Threat Level Privacy, Crime and Security Online Swedish ISP Thwarts Copyright Cops by Erasing Data

The Swedish telecom operator Tele 2 plans to erase all data identifying its 600,000 customers, a decision that will undermine the new IPRED law and make the hunt for internet scofflaws more difficult.

Starting on Tuesday, Tele 2 will destroy records of IP addresses after they’ve been processed for internal use. It’s a way to secure the customers’ privacy — and, the company likely hopes, to strengthen the ISP’s market position.

“This is a strong wish from our customers and therefore we’ve decided to no longer keep records of customers’ IP addresses,” Tele2’s CEO in Sweden, Niclas Palmstierna, told the Swedish news agency TT. “We do this to strengthen the protection of customer privacy.”

“We’ve analyzed the legislation carefully and found that we have no obligations at all to store information about our customers’ IP addresses,” he continued.

The IPRED law went into effect on April 1 in Sweden and allows courts to order ISP’s to hand over details that can identify suspected illegal file sharers. Previously, the only option for copyright holders was to report alleged infringement to the police.

Tele 2 is following the example of Bahnhof and Alltele, smaller Swedish internet operators that declared early on that they would no longer store users’ IP addresses. But the announcement from Tele 2 is of considerably greater significance, since the company is one of Sweden’s main telecom providers and boasts a giant customer base.

With no data to reveal, the new law will be ineffective.

Henrik Pontén of the Swedish Anti-Piracy Bureau is very critical of the operators’ decision.
“This will cause a huge problem for the police in their investigations of severe internet crimes, such as child pornography,” he told Threat Level. “I think it’s a shame that a company puts its profit interest ahead of their customers’ safety. This will open the door to crime.”

A police official told TT that this could have a serious impact, not only on law enforcement’s bid to crack down on internet pirates, but also on other criminal investigations.

“In some cases, this will make an investigation impossible,” said Stefan Kronkvist, the head of Swedish police’s internet crime unit.

The police are now waiting for a new legislation implementing the European Union’s data retention directive, which would force ISPs to store electronic data for a minimum of six months. That law is planned to come into force this fall.

By Kerstin Sjoden

The Pirate Bay verdict, dishing the dirt

The Pirate Bay ruling has been translated into English, and it's full of little surprises. Ars dives in to answer the big questions: who possessed those Klomifen tablets, how much did the state pay to defend The Pirate Bay admins, and why did the backers consider moving to Argentina?
Thanks to music trade group IFPI, the recent Pirate Bay ruling has now been "Englished" (PDF). While the verdict itself is well-known, numerous case details will be surprising to non-Swedish speakers—such as who paid for The Pirate Bay defense, which defendant was also arraigned on drug charges, and what happened to all that Pirate Bay computer equipment confiscated by the police?

A masterpiece of prose, the verdict is not. "A number of different filesharing programs and technologies have been developed over the years," says one representative section. "There have been or are two main types of filesharing systems."

But it does offer plenty of fascinating detail that was difficult for those not at the trial to learn. Let's take a look.

Confiscated equipment. All the confiscated servers and routing equipment from a police raid on The Pirate Bay "is declared forfeit," while other seized computers will remain confiscated "until the sentence has become legally binding." That process could take years, given the appeal already filed in the case, so by the time the equipment could be released, it will be obsolete.

Confiscated drugs. In the section devoted to defendant (and lover of wispy beards) Gottfrid Svartholm Warg, we come across this curious section. Not only were computers confiscated, but police picked up "three confiscated tablets of Klomifen," "narcotic drugs," and a "spoon containing traces of amphetamine."

Turns out that Warg wasn't just accused of aiding copyright infringement but also of violating Sweden's Prohibition of Certain Health-Impairing Goods Act. As part of the 2006 police raids on The Pirate Bay, the cops searched an apartment belonging to Warg's parents, where they found several of the listed items in "a drawer unit" and "a cupboard at the desk." Warg said that the apartment had been rented out to others at the time and that he had no knowledge of the drugs there; the court agreed that nothing had been proven against him.

