Firefox add-on with 7m downloads can invade privacy

Tweet

Ant Video secretly tracks every website visited

By Dan Goodin

A high-rated Firefox extension with more than 7 million downloads secretly collects data about every website the open-source browser visits and combines it with uniquely traceable information tied to the user, an independent security researcher said.

The undisclosed behavior of the Ant Video Downloader and Player add-on takes place even when the Firefox private browsing mode is turned on or when users are availing themselves of anonymity services such as Tor. The add-on carries a rating of four out of five possible stars and gets an average of almost 7,000 downloads per day, according to official Mozilla statistics.

The revelations raise new questions about the safety of extensions offered on Mozilla's website. A spokeswoman for the open-source developer said the media player, like all public extensions not designated experimental, was vetted to make sure it meets a list of criteria. Chief among them is that add-ons "must make it very clear to users what [privacy and security] risks they might encounter, and what they can do to protect themselves."

"We've looked into the Ant Video Player and found that it does send information about websites users visit in order to power its ranking feature displayed for each website, and also includes a unique identifier in this communication," the spokeswoman wrote in an email. "While this does not violate our policies, we do require it to be disclosed in the privacy policy and the add-on's description. We have contacted the developer and asked them to correct this."

In the meantime, the add-on is available for download on Mozilla's site with no warning.

Messages left through a submission form on Ant.com, where a stand-alone version of the software is hosted, weren't returned. Attempts to reach the developers through other channels weren't successful.
The stealth tracking came to the attention of Simon Newton while he was diagnosing problems with a web application he was in the middle of developing. When he fired up a packet sniffer, he discovered that information about every single HTTP request his PC made was being sent to a server at rpc.ant.com, which used an IP address owned by the Reality Check Network Corp. The data included the external website or internal server being accessed, the time, the browser details, and several persistent browser cookies that contained a Universally Unique Identifier.



Newton quickly linked the behavior to the the Ant Video add-on installed on the PC. He said packets captured during a recent visit to El Reg looked like this:

POST / HTTP/1.1
Host: rpc.ant.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.17) Gecko/20110422 Ubuntu/10.04 (lucid) Firefox/3.6.17
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Content-Type: application/json; charset=UTF-8
Content-Length: 327
Cookie: __utma=1.1249745586.1303010447.1305056403.1305056954.3; __utmz=1.1303010447.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmb=1.4.10.1305056954
X-Ant-UID: {0D908E35-A6A6-4326-B03A-CD8409A7FB79}
X-Ant-Agent: vdmoz-2.3.0-stable.linux-linux-i686
Pragma: no-cache
Cache-Control: no-cache
{"version":"1.0","id":1,"method":"rank","params":[{"url":"http://www.theregister.co.uk/","ref":"","uid":"{0D908E35-A6A6-4326-B03A-CD8409A7FB79}","uagent":"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.17) Gecko/20110422 Ubuntu/10.04 (lucid) Firefox/3.6.17","lang":"en-us, en"}],"agent":"vdmoz-2.3.0-stable.linux-linux-i686"}HTTP/1.1 200 OK

Ant.com servers responded with the following:

Content-Type: application/json
Content-Length: 50
Server: thin 1.2.7 codename No Hup
Connection: close
Date: Tue, 10 May 2011 20:19:09 GMT
{"version":"1.0","id":1,"code":0,"result":"4,086"}

Interestingly, the unique identifier of Newton's PC didn't change even after he removed the add-on and reinstalled it. The only way he was able purge the tracking ID was to completely revert Firefox to its original settings and then reinstall the Ant Video extension.

"As there is this unique identifier, patterns could be built up about where I go -- for example if I use my laptop at work, at a public wifi hotspot, at home or a friends house -- that [UUID] and cookie can be tied to all of those IP addresses, building a picture of not only what I am doing online, but where I am doing it from," he wrote in a blog post published on May 10.

"What alarms me a bit more is that the data that is transmitted about me and my browsing (even anonymously) is going onto servers in New York, USA," he continued. "What if I were visiting [a] site I did not want anyone to know about? What if the US government subpoena 'Reality check network corp' for all information stored on their servers about my IP address, cookie, or UUID?"

Newton said he tried contacting the add-on's developers to find out if the snoop behavior is the result of a bug, but so far no one has responded to a personal message or his blog post.

