Get FireFox for Secure Browsing
|

Saturday, September 22

Pirate Bay finds gold in MediaDefender emails
by
Xavier Ashe
on Sat 22 Sep 2007 02:53 PM EDT
Thanks to the email-leakage from MediaDefender-Defenders we now have
proof of the things we've been suspecting for a long time; the big
record and movie labels are paying professional hackers, saboteurs and
ddosers to destroy our trackers.
While browsing through the email we identified the companies that
are also active in Sweden and we have tonight reported these incidents
to the police. The charges are infrastructural sabotage, denial of
service attacks, hacking and spamming, all of these on a commercial
level.
The companies that are being reported are the following:
- Twentieth Century Fox, Sweden AB
- Emi Music Sweden AB
- Universal Music Group Sweden AB
- Universal Pictures Nordic AB
- Paramount Home Entertainment (Sweden) AB
- Atari Nordic AB
- Activision Nordic Filial Till Activision (Uk) Ltd
- Ubisoft Sweden AB
- Sony Bmg Music Entertainment (Sweden) AB
- Sony Pictures Home Entertainment Nordic AB
Stay tuned for updates. Original Post.
Tuesday, September 18

MediaDefender-Defenders!
by
Xavier Ashe
on Tue 18 Sep 2007 03:51 PM EDT
The whole mail database was converted to HTML by Forrest F. (JRWR), and is hosted by the nicest guy on the planet.
Do
note that this is not the official MediaDefender-Defenders website,
just a browseable copy of the e-mail leak that snowballed. We're also
not the guys that acquired these e-mails, we just nabbed them off of
BitTorrent and converted them.
We got pulled offline by No-ip.com, who seemed to take offense and took jrwr.hopto.org offline. You can now find us here at mediadefender-defenders.com.
However, as the world really should learn - whenever you take one site down, twelve new ones will spring online.
Update: We moved to the domain which.. one of the IRC guys got, and recieved our first C&D letter. More soon.
Feel free to come meet us at #MediaDefender-Defenders @ EFNet, and some new site features will be coming shortly. I'm not sure why I find all this so entertaining, but I do. Go read some emails:

MediaDefender Damage Control: Cease and Desist!
by
Xavier Ashe
on Tue 18 Sep 2007 01:25 PM EDT
After the big leak of last week, today mediadefender is desperately trying to establish some
level of damage control. This morning we received an email from their lawyers
stating that the domain registrar should hand over our personal information. So here is an open letter to MediaDefender.
Dearest little asstunnels,
Let me start of by thanking you for your pittyfull attempt to have your
emails removed from the entire internet (the thing that says www.).
In no way we feel obligated to fulfill your request, as a matter of
fact any organisation that tries to harm this site and the bittorrent
user in general can expect nothing more from us but a big fuck you!
In case you havent noticed, this site is located in europe (I hope you
can point it out on a map) were your stupid copyright claims have no
base. But fair is fair you guys did suffer over the past week so here's
bit of advice to you guys: The the full email sent by Markus at Meganova. It gets rather colorful.
Monday, September 17

MediaDefender Internal Emails Go Public
by
Xavier Ashe
on Mon 17 Sep 2007 02:37 PM EDT
Unfortunately for Media Defender - a company dedicated to mitigating
the effects of internet leaks - they can do nothing about being the
subject of the biggest BitTorrent leak of all time. Over 700mb of their
own internal emails, dating back over 6 months have been leaked to the
internet in what will be a devastating blow to the company. Many are
very recent, having September 2007 dates and the majority involve the
most senior people in the company. Apparently this is not the first
time that a MediaDefender email leaked onto the Internet.
According to the .nfo file posted with the Mbox file the emails were
obtained by a group called “MediaDefender-Defenders”. It states: “By
releasing these emails we hope to secure the privacy and personal
integrity of all peer-to-peer users. The emails contains information
about the various tactics and technical solutions for tracking p2p
users, and disrupt p2p services,” and “A special thanks to Jay Maris,
for circumventing there entire email-security by forwarding all your
emails to your gmail account”
Note: The mbox
formatted file is circulating publicly on BitTorrent, completely
unedited. However, for publication here we have removed the username
and password logins for Media Defender’s servers, and replaced them
with asterisks and avoided publishing emails of a personal nature, e.g
pay negotiations etc. We believe that the emails are the real deal and
all the info posted here serves the public interest. Read the whole post on TorrentFreak.
Thursday, July 19

