An unexpected finding

In September 2011, I received a Google Alert about a new document on ‘time domain reflectometry’. The URL itself looked a quite interesting:

http://onlinelibrary.wiley.com/mrw_content/erfme/articles/eme375/body.xhtml.

Going down the rabbit hole (or up the directory tree), one reaches http://onlinelibrary.wiley.com/mrw_content/ which contains around 140 directories. The directory names are mostly acronyms for pretty much all of Wiley’s Major Reference Works, a collection of textbooks on pretty much every topic in engineering and natural sciences.

The total file size is about 70 GB. In many cases the chapters of each book seem to be available as XML, HTML, and PDF.

I was busy at this time and assumed the directory listing to disappear soon. After all, this looked like a simple misconfiguration on the web server. Only, the directory listing stayed available.

Notifying Wiley

On 25. October 2011, I sent an e-mail to Wiley’s customer service, as I could not find an e-mail address for technical issues. I notified them of the issue and got a reply:

“I have checked and can confirm that the links does allow free access to the articles. I am looking into this matter and have escalated this to our internal Specialist teams for resolution. I will contact you as soon as I have more information. Thank you for your time in informing us about this issue.”

I have not yet received a follow-up email.

On 6. November 2011, I sent a tweet to Wiley, pointing out the issue.

No reply yet.

On 16. November 2011, I sent an e-mail, asking for an update.

No reply yet.

On 21. November 2011, I contacted customer service via Wiley’s live chat and reported the problem. I was told

“we would like to thank you for pointing this out. I will forward to our Web Staff to have them fix this issue.”

I was promised an update.

No update yet.

I guess this means that they do not really care about people downloading these files.

How to mirror the MRWs

There are a lot of good reasons for downloading the MRW files: for learning, for use as a corpus of scientific language, for plagiarism detection, etc.

Downloading these files from the mrw_content directory is almost straightforward:

It seems necessary to first download the main index once – not sure why:

httrack http://onlinelibrary.wiley.com/mrw_content/ -r0 -p0 -c8 -A100000 -v -#L1000000 --updatehack -X0

Then you can mirror a single reference work like this:

httrack http://$BASE_URL/$RW/ --referer http://onlinelibrary.wiley.com/mrw_content/ -c8 -A1000000 -#L1000000 -v --updatehack --update -X0 +$BASE_URL/$RW/*


Note: httrack severely limits your download speed to avoid DoSing the server. That is probably the right behavior. However, you can use a command-line parameter to make it work faster or take a tool like wget instead.

Is this legal?

Probably. Wiley’s robots.txt allows almost all bots access to all files on the server. Additionally, Wiley did not protect those files, even when notified about their availability to the public. In fact, you are doing the same thing Google’s crawlers do all the day.

At least in Germany downloading these files for one’s own scientific purposes seems to be covered by § 53 UrhG. Of course, redistributing these files would be illegal.
So, if you decide to download these files, please do not DoS the server and please do not redistribute them. files.

Over the last two years I have continuously tried to get this problem fixed silently – without success. Therefore, I publish the issue now, giving authors the chance to make informed decisions.

In this blog post I describe the problem, explain its possible consequences, and propose ways to fix this issue.

Who is Sheridan Printing?

(skip this if you have already dealt with Sheridan Printing)

In computer science, conferences are a very important venue for publishing original research.
Preparing conference proceedings and uploading the papers to the ACM digital library is a lot of work, especially for large conferences like CHI.
Sheridan Printing is a full service company that take care of the whole workflow from camera-ready manuscript to printed and digital proceedings.
They do this quite well, giving authors valuable feedback on typographic problems.
Sheridan Printing services many large and small ACM conferences, e.g. CHI, UIST, TEI, ITS, WWW, and many other conferences.

The Flaw

Sheridan comes into play once your paper gets accepted for the conference. Then you have to upload a PDF version of your paper to their submission system and add metadata like ACM classification categories or author details. Additionally, they urge you to also upload your MS Word .doc or TeX source file.
Some time after I got the acceptance notification for a paper at TEI 2010, Sheridan Printing sent me a link to a login form, where I should enter my paper ID, “p123″ (slightly changed). It looked like this:

Notice anything?

