Slashdot Mirror
Has the RIAA Wormed 95% of P2P Networks?
DancingSword was one of many to submit links to a strange story about
the RIAA hacking back by sending a worm through the major peer-to-peer networks, supposedly with a 95% infestation rate. Hoax or not?
95% of networks is not 95% of files.
I wonder, If the RIAA sends a worm through P2P networks and shut's the networks down, can the RIAA representatives be charged with hacking?. Besides, not all files on P2P networks are illegal.
Well a worm is a form of a virus, and it is a crime to create one... One would presume that the RIIA would not be stupid enough to try and play a vigilante.
.: Max Romantschuk
Where does this leave the RIAA legally? The bill mentioned in the article that would allow the RIAA and other copyright holders to crack computers to prevent piracy is not law yet. Does that mean that this would be regarded as just another worm with the authors being thrown in jail (like the authors of Love Bug and others)?
I agree. A healthy dose of scepticism is needed here. First of all, if the RIAA really *did* want to infect the p2p networks with a worm, they would make GOBBLES sign a non disclosure agreement.
Could this be FUD straight from the RIAA to scare people into not running p2p apps? Is it a rumor started by GOBBLES to create a stir against the RIAA, or is it legit?
Who cares? I'm gonna fire up my gnutella client and share open source software until the day that p2p is illegal.
...then it's an illegal act, period. Unless the Berman Bill is retroactive to a date prior to this supposed worm launch, it occoured before the bill is ever passed, and is illegal no matter what.
This supposed worm disables functions of a computer. Therefore, it is malicious, as is anything that modifies system performance without the user's knowledge and consent.
If this is true (95% infection rate? Doubt it), then we have one heck of a piece of ammo to use against the RIAA, if indeed they contracted this worm. The Price Fixing settlement, in that case, is just the beginning.
Blog Prophyts - Right On, Man
An exploit of this nature is of dubious legality
Dubious? How is there any doubt? Assuming this passes the farmer test (it's not just bullshit in a bag), how can there be doubts it's illegal. At best, it's invasion of privacy. At worst, it's cyber terrorism as defined by the Patriot Act.
The existance of a P2P client doesn't a criminal make, especially since the example given in the article by the l33t hacker is a perfectly legal file: the public MP3s (written to celebrate each OpenBSD release).
It's junk, like the quad-browser yesterday.
The biggest thing to fear is that the RIAA will use this to make up more numbers.
Never confuse volume with power.
I sincerely doubt that this is true for a number of reasons. First of all, if they were hired to write the software for RIAA, don't you thing secrecy would both, be part of the agreement, and be completely necessary?
Have you considered the possibility that they were hired by the RIAA to *claim* that they wrote the software, to scare people away from p2p networks?
"I'd rather have a full bottle in front of me than a full frontal lobotomy"
The scary thing behind what was posted to Bugtraq is that it explicitly states that all digital media on the system is cataloged, and the list is sent to the RIAA. This assumes all digital media on a system is an illegal copy.
Sure, if the worm comes into your system over a P2P network, there's a good chance that at least *some* of your mp3s are pirated, but there's no way to differentiate pirated mp3s and those you ripped/encoded from your own CD collection.
I could easily see someone downloading a public domain work via P2P network, getting infected, and having their 40GB mp3 (ripped/encoded from legally obtained sources) library listed to the RIAA "for future prosecution."
I love the whole guilty until proven innocent attitude here. Sounds like a bad "In Soviet Russia..." joke.
This is amusing, actually. Tell me again how one puts a "virus-worm hybrid" into a non-executable file and have it infect mp3 players on multiple platforms? Oh, and do it so that none of the millions of people listening to MP3s notice? While maintaining compatibility with things like handheld players? Oh, and let's not forget the linux people running programs like Integrit, which would let them know if something had modified their mpg123.
Please, I can't even believe this got posted.
End of lesson. You may press the button.
Assuming that the RIAA has created a p2p worm wouldn't it be the height of stupidity to announce it's existence? On the one hand they can generate some fear among p2p users and get a slight decrease in trading. On the other hand, if it really exists it is going to be found in very short order. If it's found by the wrong people (to them) then this is going to backfire in very short order. Once the details are known, I don't imagine it would be very hard to inject loads of spurious info into their violator database.
The SecurityFocus posting has lots of bragging about how network security tools won't find their exploit. I beg to differ. They aren't going to dodge tcpdump running on a machine that is a gateway for an infected machine. The way gnutella is supposed to work is known. To a trained eye, their "cleverly crafted" network requests are going to stick out like a sore thumb. In any case, just knowing a thing exists greatly simplifies finding it. We'll know in short order if they're hoaxing or not.