The larger lesson here is that just because a Firefox add-on has been subjected to Mozilla's official vetting process there is no guarantee it doesn't do things that many users consider to be invasions of their privacy. With at least 5,000 add-ons hosted on its site, it wouldn't be shocking to find out that Ant Video isn't the only extension that comes with a few nasty surprises. ®

Update

As of late Thursday night California time, the Ant Video Downloader was no longer available on Mozilla's site.
"The page or file you requested wasn't found on our site," the page where the add-on had been located read. "It's possible that you clicked a link that's out of date, or typed in the address incorrectly."
The error message didn't elaborate.

Related stories

• Mozilla refuses US request to ban Firefox add-on (5 May 2011)

Newscribe : get free news in real time 

China never intends to challenge US, Arms sales to Taiwan hurt military ties: PLA general

Tweet

Chinese General: Don’t Worry, America, Our Military Doesn’t Compare To Yours

 
Chen Bingde (C), Chief of the General Staff of People's Liberation Army (PLA) of China, talks to Chairman of U.S. Joint Chiefs of Staff Mike Mullen (R) during a ceremony at Fort Myer in Washington, May 17, 2011. Chen Bingde arrived in Washington late Sunday for a week-long official visit to the United States. (Xinhua/Du Jing)
A top Chinese military officer told US military brass yesterday that China never intends to challenge the United States, and China's military equipments are at least 20 years behind the US' army.

"The world has no need to worry, let alone fear … China's growth," said General Chen Bingde, chief of the People's Liberation Army's general staff, in an address to a packed room of American military officers and faculty at the National Defense University in Washington.

"To be honest, I feel very sad after visiting (the United States), because I think, I feel and I know, how poor our equipments are and how underdeveloped we remain," Chen told a press conference at the Pentagon.

The Chinese general told reporters that China's recent increase of investment in military power is "compensatory in nature," making up for decades during which modernizing the Chinese economy was given the first priority.

Admiral Mike Mullen, chairman of the U.S. military's Joint Chiefs of Staff and Chen's host, stressed the importance of renewed dialogue to minimize risk of misunderstanding.

"What he and I have both talked about is a future that is a peaceful future and a better one for our children and grandchildren. That does not include a conflict between China and the United States," Mullen said.

Chen said he invited Mullen to make his first visit to China as Joint Chiefs chairman.

At the press conference, Chen and Mullen also announced several agreements, including a plan for the U.S. and Chinese militaries to jointly conduct a humanitarian assistance and disaster relief exercise in 2012.

Trying to allay Western concerns and jitters about a rising China, Chen quoted US president Franklin D. Roosevelt's famous quote "The only thing we have to fear is fear itself."

In his speech at the National Defense University, Chen said he was optimistic about the future of U.S.-China military relations, which have suffered repeated setbacks. Early last year China angrily cut off most military-to-military contacts after the U.S. announced a $6.4 billion arms sale to Taiwan.

Chen said the U.S. needs to respect China's "core interests," which he said include issues of national unity like Taiwan. The Taiwanese, he said, are considered by all Chinese as "our compatriots and blood brothers and sisters."

The Chinese general equated China's position on Taiwan to President Abraham Lincoln's commitment to preserving the Union. Chen quoted Lincoln as saying, "The Union is unbroken."

Asked about Taiwan's long-standing request to purchase U.S. F-16 combat aircraft, Chen said such a sale would hurt U.S.-China military relations. He asked rhetorically why Taiwan would need to buy American weapons if the U.S. sincerely believes its stated policy that Taiwan is part of China.

Chen appeared to question the validity of the U.S. position favoring Taiwan's eventual peaceful reunification with China. He recounted a conversation earlier Wednesday with Secretary of State Hillary Rodham Clinton in which she repeated the U.S. position that "there is only one China in the world, and Taiwan is part of China."

He said he told Clinton: "I've heard that comment, that statement, since I was a schoolboy, and I'm hearing the same thing now I'm approaching my retirement age. I wonder when can I really see the reunification of my motherland."

People's Daily Online / Agencies

US arms sales to Taiwan hurt military ties

A senior Chinese military officer on Wednesday played down media reports about the mainland's missile deployment across the Taiwan Straits, but warned against further US arms sales to the island.

Chen Bingde (R), chief of the General Staff of the People's Liberation Army, arrives for a joint news briefing at the Pentagon on Wednesday with the Chairman of the US Joint Chiefs of Staff Admiral Michael Mullen. (Saul Loeb / Agence France-Presse)

"I can tell you here, responsibly, that we only have garrison deployment across the Taiwan Straits, and we do not have operational deployment, much less missiles stationed there," Chen Bingde, chief of the General Staff of the People's Liberation Army (PLA), said at a joint news briefing at the Pentagon with Admiral Michael Mullen, chairman of the US Joint Chiefs of Staff.

"The military development is mainly targeted at the separatist forces," Chen said.