The very first moment that I saw this login form, I could not believe my eyes. The only barrier between me and the submission details of an arbitrary paper seemed to be this ‘secret’ submission ID. An ID that consisted of a static prefix and the number my paper had been assigned when I submitted my paper for review.
To anyone that has the faintest idea of information security, it should be obvious that this form does not provide any authentication.
I tried out other submission IDs, starting at ‘p100′, incrementing. After a few tries I found another valid submission ID. The submission system showed me all details for this paper and even allowed me to submit a new version of the other paper.
The forms look like this:

Spending a few hours with the system I found out:

• You can do a brute-force attack, interating through all possible IDs. The server does not rate-limit requests.
• For many conferences, Sheridan Printing offers detailed formatting instructions, also detailling the format of the submission ID (e.g. ACM WWW). You do not even have to guess possible prefixes.
• You can change the author’s e-mail address. All notifications caused by changing the submission will be sent to this address now. The original author is not notified about the changed e-mail address and will never know that you are messing with her paper.
• You can change all submission details.
• All files that you upload to the system can be accessed by anyone. The naming scheme is easily guessable.
• You can upload new camera-ready versions.
• Changes can only be made during a short timeframe of about one or two weeks. Once Sheridan Printing receives the ACM copyright transfer form, no changes to submissions are possible anymore. However, PDF and source files remain accessible.

Not nice.

The Consequences

So, what could you do with this information?

1. You can see abstracts, paper authors, and even the camera-ready paper long before it is being published. You might do this to satisfy your curiosity. You might also use this information to prepare a new research project, giving you a time advantage over most competitors.
2. You might scavenge the .tex and .doc source files for interesting comments (I found a number of them). These might be notes to co-authors (“I’ve tidied up the data, now it is statistically significant. Yay!”) or ideas for future work that the authors did not yet want to divulge. Again, you get an advantage over competitors.
3. In countries where patents are granted on a ‘first to file’ basis, you may try to get patents on all inventions presented in the yet-unpublished papers.
4. You can change author names, abstract or references. Adding another author like ‘Ike Antkare’ might go unnoticed until the conference. Of course, you can also make yourself (or someone you don’t like) first author of all papers.
5. You can upload a blank or nonsensical paper instead of the original one. This might get caught by Sheridan Printing staff, however. Be subtle.
6. You can severely damage someone’s credibility: You download the original source file of their submission (the PDF will do, too), change some details in it, and upload it again. For example, put a plagiarized paragraph into the paper, and pretend to notice this plagiarism at the conference. If your victims are not well known in the community, probably noone will believe their claims that they did not submit this paper.

I’m sure there are many additional ways someone could exploit this security hole.
Certainly, there are many authors who know about this issue.

Trying to get the issue fixed

As soon as I had verified this security issue, I sent an e-mail to my submission coordinator at Sheridan Printing, essentially telling them everything mentioned above, and proposing ways to fix the issue. This was on 11. December 2009.

After inquiring again a few days later, I got the following terse response on 15. December 2009:

Sir

This is being addressed by the programmers, my supervisors, and the IT dept at ACM.

XXXXX
)*(
Sheridan Printing

Hey, if so many people are working on this issue right now, this should be fixed in no time, right?

Sheridan Printing did not respond to further e-mails. The issue did not get fixed.
Over the last two years, I was able to reproduce this issue with only minor changes.
I notified the conference chairs of several medium and major ACM HCI conferences about this issue.
The general response was something like

Oh my god, that’s bad. Sheridan should get this fixed. Please do not tell anyone about this, you would be causing problems for your fellow authors.

So, everyone agreed that there was a serious security issue here, but noone did have the time or power to do anything about it.

Thus, in April 2010 I contacted an ACM SIGCHI Vice President. After a while I got a response like

Yes, there is a security issue. We are already in the process of changing the workflow for paper submissions. This is a complex issue. The new workflow will be implemented for ACM CHI 2011. Please keep silent.

And silent I kept. I did not get a paper accepted at CHI 2011, so I did not have to use the submission system. However, I assumed that the issue had indeed been fixed after almost a year.

In the meantime, Jöran Beel independently discovered the security issue and wrote a blog post about this. It seems to have gone largely unnoticed. I only found it yesterday.
Jöran mentioned that the security hole had been fixed. This is evidently not the case…

This year, we got a paper accepted at UIST 2011. In August 2011 I received an e-mail from Sheridan Printing, asking me to upload the camera-ready paper to their submission system.