But there was a second incident in June 2007, when a police patrol was called to an apartment and found Warg "heavily intoxicated." In his backpack, other "preparations" were found. Warg told the court "that, despite being intoxicated, he can remember the event. He has also stated that the backpack was his, but that he, at some point during the evening, had lent it to some individuals at the party. He knows 'approximately' who he lent the backpack to, but he does not want to reveal the names of these individuals."

This didn't go over well with the court, which found "beyond reasonable doubt that Gottfrid Svartholm Warg has been in possession of the preparations in question, and that he should, therefore, be sentenced for breach of the Prohibition of Certain Health-Impairing Goods Act."

Who paid for the lawyers? The older (and much richer) defendant Carl Lundström apparently paid for his own lawyer, but the three Pirate Bay admins did not. Their lawyers were all supplied an eventually paid for by the Swedish government, and they weren't cheap. Fredrik Neij's lawyer, for instance, was given 949,025 kronor (about $115,600) for his services; 35,525 kronor of that amount was given for "time wasted."

On moving to Argentina or Russia. As it became clear that Sweden might not be the best long-term base for The Pirate Bay, Carl Lundström explored the possibility of moving the site to Russia or Argentina—and he asked the Swedish Embassy for help. "A request by Carl Lundström to the Swedish Embassy in Argentina for assistance in relocating the operation there, since the situation vis a vis copyright in Argentina could be assumed to be more user-friendly than in Europe, was turned down by the Embassy," says the verdict. "Carl Lundström then contacted an Argentinean lawyer with the aim of ascertaining the cost of establishing the operation as a company in Argentina."

Similar moves were made in Russia; nothing appears to have come of them.

Legal advice. Why the interest in getting out of Sweden? A new copyright law came into effect in 2005, and Lundström worried that it would make the site illegal. "Carl Lundström contacted a lawyer," says the verdict. "Following discussions with his legal representative, he e-mailed Gottfrid Svartholm Warg and mentioned that as of 1 July 2005, the operation would be unlawful and that they should, therefore, consider relocating the operation to another country."

In the meantime, Fredrik Neij sought some legal advice of his own. Rather than pay a lawyer, though, he sought out the advice of a "law student who, in turn, checked with his teachers and professors." Based on advice from the student, Neij told the court that he believed The Pirate Bay was legal.

The Pirate Bay meets... TV? One other curious revelation was that Lundström had the idea back in 2006 "for new services in the form of a pooling of The Pirate Bay’s website and a digital television receiver." Few details are offered, but this sounds a bit like a set-top box that could tune TV and also grab video content from The Pirate Bay. As with many of the other schemes mentioned in the verdict, nothing came of this.

The Google defense. During the trial, the defendants harped on the fact that Google also indexes .torrent files, many of them infringing; why was a search engine like The Pirate Bay on trial while a search engine like Google was not?

Here is the judge's answer in its most condensed form: ""In accordance with what will be further demonstrated below, all the defendants were aware that a large number of the website’s users were engaged in the unlawful disposal of copyright-protected material. By providing a website with advanced search functions and easy uploading and downloading facilities, and by putting individual filesharers in touch with one other through the tracker linked to the site, the operation run via The Pirate Bay has, in the opinion of the District Court, facilitated and, consequently, aided and abetted these offences."

What happened to the "safe harbor"? US law offers immunity (under both the Communications Decency Act and the Digital Millennium Copyright Act) to certain websites and ISPs for the actions of their users. Europe's "Electronic Commerce Act" contains a similar provision, but the judge found that The Pirate Bay didn't qualify. Why not? Because the law requires that a service provider was "not aware of the existence of the illegal information or operation, and was not aware of facts or circumstances which made it obvious that the illegal information or operation existed or who, as soon as he received knowledge about or became aware of this, prevented the spread of the information without delay."

