Internet Storm Center Infocon Status
Get FireFox for Secure Browsing
My Blog Roll
Login
User name:
Password:
Remember me 

View Article  Pirate Bay finds gold in MediaDefender emails

Thanks to the email-leakage from MediaDefender-Defenders we now have proof of the things we've been suspecting for a long time; the big record and movie labels are paying professional hackers, saboteurs and ddosers to destroy our trackers.

While browsing through the email we identified the companies that are also active in Sweden and we have tonight reported these incidents to the police. The charges are infrastructural sabotage, denial of service attacks, hacking and spamming, all of these on a commercial level.

The companies that are being reported are the following:

  • Twentieth Century Fox, Sweden AB
  • Emi Music Sweden AB
  • Universal Music Group Sweden AB
  • Universal Pictures Nordic AB
  • Paramount Home Entertainment (Sweden) AB
  • Atari Nordic AB
  • Activision Nordic Filial Till Activision (Uk) Ltd
  • Ubisoft Sweden AB
  • Sony Bmg Music Entertainment (Sweden) AB
  • Sony Pictures Home Entertainment Nordic AB

Stay tuned for updates.

Original Post.

View Article  MediaDefender-Defenders!

The whole mail database was converted to HTML by Forrest F. (JRWR), and is hosted by the nicest guy on the planet.

Do note that this is not the official MediaDefender-Defenders website, just a browseable copy of the e-mail leak that snowballed. We're also not the guys that acquired these e-mails, we just nabbed them off of BitTorrent and converted them.

We got pulled offline by No-ip.com, who seemed to take offense and took jrwr.hopto.org offline. You can now find us here at mediadefender-defenders.com. However, as the world really should learn - whenever you take one site down, twelve new ones will spring online.

Update: We moved to the domain which.. one of the IRC guys got, and recieved our first C&D letter. More soon.

Feel free to come meet us at #MediaDefender-Defenders @ EFNet, and some new site features will be coming shortly.

I'm not sure why I find all this so entertaining, but I do. Go read some emails:

View Article  MediaDefender Damage Control: Cease and Desist!
After the big leak of last week, today mediadefender is desperately trying to establish some level of damage control. This morning we received an email from their lawyers stating that the domain registrar should hand over our personal information. So here is an open letter to MediaDefender.

Dearest little asstunnels,

Let me start of by thanking you for your pittyfull attempt to have your emails removed from the entire internet (the thing that says www.). In no way we feel obligated to fulfill your request, as a matter of fact any organisation that tries to harm this site and the bittorrent user in general can expect nothing more from us but a big fuck you!

In case you havent noticed, this site is located in europe (I hope you can point it out on a map) were your stupid copyright claims have no base. But fair is fair you guys did suffer over the past week so here's bit of advice to you guys:

The the full email sent by Markus at Meganova.  It gets rather colorful.
View Article  MediaDefender Internal Emails Go Public

Unfortunately for Media Defender - a company dedicated to mitigating the effects of internet leaks - they can do nothing about being the subject of the biggest BitTorrent leak of all time. Over 700mb of their own internal emails, dating back over 6 months have been leaked to the internet in what will be a devastating blow to the company. Many are very recent, having September 2007 dates and the majority involve the most senior people in the company. Apparently this is not the first time that a MediaDefender email leaked onto the Internet.

According to the .nfo file posted with the Mbox file the emails were obtained by a group called “MediaDefender-Defenders”. It states: “By releasing these emails we hope to secure the privacy and personal integrity of all peer-to-peer users. The emails contains information about the various tactics and technical solutions for tracking p2p users, and disrupt p2p services,” and “A special thanks to Jay Maris, for circumventing there entire email-security by forwarding all your emails to your gmail account”

Note: The mbox formatted file is circulating publicly on BitTorrent, completely unedited. However, for publication here we have removed the username and password logins for Media Defender’s servers, and replaced them with asterisks and avoided publishing emails of a personal nature, e.g pay negotiations etc. We believe that the emails are the real deal and all the info posted here serves the public interest.

Read the whole post on TorrentFreak.