Of course, I checked out whether this almost two years old bug had been really fixed.
…
…
…
Twenty minutes later, I knew the authors and abstracts of all upcoming UIST papers.
I downloaded 43 camera-ready PDFs, 11 .doc and 14 .tex source files.

So, yes, this security hole ist still wide open after two years and several inquiries from at least two researchers.

I contacted both the ACM SIGCHI Vice President and Sheridan Printing.

Only Sheridan Printing replied:

Raphael,

I have requested clarification from our programmer and sent this to our supervisor to respond.

XXXX
)*(
Sheridan Printing

Seems, everyone is again working day and night to fix the issue. I have not yet received an update on whether they were successful this time.

Conclusions

I have learned a few things:

• Sheridan Printing does not really seem to care about the security of the authors who have to use their system.
• Many conference organizers agree that this is a serious issue, but do not have the time or power to get it fixed.
• ACM SIGCHI seems to depend so much on Sheridan Printing that they do not want to press this issue.
• I guess, I have done pretty much all I can do in this regard. Obviously, keeping silent so far has not helped in getting the issue fixed.

So, what can you do?

I have done pretty much everything I could to get this security hole fixed. It’s your turn now.

If you are asked to submit your camera-ready paper to this system, you might want to ask the papers chair to manually handle your submission outside of this system. I have done so on one occasion. This actually causes the papers chair some work, increasing the chance that he will take the issue seriously.

If you are a papers chair at an ACM conference that uses Sheridan Printing’s submission system, you might want to ask them about the security issue.

If you are a programmer at Sheridan Printing: please, just send authors private URLs with a secret token for changing submission details and uploading the camera-ready paper. It is really that easy.

If you think my concerns are completely unwarranted, please tell me so in the comments.

If you have questions, please ask.

Edit: added links to Sheridan Printing
Edit 2: fixed a typo, put ACM response in blockquotes.

Update 09. September 2011, 08:30 UTC

On Twitter, Ed Chi, Co-Program Chair for CHI 2012 responds:

@keithinstone @ProfessorHook yes, it is bad. Sheridan is an ACM contractor. So sigchi can’t do a lot abt it.

Update 12. September 2011, 09:30 UTC

Please see Scooter Morris’ (ACM SIGCHI VP Conferences) comment below. At least for most SIGCHI-sponsored conferences, this security issue should become irrelevant next year.

Update 13. September 2011, 16:00 UTC

Please read Joe Konstan’s comment below. It seems the issue had already been fixed in July.

This might also be a good time to write a preliminary conclusion. From the reactions to this blog post I have learned the following:

• Some researchers suffer from worse security holes.
• Indeed, a majority of authors seems to have been unaware of the Sheridan Printing security issue.
• As James Landay pointed out on Twitter, he notified Sheridan Printing of this issue back in 2004, almost eight years ago, and Sheridan explicitly refused to fix it. So, one the one hand, this means that Sheridan Printing really sucks.
• On the other hand, it seems that quite a number of authors have been aware of this security issue for several years, and have seen that the issue was not going to be resolved. Actually, I learned that this security hole has been regularly exploited by some people for downloading unpublished papers.
• Except for Jöran Beel’s account from 2010, I could not find any public mention of the issue. So, not everyone who encountered the issue seems to have been inclined to do something about it.

Hopefully, our community’s reaction to scientific fraud would be more immediate…

Message from syslogd@seamless at Nov 11 04:01:37 …
kernel:[2972477.277368] You have some hardware problem, likely on the PCI bus.

Message from syslogd@seamless at Nov 11 04:01:37 …
kernel:[2972477.277368] Dazed and confused, but trying to continue

Message from syslogd@seamless at Nov 11 04:01:37 …
kernel:[2972477.277368] Uhhuh. NMI received for unknown reason 34 on CPU 0.

Message from syslogd@seamless at Nov 11 04:01:37 …
kernel:[2972477.277368] Do you have a strange power saving mode enabled?