Since they posted many of the takedown letters sent in by copyright owners, the admins certainly knew about all sorts of copyright infringement taking place on their site. They did nothing about it and instead mocked the rightsholders. "It must have been obvious to the defendants that the website contained torrent files which related to protected works," said the court. "None of them did, however, take any action to remove the torrent files in question, despite being urged to do so. The prerequisites for freedom from liability under §18 have, consequently, not been fulfilled."

Translation: no immunity.
The end of the beginning

Despite the verdict, the case is just getting started. Defense lawyers have already filed an appeal and have since accused the judge overseeing the case of a conflict of interest. Judge Tomas Norström belongs to a couple of Swedish copyright associations, a fact no one managed to dig up before the trial.

While the court's judgment sheds plenty of light on how The Pirate Bay operated and what its backers believe, the least relevant part of it may in fact be the legal reasoning.

mp3-2-swfembedder

//mp3-2-swfembedder.java
//@author Alex Zaharis, Dini Martini
//WDFIA 2009

import java.io.IOException;
import java.util.ArrayList;
import com.flagstone.transform.FSMovie;
import com.flagstone.transform.FSShowFrame;
import com.flagstone.transform.util.FSSoundConstructor;

class mp32swfembedder{
public static void main(String[] args){
try{
FSMovie movie = new FSMovie("theproof.swf");
FSSoundConstructor sounder = new FSSoundConstructor("theultrasound.mp3");

float framesPerSecond = 12.0f;
int samplesPerBlock = sounder.getSampleRate() / (int) framesPerSecond;
int numberOfBlocks = sounder.getSamplesPerChannel() / samplesPerBlock;
movie.add(sounder.streamHeader(samplesPerBlock));

for (int i=0; i numberOfBlocks; i++) {
movie.add(sounder.streamBlock(i, samplesPerBlock));
movie.add(new FSShowFrame());
}
movie.encodeToFile("aizak.swf");
}
catch (Exception e)
{
e.printStackTrace();
}
}
}

Libraries can be found here.
Examples can be found here.

Deep packet inspection could be outlawed in US

US lawmakers are set to limit the way ISPs use deep packet inspection (DPI), even though no American service providers are using the technology.

Representative Rick Boucher, a Virginia Democrat, and three privacy experts, speaking at a hearing before the House Energy Commerce sub-committee urged lawmakers to pass comprehensive online privacy legislation in the coming months.

While DPI can be used to filter spam and identify criminals, the technology raises serious privacy concerns, Boucher said. "Its privacy-intrusion potential is nothing short of frightening," he added. "The thought that a network operator could track a user's every move on the Internet, record the details of every search and read every email ... is alarming."

Boucher, chairman of the House Subcommittee on Communications, Technology and the Internet, said he planned to introduce a privacy bill for online users. That legislation could possibly prohibit DPI for use in behavioural advertising and other uses not related to security or network management, he suggested.

Officials with Free Press, the Center for Democracy and Technology (CDT) and the Electronic Privacy Information Center (ERIC) all spoke in favour of online privacy legislation. "In our view, deep packet inspection is really no different than postal employees opening envelopes and reading letters inside," said Leslie Harris, president and CEO of CDT. "Consumers simply do not expect to be snooped on by their ISPs or other intermediaries in the middle of the network, so DPI really defies legitimate expectations of privacy that consumers have."

Comcast and Cox Communications, both cable-based broadband providers, have experimented with using DPI in conjunction with behavioural advertising, but panelists at the hearing said they knew of no US ISP now using DPI that way. However, there are about a dozen companies offering DPI services to ISPs, said Ben Scott, policy director at Free Press.

With ISPs staying away from DPI, Congress should let ISPs self-regulate, said Kyle McSlarrow, president and CEO of the trade group the National Cable and Telecommunications Association. "Any technology can be used for good purposes and for bad," he said. "We recognise that no one would want us looking at the communication in e-mail. We don't particularly want to do that."

The technology is changing so rapidly, it may be difficult to draft appropriate legislation, he added. "There are new models being created," he said. "It's fairly hard to freeze, in one point and time, a fairly immature marketplace. We should allow industry and all stakeholders to try to work together ... come up with self-regulatory principles that protect consumer privacy."

