Context-keyed Payload Encoding - AthCon 2010

This Thursday I will be doing a talk on "Context-keyed payload encoding" at AthCon 2010.

AthCon is a fresh IT security conference that will take place on June 3rd 2010, in Athens, Greece.

My presentation will cover both shellcode detection and NIDS evasion themes, but will mostly focus on the "Context-keyed payload encoding" technique, that allows attackers to bypass many of today's state of the art intrusion detection systems.

I must say that I'm quite excited about this event, since I've been yearning for a Greece-based technical ITsec conference for many years now..

AthCon also gives us the opportunity to meet up with old friends and respected colleagues from the field. So yes, it's going to be both interesting and fun! :^)

Hope to see you there!

P.S. registration ends today; you may want to sign up fast!

the new yada yada operator

Perl 5.12 is out!

This release introduces a new operator, called the "yada yada" which looks like an ellipsis (...) and implements a placeholder for code.

So, the following snippet is now valid perl :-)

do {
    steal_underpants;
    ...;
    profit;
};

canaries, black hats and other magic tricks

Haven't updated my blog for some time now. Hmm, maybe it needs a new look.

I've been spending most of my free time on census research projects and PhD stuff. Hopefully I'll be finishing the darn thing this year.

Anyway, I recently did a quick writeup on how canary gets randomised nowadays in Linux apps. You can find it over here.

In other news, my workmate argp will be presenting both stack and heap smashing techniques for FreeBSD kernel exploitation at this year's BlackHat Europe (woohoo!). This will be a thorough examination for both attack vectors along with notes on safe kernel continuation. You don't wanna miss this!

That's all for now.

The Netflix prize

For those of you that participated in the Data Mining session of the recent ellak workshop, there are some new developments regarding the Netflix data mining contest.

According to Slashdot and the Netflix Prize Leaderboard, there may be a winning team.. :-)

How to force a reboot when you have a RAID array attached

When the system gets stuck (yes, this happens in our beloved operating system too) who do you call?

- Sysrq of course!

My usual approach would be:
1) sync all filesystems: alt + sysrq + s (multiple times, the actual value depends on my mood :-)
2) remount all filesystems read-only: alt + sysrq + u
3) cause a reboot: alt + sysrq + b

BUT, this comes with an issue if you're doing software RAID (md).

md devices register themselves (via register_reboot_notifier) to be sync'ed whenever a reboot is about to occur. Also, if the array was being reconstructed (or re-synced) during the reboot operation, you get a nice checkpoint, so that after reboot the operation will continue off from where it left. This is all fine and dandy, but it seems that the sync/checkpointing operation does not occur if you've previously called for an emergency read-only remount of filesystems.

[ It seems that alt + sysrq + u, also makes the raid devices read-only... and thus, not being able to perform any writable operation (such as a sync or checkpoint). BUT, I've yet to find the part of the code that is the cause of this. I'll have another look though, as soon as I figure out what's going on with libata lately. Since 2.6.25 I've been having timeout troubles with my SATA drive (yes, a seagate one). The lkml-suggested 'noncq' option hasn't helped much.. ]

ANYWAY, back to our subject. So you have a raid-array and you want to reboot?
- Just sync (alt + sysrq + s) and reboot (alt + sysrq + b) without doing any RO-remounting.

Leeching Picassa Albums

Here's a tiny python script for downloading Picassa photo albums!

It requires two parameters: the album's RSS URL (there's
a link to this at the bottom of each album page) and the pathname
of the directory where the downloaded photos will be stored.

Enjoy :-)

#!/usr/bin/env python

import urllib
import feedparser
import sys
import os

if len(sys.argv) != 3 :
   print >> sys.stderr, (("usage: %s " + 
      "<picassa-album-rss> <local-dir>") % sys.argv[0])
   sys.exit(1)

album_rss = sys.argv[1]
local_dir = sys.argv[2]

if not os.access(local_dir, os.W_OK | os.X_OK):
   print >> sys.stderr , ("error: dir %s is not writable" %
                          local_dir)
   sys.exit(1)

abs_dir = os.path.realpath(local_dir)

feed = feedparser.parse(album_rss)

total_items = len(feed.entries)
if total_items == 0:
   print >> sys.stderr , ("error parsing url %s" % album_rss)
   sys.exit(1)

for i in range(total_items):
   # of course this breaks once Picassa change their rss format..
   website = feed.entries[i]["enclosures"][0]["href"]
   slash_pos = website.rindex("/")
   pic_name = website[slash_pos+1:]
   urllib.urlretrieve(website, "%s%s%s" % (abs_dir, os.path.sep,
                                           pic_name))
   print "downloaded: %s (%i/%i)" % (pic_name, i+1, total_items)

"Software Libre Society events" report

What was missing?