What are you talking about? The only thing ``unrealistic" about the Apache exploit was that the ``experts" didn't believe it was exploitable on 32-bit systems.
As for the OpenSSH bug... it was discovered by ISS, announced and fixed by the OpenBSD team, and then, a week later (or so), they released an exploit. All they did was make a diff of the two versions to find the security problem, then write a small script that exploits it... That's more tame than almost all other exploits, since they did not find it themselves, and did not have to do much work to exploit it, since it (the bug) was already explained in detail.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
So, has anyone downloaded the source example from bugtraq, compiled it, and seen what happens?
Praying for the end of your wide-awake nightmare.
This would be a lot easier to swallow if the RIAA.org wasn't so blatently easy to hack, then you could reasonably assume that the RIAA even knows a decent hacker let alone contracts them.
But seriously, let's say this isn't a hoax. Big Effing Deal. So the RIAA gets one day to make the P2P networks all DDOS themselves to hell. Yippie. That's just one day of interupted service. Within hours of this hyrda going off there will be virus definitions and patches from all the anti-virus vendors to fix the issue. And all of the software that is being exploited would also recieve patches.
Does anyone seriously believe that any significant percentage of P2P users are going to suddenly say "wow the RIAA has been right all along I better start paying for things" because they get exploited by Hilary & Friends?
I mean seriously here, the dilema is: a) Don't pay for anything and risk getting hacked by the RIAA *maybe* once. b) Pay for everything.
Wow that's sure gonna be a tough choice for the P2P crowd. What an insane waste of money for the RIAA to even bother with this nonsense.
Have you considered the possibility that they were hired by a group who wants to make the RIAA look more evil (or perhaps are acting on their own), and the RIAA actually has nothing to do with it?
I think it's interesting, and I'm glad it was posted, although my first reaction was the same as everyone else, BOLLOCKS! But as lots of other people, including the mighty Register have pointed out, Gobbles has a good record for making apparently silly claims, letting people scoff, then proving them wrong. I think the real story is "Gobbles makes outraegous claim, what the hell is he up to?"
Speculation: Theoretically, I guess it's possible that there's an overflow in a library widely used in mp3 players. Remember the SMTP vulnerabilities last year, or the zip library hole that affected everyone from RedHat to Microsoft? Heh, that's the trouble with those pesky BSD licensed libs ;) Suppose Gobbles did find a zero-day hole. Remember that 95% of p2p users are going to be Windows users, so they're probably all using the same OS libs in their clients - for network access, say, if not for mp3 playback. Bear in mind that this worm would be pretty silent - it wouldn't be throwing rude messages up on the screen, it'd be sneaking around and trying to hide itself... Suppose it was only released in the wild a week ago. Perhaps it used the Kazaa auto-updating features to distribute itself over the network . Hmmm, this is actually starting to sound feasible. Now, obviously if the RIAA hav done this, then they're in deep, deep trouble: even the copyright mafia and Bush junta would have a problem trying to make out that this is anything but deeply criminal action. Posit: Gobbles, or another ethically challenged researcher, decides to try to discredit the RIAA... what better way to do it? Can you imagine the 9o'clock TV news headlines if there turns out to be a whiff of fire behind the smoke?
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
This is so obviously a joke its not even funny.
> Things to keep in mind:
> 1) If you participate in illegal file-sharing
> networks, your computer now belongs to the RIAA.
Im sure glad there are no illegal file-sharing networks yet!
> 2) Your BlackIce Defender(tm) firewall will not
> help you.
> 3) Snort, RealSecure, Dragon, NFR, and all that
> other crap cannot detect this attack, or this
> type of attack.
Admitting its an attack, and admitting you are purposly designing it to avoid current defences, that will look good to a judge.
> 4) Don't fuck with the RIAA again, scriptkids.
Oh, your 13 years old?
> 5) We have our own private version of this hydra
> actively infecting p2p users, and building one
> giant ddosnet.
So any future DDoS we now can blame on these people who openly admitted to it.
GO get em yahoo and ebay!
> Due to our NDA with the RIAA, we are unable to
> give out any other details concerning the
> technology that we developed for them, or the
> details on any of the bugs that are exploited in
> our hydra.
An NDA is a legal document which cannot in any way override existing laws.
They admit to breaking numerous laws, and yet think a legal document will protect them?
I guess they really must all be under 13.
As a matter of fact, if my PC acts strange in any way shape or form, they now have opened themselfs up to a lawsuit.