The general, in response to a question about Taiwan's request to buy US F-16 combat aircraft, told reporters that if the Pentagon goes ahead with additional arms sales to Taiwan, it would definitely undermine Sino-US military relations.

"As to how bad the impact will be, it will depend on the nature of the weapons sold to Taiwan."

He urged Washington to review the 1979 Taiwan Relations Act, which provides a legal basis for the Pentagon to sell "defensive arms" to Taiwan, since cross-Straits relations have undergone fundamental changes over the past decades.

"The US is using a domestic law to handle another country's internal affairsto be honest, it's too overbearing."

The general equated Beijing's position on Taiwan to Abraham Lincoln's commitment to preserving the Union. "The Union is unbroken," Chen said, quoting Lincoln.

Beijing broke off military ties in January last year after the US approved a $6 billion arms sale to Taiwan. China rejected a proposal in June for a visit by US Defense Secretary Robert Gates.

Military ties only started to warm up at the end of last year. A visit to China by Gates in early January finally eased tension and put relations back on track.

A news release issued after the talks between Chen and Mullen said that the Chinese and US navies will conduct a series of joint exercises to counter piracy in the Gulf of Aden. The militaries of the two countries will also conduct a joint exercise next year in humanitarian assistance and disaster relief. Exchange visits by navy hospital ships, plus a joint exercise focusing on medical aid, are also on the agenda.

Chen, the first chief of the general staff to visit the US in seven years, headed a delegation that included senior officers from all branches of the military.

The delegation also met US Secretary of State Hillary Clinton and several members of the US Congress.

Both Chen and Mullen emphasized that agreements were reached within the framework of building a "US-China cooperative partnership based on mutual respect and mutual benefit", a consensus that President Hu Jintao and US President Barack Obama attained during Hu's official visit to the US in January.

Chen and Mullen highlighted the fact that "a healthy, stable and reliable military-to-military relationship is an important part of the China-US relationship".

Their talks provided an "opportunity to validate our assumptions of each other so we can make adjustments accordingly", Mullen said.

Chen played down Chinese military advances on his trip, telling an audience of US military officers and faculty members at the National Defense University that the PLA lagged at least 20 years behind developed Western nations.

Chen made a similar point later at the Pentagon news conference.

"I can tell you that China does not have the capability to challenge the US," he said, adding that China's wealth and military strength pales in comparison with that of the US. China's navy is 20 years behind the US navy. he said.

"To be honest, I feel very sad after visiting (the US), because I think, I feel and I know, how poor our equipment is and how underdeveloped we remain," Chen said.

"Although China's defense and military development has come a long way in recent years, a gaping gap between you and us remains," Chen said.

"China never intends to challenge the US," he added.

Mutual trust and especially mutual respect and accommodation of each other's core interests are essential to China-US military ties, Chen said.

Chen and Mullen discussed US reconnaissance activities in waters close to China.

The two military chiefs also stressed shared concerns over such issues as nuclear proliferation, terrorism, climate change, energy security and piracy, Mullen said.

Above all, "what he (Chen) and I both talked about is the future, a peaceful future, a better one for our children and grandchildren", Mullen said.

"That (future) does not include conflict between China and the US."

Chen extended an invitation to Mullen and his wife to visit China, an invitation that Mullen accepted.

Liu Lin, an expert on world military studies with the PLA Academy of Military Sciences, said US politicians have a tradition of overreacting to the Chinese mainland's military deployment across the Taiwan Straits.

"It is a domestic affair. But the US uses it as an excuse for arms sales to Taiwan," Liu said.

Yao Yunzhu, a researcher at the same academy, said it is time for Washington to "review whether the Taiwan Relations Act, passed more than 30 years ago, is still relevant (in dealing with the Chinese island)".

Li Xiaokun in Beijing, AP, Reuters contributed to this story.

Yoga Improves Quality of Life and Regulates Stress Hormones in Women with Breast Cancer Undergoing Radiation Therapy

Tweet

Released: 5/17/2011 3:55 PM EDT
Embargo expired: 5/18/2011 6:00 PM EDT
Source: University of Texas M. D. Anderson Cancer Center

MD Anderson study first to compare benefits of mind-body practices to simple stretching exercises 
 
Newswise — HOUSTON — For women with breast cancer undergoing radiation therapy, yoga offers unique benefits beyond fighting fatigue, according to new research from The University of Texas MD Anderson Cancer Center.

While simple stretching exercises improved fatigue, patients who participated in yoga that incorporated yogic breathing, postures, meditation and relaxation techniques into their treatment plan experienced improved physical functioning, better general health and lower cortisol (stress hormone) levels. They also were better able to find meaning in their cancer experience.