View Article  FBI's Secret Spyware Tracks Down Teen Who Made Bomb Threats

FBI agents trying to track the source of e-mailed bomb threats against a Washington high school last month sent the suspect a secret surveillance program designed to surreptitiously monitor him and report back to a government server, according to an FBI affidavit obtained by Wired News.

The court filing offers the first public glimpse into the bureau's long-suspected spyware capability, in which the FBI adopts techniques more common to online criminals.

The software was sent to the owner of an anonymous MySpace profile linked to bomb threats against Timberline High School near Seattle. The code led the FBI to 15-year-old Josh Glazebrook, a student at the school, who on Monday pleaded guilty to making bomb threats, identity theft and felony harassment.

Read the full article on Wired.  I believe that this is the first confirmed use of an FBI Trojan horse program in a criminal investigation.  That we know of ;)

View Article  Surf the Net Safely and Privately with JanusVM

This morning, while having a little fun with VMWare Server, I stumbled on VMWare’s list of free virtualized environments. If you have any VMWare product installed on your box, you’ll definitely want to check this list out. Anyhow, like I already said, I stumbled on this list and quickly browsed the available products. That’s when I ended up on a very interesting security package named JanusVM. JanusVM is a virtualized security environment that allows you to surf the internet absolutely securely and privately. It was designed to run on VMware Player (or Server) and brings together openVPN, Tor, Squid, Privoxy and dns-proxy-tor to give you a transparent layer of security that is compatible with most TCP based applications.

JanusVM Features:

  • WiFi Support.
  • Supports multiple users in a LAN.
  • Protects you from most man-in-the-middle attacks.
  • Protects you from Javascript, Java, and Flash based side-channel privacy attacks.
  • Protects your identity and your true location by masking your IP Address.
  • Encrypts and re-routes your DNS request and ALL TCP traffic to ensure strong privacy.
  • Strips out most privacy sensitive information your web browser may leak.
  • Blocks popups, annoying ads, banners, and other obnoxious Internet junk.
  • Very simple setup and operation.
  • Works transparently for applications using TCP.

Setup is very easy. Just download and install VMWare player, download JanusVM and follow these simple instructions.

After setting up the environment, if you decide to keep JanusVM running on your box, please consider giving a small donation to the developer. Your donations will surely encourage him to keep on working on this fantastic project.

Nice, I'm downloading this now.  Usually the presence of Tor on a corporate laptop is eyed suspiciously.  Found on Geeks are Sexy.

View Article  Quicken Backdoor Could Give Feds Access to Finance Data
A Moscow-based password-recovery vendor Thursday accused Intuit Inc. of hiding a backdoor in its popular Quicken personal finance program that gives it -- and perhaps government agencies -- access to users’ data files.

Intuit called the charges baseless, and said that although there is a way to unlock Quicken’s encrypted data, it’s only used by the company’s support team to help customers who have forgotten their passwords.

In a statement, Elcomsoft Co. Ltd., a Russian maker of password-recovery tools, said Quicken versions since 2003 have used strong encryption designed to foil hackers. But those editions also have a backdoor that unlocks the encryption with the 512-bit RSA key that Intuit controls.

"It is very unlikely that a casual hacker could have broken into Quicken’s password protection regimen," Vladimir Katalov, Elcomsoft’s CEO, said in the statement. "[We] needed to use advanced decryption technology to uncover Intuit’s undocumented and well-hidden backdoor, and to successfully perform a factorization of their 512-bit RSA key."

"Very unlikely..." my ass.  Read the full article at CSOonline.com.
View Article  Z Backscatter Van Drive-By Screening System

A breakthrough in X-ray detection technology, AS&E's Z Backscatter Van (ZBV) is a low-cost, extremely maneuverable screening system built into a commercially available delivery van. The ZBV allows for immediate deployment in response to security threats, and its high throughput capability facilitates rapid inspections. The system's unique "drive-by" capability allows one or two operators to conduct X-ray imaging of suspect vehicles and objects while the ZBV drives past.

The ZBV can also be operated in stationary mode* by parking the system and producing X-ray images of vehicles as they pass by. Screening can also be accomplished remotely while the system is parked. Remote operation allows scanning to be done safely, even in dangerous environments, while maintaining low-profile operation. The system is unobtrusive, as it maintains the outward appearance of an ordinary van.

