Here’s a direct link to the view in Google Earth.

Hi John,

Dan, the author, never approved my comment on his site, which was:

It’s just the welcome page, which has embedded flash, which, as explained by a commentor in that same story, uses 2o7 for flash usage statistics. Prove it to yourself, just check the “don’t show again” on the welcome screen, quit, and restart. Boom, no Little Snitch alert for 2o7.

Much like the iPhone IMEI non-story, this story has been written with little research and with a trollish title so as to generate maximum digg and techmeme hits. I hope the Yahoo ads revenue is worth it for you.

Dan also authored that iPhone IMEI non-story mentioned above, so meh, strikes me as just diggbait. The embedded flash on the welcome page is what’s contacting 2o7.net, not the app itself. A packet trace shows this clearly.

12:38:47.746665 IP 192.168.1.103.51075 > 192.168.112.2O7.net.http: P 1:436(435) ack 1 win 65535
E...uE@.@......g.4.....P..1....?P....X..GET /b/ss/mxcentral/1/F.3-fb/s1198874320251.55?[AQB]&purl=mm&pccr=true&c2=ai&c3= 13.0.2&c4=mac&c5=en_US&c6=full&c7=&c8=&c9=ai_13.0.2_mac_en_US_full__[AQE] HTTP/1.1
User-Agent: Adobe Flash Player 9
Referer: http://www.adobe.com/startpage/ai_content/ai_1302_full_default.swf?prod=ai&ver=13.0.2&plat=mac&lang=en_US&stat=full&tday=&spfx=&productName=illustrator
X-Flash-Version: 9,0,43,0
Connection: close
Host: 192.168.112.2O7.net

If you bring up the welcome page from the Help menu in Adobe apps, you’ll see the same 2o7.net message.

I think the 192.168 naming is a valid point, but Dan’s title and content are misleading diggbait, IMO.

- Todd

My comment on Dan’s site reads a little more snarky than I intended it, but so be it. Note that 2o7 uses that same server for all flash and flex statistics and also for, as Gruber noted, the iTunes music store. I think the misleading name of the 2o7 server is a somewhat valid point, but like we saw with the iPhone IMEI reporting non-story from Dan at Uneasysilence, there could be a valid reason for the naming. I honestly doubt the name is there to mislead people or get around firewall rules, since 99.9% of web users wouldn’t even know anything about private IP address ranges.

Step 1: Required equipment.

You’ll need:
* A wired connection to the internet.
* A Mac that has both a wired and wireless connection, really any portable, iMac or Mac Mini and many other systems will work.
* Mac OS X (Either Tiger or Leopard will work. Screenshots in this article are of Leopard, and Tiger looks somewhat different but has the same functionality.)
* The ability to type some commands in Terminal.

We’ll be using built-in software (tcpdump) for this, but for extra functionality you can install Wireshark. We’ll cover this later.

Step 2: Setting up Internet Sharing.

Tiger and Leopard have a feature that allows you to share your wired ethernet connection over your built-in wireless. Effectively you are turning your Mac into a temporary wireless access point. These screenshots are from Leopard, which looks somewhat different than Tiger, but the basic steps are the same on Tiger.

Before you start, make sure you’ve got a wired ethernet connection to your Mac.

Go to System Preferences, then to Sharing, then to Internet Sharing.

Set up sharing to go from your built-in Ethernet to Airport, like so:

Click the Airport Options box and give the access point a useful name, like “test”. You can use WEP security if you want, but since you’ll only be running this for a few minutes, it’s easier just to leave it open. Just don’t forget to shut it off when you’re done.

Back on the Internet Sharing screen, click the checkbox on the left to turn Internet Sharing on.

Step 3: Connect your iPhone to your Mac.

On your iPhone, go to Settings, then to Wi-Fi, and connect to your test network.

Step 4: Find your network interface on your Mac and iPhone.

Start Network Utility on your Mac and on the first Info tab run through your network interfaces. One should have a 10.0.2.1 address. That’s your temporary wireless access point’s address. Note the interface number of this interface. (Mine is en1, for example.) We’ll need that later.