Message from syslogd@seamless at Nov 11 04:01:37 …
kernel:[2972477.277368] Dazed and confused, but trying to continue

1. The big question regarding such awards is: “In which way are they useful for the community”. Like in education, an intervention (the award) should have a lasting positive effect either on the awardee or the community. Sure, the individual author who receives an award might feel happy for a short while. However, this positive effect might also be reached by just patting them on the back and saying “Great Work!”. There is no evidence that such awards lead to higher achievements. Quite to the contrary, a number of publications claim that awards and incentives actually have overall negative effects on individuals and communities, lowering their performance [1].

2. Awards are a bad metric for great research. Bartneck and Hu have pointed out that (on average) papers which got a CHI best paper awards did not get more citations than a random sample [2]. It seems that even a commitee of experts is unable to predict which papers will have the highest impact. If detecting great work is not even possible for papers with their fixed structure, why should it work for posters or demos? Especially demos are so diverse that a one-size-fits-all award is plain wrong. Is an artful, thought-provoking demo better than a demo of a novel, extremely versatile sensing technology?

3. Undersampling is another problem. How many of the conference attendees have seen all posters and demos? I would guess that, for any poster session, not a single attendee has read all poster titles. Likewise, it is hard to judge the quality of a demo without understanding it. For understanding a demo, you have to try it out for some time. With hundreds of other attendees trying out the same demos, there is just no time for this. Therefore, almost all votes for a best demo or poster can consider only a small subset. Nearly noone is able to make a qualified decision. Variables like poster/demo placement or group dynamics might have more of an effect on the votes than any kind of actual “quality” of a poster or demo.

Overall, best poster/paper/demo awards are neither shown effective nor valid nor at least fair. Why are we then clinging to them?

The TEI conference – which has a very intensive and diverse demo and poster session – has opted not to have any awards – for more or less these reasons.

[1] Kohn, A. (1993). Why incentive plans cannot work. Harvard Business Review, September 1993

[2] Bartneck, C., & Hu, J. (2009). Scientometric Analysis Of The CHI Proceedings. Proceedings of the Conference on Human Factors in Computing Systems (CHI2009), Boston, pp.699-708

(The demo and poster session is like a huge, dark playground with (literally) tons of amazing touch interfaces.)

Monday was the first day of paper presentations. There was a wealth of papers on several topics. Therefore my account is very selective. You can get all papers at the conference website.

The day started very relaxing with “Tafelmusik“, two musicians with a digital audio sequencer and a table full of objects that make sounds. See their website for a photo. By sampling them and continuously replaying these sounds they created a sound landscape – sometimes soothing and sometimes fascinating.

Brad Paley gave a keynote covering a wide range of topics but centering about ways to visualize information. Some of his claims:

• “CHI” considered harmful: instead “computer mediated human-to-human interaction”
• Color is bad for encoding data
• Consistence *impairs* performance
• 15:1 increases in information density, 20:1 speed-ups can be easily reached
• “users” considered harmful

While Brad did not explicitly say so, I think in their entirety these claims only apply to UIs for expert users, however.

Afterwards, Malte Weiss (RWTH Aachen) presented “BendDesk: Dragging Across the Curve” [PDF]. He and Simon Voelker built a desk with an interactive surface bent partly upwards. Malte kindly mentioned Curve – our research on this topic. We are currently figuring out how to connect both prototypes for remote interaction.

In the same session, Yvonne Jansen presented MudPad [PDF], a tactile display using ferrofluid and magnets.

Antti Virolainen presented an interactive surface made out of ice (FTIR in ice is probably not possible).

Hrvoje Benko (Microsoft Research) presented another spherical multitouch surface – but this time a large dome where you walk inside [PDF]. Interesting link from his talk: worldwidetelescope.org

In the afternoon, Dietrich Kammer (TU Dresden) presented an interesting theoretical framework for describing gestures [PDF].

For me, the demo and poster session is always the highlight of a conference. At ITS 2010 it took place at DFKI. There was a wealth of really cool demos and interesting posters. As I had to present my own poster (“Some Thoughts on a Model of Touch-Sensitive Surfaces” [PDF]), I did not find time to have a look at every demo. However, there was an amazing mixture of art, high-tech hardware, and applications. See the photos on Facebook!

While I liked some demos and posters more than others, I did not fill out my voting sheet for best poster or demo. More on this later.

