IP over DAB Digital Radio

Speaking of DAB digital radio, Symantec's Ollie Whitehouse alerts us to the standard for tunneling IP over DAB, ETSI ES 201 735 [PDF]. This sounds extremely cool for broadcast or multicast data to inexpensive devices.

Looks like the HTC Monet uses this, not DVB-H (handheld DVB) to show TV. Virgin Mobile UK is branding it as the Lobster. El Reg has an interesting review.

Ollie is worried about the security aspects though:

Looking at this from a 30,000 ft viewpoint, a number of different and obvious attack surfaces appear to exist:
• The DAB protocol stack
• The IP stack
• Media codecs

Then, your mind starts to work:
• I wonder if they firewall the DAB connection on the device?
• Can I spoof content? If so, how hard is it to attack the media codec with this spoofed content?
• Is it possible to leverage that old IP stack DoS and take out every DAB-IP enabled mobile/cell phone in a 10-mile radius?

You end up with a situation where you could conceivably "broadcast" exploits to a geographic area if you were able to successfully attack any of the attack surfaces outlined above. It makes you think, doesn't it?

Update: also noted at...

• Geekzone
• The Smart PDA
• Reiter's Mobile TV Report

Woo and Yay for the BBC and the TV "Tax"

Snigger: UNEASYsilence discovers that the UK has a TV licensing regime. Way to go with the up-to-the-minute news, Dan.

Considering the quality of the programming on BBC TV and radio is consistently amongst best available, if not the best (IMHO), I’m really happy to contribute to the BBC this way. The moment “Aunty Beeb” stops giving value for money, that money’s going to be taken away from them. They know it, and the system works.

Also — “because of the unique way the BBC is funded” — the BBC has helped bring us technical leaps such as:

• PAL colour (when the US had the awful NTSC standard)
• 576 line TV (when the US had 480)
• Digital stereo TV sound (when the US was doing analog)
• RDS data over FM radio (which the US grudgingly picked up in half-hearted way recently)
• An open DAB digital radio standard (when the US was doing closed, incompatible digital radio)
• DVB-T digital television at no extra charge, using robust COFDM (while the US mess about with the quite dreadful 8-VSB)
• 16:9 widescreen TV broadcasts (when the US was still bickering about HD)

The regulatory regime means that the majority of the population have access to 20-30 TV channels, free of charge, from a relatively small antenna, which doesn’t need to be rotated when you change channels. Meanwhile in the US, TV antennae are butt-ugly and often need to be pointed at several different transmitters, hence the popularity of expensive cable TV.

Detector vans are rare anyway — they’re only used to gather evidence for prosecution. If your household doesn’t have a license, you’ll be “invited” to buy one. If you don’t get one, it’s up to TV Licensing to prove that you’re breaking the law.

Microsoft Promises Sender ID Remains Open, But There's No News Here

Microsoft today announced that it has added the Sender ID Framework Email Authentication spec. to the list of Microsoft technologies covered under the Microsoft Open Specification Promise (OSP). This essentially means that Microsoft promises not to take action to protect its patents and other intellectual property (IP) related to these technologies.

The idea is to remove objections to implementing against published "standards" that are based on the fear of Microsoft will sue the developer. This was the main stumbling block preventing Sender ID from becoming an Internet standard in 2004 -- the Purported Responsible Address (PRA) algorithm was patented.

Big whoop. As far as I can tell, nothing has changed. There's no news here. Move along.

This promise seems to be exactly the same promise as was made by Microsoft in 2004. It's a promise that didn't prevent the MARID working group from failing to reach consensus -- mainly due to deadlock over the IP issue.

Happy Friday

You may know that I write the daily IT Blogwatch column on Computerworld.com. Who knows, you might even read it; perhaps via its RSS feed. For those of you who can't wait for Monday's edition, here's what has to be the funniest And Finally for ages. Cliquez-vous ici [hat tip: B3ta].

There May be Troubles Ahead (for Spamhaus)

But while there's moonlight, and music, and love, and romance...

I'm reading some misinformed comment about the latest Spamhaus woes. I wrote today's IT Blogwatch on the topic, but here's my attempt to summarize here...

1. e360, which describes itself as a legitimate direct marketer [no comment], objected to being described by Spamhaus as a spammer. It sought legal redress in an Illinois state court.
2. Spamhaus argued that it was a U.K. organization with no business dealings in Illinois, so the court had no jurisdiction. However, before Spamhaus decided on this defense strategy it asked the court for the case to be removed from state court and moved to federal district court.
3. Because Spamhaus then decided not appear in court, the judge decided he had no choice but to enter a default judgment in favour of e360.
4. A further, proposed order from the court would have the spamhaus.org domain de-registered. This is potentially a huge problem for Spamhaus -- access to the Spamhaus blacklists is usually via a DNS lookup -- a query to a zone such as sbl-xbl.spamhaus.org.

For its part, Spamhaus appears nonplussed, stating that:

We think it can not actually happen, due to the effect it would have both on the Internet and on millions of users. We believe a government agency would have to step in before it happened. One U.S. government agency has begun working on a response. Before an event such as this could occur, we believe ICANN would fight the order, as ICANN understands both the technical effect as well as the political one (hint: ITU and U.S. control of the Internet).

In other words, Spamhaus is pointing to the ongoing grumbles from outside the U.S. about the continued control over Internet policymaking by the U.S. government. If Spamhaus were to "go dark" it may catalyze a new, strengthened effort to wrest control of the Internet from the U.S.

This proposed action may seriously reduce the effectiveness of our spam filters. In the meantime, what can you do to guard against the problem?

If your spam filter uses either of the Spamhaus DNS blacklists, you may be able to change the zone it uses to one that isn't under U.S. control. For example, look in your filter's configuration and change sbl-xbl.spamhaus.org to sbl-xbl.spamhaus.org.uk (note that Spamhaus has not yet confirmed that this is supported).

Alternatively, as suggested by Slashdot's The Blue Meanie, you may be able to modify the way you resolve DNS queries. In UNIX-like operating systems, you might add something like this to /etc/named.conf:

zone "spamhaus.org" in {
type forward;
forwarders {216.168.28.44; 204.69.234.1; 204.74.101.1; 204.152.184.186; };
};