On your iPhone, go to Settings, then to Wi-fi, and then click the blue circle with a “>” next to your test wifi network. You should see an IP Address of 10.0.2.2 or similar.

Step 5: Test your connection.

At this point you should be able to to use Safari on you iPhone to get out to an internet site. Try the always-handy http://whatismyip.com

If you can get out, then we’re done with the set-up and you have a completely working test bed for our packet sniffing.

Step 6: Sniff some traffic

Mac OS X already has a built-in packet sniffer called tcpdump. It’s useful for getting basic information about what’s going on. To use tcpdump open up Terminal and type the following command.

sudo tcpdump -i en1 -A -s 0

If you found a different interface than ‘en1’ in Step 4, use that in place of en1.

You’ll end up with some rather cryptic output that looks like this:

10:39:37.299255 IP 10.0.2.2.50327 > 66.230.165.157.http: S 2056:2056(0) win 65535 <mss 1460,nop,wscale 0,nop,nop,timestamp 127850900 0,sackOK,eol>
E..@&.@.@..7
...B......P.............Z.............
............
10:39:37.383132 IP 66.230.165.157.http > 10.0.2.2.50327: S 3906021356:3906021356(0) ack 2057 win 5792 <mss 1460,nop,nop,timestamp 2852411112 127850900,nop,wscale 0>
E .<..@./.W.B...
....P....'.... ...............
..V.........
10:39:37.385589 IP 10.0.2.2.50327 > 66.230.165.157.http: . ack 1 win 65535 <nop,nop,timestamp 127850900 2852411112>
E..4&.@.@..B
...B......P... ..'......h.....
......V.
10:39:37.390488 IP 10.0.2.2.50327 > 66.230.165.157.http: P 1:382(381) ack 1 win 65535 <nop,nop,timestamp 127850900 2852411112>
E...&.@.@...
...B......P... ..'.....?......
......V.GET / HTTP/1.1
Accept-Language: en
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (iPhone; U; CPU like Mac OS X; en) AppleWebKit/420.1 (KHTML, like Gecko) Version/3.0 Mobile/3B48b Safari/419.3
Cache-Control: max-age=0
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Connection: keep-alive
Host: goat.cx


Telling you how to read this output is beyond the scope of this post, but what you’re seeing is the raw data going between the iPhone and any other internet site.

When you’re done, don’t forget to shut down you Internet Sharing in System Preferences.

Bonus Step 7: Wireshark

Wireshark is a nice graphical packet analyzer that runs under X11 on OS X. To install it you’ll need to have the Apple Developer Tools and X11 installed. Assuming you have those, you can either install Wireshark through MacPorts or grab a pre-configured version of Wireshark from Andreas Fink. In either case you need to make one small change to the X11 config to make Wireshark work under Leopard. Under X11.app, go to preferences, then to the Output tab, and under that choose “Thousands” for colors. Quit X11.app and restart.

Wireshark gives you much nicer output than tcpdump, and makes it much easier to browse the packets and see what’s going on. (Click for a larger screenshot.)

Conclusions

While it does require a fair amount of technical knowledge to set all this up, there’s really no excuse for a reasonably technical person with a Mac and an iPhone to not check things out themselves the next time a “OMG THE IPHONE SENDS YOUR TAX RECORDS TO RUSSIA”-style story hits the blogs.

It took me literally 60 seconds to capture traffic. Here’s how I did it:
- Set up internet connection sharing on my iMac to share my wired connection onto a temporary open wireless access point.
- Used tcpflow to capture the packets.

So here’s a request for stocks:


010.000.002.002.50987-017.254.032.016.00080:
POST /dgw?imei=BA650B95-F00A-499B-8953-EC7F096C11AB&apptype=finance HTTP/1.1
Accept: */*
Accept-Language: en
Accept-Encoding: gzip, deflate
User-Agent: Apple iPhone v1.1.2 Stocks v1.0.0.3B48b
Content-Type: text/xml
Content-Length: 467
Connection: keep-alive
Host: iphone-wu.apple.com