There was a need (for some time now) for a real discussion forum on Software-related issues, targeted towards the growing Free Software community in Greece. A place where developers could meet on a regular basis, present their work and exchange ideas with other members of the local community. A place where sysadmins could talk about "best practices" in their line of work and receive valuable feedback. A "computer club" that would present new developments in hardware, software and in the tech-y world at large. A place where the recreational hacker would feel at home :)

How did the "Software Libre Society events" cοme to be?

In October 2007, two 1st-year students from the Department of Informatics of the University of Piraeus dropped the following question to the administration team of the CS-laboratories: "Why don't we do a local OSS event?". Although we had been hosting 1-or-2 such events each year (install fests, distro demo's, MySQL 5.0 show by David Axmark and friends), I was thinking that maybe this time we should be going for something more of a community event.

Having some previous experience from "Δαίμων" (a software forum that was hosted at the University of Athens, a few years ago), the "ΕΛΛΑΚ workshops" (www.ellak.gr) and the support of friends from the local Linux User Group (www.hellug.gr), we set out to empower both the local university community (oss.cs.unipi.gr) and ultimately the Greek OSS community, by creating a weekly event that was targeted specifically for this audience.

What does a "Software Libre Society event" look like?

Every Friday at 18:00pm to 21:00pm (EET) we have 2 (sometimes 3) presentations in a Computer Science Laboratory at the University of Piraeus (the room has a 50-person quota which is OK for now but we might have to move to a bigger place if needed).

Each presentation takes approximately 45' and is followed by a 15' Q&A session. We try to organise the presentations so that we first have a technical subject which is then followed by some lighter subject, or an introductory subject followed by a more advanced one. We also try to group similarly themed presentations together.

Each session has its own documentation page on the community's wiki. The wiki contains the event schedule, presentation files, various flyers, related links and other information related to the presentations.

During the presentations, there's a live video stream for all those who couldn't make it to the event. Once the captured video's have been edited, they become available on the wiki.

There's a 10' break between presentations so you can strech your legs, socialise, grab a cup of tea/coffee/beer.. Once the presentations are over, we usually go out and have something to eat. This has become quite a tradition and some may even argue that it constitutes half of the event :)


EventZero

In the initial event I did an intro on Free Software and GNU/Linux which was followed by the remarkable team of "iloog" developers (Giorgos Kargiotakis, Leuteris Zafiris) who presented their distribution (and the distro it's based on, Gentoo). The event was a big success, with a 40-person attendance, half of them coming from greek OSS communities (unipi.gr, ntua.gr, upatras.gr, ilug.gr, hellug.gr, ubuntu.gr, linuxformat.gr and GRnet's #linux/#linuxhelp) and the other half being mainly university students.

Unfortunately there was no video capture of this event, but we managed to get a few photos such as the one below:



The event was followed by a beer drinking session at "The Stand" in Exarcheia.

EventOne

In this session Dimitris Glezos introduced us to the Fedora platform and his own work on the (GSoC sponsored) software called Transifex! Lambros Papadimitriou went on to present the wonderful packet manipulation library called "scapy", which he used in his own project Pluto.



The event was well attended (approx 30 persons). It was recorded to digital video and a small sample can be found here.

The event organisers went on to watch a show of the "Night on Earth" band at the Small Music Theater in Athens.

EventTwo

This was the first event of these series to be broadcast over the internet (and have questions fed over irc).

Lambros did an introduction to Source Code Management tools and explained the Subversion SCM. Giorgos Keramidas (of FreeBSD fame) continued on with a presentation on distributed SCMs with a focus on Mercurial.



Although the stream was available over the internet we had a wopping 35-person attendance! Our tiny webserver got 2120 hits and there were 10 people watching over the net.

Once the event was over we headed towards "Rozalia" at Exarcheia to have something to eat.

EventThree

This time Giorgos Keramidas took on a different subject (one he knows by heart), the FreeBSD project! He was followed by Nikos Kokkalis who explained a few things about the greek FreeBSD documentation project. The event ended with Zafiris Galanopoulos' (poetic?) presentation on the XeLaTeX typesetting system, whose features were much anticipated by the greek-typesetting community for some time now.