They also claim the RIAA now has an illegally gained list of the perfectly legal files on my harddrive. This would be the perfect time for a large company to sue and request discovery, which would allow someone (generally feds, but still) to collect evedence (IE take any/all of their servers on the public network which ever have/had connections to a p2p network) which will cost them time and resources and frustrations. Then hopefully some evedence will be found as well.
My only wish is that alot of companys able to afford the legal fees open petty lawsuits aginst them for admitting all the crimes they have commited, if for nothing else than to cause them grief. Can also be used to harass the RIAA a little (Would be much better if the RIAA admitted this was true, but that will never happen.)
Turn the stupidity of the system aginst the enemy for a change.
isn't it a no-no to put your legally ripped-from-cd tracks into your "share" directory for others to copy?
all digital media on the system is cataloged, and the list is sent to the RIAA.
So what exactly makes you think it'll only search your shared folder?
- We are the slashdot. Resistance is futile. Prepare to be moderated -
force the makers of MP3 players to recheck their source code to ensure that such holes DON'T exist, this would be a way to do it. Publish an exploit, link it to all major players, invoke the RIAA demon, and watch the coders scramble. Right now:
- Coders are, I'm sure, crawling through their code to look for and fix any security holes,
- Users are running firewalls and packet analyzers to check for any worm-like behavior,
- Some P2P users are taking a second look at checksums.
If such vunerabilities exist, I'm sure they won't for much longer. If the Berman bill ever becomes law, there won't be much to hack.
It might be able to claim your P2P shares are for that purpose, but it's perfectly legal to put your MP3s on a server within your own house and then have all of your other devices access from a share on that server. It's being shared in a tech sense, but in reality its transfering from one computer of yours to another computer of yours, so it's you-to-you and no copyright violation can happen there.
Where to begin.... I'll only deconstruct the SecurityFocus message.
First, the fact that these programs have exploits is no surprise, but one media clip (probably MPEG (maybe MP3)), since while Windows Media Player and WinAMP offer universal playback, do ALL of them? Could one file even hit exploits in all these programs?
Second, since each is likely to have a different vulnerability, the amount of worm data in a file would be a decent chunk. Wouldn't it be noticed?
Third, an NDA would state that there can be no mention of it until it is ACTIVATED and USED. Now, Ad-aware-style programs will pop up to clean it if it exists.
Fourth, how many files would this have to be to get 95% of P2P users? The only way it could is by infecting every file you share, but SOMEBODY would have to notice that, whether the file size changes or some A/V data is thrown out.
Also, the idea of "specially formatted P2P requests" to inform RIAA is laughable. Even if the P2P software itself were compromised, a firewall user could notice it. Furthermore, consider the average media collection - hundreds of MP3s. Considering it would have to send artist name and song name, the amount of data would be well over 1MB unless compressed, and even then on dialup users it would have to be staggered.
Also, what kind of backend would this take? Multiple servers, a huge internet connection. Considering how big the P2P networks are, wouldn't this have to be a massive monitoring system? There aren't that many locations with these resources INSTALLED, so finding the facility would not be hard.
And why mention you have a IDENTICAL worm that you use to build a DDOS NET? Simple. Get those who don't care about privacy too much kicked up about that.
Finally, this sounds very strangely like RIAA-induced hypnosis - here are a few lines which show that they probably are lying and not even working with RIAA, just agree with RIAA's ideas.
"victim" (not the hard-working artists who p2p technology rapes, and the RIAA protects)
4) Don't fuck with the RIAA again, scriptkids.
Until we became RIAA contracters, the best they could do was to passively monitor traffic. Our contributions to the RIAA have given them the power to actively control the majority of hosts using these networks.
There are some spelling mistakes. There are factual holes that they cover with the claim of an NDA. In short, the probability of a hoax is about 98%.
Jeez.
He's trying to make a point - that running all this P2P crap blindly on your systems, -especially- Windows boxes, is a security nightmare.
Think about it; he's managed to get thousands upon thousands of people worldwide nervous and antsy about whether or not their boxes are in a semi-0wned condition. Why?
Because it's within the realm of possibility that something like this could be done. Not by the stupid RIAA, who can't even secure their own Web site, but by somebody a) more skilled and b) motivated to do something Really Bad, like build (and use) a gigantic DDoS network, or steal any kind of account/password info it can find, or any kind of documents which might contain proprietary information, etc.
The intellectual property aspect of filesharing aside, I personally think that anyone who runs a P2P app is asking to get burned. There simply hasn't been the kind of scrutiny turned on these things that we see on other types of apps and utilities (and we already know that the concept Gobbles is preaching about is valid due to the earlier KaZAa worm, etc.).