FBI's Secret Spyware Tracks Down Teen Who Made Bomb Threats
by
Xavier Ashe
on Thu 19 Jul 2007 11:36 PM EDT
FBI agents trying to track the source of e-mailed bomb threats against
a Washington high school last month sent the suspect a secret
surveillance program designed to surreptitiously monitor him and report
back to a government server, according to an FBI affidavit obtained by
Wired News.
The court filing offers the first public glimpse into the
bureau's long-suspected spyware capability, in which the FBI adopts
techniques more common to online criminals.
The software was sent to the owner of an anonymous MySpace profile
linked to bomb threats against Timberline High School near Seattle. The
code led the FBI to 15-year-old Josh Glazebrook, a student at the
school, who on Monday pleaded guilty to making bomb threats, identity
theft and felony harassment.
Read the full article on Wired. I believe that this is the first confirmed use of an FBI Trojan horse program in a criminal investigation. That we know of ;)
Monday, June 25

Surf the Net Safely and Privately with JanusVM
by
Xavier Ashe
on Mon 25 Jun 2007 01:46 PM EDT
This morning, while having a little fun with VMWare Server, I stumbled on VMWare’s list of free virtualized environments.
If you have any VMWare product installed on your box, you’ll definitely
want to check this list out. Anyhow, like I already said, I stumbled on
this list and quickly browsed the available products. That’s when I
ended up on a very interesting security package named JanusVM.
JanusVM is a virtualized security environment that allows you to surf
the internet absolutely securely and privately. It was designed to run
on VMware Player (or Server) and brings together openVPN, Tor, Squid, Privoxy and dns-proxy-tor to give you a transparent layer of security that is compatible with most TCP based applications.
JanusVM Features:
- WiFi Support.
- Supports multiple users in a LAN.
- Protects you from most man-in-the-middle attacks.
- Protects you from Javascript, Java, and Flash based side-channel privacy attacks.
- Protects your identity and your true location by masking your IP Address.
- Encrypts and re-routes your DNS request and ALL TCP traffic to ensure strong privacy.
- Strips out most privacy sensitive information your web browser may leak.
- Blocks popups, annoying ads, banners, and other obnoxious Internet junk.
- Very simple setup and operation.
- Works transparently for applications using TCP.
Setup is very easy. Just download and install VMWare player, download JanusVM and follow these simple instructions.
After setting up the environment, if you decide to keep JanusVM running on your box, please consider giving a small donation to the developer. Your donations will surely encourage him to keep on working on this fantastic project. Nice, I'm downloading this now. Usually the presence of Tor on a corporate laptop is eyed suspiciously. Found on Geeks are Sexy.

Quicken Backdoor Could Give Feds Access to Finance Data
by
Xavier Ashe
on Mon 25 Jun 2007 09:10 AM EDT
A Moscow-based
password-recovery vendor Thursday accused Intuit Inc. of hiding a
backdoor in its popular Quicken personal finance program that gives it
-- and perhaps government agencies -- access to users’ data files.
Intuit
called the charges baseless, and said that although there is a way to
unlock Quicken’s encrypted data, it’s only used by the company’s
support team to help customers who have forgotten their passwords.
In
a statement, Elcomsoft Co. Ltd., a Russian maker of password-recovery
tools, said Quicken versions since 2003 have used strong encryption
designed to foil hackers. But those editions also have a backdoor that
unlocks the encryption with the 512-bit RSA key that Intuit controls.
"It
is very unlikely that a casual hacker could have broken into Quicken’s
password protection regimen," Vladimir Katalov, Elcomsoft’s CEO, said
in the statement. "[We] needed to use advanced decryption technology to
uncover Intuit’s undocumented and well-hidden backdoor, and to
successfully perform a factorization of their 512-bit RSA key."
"Very unlikely..." my ass. Read the full article at CSOonline.com.
Monday, May 14

Z Backscatter Van Drive-By Screening System
by
Xavier Ashe
on Mon 14 May 2007 12:52 PM EDT
A breakthrough in X-ray detection technology, AS&E's Z
Backscatter Van (ZBV) is a low-cost, extremely maneuverable screening
system built into a commercially available delivery van. The ZBV allows
for immediate deployment in response to security threats, and its high
throughput capability facilitates rapid inspections. The system's
unique "drive-by" capability allows one or two operators to conduct
X-ray imaging of suspect vehicles and objects while the ZBV drives
past.
The ZBV can also be operated in stationary
mode* by parking the system and producing X-ray images of vehicles as
they pass by. Screening can also be accomplished remotely while the
system is parked. Remote operation allows scanning to be done safely,
even in dangerous environments, while maintaining low-profile
operation. The system is unobtrusive, as it maintains the outward
appearance of an ordinary van. Boing Boing has also posted about this rolling invader of privacy. Get the details from the manufacturer, AS&E.
Saturday, May 12