The event was well attended (almost 30 persons) and got great reviews!

IIRC we had dinner at "Hardalia's Koutouki" in Kalithea that night.

EventFour

Last Friday's event was a big success. We met with lots of people we hadn't seen in ages (kudos to the AWMN OSS guys!) and the attendance could only be compared to that of the initial event (40+ persons there, 15 viewers from the internet). What is really important is the fact that as the events continue on, the percentage of the OSS community within the attending parties is growing strong, thus allowing for more technical questions during the Q&A and later discussions.

As far as the presentations are concerned, Gregory Potamianos presented the Debian GNU/Linux distribution and a few tricks for the already initiated, while Apollon Oikonomopoulos presented the MacOS X platform, from the Unix user's point of view.



Discussions continued on in a beer drinking session at "Ostria" in Exarcheia and we later moved to a tavern called "Efimeron" for dinner. For some strange reason we kept on bumping into people from the events during our walk in the center of Athens. Seems the community is everywhere..beware! :o)

xmas special event

This Friday we will be having a special event dedicated to computer graphics!

Giannis Tsiompikas (aka Nuclear in the Demo scene world) will be presenting the principles behind the Design and Implementation of 3d graphics engines, along with a demo of his older engine "3dengfx". Christos Smailis will follow, taking us on a trip to the world of 3d modelling with Blender!

There's a good chance there's going to be a surprise at the end of the event, so don't miss it! :)

Preparing a DivX movie for your standalone DivX player

Here's an avidemux guide for processing DivX movies to make them suitable for playback on standalone DivX/DVD players.

You can use a shell script to prepare all of your movies, since Avidemux can be configured to perform most (if not all) operations from the command line!

Cool stuff.

Tip for saving printing paper

One can save on paper supplies, by printing multiple pages in single A4 paper sheets.

On GNU/Linux you can do this with the pdfjam utilities.

# apt-get install pdfjam

The following cmdline turns file[1-3].pdf into a single pdf file

$ pdfjoin --outfile single.pdf file1.pdf file2.pdf file3.pdf

We now put two pages into one (in landscape mode)

$ pdfnup --outfile 2_pages_in_one.pdf single.pdf

You may wish to enable double sided printing through CUPS at this point.

Your job is now ready for printing.

$ lp -d printer_name 2_pages_in_one.pdf

Sylphis3D has been GPL'ed!

I still can't believe it.. We were all hoping for this to happen sometime, but the actual news took us by storm! Sylphis3D, one of the most advanced 3D engines out there, has been made OpenSource!

Congrats to the lead developer Harry Kalogirou, who turned a part-time project into a landmark in the gamedev world. I hope the project will flurish in many exciting ways, bringing the "cream of the crop" in 3D to the OpenSource community.

Bravo Harry!

Implementing Polymorphism in C

A few months ago I was doing some work on Linux /proc fs. As you may already know, procfs (just like any other filesystem in Linux) implements the VFS API. The VFS API groups together common concepts between filesystems (e.g. retrieving an i-node from a pathname, assigning permissions to an i-node etc.). This allows for some polymorphism in the kernel code: a module requiring a VFS operation upon a file, does not need to know the actual type or inner-workings of the filesystem hosting this file.

In order to apply Objected Oriented Programming concepts to C code, one could map classes to structs, attributes to struct members and methods to function pointers. Having said this, there exists a small issue here that can be quite disturbing (other than the OOP->C mapping :-). A function pointer restricts (via the function prototype) the type of parameters passed to the function it is pointing to.

One can use void pointer parameters to allow for varying parameter types, but this decreases the code readability (i.e. function prototypes include void pointer arguments instead of meaningful types) and disables parameter type checking.

Another approach is to introduce a common structure, which will be passed as parameter to the polymorphic function, hiding all type-dependant data in a special field of this structure. This special field is usually a void pointer or a union and is used as private storage space for each implementation of the polymorphic function. This is common practice and can be found in many TCP/IP stack implementations. Should a void pointer technique be used, there would be some code readability issues regarding the structure definition. The union approach, although more verbose in nature, ties the definition of the special field with all possible types of private data and in this way, forces an update on the struct definition each time a new type is introduced.

So, how can we keep the function prototype as generic as possible and at the same time have descriptive parameter types without changing too much code?

