Corante

About this Insider
Simple enough: everything having to do with podcasting.
About these Authors
EDITOR
Alex Williams Alex Williams
( Profile | Archive )

CONTRIBUTORS
Matt May Matt May
( Profile | Archive )

Nicole Simon Nicole Simon
( Profile | Archive )

Roland Tanglao Roland Tanglao
( Profile | Archive )

Matt May is a Web accessibility specialist, and has written on the interaction of people and technology since 1995. He keeps his own weblog at bestkungfu.com, and produces a podcast called Staccato, which features Creative Commons-licensed music.

Alex Williamsblogs, consults and produces unconference style events, where people immerse in DIY media. These are fun occasions, designed for people who want to get together with authors, artists, technologists and leading thinkers to converse, eat, listen to music, write, shoot photos and post podcasts and videoblogs. Alex also works with companies to establish DIY approaches, where writing, photography, voice and video come together to create new conversations and communities. Alex is currently fascinated with digital photography. His girlfriend calls him a Flickrholic. Send Alex a nice message: alexhwilliams at gmail.com.

Nicole Simon loves blogging and podcasting, dashed with an European view. As consultant she helps to facilitate such tools for business purposes or personal publishing empires. She can be found at cruel to be kind and on her private blog Useful Sounds.

Roland Tanglao is a well known podcasting enthusiast and a passionate advocate of blogs, RSS, and social software as a means of online expression for people, organizations and businesses. He is a prominent participant in the blogosphere and online communities and one of the founders of Bryght and as Bryght's Chief Blogging Officer reads hundreds of blogs daily. He graduated from the University of Waterloo, worked at Nortel Networks where he ran its first internal corporate blog, has has been blogging since 1999, and was the first business blogging consultant in Canada.

Podcasting

« AmigoFish - get predictions for new podcasts | Main | Podcast Audio Search Is On Its Way »

December 01, 2005

RSS Hijacking....Podjacking?

Email This Entry

Posted by Alex Williams

Look out, the RSS Hijackers are here. News comes that podcasters may be vulnerable to people who steal RSS feeds.

Collette Vogel at the Center for Internet and Society recounts the experience of Erik Marcus, the podcaster responsible for Vegan.com and his show, "Erik's Diner." Apparently, Erik lost 75 percent of his readership to an RSS Hijacker.

Erik writes to Collette:

RSS hijacking is different [from domain hijacking]. Most podcasters/bloggers are not technically savvy, and the technique used for hijacking their feeds doesn’t involve swiping passwords or overt illegal methods. Rather, it merely involves finding a target podcast, and creating your own unique URL for it on a website you control. You then point your URL to the RSS feed of the target podcast. Next, you do what it takes to make sure that as new podcast search engines come to market, the page each engine creates for your target podcast points to your URL instead of the podcast creator’s official URL.

The problem comes down to this. RSS Hijackers are sneaky. And most podcasters are doing their shows, not checking to see if their original url is in the podcast directories. Collette writes::

Since the URL points to their RSS feed, everything works fine and listeners will be able to hear their show through iTunes, Yahoo, etc.” The RSS hijacker can then sit back back for months or year letting “the target continue to grow his/her show’s listenership

So years can go by and then the hijacker strikes:

At some point, [the hijacker] can then spring out of the woodwork and demand payment from [the] target [podcaster].” The podcaster is “supremely vulnerable”, because the hijacker can at any moment change URL pointer to any other show of the hijacker’s desire and the target podcaster’s audience will “vanish.”

How do you stop this? Collette has a few suggestion:

1. You should check all the podcast directories and search engines to be sure that their RSS feeds are pointing to your official URL/RSS feed. (Though, in iTunes and possibly others, this information may not be readily available or obvious.) 2. If you learn of a hijacking, you can write to the hijacker and demand that she or he stop their conduct. 3. You can also write to the podcast directories and search engines to point out the bad actor’s conduct. 4. And, of course, you can consult a lawyer about possible claims against the hijacker.

I orginally found a post to the RSS Hijacking issue over at Om Malik's blog. The comments from his post shed some light on this issue.

Comments (15) + TrackBacks (2) | Category:


COMMENTS

1. Tim Germer on December 1, 2005 03:22 PM writes...

I noticed my feed for Northwest Noise was hijacked when Yahoo! launched their podcasting site: http://www.northwestnoise.com/blog/2005/10/10/pissed-at-yahoo/

My hijacked feed on Yahoo! Podcasts now is served from podkeywords, or something like that. Emails to both Yahoo! and podkeywords went unanswered. We talked about this briefly at a Portland Podcasting Meetup, but we had never thought of the "blackmailing" angle you discuss. I don't like this. How can this hijacking be stopped?

