MobiTV: failed security opens gaping hole
Update 3/7/08 7:45pm EST: CNET news reports MobiTV has withdrawn the threats, backpeddled on its original legal intentions, and is fixing the security problems. What were those guys smoking in starting all this nonsense?
Cell phone television supplier, MobiTV, issued a cease and desist order to a popular website covering mobile devices. A website user posted unadvertised, yet publicly available, links to programming on the MobiTV site.
Here's how ZDNet's Matthew Miller described the situation:
[A] HowardForums member posted URLs to MobiTV’s website that allows you to view their content....[T]hese URLs are completely unsecured and can be found easily by anyone....
MobiTV sent a cease and desist letter and demanded the links be taken down, but Howard did not believe this was secure and copyrighted material (can URLs really be copyrighted and protected?) so he did not remove the links. The latest news is that MobiTV has contacted his host and is trying to shut down HowardForums.
The cease and desist letter to HowardForums states:
[S]everal sections of your website...contain links and information that describe and facilitate the unauthorized use...of the MobiTV Software, which enables [users] to gain free access to MobiTV's various services....
[W]e hereby demand that HowardForums immediately remove all content...that facilitates any unauthorized use of the MobiTV software.
Here's the offending content that MobiTV doesn't want you to see:
Well, I found this in the Sprint forums and here we go:
qtv.mobitv.com/sprintTVlive.mcd
1. Copy and paste that link into the address bar. 2. Don't run it but save it to your computer. 3. Find it on your computer and OPEN it up. Select to open it with Internet Explorer or the browser of your choice. 4. There will be a whole bunch of links. Choose the channel you want to watch... 5. Get your LG Voyager and start up the browser. 6. Type one of the links into your Voyager and press OK!
There you go, live TV...
Rather than rely on true security, MobiTV placed valuable content behind an open, yet unadvertised, web address. If MobiTV's content is of sufficient value to warrant calling the lawyers, then why wasn't it deployed securely?
Note to MobiTV executives: HowardForums is nothing more than a distraction for you right now. Forget them and figure out how to effectively secure your content.
A MobiTV spokesperson refused to say a word when I called seeking comment.