Some Republicans on the subcommittee also questioned whether legislation should be targeted only at ISPs. "Our focus should ... look at the entire Internet universe, including search engines and Internet advertising networks," said Representative Cliff Stearns, a Florida Republican. "Consumers don't care whether you are a search engine or a broadband provider; they just want to ensure that their privacy is protected."

Privacy advocates also urged lawmakers to go beyond rules that would force ISPs to get opt-in permission from customers before tracking their online activities. In many cases, customers don't completely understand what they're being asked to opt into, said Marc Rotenberg, EPIC's executive director.

"I don't think [opt-in] is sufficient because it won't be meaningful unless consumers understand what data about them is being collected and how it's being used," he said.

By Grant Gross, IDG news service

BT blocks off Pirate Bay

BT and other mobile broadband providers are blocking access to The Pirate Bay, as part of a "self-regulation" scheme.

Read our top ten Pirate Bay putdowns here.

BT Mobile Broadband users who attempt to access the notorious BitTorrent tracker site are met with a "content blocked" message.

The warning page states the page has been blocked in "compliance with a new UK voluntary code".

"This uses a barring and filtering mechanism to restrict access to all WAP and internet sites that are considered to have 'over 18' status," the warning states. It goes on to list a series of categories that are blocked, including adult/sexually explicit content, "criminal skills" and hacking.

It's not stated which category The Pirate Bay breaches, although the site does host links to porn movies.

BT's warning message advises customers to contact customer services if they want the block on the site to be lifted. The message also invites users to seek further information on the self-regulation scheme on the Internet Watch Foundation's website, although an IWF spokesman denies any involvement with the mobile filtering scheme.

All mobile networks

The self-regulations scheme includes all five of the major mobile networks. (BT's service is based on the Vodafone network).

The Code says that members agree to block even legal "adult" content on mobile connections, in case phones or laptops fall into the hands of minors.

"The Code covers new types of content, including visual content, online gambling, mobile gaming, chat rooms and internet access," the code of practice states.

However, it then goes on to state that "the Code does not cover peer-to-peer communications but it does give assurances to customers that the mobile operators are taking action to combat illegal, bulk and nuisance communications."

Pirate Bay's founders last week lost their landmark case against several leading record companies and now face a huge fine and up to a year in jail, pending an appeal.

BT says that it alone took the decision to block The Pirate Bay site. "BT and the other UK mobile operators have agreed and implemented a voluntary Code of Practise for mobile content that restricts access to content unsuitable for customers under the age of 18," the company claims in a statement.

"The list of sites and content that is restricted is compiled by individual operators themselves. The warning that BT provides links to the IWF website is for information on the Code only. BT customers who wish to have access to particular sites reactivated can do so by calling 150."

Report: Payment card data was top target in 2008

More records were breached in 2008 than in the previous four years combined as a result of a few large breaches involving payment cards, according to a report released on Wednesday.

Last year, 295 million records were compromised and there were 90 confirmed breaches, the Verizon Business 2009 Data Breach Investigations Report (PDF) found.

The top five breaches accounted for 93 percent of total records compromised and as a percentage of caseload, 80 percent were payment card breaches while payment card data represented 98 percent of all records compromised last year.

PIN data was increasingly targeted in 2008 in attacks in which magnetic-stripe data and PIN data was used for identity fraud. For example, criminals used the data to make ATM withdrawals from victim's accounts.

PIN data stolen in a breach at payment processor RBS WorldPay was used to clone cards and withdraw millions of dollars from victim bank accounts last year. Meanwhile, payment processor Heartland had a huge data breach of its own last year that it reported in January and there have been reports of another breach at an unidentified institution.

More than three-fourths of organizations suffering payment card breaches were found to be not compliant with PCI data security standards or had never been audited. The typical organization had met less than a third of the requirements in the standards, the report found.

This chart shows threat categories by percent of breaches (black) and records (red).

