backdoor
is written by the programmer who creates the code for the program. It is
often only known by the programmer. A backdoor is a potential security risk.
--------------------------------

I and a couple of others are using the term properly. An INTENTIONAL
bit of code put in by the programmers (for whatever reason).

You and other keep getting this confused with "What the bot did." and I
think most of us agree that the bot did not do any harm in this
particular case. So there is no need to keep explaining that to us.

Now read the last sentence of that definition: "A backdoor is a
potential security risk."

That has nothing to do with the competence of the programmer. It has
to do with the ability of a dishonest insider, or a hacker on the
outside becoming aware of the backdoor and how to access it. And I know
with a fair degree of certainty that this has been done on occasion.

How do we know the backdoor exists in the first place? Because people
(AWLD people) have used it in the past and slipped up and left tracks.
Just like they did this time, except in the past the tracks have been
things like screwed up builders lists etc. We KNOW, we have EXPERIENCED
this, we are not just hypothesizing here.

It was NOT necessary to build the database (whatever the database
actually is), since the information could have been solicited from
interested world owners.

dion

Feb 25, 2002, 12:36am
ActiveWorlds is made in such a way that universe caretakers are caretakers
of all the worlds within it. What that Citizen does with those worlds is
perfectly OK as long as it does not go against the TOS that was agreed to by
the owner of the world when it has been built.

zeo toxion

Feb 25, 2002, 1:14am
actually it is documented in many places that says citezin number one has
rights in all worlds, etc etc... its pretty common knowledge if you've been
here a while. they arent trying to hide this fact and really can't with
other uni owners knowing about it. It could be a security risk becuase any
user can use cit#1 privs if they know the ppw which is highly unlikely. but
the post is saying that the bot would do harm to the worlds, steal, etc when
the programmer works for AW i think he knows what hes doing unless he wants
to get fired and banned, i think if every world got wiped out or something
they could figure it out pretty easily.

[View Quote]

gavroche

Feb 25, 2002, 8:45am
Jeeze,

this thread is REALLY out of hand.

I don't see what all the fuss is about. The bot didn't actually "enter" the
world. I logged in, didn't register as an avatar, didn't enter private
worlds, didn't query property, didn't change anything. In fact, all it did
was read a couple of world attributes. I would most definitely rather that
than AWCorp using a bot running as a citizen, which we all know is possible
as I have demonstrated a couple of times.

There are a couple of security risks which I will address to Will (MrGrimm)
and Roland about the scan, but if those are cleared, I don't see what the
concern is about.

I think it was very unwise to name the thread "Spy Bot" since it wasn't
spying, it couldn't even "hear" people within the world.

Anyhow, I strongly advise against further scans until 3.3 world server is
public, or the security of the universe could be SEVERELY compromised. For
those who understand the implications of the impersonation flaw, you will no
doubt be a little concerned about public safety related to a scan using root
rights.

*Crosses fingers and waits for the 3.3 protocol*

Take Care,

Luke.

binarybud

Feb 25, 2002, 3:15pm
grow up and try learning a little about what you speak.

[View Quote]

binarybud

Feb 25, 2002, 3:26pm
ok how about this.....they send a letter out to ASK permission to get the indexing info...and all hell breaks loose in the
newsgroups debating on how and why they should or should not index each world.....got the idea? you people are a waste of their
time and effort.......sit back and enjoy the ride....or get the hell off the ride......:) your starting to ruin the fun for the
people who are in this for fun....;) They are planning the future of their SOFTWARE not your social future..... don't be so
hard on them for trying.

Leo :)




[View Quote]

binarybud

Feb 25, 2002, 3:30pm
AWLD 1 has always been there and you know it. ALWAYS if you were not aware of it then that's where the problem lies.
AWLD 1 is needed and quite acceptable.....they can come to my world anytime and inspect it. not a problem. if you have a problem
with it then you need to find another playground they own this one...:)

Leo :)




[View Quote]

kah

Feb 25, 2002, 4:03pm
I bet that if they had asked nobody would've made a fuss and would've let
them...