Instead of employing a one-level inheritance scheme, where a base struct contains a special field for use by "sub-classes", we can reverse this model to allow for arbitrary inheritance levels (and get multiple inheritance as a bonus!):

"struct mydriver" is a struct used by an imaginary device driver. This driver adheres to some driver API and as such inherits "struct driver_API" from this API. The driver makes use of a character device and hence inherits some utility functions from "struct char_driver". Thus, "struct mydriver" would look something like this:

struct mydriver {
  struct driver_API d_api;
  struct char_driver char_dev;
  time_t timeout;
  int fd;
};

struct members "timeout" and "fd" are mydriver-specific. Now, let's say that we wish to override a function found in the "struct driver_API" with a mydriver-specific one which makes use of the "timeout" field. The function pointer "update_pci_timeout" yields this function's prototype as follows:

struct driver_API {
  ...
  time_t (*update_pci_timeout)(struct driver_API *d_api,
                               time_t new_timeout);
  ...
};

The mydriver implementation of this function would look something like this:

time_t mydriver_update_pci_timeout(struct driver_API *d_api,
                                   time_t new_timeout)
{
  struct mydriver *mydriver_data;
  ...
  mydriver_data = get_mydriver_ref(d_api);
  if ((mydriver_data->timeout) < 1900){
    ...
  }
  ...
}

Hmmm, what is this magical "get_mydriver_ref"? It returns a pointer to the child (outer "struct mydriver") given a pointer to the parent (inner "struct driver_API"). Of course this only works if "struct driver_API" was previously instantiated as a member of a "struct mydriver", but this is a safe assumption since the scope of our code is limited to the "mydriver" driver.

What follows is the code for "get_mydriver_ref". It uses a bit of GCC magic (macro "container_of") to get the address of the outer struct.

#define container_of(ptr, type, member) ({ \
  const typeof( ((type *)0)->member ) *__mptr = (ptr); \
  (type *)( (char *)__mptr - offsetof(type,member) );})

struct mydriver *get_mydriver_ref(struct driver_API *api){
  return container_of(api, struct mydriver, d_api);
}

"container_of" is defined in <linux/kernel.h> of the kernel sources. You can see an example of its use with PROC_I (returns procfs-specific data for an i-node) in linux/fs/proc/inode.c

Recovering Deleted Files through open fd's

oops, you deleted a file you've just downloaded thru a p2p file sharing app.

Maybe there's still a chance getting your data back without using your forensics kit.

Unix never releases the data blocks that are linked to a file, if a file descriptor to that file is still open. Hmmm, maybe if this p2p app is still running, we can get our file back, no?

p2p apps tend to have many file descriptors open since they're constantly sharing files to other peers. There's a good chance a file descriptor might still be open for the file you're missing. Linux gives you access to the file descriptor <n> of a process with pid <pid> thru /proc/<pid>/fd/<n>. This file looks like a symlink pointing to the pathname of the (long-lost?) file. Using open() on this file will not dup() the process fd [1] but will instead give you a new file descriptor pointing to the start of the relevant file. The following example illustrates this basic principle.

xx@yyy:/proc/1952/fd$ ls -al
total 0
dr-x------ 2 xx users 0 Feb 2 03:33 .
dr-xr-xr-x 4 xx users 0 Feb 2 03:33 ..
lrwx------ 1 xx users 64 Feb 2 03:34 0 -> /dev/null
lrwx------ 1 xx users 64 Feb 2 03:34 1 -> /dev/null
lrwx------ 1 xx users 64 Feb 2 03:33 2 -> /dev/null
lrwx------ 1 xx users 64 Feb 2 03:34 3 -> /tmp/foo (deleted)
lr-x------ 1 xx users 64 Feb 2 03:34 4 -> /var/lib/somefile
lr-x------ 1 xx users 64 Feb 2 03:34 6 -> /var/lib/some-other-file
xx@yyy:/proc/1952/fd$ dd if=3 of=/tmp/bar
0+1 records in
0+1 records out
175 bytes (175 B) copied, 0.000441111 seconds, 397 kB/s

In case you're wondering, the '(deleted)' flag comes from the fact that the particular dentry does not have a corresponding hash entry in the dcache. For more details, see fs/dcache.c and include/linux/dcache.h in your kernel sources.