Permalink to Comment

2. Alex Williams on December 2, 2005 01:50 AM writes...

Tim -- Yahoo! did not respond? Hmmm. It's a clear problem. Reading the posts at the Yahoo! Podcasting group it appears that one precaution is to check all the directories where your podcast has been submitted to see if they have the correct url. But if they have the wrong one, how do you get it corrected if they won't respond to you? Seems like a little blogging and podcasting about the issue may be the answer if you still can't get a response.

Permalink to Comment

3. Martin Owens on December 2, 2005 10:28 AM writes...

The solution is to include an offical crypt string with the rss feeds to secure them with the directories (not the users) so the directories can make sure the feeds are the orginal ones.

The second thing is that you can check your http/rss logs, if you notice alot of your request redirects coming from a non directory site then you know you may have a problem.

Permalink to Comment

4. Paul Lancefield on December 2, 2005 11:51 AM writes...

Perhaps obvious, but a simple non-technical counter-measure would be to ensure you inform your listeners of the authentic RSS URL in your podcasts!

Permalink to Comment

5. Robert Walch on December 2, 2005 12:20 PM writes...

Finding out your show URL that iTunes is using is very simple. First subscribe to your own show (which you should be doing anyway) then in iTunes under the Podcasts (Where all of your subscribed to podcasts are - not the iTunes store) find your podcast and then Right click (control click) on your show Title, and choose "Show Description" A pop up box will show you what the URL of the feed is.

Permalink to Comment

6. Jeff Eske on December 2, 2005 02:07 PM writes...

I'm sure that you've gotten numerous responses on this already, but here it goes anyway. Why not protect your podcast files just as people have been protecting images from hotlinking for some time now? Setup rules in an .htaccess file that only rss feeds that reside on your server, or servers that you designate as "trusted" can link to your files. Granted, this SHOULD be done immediately, to prevent the hijackers from building an audience, based on their hijacked page, but even done later, it would allow you stop the hijackers. You could even add a custom message that would let people know that they arrived there via a hijacked link.

Jeff

Permalink to Comment

7. PErson on December 2, 2005 05:45 PM writes...

If people don't want this maby they should use EULA's for the RSS feeds that prohibit mirroring and redirecting, that way if someone did try to hijack you, one would have better grounds for seeking legal redress.

Permalink to Comment

8. Moz on December 3, 2005 05:20 AM writes...

PErson -

linking to another person's material ("deep linking") is legal and cannot be restricted by EULA in any civilised country. Doing so would be an abuse of copyright law and so on.

What you can do, is have your web server set up to detect any redirects and give a different page / stream / etc. in that case which tells the end user to update their links. It won't work 100% (some browsers don't send the information), but it will get rid of the problem since most of your audience will not be lost later.

Really sneaky people will make sure that users in the redirecting domain will not get the special page. In this case they may continue to link to you even after you've put security measures in place. This will provide free publicity and also take up their time.

Permalink to Comment

9. Just Me on December 3, 2005 09:23 AM writes...

I don't advocate Internet activism, but from what I've read it sounds like a lot of people are having trouble with the same domain. Ought to be easy to shut it down.

Permalink to Comment

10. David Lawrence on December 3, 2005 05:49 PM writes...

Here's a copy of the comment I posted on Erik's attorney's blog a few moments ago:

Regarding this “podjacking” controversy…

I just spoke with George Lambert, the owner of podkey.com. He’s going to be on my radio show tonight at midnight ET, 9p PT:

http://onlinetonight.com

and my Personal Netcast podcast directly after:

http://feeds.feedburner.com/pn

Since you’re both in the Bay area, Collette, you and your client will be able to listen on KNEW AM 910 at 9:06 pm. If you have XM, we’re on Channel 152; if you have Sirius, you can listen on Stream 117, Ask Sirius. The show will be repeated tomorrow evening at the same time on both systems.

My take on this: he’s being unfairly blamed, and you and your client, Erik, don’t understand the very simple technological constraints here. There’s no difference here between George’s free service, podkey.com, and Feedburner podshow.com’s proposed redirection service, or any other redirector/aggregator.

After speaking with a clearly shaken George Lambert, who have been getting phone calls in the middle of the night from people who don’t know the full story, I believe that Erik Marcus, the vegan podcaster, who had registered vegan.podkey.com and a series of keywords associated with vegetarianism about a year ago, noticed that the podkey URL that he had registered with George was getting more play on the search engines than his original vegan.com feed was, and in fact, via OPML, had been picked up by iTunes and Yahoo in addition to his direct feed.