KAH

[View Quote]

sw chris

Feb 25, 2002, 4:28pm
That is just a rumor, and it's not going further than that. Otherwise I
would have heard something more substantial about it by now. :) So fear
not, you have no need to worry. Hopefully.

SW Chris

[View Quote] [View Quote] On the other hand, the rumormill is now talking about AWC charging $30 extra
for that update to 3.3, even though world and 3D Homepage owners are still
required to pay the Tourist Fee, free cits for world owners have been
reduced or eliminated, and citizen prices have been raised.

How much more money do they expect us to pay before we even get a glimpse at
the "promised new features"?

*shakes head*

And they have hopes of selling this browser on a CD?

They just don't get it down there at the home office, do they?

Aine

sw chris

Feb 25, 2002, 4:31pm
The software is our social future. That is its purpose.

If they ask, a debate would spring up, sure. But each person owning a world
would be individually responsible for allowing or not allowing the world to
be indexed. The debate that would inevitably happen wouldn't matter much at
all.

SW Chris

[View Quote]

binarybud

Feb 25, 2002, 5:07pm
using an analogy......
point being it's their "book"...... and they have every right to post and publish an INDEX to ALL of it...:)
whether you want/or like them to do it.....:) everyone needs to quit "bucking the system" and quit doing it with the claim of
"privacy" or "rights" THEY own the software...:) don't like it play elswhere :)



[View Quote]

silenced

Feb 25, 2002, 5:25pm
More like they're the publishing company, and you should have the choice if
you want your work into that book.

-Silenced

[View Quote]

dion

Feb 25, 2002, 5:30pm
Too late, you already signed the contract that never stated anything about
requiring consent for such a thing.
[View Quote]

silenced

Feb 25, 2002, 5:32pm
Contract? I don't remember signing a contract. An illegal business practice
is an illegal business practice. (that is using a backdoor to get
information that is not allowed.. ie using a bot when bots aren't allowed)

-Silenced

[View Quote]

binarybud

Feb 25, 2002, 5:35pm
point is there is NOTHING illegal about it . so stop crying about it. sheeesh like you have something you want private so
lets go put it in an Active Worlds World that's pretty safe huh? LOL you guys are a hoot fer sure. hehehe


[View Quote]

silenced

Feb 25, 2002, 5:40pm
Uh, I'm not crying about it. It's very illegal to use a backdoor to get
information on something. I would just liked to have known if they were
going to do this.. maybe a universe message would've been nice. Why do
people complain about other people complaining? If you don't like it, don't
read it, simple as that. Much less respond to it.

-Silenced

[View Quote]

binarybud

Feb 25, 2002, 5:52pm
just trying to enlighten you guys.....pay attention....it's real simple....there is not a "back door" it's account AWLD1 they
have access to everything they always have, and always will...it's their software....please write this down so you remember...:)


[View Quote]

zeo toxion

Feb 25, 2002, 5:53pm
i doubt it. there would be a huge argument saying its their worlds etc
etc....either way peopel are goign to complain and this way they arent
waisting their time

[View Quote]

zeo toxion

Feb 25, 2002, 5:54pm
its not like their gettign you adress and phone number my god.....

[View Quote]

silenced

Feb 25, 2002, 5:56pm
It's the principle of the thing.

-Silenced

[View Quote]

silenced

Feb 25, 2002, 5:58pm
You don't need to "enlighten" us. You're not the all knowning person, it is
a back door, read one of the previous posts to see why it is. Yes it's
always been there, yes they have access to everything, and yes they always
wil, does this make it right? No, it doesn't, it's supposed to be a last
resort. Why not allow users to have their world indexed if they want it to
be? It's not AWLD1 btw, it's just AWLD.. get it right if you're going to
"enlighten" us please.