So, now you got one more reason to share your files :-)

[1] Am I the only one that found this the logical thing to do? :p

You must be kidding me.. Part 1

from the manpage of diskseekd (1):

Several people have noticed that Linux has a bad tendency of killing floppy drives. These failures remained completely mysterious, until somebody noticed that they were due to huge layers of dust accumulating in the floppy drives. This cannot happen under Messy Dos, because this excuse for an operating system is so unstable that it crashes roughly every 20 minutes (actually less if you are running Windows). When rebooting, the BIOS seeks the drive, and by doing this, it shakes the dust out of the drive mechanism. diskseekd simulates this effect by seeking the drive periodically. If it is called as diskseek, the drive is seeked only once.

The linux-gate.so & VDSO story

If you ever wondered why linux-gate.so keeps appearing on your ldd

$ ldd /bin/ls 
     linux-gate.so.1 =>  (0xffffe000)
     librt.so.1 => /lib/tls/librt.so.1 (0xb7f39000)
     libacl.so.1 => /lib/libacl.so.1 (0xb7f30000)
     libselinux.so.1 => /lib/libselinux.so.1 (0xb7f1b000)
     libc.so.6 => /lib/tls/libc.so.6 (0xb7de3000)
     libpthread.so.0 => /lib/tls/libpthread.so.0 (0xb7dd1000)
     /lib/ld-linux.so.2 (0xb7f55000)
     libattr.so.1 => /lib/libattr.so.1 (0xb7dcc000)
     libdl.so.2 => /lib/tls/libdl.so.2 (0xb7dc8000)
     libsepol.so.1 => /lib/libsepol.so.1 (0xb7d87000)

then this blogpost is for you. It also says a few things about Virtual Dynamic Shared Objects (vdso's) and the sysenter instruction found on modern x86 cpu's.

userspace filesystems

Once a year I do a "filemanager" poll: I check on the status of two-pane file managers, looking for something that resembles Total Commander, only in Unix.

This year I ran into gnome-commander while looking for a file-manager that would support libgnomevfs (with its exotic sshfs, smbfs and so on).

It strikes me odd, the fact that there is so much code duplication between user-space filesystem projects. There are three levels of userspace filesystem implementations on Linux software right now:

• Virtual filesystems implemented within the file-manager (such as a virtual filesystem for tar.gz contents)
  
• Userspace filesystems exported via libraries (and object broker services), to applications (such as gnomevfs sshfs module, or samba kio-slave)
  
• Kernel-assisted userspace filesystems, accessible by all applications, but requiring manual setup (see FUSE-related projects)
  

Is there a way to unite these projects so that people don't have to write the same code over and over again? Shouldn't a newly mounted userspace filesystem, be available to all applications and not just the one that generated it?

More on this later.

Rebuilding freetype on Debian

My rather slow desktop (450mhz) is becoming more and more sluggish.

A friend insisted that I should try compiling [1] libfreetype for my machine. Debian uses "-g -O2" for the official libfreetype6 package, which I turned to "-O3 -march=k6-2" in debian/rules.

apt-get build-dep libfreetype6
apt-get source libfreetype6
cd freetype-2.2.1
vi debian/rules
dpkg-buildpackage -b -nc -rfakeroot
dpkg -i ../libfreetype*.deb

The optimisation flags helped a lot. Firefox seems a bit more lightweight now, gimp does font-kerning in 'no time' and gnome-commander displays directory entries much much faster.

I should note here that according to the info pages of gcc [2] -mmmx and -m3dnow do not add any optimisations to the source code. They simply enable the corresponding cpu operations in the form of builtin functions, such as:

v8qi __builtin_ia32_paddb (v8qi, v8qi)

kudos to vvas
[1] apt-build automates package building/upgrading on Debian
[2] pinfo is a nice browser for info pages btw..

Catharsis (flushgmail)

When I got my gmail account I read the ad saying "this is a fantastic spot to subscribe to all your favourite mailing lists and never delete any email EVER". Saw I said, "ok, let's do that". I started subscribing to a few mailing lists (with lots and lots of traffic) and what do you know? 22k email messages on the first month. So I said "my bad, let's delete all these messages and I'll just read my news from tin as usual". But I found no way of doing this.

Months and years passed and not a single time did I use this account. Why? Because it was muffled with all these garbage messages. "Time to change this", Yoda said. So I looked at fetchmail's manpage to see if I could get rid of all messages in a POP3 mailbox (yes gmail now gives you POP3-SSL access). Guess what? You can't do this without retrieving part of the messages. I resorted to something like this:

fetchmail -v -a --ssl -p POP3 -u account@gmail.com pop.gmail.com --bsmtp /dev/null

"Oh, such inefficiency!" cried the young padowan and ran towards the masters.