(Credit: Verizon)

Of the total breaches, 75 percent came from external sources, 39 percent involved multiple parties, 32 percent involved business partners and in 20 percent of the cases insiders were implicated. Three-fourths of the breaches were undiscovered and uncontained for weeks or months.

As far as types of breaches, 64 percent resulted from malicious hacking, 38 percent used malware, 22 percent involved privileged misuse, and 9 percent used physical attacks such as equipment theft or tampering.

In about four of 10 hacking-related breaches, an attacker gained unauthorized access to the victim via one of the many types of remote access and management software, typically provisioned to third-parties for remote administration.

During 2008, malware was involved in more than one-third of the cases investigated and contributed to nine out of 10 of all records breached.

"Malware is now an essential component to nearly all large-scale data breach scenarios," the report said. "Hacking gets the criminal in the door, but malware gets him the data."

New MS08-067 Exploit Creeps in During DOWNAD Frenzy

A new MS08-067 exploit silently made its entrance as the rest of the world was keeping watch on DOWNAD’s next step last week. In what seems to be a case of “old worm with new tricks,” the worm Neeris which has been active for a few years now was found updated with the now infamous MS08-067 exploit.

Detected by Trend Micro as WORM_NEERIS.A, the number of PCs infected by this variant reportedly spiked almost at the same time that DOWNAD was supposed to do its thing. However, despite similarities between DOWNAD and Neeris, Microsoft reports that no evidence has been found suggesting any connection between the two.

Apart from propagating through the Microsoft Server Service Vulnerability, WORM_NEERIS.A also propagates through removable drives, SQL servers, and through the instant messaging application MSN Messenger. It also drops a rootkit component, detected as RTKT.FARFLI.UW which it uses to hides its processes. This worm also opens the affected system’s port 449 and connects to a certain site where it waits for commands sent by a remote user.

If Neeris would be able to live up to the mark left by DOWNAD is anyone’s guess for now. Sadly, the fact that another threat leveraging on the same vulnerability that had just been on the global spotlight has emerged indicates that there are still users who are unable to see the importance of updating their systems. Users must realize that cyber criminals will continue to strike as long as they keep themselves vulnerable. So please, update here

Η Forthnet ελέγχει IPs για Card Sharing

Σύμφωνα με δημοσίευμα του περιοδικού DSTV που ειδικεύεται στα δορυφορικά, η NOVA σκληραίνει την στάση της και μετά το εξώδικο, στους διαχειριστές του justin.tv και του blog troktiko, έδωσε την έγκρισή της στην FORTHNET στο να ελέγξει και καταγράψει όλες τις IP πελατών της, ώστε να διαπιστωθεί ποιοι από αυτούς μοιράζουν η μοιράζονται κλειδιά από κάρτες NOVA, το γνωστό και ως internet card sharing.

Όπως γράφετε στο περιοδικό, έχει γίνει αίτηση στην εισαγγελική αρχή έτσι ώστε να εξαναγκασθούν και οι άλλοι παροχείς να κάνουν το ίδιο, δίνοντας έτσι τα στοιχεία των πελατών τους που χρησιμοποιούν αυτόν τον παράνομο τρόπο διαμοίρασης.

To θέμα αμέσως έλαβε διαστάσεις στο δορυφορικό και Internetικό γίγνεσθαι και κάποιοι χρήστες ήδη ετοιμάζονται να κάνουν καταγγελία στην αρχή προστασίας προσωπικών δεδομένων θίγοντας έτσι το ευαίσθητο θέμα του προσωπικού απορρήτου.

Μάλιστα σε συζητήσεις χρηστών γράφεται τόσο ότι η Forthnet έχει στείλει σχετικό memo στην HOL, όσο ότι στην Κατερίνη ήδη συνελήφθησαν κάποιοι για αυτό τον λόγο.

Υπενθυμίζεται ότι η τηλεπικοινωνιακή εταιρεία Forthnet έχει αγοράσει το πλειοψηφικό πακέτο της NOVA εδώ και 11 μήνες.