New Computer Program to Reassemble Shredded Stasi Files
by
Xavier Ashe
on Sat 12 May 2007 10:58 AM EDT
Millions of files consigned to paper shredders
in the late days of the East German regime will be pieced together by
computer. The massive job of reassembling this puzzle from the late
Cold War was performed, until now, by hand.
It's been years in the making, but finally software designed to
electronically piece together some 45 million shredded documents from
the East German secret police went into service in Berlin on Wednesday.
Now, a puzzle that would take 30 diligent Germans 600 to 800 years to
finish by hand, according to one estimate, might be solved by computer
in seven. Low tech decryption. Good article from Spiegel Online.
Wednesday, April 18

Anyone need a Watchlist?
by
Xavier Ashe
on Wed 18 Apr 2007 11:33 AM EDT
Prior to the airline hijackings on Sept. 11, 2001, the Federal Aviation Administration's "no-fly list" contained 11 names.
Soon after the attacks, the Transportation Security Administration was
created, and given direct authority over airline security screening and
the watch list. The list soon began to expand almost daily, according
to government documents. The last credible report on the list put its
length at 119,000 names, though the TSA says it has since narrowed it
to a smaller number that must remain a secret.
While it was expanding the no-fly list, the TSA was also busy
carving out a second list of people who were allowed to fly, but would
be screened extra closely on their way to the gates. The government
initially denied this "selectee list" existed, but a watchdog group
eventually got the goods in a Freedom of Information Act request.
Of course, the TSA isn't the only agency making lists these
days. Here's a quick Wired News field guide to post-9/11 watch lists.
Get the list on Wired.
Monday, April 9

Counter attack hacking OK-ed by courts
by
Xavier Ashe
on Mon 09 Apr 2007 11:56 AM EDT
This is a very interesting case. It seems if you are just collecting evidence while trying to protect your own systems, hacking a hacker is okay.
A federal appeals court just shot down an attempt by confessed
superhacker Jerome Heckenkamp to overturn his computer crime
convictions, which were an end result of information provided by a
university sysadmin who broke into Heckenkamp's computer to gather
evidence.
The warrantless cyber-search was justified by the "special needs"
exception to the Fourth Amendment, because "the administrator
reasonably believed the computer had been used to gain unauthorized
access to confidential records on a university computer," the U.S. 9th
Circuit Court of Appeals ruled Thursday.
Later in the article on Wired: According to the decision, UWisc cracked Heckenkamp's computer in
order to confirm that he was the hacker they were looking for.
Heckenkamp turned out to be guilty, so Schroeder's tough talk has some
surface appeal. But what if Heckenkamp had been innocent?
The whole policy has some nasty implications for student privacy.
There's no judge in the loop; no independent finder of fact. So who
decides when there's enough evidence to break into the student's
machine and riffle through his files? And then there's the inevitable
mission creep. What happens when system administrators crack a
suspected hacker's computer, and find he's innocent of the hack, but
also turn up evidence that he's been selling dope to his friends? Or
downloading pirated music? And eventually, instead of Qualcomm, it'll
be the RIAA or the MPAA calling up the University of Wisconsin for a
little help.
Monday, January 22

It's Official: Pretexting Is Illegal
by
Xavier Ashe
on Mon 22 Jan 2007 02:25 PM EST
President Bush signed a bill last week making a controversial practice known as "pretexting," a federal offense.
The law specifically forbids the act of misrepresentation,
impersonation or deception in order to obtain personal telephone
information. Just five months ago, pretexting fell into a gray area of
the law.
The issue gained national attention when Hewlett-Packard filed a document with the U.S. Securities and Exchange Commission. The computer
maker said its investigators had used tactics to find out which members
of its board where leaking private company information to the media,
which ended up as news reports. The scandal led to testimony before
Congress and the resignation of several board members and HP employees.
Several lawyers and private investigators -- including some working for
HP when the company obtained journalists' and board members' personal
phone records during an investigation into leaks from its boardroom --
said that it was unclear whether pretexting was against the law.
The legal line is clearer now. The text of the Telephone Records and Privacy Protection Act
of 2006 now states it is illegal to use fraud in order to obtain
billing records and other information phone companies retain on
individual customers. Law enforcement officers are exempted but
generally need warrants to get the information.
Read the full article on InformationWeek.
|
|