Boing Boing has also posted about this rolling invader of privacy.  Get the details from the manufacturer, AS&E.

View Article  New Computer Program to Reassemble Shredded Stasi Files

Millions of files consigned to paper shredders in the late days of the East German regime will be pieced together by computer. The massive job of reassembling this puzzle from the late Cold War was performed, until now, by hand.

It's been years in the making, but finally software designed to electronically piece together some 45 million shredded documents from the East German secret police went into service in Berlin on Wednesday. Now, a puzzle that would take 30 diligent Germans 600 to 800 years to finish by hand, according to one estimate, might be solved by computer in seven.

Low tech decryption.  Good article from Spiegel Online.

View Article  Anyone need a Watchlist?

Prior to the airline hijackings on Sept. 11, 2001, the Federal Aviation Administration's "no-fly list" contained 11 names.

Soon after the attacks, the Transportation Security Administration was created, and given direct authority over airline security screening and the watch list. The list soon began to expand almost daily, according to government documents. The last credible report on the list put its length at 119,000 names, though the TSA says it has since narrowed it to a smaller number that must remain a secret.

While it was expanding the no-fly list, the TSA was also busy carving out a second list of people who were allowed to fly, but would be screened extra closely on their way to the gates. The government initially denied this "selectee list" existed, but a watchdog group eventually got the goods in a Freedom of Information Act request.

Of course, the TSA isn't the only agency making lists these days. Here's a quick Wired News field guide to post-9/11 watch lists.

Get the list on Wired.

View Article  Counter attack hacking OK-ed by courts
This is a very interesting case.  It seems if you are just collecting evidence while trying to protect your own systems, hacking a hacker is okay.

A federal appeals court just shot down an attempt by confessed superhacker Jerome Heckenkamp to overturn his computer crime convictions, which were an end result of information provided by a university sysadmin who broke into Heckenkamp's computer to gather evidence.

The warrantless cyber-search was justified by the "special needs" exception to the Fourth Amendment, because "the administrator reasonably believed the computer had been used to gain unauthorized access to confidential records on a university computer," the U.S. 9th Circuit Court of Appeals ruled Thursday.

Later in the article on Wired:

According to the decision, UWisc cracked Heckenkamp's computer in order to confirm that he was the hacker they were looking for. Heckenkamp turned out to be guilty, so Schroeder's tough talk has some surface appeal. But what if Heckenkamp had been innocent?

The whole policy has some nasty implications for student privacy. There's no judge in the loop; no independent finder of fact. So who decides when there's enough evidence to break into the student's machine and riffle through his files? And then there's the inevitable mission creep. What happens when system administrators crack a suspected hacker's computer, and find he's innocent of the hack, but also turn up evidence that he's been selling dope to his friends? Or downloading pirated music? And eventually, instead of Qualcomm, it'll be the RIAA or the MPAA calling up the University of Wisconsin for a little help.

View Article  It's Official: Pretexting Is Illegal

President Bush signed a bill last week making a controversial practice known as "pretexting," a federal offense.

The law specifically forbids the act of misrepresentation, impersonation or deception in order to obtain personal telephone information. Just five months ago, pretexting fell into a gray area of the law.

The issue gained national attention when Hewlett-Packard filed a document with the U.S. Securities and Exchange Commission. The computer maker said its investigators had used tactics to find out which members of its board where leaking private company information to the media, which ended up as news reports. The scandal led to testimony before Congress and the resignation of several board members and HP employees.

Several lawyers and private investigators -- including some working for HP when the company obtained journalists' and board members' personal phone records during an investigation into leaks from its boardroom -- said that it was unclear whether pretexting was against the law.

The legal line is clearer now. The text of the Telephone Records and Privacy Protection Act of 2006 now states it is illegal to use fraud in order to obtain billing records and other information phone companies retain on individual customers. Law enforcement officers are exempted but generally need warrants to get the information.

Read the full article on InformationWeek.


Search
Google Search
Translators
Partner Sites
Chat with me
Alexa Traffic Counter
Feed Map
Technocrati Chart
Posts that contain "Lazy Genius" per day for the last 60 days.
Technorati Chart
Get your own chart!