French government OKs Web piracy law

LONDON -- The French National Assembly has voted to adopt the central clause in the anti-piracy Creation and Internet Law, which would allow a state body to cut off copyright infringers' broadband access after two warnings were issued.

The three-strikes scheme proposed by the French government to tackle P2P file-sharing has met with opposition from some politicians and consumer groups, but the vote has been welcomed by parts of the international music business.

"The French government has taken a decisive step to protect artists and creators, setting an example to the rest of the world," said IFPI chairman and chief executive John Kennedy in a statement. "The great thing about this French initiative is that it will result in very sensible and achievable actions by ISPs to reduce piracy in a way that is overwhelmingly preventative and not punitive."

IMPALA, which represents 4,000 independent labels across Europe, also welcomed the vote.

"We see this as a great breakthrough. Independents produce 80% of all new releases and as a result suffer particularly from illegal downloading," said executive chair Helen Smith in a statement. "We feel that this text reaches an excellent compromise between the interests of the fans, the music companies and the ISPs."

Michel Lambot, co-president of PIAS and co-president of IMPALA, added: "This was a bold move by the French, and has brought its fare share of criticism. We hope the law will now be able to go on to be the success that we believed it would and that it will serve as an example that other countries can follow."

France's consumer rights group UFC-Que Choisir has opposed the plan.

Thursday's vote on the three-strikes measure was crucial to the legislation, which will undergo parliamentary scrutiny article by article, beginning April 9, before it is finally passed into law.

Survey: Credit card fraud a top concern in U.S.

This should come as no surprise to anyone, but people in the U.S. are worried that as the economy worsens, the chances for identity fraud, particularly with regard to credit card data theft, will increase.

Nearly 75 percent of Americans believe that the global financial crisis increases their risk of identity and related fraud, according to the Unisys Security Index due to be released on Monday.

More than two-thirds surveyed said they are extremely or very concerned about other people obtaining and using their credit and debit card data, with 90 percent at least somewhat concerned.

Credit and debit card fraud is the top security concern for people, with 68 percent saying they are extremely or very concerned. And 66 percent said they are seriously concerned about unauthorized access to or misuse of personal information.

More than 40 percent of respondents said they are extremely or very concerned about security related to viruses and unsolicited e-mail.

Overall, people are more worried about their financial security and less worried about national security than in previous surveys, according to the survey.

The survey of more than 1,000 respondents in the U.S. was conducted from February 20-22.

France to Block The Pirate Bay, Disconnect File-Sharers

Despite public protests the French Parliament has passed a controversial new law that will see alleged copyright infringers disconnected from the Internet. In addition, France’s Minister of Culture Christine Albanel has stated that under the new law, ISPs may be ordered to block The Pirate Bay.

In order to clamp down on piracy the French have passed a new law requiring Internet service providers to cut off Internet access for persistent offenders. Under the new legislation ISPs have to warn alleged copyright infringers twice, and if they they ignore these warnings their Internet access is terminated for up to a year.

One of the biggest problems with the new law is that copyright infringers will be identified only by an IP-address, which will undoubtedly lead to many false accusations. Those who want to prove their innocence have only one option, namely, to install a spyware application that will monitor their every move on the Internet and report it back to the authorities. Hardly practical.

The law goes much further than disconnecting alleged file-sharers though. In addition it is now possible to take “any action” in order to put a halt to copyright infringement. Minister of Culture, Christine Albanel, explicitly named The Pirate Bay as one of the sites that could be easily blocked under the new law.

Thus, without having to provide evidence that a website is engaging in illegal activities, it can still be blocked. Potentially this could mean that access to BitTorrent sites is disallowed in France, as well as access to sites like YouTube or perhaps even Google.

In summary, the new law introduces unlimited options for the copyright holders to go after sites and people that may or may not infringe copyright, without having to actually proove that the accused are guilty. To date, this is by far the most aggressive and unbalanced piece of copyright legislation that we’ve seen.