010.000.002.002.50987-017.254.032.016.00080: < ?xml version="1.0" encoding="utf-8"?>
<request devtype="Apple iPhone v1.1.2" deployver="Apple iPhone v1.1.2" app="YGoiPhoneClient" appver="1.0.0.3B48b" api="finance" apiver="1.0.0" acknotification="0000">
.<query id="1" timestamp="0" type="getquotes">
..<list>
...<symbol>%5EDJI</symbol>
...<symbol>AAPL</symbol>
...<symbol>GOOG</symbol>
...<symbol>YHOO</symbol>
...<symbol>T</symbol>
...<symbol>DELL</symbol>
...<symbol>QQQX</symbol>
..</list>
.</query>
</request>


and here’s a request for weather


010.000.002.002.50989-017.254.032.016.00080:
POST /dgw?imei=BFBCC984-744C-4A85-A3D5-BC0AF74A09AD&apptype=weather&t=2 HTTP/1.1
Accept: */*
Accept-Language: en
Accept-Encoding: gzip, deflate
User-Agent: Apple iPhone v1.1.2 Weather v1.0.0.3B48b
Content-Type: text/xml
Content-Length: 357
Connection: keep-alive
Host: iphone-wu.apple.com


010.000.002.002.50989-017.254.032.016.00080: < ?xml version="1.0" encoding="utf-8"?><request devtype="Apple iPhone v1.1.2" deployver="Apple iPhone v1.1.2" app="YGoiPhoneClient" appver="1.0.0.3B48b" api="weather" apiver="1.0.0" acknotification="0000"><query id="30" timestamp="0" type="getforecastbylocationid"><list><id>USCA1018|2488836</id></list><language>en</language><unit>f</unit></query></request>

So what do we know from this?

• The “imei” field being sent to Apple isn’t your actual IMEI in plain text.
• The weather and the stock widget both contain different values for the imei field, so there must be some sort of encoding or salt added to the actual IMEI value for each one.
• At this point there’s no empirical data that the imei field data being sent has anything to do with your actual IMEI, but it does appear to be some sort of identifier.
• Also, I tried a reboot and the data in the imei field is persistent, it stays the same after a reboot. (Edit: it’s now known that the identifier identifies the app, not the phone, so every phone’s stock widget sends the same identifier.)

Worst comment of the bunch comes from Duncan Riley at Techcrunch, who says “if you’re using your iPhone to surf porn be warned.”

Uh, no Duncan. First, this is only the stock and weather widget. Second, if you’re surfing porn at your house, for example, the porn site knows where you came from, your rough geographic location, and using a variety of trackers probably knows other porn sites that you visited from that IP. In fact, since TechCrunch uses google analytics every single person visiting TechCrunch while logged into their Google account has their entire TechCrunch browsing history logged at Google. But just to be clear, Apple isn’t appending the imei identifier to your porn search requests in Safari.

Your computer has a similarly unique, not-easily-changed identifier called a MAC Address. You’d also be surprised how little your IP at home likely changes. You also probably have doubleclick cookies that are set to expire in 2029 that have been on your system for years. So, meh.

Best comment summarizing my opinion on this comes from Gizmodo

“Holy s*** I just got my phone bill!

THEY KNOW EVERY NUMBER I CALLED!!!

TORCHWOOD”

I took the Acela Express train today from Washington D.C. to New York City. I had my Novatel U720 EVDO.a USB modem with me. I’ve had this for a while but I haven’t had the chance to exercise it on a good long trip, and the three hours on the Acela Express was a good chance to try it out.

You can get the U720 (or Expresscard format cards) from many vendors, but mine is from Sprint. The cost for the card can vary wildly depending on your contract, but the service is about $50/month unlimited. (Whether this is the Limited form of Unlimited as used by Verizon, I’m not sure, but I doubt I’ll use it enough to worry Sprint in any event.

Leaving DC my speeds were great. I was even able to video iChat with my wife and daughter with no problems. (Video iChat going 100mph on a train! Amazing!) Shortly after Baltimore I lost EVDO and dropped down to 1xRTT speed, which is roughly the speed of a 56k dial-up modem. It was still useful for e-mail and light web browsing, but loading a graphics-heavy web page was painful. When we hit Philadelphia I got EVDO service again and kept it all the way to Penn Station.