-Silenced

[View Quote]

dion

Feb 25, 2002, 6:05pm
Hey, I explained this before. Citizen 1 is the owner of the ActiveWorlds
Universe. In all Universes, the caretaker of the universe may enter any
world, private or not, allowing bots or not. He has full control of
everything. You did agree to a TOS when you bought the world. That TOS is
the 'contract' in this analogy.

The caretaker of the world and universe can over-ride all the permissions,
including bots and enter privelages. Citizen 1 is AWLD, which is a universe
caretaker and may enter and over-ride any and all privelages that you
cancel. It is not a backdoor! Are you clear about this? This is not a
secretive thing? A backdoor is if they had added a thing on your computer
that opened a port allowing them to connect directly to your computer and
take information off of it that did not have anything to do with your
ActiveWorlds World! This information in your rights and privelages and
features is not private. It is sent out to every person that enters your
world.

If you consider that a backdoor, to grab information that is sent to them...
then you are a nutcase.
[View Quote]

dion

Feb 25, 2002, 6:06pm
You wouldn't live a day in court with a 'principle of the thing'.

[View Quote]

silenced

Feb 25, 2002, 6:13pm
> Hey, I explained this before. Citizen 1 is the owner of the ActiveWorlds
> Universe. In all Universes, the caretaker of the universe may enter any
> world, private or not, allowing bots or not. He has full control of
> everything. You did agree to a TOS when you bought the world. That TOS is
> the 'contract' in this analogy.

Not the owner, but the "caretaker." You don't agree to a TOS when you buy a
world, maybe an agreement if you run the windows server.. but if you run the
unix one.. you don't get that.

> The caretaker of the world and universe can over-ride all the permissions,
> including bots and enter privelages. Citizen 1 is AWLD, which is a
universe
> caretaker and may enter and over-ride any and all privelages that you
> cancel. It is not a backdoor! Are you clear about this? This is not a
> secretive thing? A backdoor is if they had added a thing on your computer
> that opened a port allowing them to connect directly to your computer and
> take information off of it that did not have anything to do with your
> ActiveWorlds World! This information in your rights and privelages and
> features is not private. It is sent out to every person that enters your
> world.

Do you know what a backdoor is? It's something programmed in to allow
unrestricted access to information (in general). It doesn't have to be
secret to be a back door. Allowing access to a part of your computer is a
trojan backdoor, but where do you think these worlds are hosted? On someone
else's computer.. so it's accessing their computer. It still took
information off it, even if it was part of the universe. You're right, it's
not, but the way in which they went about to get it was.

> If you consider that a backdoor, to grab information that is sent to
them...
> then you are a nutcase.

No, it's a backdoor, look up the definition. Do you not realize how serious
this could be? All we have is MrGrimm's word that he didn't do anything,
but we don't exactly know.

-Silenced

[View Quote]

dion

Feb 25, 2002, 6:15pm
Listen, the information that the bot is getting is coming from your world.
Your world server sends that information to the browser of every person who
enters. That's like me giving you a car and then calling you a theif!
[View Quote]

silenced

Feb 25, 2002, 6:18pm
If I was going to take it to court, I'd pick a more suitable reason. Since
this is a newsgroup, I have no need to. And why isn't it illegal? No one's
said anything different then "it just takes things that are already
transmitted." But what about the way they went about getting it? Entered a
world where the owner didn't explicitly give them rights to enter, or
without consent of a world owner. That my friend is illegal. It's someone
else's data on someone else's computer, and is most definately not AW's data
when you host it yourself. Even if they have AWLD's priv, it still doesn't
make it right to violate someone's privacy (which means entering a world
where the owner didn't specificy them to be allowed). If they had asked or
posted something, it would've been fine, but they didn't, they did it in
secret.

-Silenced

[View Quote]

1  ...  4  5  6  7  8  |  
Awportals.com is a privately held community resource website dedicated to Active Worlds.
Copyright (c) Mark Randall 2006 - 2024. All Rights Reserved.
Awportals.com   ·   ProLibraries Live   ·   Twitter   ·   LinkedIn