I say, since we're still on Catharsis weekend, let's do a proper flush for gmail :)

flushgmail.pl
---------------------------------------------------------------
#!/usr/bin/perl -w

use Term::ReadPassword;
use Mail::Transport::POP3;

my $gmail_server = "pop.gmail.com:995";
my $stunnel_pid_file = "/tmp/flushgmail_stunnel4.pid";

die "usage: flushgmail.pl <localport>\n" unless(@ARGV == 1);

my $localport = shift @ARGV;

print "Enter gmail username: ";
my $username = <>;
die "error: no username provided!\n" unless defined $username;
chomp($username);

my $password = read_password('      gmail password: ');
die "error: no password provided!\n" unless defined $password;

sub report {
      my $msg = shift;
      print "flushgmail: $msg\n";
}

sub stunnel_shutdown {
      my $msg = shift;
      report($msg);
      if (-r $stunnel_pid_file){
              kill('TERM',`cat $stunnel_pid_file`);
      }
}

sub sig_int_catcher {
      stunnel_shutdown("stunnel emergency shutdown");
      die "flushgmail: caught SIG_INT!\n";
}

$SIG{INT} = \&sig_int_catcher;

stunnel_shutdown("destroying old stunnel instances");

report("spawning new stunnel");
open(STUNNEL, "|stunnel4 -fd 0");
print STUNNEL << "STUNNEL_END_CONFIG";
pid = $stunnel_pid_file
[gmail]
accept = $localport
client = yes
connect = $gmail_server
STUNNEL_END_CONFIG

close(STUNNEL);

my $total_deleted_msgs = 0; 
my $run = 1; 
while(1){  
      my $pop3_conn = Mail::Transport::POP3->new(
              port     => $localport,
              hostname => 'localhost',
              username => $username,
              password => $password);

      unless (defined($pop3_conn)){
              stunnel_shutdown("emergency stunnel shutdown");
              die "error: could not connect to stunnel\n";
      }
    
      my $msg_cnt = $pop3_conn->messages;
      last if ($msg_cnt == 0);
      report("run #$run found $msg_cnt messages");

      my @ids = $pop3_conn->ids;
      $pop3_conn->deleted(TRUE, @ids);
      $pop3_conn->disconnect;
      $total_deleted_msgs += $msg_cnt;
      ++$run;
}

stunnel_shutdown("shutting down stunnel");
report("deleted $total_deleted_msgs messages");

To use the script you'll need Perl modules Mail::Box and Term::ReadPassword, as well as stunnel4 (cause Mail::Box doesn't support SSL natively yet).

If you're wondering why there's a loop around the POP3 connection.. I noticed that each time I connected to gmail, the pop3 server provided me with just a subset of my mailbox (ranging from 500 to 1200 messages) instead of the whole thing. Maybe this is the way gmail organises their mbox'es, in volumes of a certain size..

Privacy

(recovered from livejournal)

I'm becoming more and more concerned about privacy issues on the web, especially the so called "user-tracking" problem. Let's say that provider A is controlling the web sites A1, A2 and A3. User Stella is browsing through the web, hopping thru websites Z -> A1 -> D -> E -> A2 -> A3. Provider A can track a good proportion of Stella's web-browsing activities, by examining the logfiles of the webservers hosting the sites A1, A2, A3 (plus any info coming from referer sites or followed-links). The logfiles contain (among other things) browser identification info (OS, version etc.), the actual page requested (along with any URL-submitted parameters), and the IP address of the public host that seemed to have requested the page in question.

I'm not really interested in what the provider does with this data (user-modelling, data mining etc.). What I'm concerned about is the possibility that a single entity could control such a number of websites that it would be feasible for this entity to reconstruct part of a (random) user's web-surfing route.

Of course the number of sites that a provider would need to control seems at first look daunting. If you even consider that the sites must be of varying subjects, so as not to follow just the people that have clustered around a specific domain of interest, this makes the user-tracking task look even more daunting.

But, let's imagine the following scenario:

A company offers the following services:
a) Search Engine
b) Ads (or other site-embedable objects like website usage statistics, maps etc.)
c) Blog-space
d) Webmail
e) Social Networking
....
If you're beginning to see the pattern here then maybe it's time to pass some legislation regarding the effective web presence (or omnipresence for this matter) of entities with common interests...

..or maybe it's high time we start looking for anonymizing proxies :P

Current Mood: worried
Current Music: Husnu Senlendirici - Husnu Klarnet