Here’s my current speed sitting in my hotel room in midtown Manhattan:

As you can see, unless you’re a heavy downloader, the speed is good enough to replace hotel and airport DSL, so the $50 a month could be paid-for pretty quickly if you’re paying hotspot fees more than a few times a month. I also used it on-the-fly when I exited Penn Station and got a bit lost. I went into a nearby Starbuck’s and got my bearings while I sipped a coffee. An iPhone would have been more convenient, sure, but my MacBook Pro is almost always on hand.

If you’ve got Mac OS X 10.4.9 installed, you should have all the drivers that you need to use the U720 or any other supported EVDO gadget. If you’re on 10.4.8 and don’t want to go to 10.4.9 for some reason, you can get the update separately and see the supported hardware list here.

The only criticism I can really make is that the USB version is an ugly black block of plastic. I’ve already lost the removable cap for the USB plug, but it seems sturdy enough to survive in my gadget back without it. Note that while in-use on a MacBook Pro the U720 will cover up either the power plug on the left or the firewire plug on the right. It does come with an ugly Y-cable that will let you use those ports if you want to carry yet another cable around.

I was laughing out loud in the car yesterday listening to the current episode of This American Life on NPR. John Hodgman, a.k.a. “PC” on the Apple Get A Mac ads, talks about how the Apple ads changed his life. His story about entering the soho Apple store in NYC is not-to-be-missed.

Grab the whole episode as an MP3 on the episode’s page.

(As an aside, I think it’s great that Chicago Public Radio makes great programming like This American Life freely and easily downloadable.)

Seeing all your metadata

First, download the latest version of Atomic Parsely.

Now, let’s see all the metadata you can see on a file. To get all the metadata for a file, just add -t to the end. (Note: I changed a couple of the fields that might hold personal info about my iTunes account.)

% atomicparsley Pirates\ of\ the\ Caribbean_\ The\ Curse\ of\ the\ Black\ Pearl.m4v -t

Atom “covr” contains: 1 piece of artwork


Ok, so from looking at this we can see that the description is easy enough to get to, but the actors, director, and producer are all embedded in a plist inside the metadata. That doesn’t look too easy to manipulate. The adamId is apparently a unique identifier the iTunes store uses to identify each person, probably so you can click on their names in iTunes and get to more information about that person. I’ll revisit that data in a bit, but for now the easy stuff. Just to make the lines shorter I’ll make the filename simply Pirates.m4v from now on. Note that the command can sometimes take a long time on big files because Atomic Parsley needs to make room in the file for the metadata by shifting the data section over.

Set the description

atomicparsley Pirates.m4v --description “This is a description. It can be up to 255 characters long and it will truncate if it is longer than that.”

Set the rating

atomicparsley --contentRating “PG-13”

where rating is one of TV-MA, TV-14, TV-PG, TV-G, TV-Y, TV-Y7, Unrated, NC-17, R, PG-13, PG, G . Ratings for other countries are more complicated. See the atomic parsley forums for more detail.

Set all TV Episode data

Here’s an example of how to set every useful piece of metadata for a TV show. This is a real example using all the metadata on an iTunes-purchased episode of BSG.

atomicparsley Example.m4v --title “Battlestar Galactica” --album “Battlestar Galactica, Season 3” --artist “Battlestar Galactica” --genre “Science Fiction” --tracknum 15 --description “Chief Tyrol’s inner labor leader leads him to defy Adama and become the rallying point for a strike.” --TVNetwork “NBC Universal” --TVShowName “Battlestar Galactica” --TVEpisode T2715 --TVSeasonNum 3 --TVEpisodeNum 15 --stik “TV Show” -art /users/yourname/desktop/art.jpg

Set all Movie data

Here’s an example using Pirates of the Caribbean and setting all useful metadata.

atomicparsley Pirates.m4v --title “Pirates of the Caribbean: The Curse of the Black Pearl” --genre “Action & Adventure” --description “From producer Jerry Bruckheimer (PEARL HARBOR) comes PIRATES OF THE CARIBBEAN: THE CURSE OF THE BLACK PEARL, the thrilling high-seas adventure with a mysterious twist. The roguish yet charming Captain Jack Sparrow’s (Academy Award (R) Nominee Johnny Depp)” --stik “Short Film” --contentRating “PG-13” -art /users/yourname/desktop/art.jpg