Photo taken from the official ITS 2010 Facebook album:

(people testing the multitouch device they just built)

Sunday started with four tutorials:

Sheelagh Carpendale (University of Calgary) gave an introduction into qualitative evaluation and observation of tabletop interaction. We did an experiment where she would tell us a story and we should draw a continuous line somehow representing the mood of the characters in the story. I found it quite interesting that there were completely different looking drawings but some drawings looked quite similar. I wonder whether you could find out which persons have a similar understanding of a story. Looks like a great method for match-making.

Uli von Zadow (Archimedes Solutions) gave a very interesting overview of multitouch sensing APIs and implementation details of common processing stages (e.g. it is not a good idea to put successive processing stages on different processors as this makes the processor cache pretty much useless).

Florian Echtler (Hochschule München) presented an overview of multitouch sensing techniques [I did not attend the talk as I'm pretty familiar with his work].

And finally, Anne Roudaut (HPI Potsdam) organized a really cool “build your own multitouch” session where about 50 participants built a simple touch-sensitive surface using FTIR with visible light and a cheap webcam. You can find the instructions online on her Acrylicpad page. They got really cheap (5 EUR) webcams on eBay. However, they only worked with Windows XP – and of course Linux

Afterwards we had a nice get-together at the Ratskeller in Saarbrücken.

Photo taken from the official Facebook album:

Day 1, Day 2

However, today Cody Brocious (Daeken) has released the first version of a Python toolkit for the EPOC. For this he cracked the AES encryption and partially reverse-engineered the protocol.
There’s still a lot missing – for example, it is not clear which signal belongs to which sensor, and the signals are not yet analyzed in any way.

This seems like the right opportunity to get an EPOC and tinker with it. Thanks Daeken.

Some discussion is happening at Hacker News and Hack A Day

Update: H+ magazine has an interview with Cody, conducted by Bryan Bishop who already wrote a Python wrapper for the EPOC in June, using the official SDK, however.

Update 2: It seems the developer headset is different from the standard one. skadge is trying to get it working.

Update 3:
Emotiv responds in their forum:

We strongly oppose this kind of action. It violates the end user license and seriously threatens our viability. It is no exaggeration to say we may be forced to withdraw the consumer headset from the market or go out of business entirely. Kinda defeats the stated purpose of “opening up” the product for research users – which is frankly spurious because it IS open to properly licensed owners – and OpenViBE has a properly licensed driver already in Beta development.

It’s all well and good to demonstrate how smart you are by hacking the iPhone – Apple can afford to lose some revenue. We are a struggling company and this action has prompted our investors ask us to show cause why they should not demand repayment of our operating loan. Research licenses are a substantial part of our revenue. Thanks to this selfish action we may well have to close the doors or withdraw the consumer product, or re-price it at a significantly higher level.

That enough discussion for you?

Update 4:
Daeken has posted an unconfirmed Dev Key on IRC:

conKey = '\x31\x00\x35\x54\x38\x10\x37\x42\x31\x00\x35\x48\x38\x00\x37\x50'
devKey = '\x31\x00\x35\x48\x31\x00\x35\x54\x38\x10\x37\x42\x38\x00\x37\x50'

I’m curious whether any conference organizers will indeed buy back the domains.

The URLs registered so far are:

adbis2011.org
bpm2012.org
civr2011.org
cluster2011.org
cluster2012.org
cluster2013.org
ecdl2011.org
ecdl2012.org
ecmlpkdd2012.org
ecmlpkdd2013.org
eswc2012.org
eswc2013.org
eswc2014.org
euram2012.org
euram2013.org
grid2011.org
grid2012.org
grid2013.org
hpv2012.org
iamot2012.org
iamot2013.org
icde2012.org
icml2011.org
icml2012.org
icps2012.org
icsb2012.org
irmmw-thz2012.org
irmmw-thz2013.org
irmmw-thz2014.org
isaac2014.org
its2011.org
its2012.org
jcdl2012.org
metropolis2012.org
metropolis2013.org
mne2012.org
mwp2011.org
mwp2012.org
mwp2013.org
oecc2012.org
oecc2013.org
oecc2014.org
pcs2011.org
robocup2013.org
sigir2014.org
sigmod2012.org
sigmod2013.org
webdb2011.org

I just switched from my.opera.com/raphman to WordPress.com for most of my blogging. Unfortunately, my.opera.com lacks many nice features.