Even more so, only last week the European Parliament spoke out against such disproportionate legislation by adopting a report that aims to protect the rights and freedoms of Internet users and excludes ‘three strikes’ as a punitive sanction. Unfortunately, members of the French parliament completely ignored this.

What struck us most is that the people who get to decide on these issues have no clue about file-sharing at all. Many of them don’t know what BitTorrent is, or how it works. Yet, they decide the fate of hundreds of thousands of Internet users.

New Nmap version detects the Conficker worm

The Conficker worm is receiving a lot of attention because of its vast scale (millions of machines infected) and advanced update mechanisms. Thanks to research by Tillmann Werner and Felix Leder of The Honeynet Project and implementation work by Ron Bowes, David Fifield, Brandon Enright, and Fyodor, a new Nmap release is here which can remotely scan for and detect infected machines.

To scan for Conficker, use a command such as:
nmap -PN -T4 -p139,445 -n -v --script=smb-check-vulns --script-args safe=1 [targetnetworks]

A clean machine should report at the bottom: “Conficker: Likely CLEAN”, while likely infected machines say: “Conficker: Likely INFECTED”. For more advice, see this nmap-dev post by Brandon Enright. Dan Kaminsky broke the story on Doxpara.com.

While Conficker gets all the attention, 4.85BETA5 also has many other great improvements:

* Ndiff now includes service (version detection) and OS detection differences.
* [Ncat] The --exec and --sh-exec options now work in UDP mode like they do in TCP mode: the server handles multiple concurrent clients and doesn't have to be restarted after each one.
* [Ncat] The -v option (used alone) no longer floods the screen with debugging messages. With just -v, we now only print the most important status messages such as "Connected to ...", a startup banner, and error messages. At -vv, minor debugging messages are enabled, such as what command is being executed by --sh-exec. With -vvv you get detailed debugging messages.
* [Ncat] Chat mode now lets other participants know when someone connects or disconnects, and it also broadcasts a current list of participants at such times.
* [Ncat] Fixed a socket handling bug which could occur when you redirect Ncat stdin, such as "ncat -l --chat < /dev/null". The next user to connect would end up with file descriptor 0 (which is normally stdin) and thus confuse Ncat.
* [Zenmap] The "Scan Output" expanders in the diff window now behave more naturally. Some strange behavior on Windows was noted by Jah.
* The following OS detection tests are no longer included in OS fingerprints: U1.RUL, U1.TOS, IE.DLI, IE.SI, and IE.TOSI. URL, DLI, and SI were found not be helpful in distinguishing operating systems because they didn't vary. TOS and TOSI were disabled in 4.85BETA1 but now they are not included in prints at all.
* The compile-time Nmap ASCII dragon is now more ferocious thanks to better teeth alignment.
* Version 4.85BETA4 had a bug in the implementation of the new SEQ.CI test that could cause a closed-port IP ID to be written into the array for the SEQ.TI test and cause erroneous results.
* Nbase has grown routines for calculating Adler32 and CRC32C checksums. This is needed for future SCTP support.
* [Zenmap] Zenmap no longer shows an error message when running Nmap with options that cause a zero-length XML file to be produced (like --iflist).
* Fixed an off-by-one error in printableSize() which could cause Nmap to crash while reporting NSE results. Also, NmapOutputTable's memory allocation strategy was improved to conserve memory.
* [Zenmap] We now give the --force option to setup.py for installation to ensure that it replaces all files.
* Nmap's --packet-trace, --version-trace, and --script-trace now use an Nsock trace level of 2 rather than 5. This removes some superfluous lines which can flood the screen.
* [Zenmap] Fixed a crash which could occur when loading the help URL if the path contains multibyte characters.
* [Ncat] The version number is now matched to the Nmap release it came with rather than always being 0.2.
* Fixed a strtok issue between load_exclude and TargetGroup::parse_expr that caused only the first exclude on a line to be loaded as well as an invalid read into free()'d memory in load_exclude().
* NSE's garbage collection system (for cleaning up sockets from completed threads, etc.) has been improved.