After all that for a movie file, we’re still missing two things. We haven’t yet attacked the Actor, Producer, Director fields, and there is an information button on iTunes-purchased movies that we don’t see on home-made movies. It looks like this:

Setting this is a bit harder, you’ll need to make a plain text file, all one line, something like this:

atompic--rDNSatom “< ?xml version=\"1.0\" encoding=\"UTF-8\"?><!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> castadamID1nameDonald DuckdirectorsadamID1nameMickey MouseproducersadamID1nameMinnie Mouse” name=iTunMOVI domain=com.apple.iTunes “

Really this is beyond the scope of what I’m writing up today. If you want to mess with this I suggest you wait for someone to write a tool that allows you to manipulate it.

Ok, so one last thing. Setting the cast and director above enabled the Information button in iTunes, but we don’t see the description when we click, just an empty box. It turns out that that box uses something called the long description, which is different than the normal description field. Atomic Parsley can’t reach that data, but we can copy it using AppleScript. I’ll work on that for the next post.

Many thanks to the Atomic Parsley author and other contributors over at the Sourceforge forums, who provided a lot of good info in their posts.

I wish the hard drive was a lot bigger than the 40GB drive (with 33GB usable space). I could really use a 500GB drive if I was really going to keep all my movies and music on it. But really you don’t have to if you have an 802.11n wireless network or a wired network between your machine running iTunes and your AppleTV. Our main machine in the house is a 20″ Intel iMac, and we have wired gigabit from the office to the living room. The AppleTV only has 10/100 megabit ethernet, but that’s fine for streaming content. So, I have zero movies on the AppleTV, and instead I play movies by browsing to the iMac’s iTunes library and streaming the content from the iMac to the AppleTV.

When browsing the iMac’s movie library on my TV, an old 36″ Sony VEGA CRT running at 1080i, I get full descriptions, nice artwork, and actors and directors for iTunes-purchased movies and for podcasts, but not for DVD’s that I ripped myself using HandBrake. For hand-ripped DVD’s and home movies, I just get the movie filename and the length. That’s it.

Here’s an example of the Description metadata in Pirates of the Caribbean:

and how it looks on-screen:

But on a normal movie file you don’t get the Show Description right click item:

I tried looking in iTunes for how to set the description, but there’s no description field there.

Some googling led me to Lostify, which let me put a Description in, but not artwork. Lostify led me to the Atomic Parsley command line tool for movie metadata editing, which led me to vID Infiltr8. vID Infiltr8 let me set the Description and the Artwork with no trouble. The interface is a bit strange, but otherwise it works well.

Here’s the vID Infiltr8 interface (click for larger):

After adding the tags into Infiltr8 and saving, now you have a full description in the movie preview:

An alternative to adding the artwork through Infiltr8 is to add a Poster Frame. The Poster Frame will become your artwork that will show when you browse to the movie on your AppleTV. To set the Poster Frame, just play the movie in iTunes until you get to a spot that you would like as the title’s artwork, right click, and choose Set Poster Frame.

And you’re done for now. I think Atomic Parsley should be able to add some of the fields you see in the Pirates shot, like Director and Actor names. I’m going to play around with it and see what I can get working.

P.S. While I’m not a huge Barbie fan myself, I have a five-year-old daughter that is.

In the meantime, you can always reach me directly, my contact info is on the about page.

• Compatible with any 2.5″, 3.5″, 5.25″ IDE or SATA device!
• Supports IDE & Enhanced IDE 3.5″ internal IDE Hard Disk
• Supports ATA/ATAPI-6 Specification 1.0
• Supports SATA I and SATA II
• USB 2.0 up to 480Mbps Transfer Speed
• Backwards Compatible with USB 1.1
• Plug and Play
• Hot Swappable
• Mac OS 9.2 or higher incluing Mac OS X
• Linux 2.4.X
• Microsoft Windows 98/98SE/ME/2000/XP

And only about $25. Very cool. I can see this being very handy at home for all sorts of backup and drive upgrade uses. I ordered two of them, one for me and one as a geek gift. I’ll post back how well they work after I get them.