Wanting to aggregate his traffic, he asked George to remove the feed, which George did. Erik’s traffic then, predictably, dropped a lot (75% it appears), since people had been subscribed via the podkey.com feed. He panicked, called George and told him to reinstate the feed, which George agreed to do, and did.

Erik also demanded that George remove those vegan-oriented keywords and their association with the podkey feed from any existing OPML feeds (impossible) and prevent anyone from registering those podkey keywords (unreasonable but doable with special coding), and that’s when George then became annoyed.

To be clear: George is NOT preventing the podcast from being fed at either feed point, and he’s done every thing that Erik’s asked other than do custom programming to filter out keyword based individual vs. OPML requests.

I think this needs to be made clear, and I will on tonight’s show and podcast. And I think we should reserve the word “podjacking” for real fradulent activity.

And, I am more than happy to give you equal time on the air to discuss anything I’ve missed. You may want to save your words for court, but it appears that you also may want to tell your client that this case has no merit.

David Lawrence
Online Tonight

Permalink to Comment

11. gentry on December 4, 2005 08:38 PM writes...


Suing the people doing it civily will stop it fast.

The easiest thing to do though is just change the address you're sending from to one you pre-enter into directories, & just shut the old one down.

Serving Yahoo with a cease & desist order would probably help too.

Quite simply if Yahoo is facillitating this DMCA violation by these people, they're in a bit of a stew as soon as one of these clowns trys to pull this on someone who has money.

Not like they're listening to the content, so a change could be announced well after you're set up with it in place.

Imagine for a second someone trying to pull this with a CNN feed...

Permalink to Comment

12. Paul Puri on December 4, 2005 09:18 PM writes...

I just interviewed Mr. Lambert, the gentleman being accused of doing this, and he has some very interesting things to say. In fact, every single post that I have seen to date has been wrong.

The interview is at www.unsignedpodcastnetwork.com

Also, I break it down somewhat in my blog.
www.unsignedpodcast.blogspot.com

Very interesting how anything the press has said is not true.

Permalink to Comment

13. Jake Ludington on December 4, 2005 09:24 PM writes...

The most obvious way to avoid this is to retain control over your feed in the first place. Yes, maybe it's a problem if Yahoo won't respond. But how long has the Erik's Diner podcast been listed in Yahoo's directory with the wrong URL? Since launch of the directory? It seems like we might not be getting the full story.

I ran down a hitlist of the three key things to do to avoid getting hijacked over on my blog.

Permalink to Comment

14. Anonymous on December 5, 2005 01:15 AM writes...

This is clearly a case of most of the reporters and vegan.com not having a clue!

Permalink to Comment

15. 1746 on December 10, 2005 03:17 PM writes...

One point that seems to be missed by most of the media coverage and most of the people replying to the blogs is that Mr. Marcus asked to be listed on Podkeyword, and in fact gained substantial listenership from this free listing. When Mr. Marcus asked to be removed, his wish was granted and it was only after he realised he had lost most of his listeners that he now wanted to be reinstated temporarily so he could regain this lost audience without so much as a thank you for what he obtained at no cost. If this charade wasn't damaging an honest person's integrity, it would be laughable!

Permalink to Comment

TRACKBACKS

TrackBack URL:
http://www.corante.com/cgi-bin/mt/backtar.cgi/16635

Listed below are links to weblogs that reference RSS Hijacking....Podjacking?:

Let's get rid of podkeyword.com from [blog.forret.com]
So someone provides a mirror service for your podcast feed, gets it registered with major podcast directories and search engines and can then choose whether to just mirror your feed, alter it (e.g. insert advertising), or replace it by whatever he feel... [Read More]

Tracked on December 2, 2005 01:17 PM

Extortion! Hijacking! Podjacking! from Podfeed Podcast Nederland
Er is al geruime tijd behoorlijke comotie rondom de site Podkeyword, alwaar podcasters zich konden aanmelden om via zelfgekozen keywords luisteraars naar hun podcasts te drijven. [Read More]

Tracked on December 13, 2005 12:15 PM

POST A COMMENT




Remember Me?



EMAIL THIS ENTRY TO A FRIEND

Email this entry to:

Your email address:

Message (optional):




RELATED ENTRIES
iPodderX with new name: Transistr
Top of the pods - BBC publishes "podcast charts"
Odeo allows you to integrate any content into your blog - encouraging copyright infringements?
Routing Around The Censors In China
Change the URL of Your Podcast Feed in iTunes
Audible Wordcast
Marketing Sherpa Study: Podcasting Is For Early Adopters
Now You Can See the Man With the Bionic Arm on Your iPod