The findings, to be presented next month in an oral session at the 47th annual meeting of the American Society of Clinical Oncology by Lorenzo Cohen, Ph.D., professor and director of the Integrative Medicine Program at MD Anderson, are the latest in an ongoing effort to scientifically validate the age-old belief that mind-body interventions have a beneficial impact on the health of cancer patients. The research was conducted in collaboration with India’s largest yoga research institution, Swami Vivekananda Yoga Anusandhana Samsthana in Bangalore, India.

The study assessed, for the first time, yoga benefits to cancer patients by comparing their experience with patients in an active control group who integrated simple, generic stretching exercises into their lives. “The combination of mind and body practices that are part of yoga clearly have tremendous potential to help patients manage the psychosocial and physical distress associated with treatment and life after cancer, beyond the benefits of simple stretching,” said Cohen.

To conduct the study, 163 women with breast cancer (stage 0-3) averaging 52 years of age were randomized to one of three groups: 1) yoga; 2) simple stretching; or 3) no instruction in yoga or stretching. Participants in the yoga and stretching groups attended sessions specifically tailored to breast cancer patients for one hour three days a week throughout their six weeks of radiation treatment.



Participants were asked to report on their quality of life, including fatigue, daily functioning, benefit finding, depression and spirituality. Saliva samples were collected and electrocardiogram tests were administered at baseline, end of treatment, and at one, three and six months post-treatment.

After completing radiation treatment, only the women in the yoga and stretching groups reported a reduction in fatigue. At one, three and six months after radiation therapy, women who practiced yoga during the treatment period reported greater benefits to physical functioning and general health. They were more likely to perceive positive life changes from their cancer experience than either other group.

Women who practiced yoga also had the steepest decline in their cortisol across the day, indicating that yoga had the ability to regulate this stress hormone. This is particularly important because higher stress hormone levels throughout the day, known as a blunted circadian cortisol rhythm, have been linked to worse outcomes in breast cancer.

According to Cohen, developing a yoga practice also helps patients after completing cancer treatment. “The transition from active therapy back to everyday life can be very stressful as patients no longer receive the same level of medical care and attention. Teaching patients a mind-body technique like yoga as a coping skill can make the transition less difficult.”

Through a grant from the National Cancer Institute – the largest ever awarded for the study of yoga in cancer – Cohen and his team will next conduct a Phase III clinical trial in women with breast cancer to further determine the mechanisms of yoga that lead to improvement in physical functioning, quality of life, and biological outcomes during and after radiation treatment. A secondary aim of the trial, but one of great importance, stressed Cohen, is assessing cost efficiency analysis for the hospital, health care usage costs in general, and examining work productivity of patients.

MD Anderson recognizes the growing body of research indicating that relaxation-based interventions can contribute to the well-being of people with cancer. Through the Integrative Medicine Program, complementary therapies, such as yoga, are offered at MD Anderson’s Integrative Medicine Center, and are used in concert with mainstream care to manage symptoms, relieve stress, enhance quality of life, and improve outcomes for patients and their caregivers. MD Anderson’s Integrative Medicine faculty also conduct research in the biological and behavioral effects of mind-body based interventions; the anti-cancer potential of natural compounds; and, acupuncture to treat common cancer treatment-related side effects.

In addition to Cohen, other MD Anderson researchers contributing to this study include: Kavita Chandwani, M.D., former senior research coordinator and yoga teacher; Robin Haddad, M.P.H. , research coordinator, George Perkins, M.D. in the Department of Radiation Oncology; Amy Spelman, Ph.D., Kayla Johnson, B.S. and Adoneca Fortier, B.S., all staff in the Integrative Medicine Program; Banu Arun, M.D., in the Department of Breast Medical Oncology; and Qi Wei, M.S., Sr. Statistical Analyst. Clemens Kirschbaum, Ph.D. contributed from the Technical University of Dresden, Dresden, Germany. Collaborators from SVYASA include NV Raghuram, B.E.; R. Nagarathna, M.D., and HR Nagendra, Ph.D., founder.

About MD Anderson
The University of Texas MD Anderson Cancer Center in Houston ranks as one of the world's most respected centers focused on cancer patient care, research, education and prevention. MD Anderson is one of only 40 comprehensive cancer centers designated by the National Cancer Institute. For seven of the past nine years, including 2010, MD Anderson has ranked No. 1 in cancer care in “America's Best Hospitals,” a survey published annually in U.S. News & World Report.

Newscribe : get free news in real time