How does their software know what media is illeagal? If I have ripped my own collection of CD's so that I can listen to them when I want to using my PC, how does the RIAA know? Further, if I am not sharing those files, download a song just to listen to it then delete the file, why does the RIAA get to infect my PC with a virus? --JS
If you are never moderated, do you really exist?
Not to mention all the paranoid folks that monitor all their traffic. The worm claims to send info back to the RIAA, just try to tell me that somebody who's a religious packet sniffer won't notice that.
Unbreakable toys can be used to break other toys.
Come on, this is about as realistic as the computer jargon you hear on TV.
"My Subnetwork ping redistributer is down! I need to reboot my LAN before the virus infects my ethernet cable and gets everywhere!!!"
And yet I see people saying "this is probably not true" or "this may be a hoax", or "if they're doing this it should be illegal!". Come on. For Christ's Sake, this is totally idiotic and anyone with an iota of computer knowledge should immediately dismiss it.
I don't care if Linus Torvalds himself came out and said he'd done it, I'd laugh and point.
Not so much that, but I know theirs geeks out their with a linux or BSD box firewalling, that logs EVERY packet for some paronoid reason. *G* Anyways, I'm guessing one of these people would have caught something like this already. I'll agree with the hoax line.
Can all fish swim?
ok, so you exploit a buffer overflow in xmms, then what? how many people are running xmms as root? i'm kinda slow, so bare with my ignorance. how does a buffer overlflow in xmms give a "normal" user the ability to infect the operating system? how does one write a worm to infect multiple operating systems on multiple platforms efficiently? this sounds a bit hokey to me.
-- john
This is not surprising, since it's clear that Gobbles does not like Theo, but it is significant if it is true.
Gobbles?
Jesus, then it's probably not real.. anyone remember his "security alert" about awhttpd? Basically, the "vulnerability" he described was Lynx retrieving the file from his local filesystem via a file:// URL-type.
A reply, showing just what an idiot this "Gobbles" is is here
the world portrayed in this statement is not the world as it is now. it is the world that will be some day if entertainment companies don't figure out a way to give the customer a better reason to buy their products. legislation will not make consumers want to buy content they don't think is worth money. people buy DVDs and video games more and more all of the time. unlike VHS, DVD has extra features. something extra was given to the buyer to make it worth the higher purchase cost and increased copy protection. the video game industry continues to flourish because it continually strives to make new, different products (at least visually) and it has kept up with copy protection over time. there is some degree of copyright control, but the consumer has also been taken into consideration.
the RIAA and the MPAA dropped the ball and now want someone else to clean up their messes. let them clean it up. don't allow any industry to become vigilantes protecting its own interests. banks are not allowed to hunt down suspects in robberies. it would be a terrible precedent to set.
these "free" copies being distributed on the internet are lower quality than the originals they come from. if the free stuff bothers the industry, the industry should give consumers a reason to buy original copies other than, "we want you to." put DRM all over it. require new players, whatever. but make sure the consumer has incentive to accept all of that. do not bite the hand that feeds you. the industry feels cheated. if consumers didn't feel cheated by what they are offered, they wouldn't go looking elsewhere for free alternatives. if the content were compelling, people would pay for it.
you probably shouldn't have read this.
Is exactly what I will do if legislation like Berman's and all of the other stupid, dinosaur-Entertainment-cartel-protection-racket legislation passes.
As a professional in the IT industry and as an American citizen (NOT CONSUMER!), I care so much more about the usurpation of the American political process by and transfer of control over my rights regarding my personal property to big (mostly global) corporations than I do about what you mischaracterize as "piracy" -- piracy is commercial activity, passing out tapes for free on the streetcorner is not, and may even be protected under the Audio Home Recording act -- THAT I SIMPLY WON'T SPEND ANY MONEY ON ENTERTAINMENT AGAIN!
Read this, Rep. Goodlatte -- if that is really who you are -- over the past 5 years my income has been significantly higher than the national mean, due to my profession. I have spent an enormous amount of money on entertainment, computers and consumer electronics.
But with each step further into my home that the Entertainment industry attempts to exert power, my consumption has dropped and will continue to.
I do not, AND WILL NEVER own a DVD player thanks to CSS, region coding and other corporate attempts to control my private behavior.
I do not, AND NEVER WILL own an HDTV thanks to the broadcast flag and rules and legislation being proposed which seem to be designed to make things like the Linux computer which so empowered me (by, for instance, providing me with a learning platform which I used to leverage myself into this income bracket in the first place) illegal.
When ALL TV broadcasts are digital and protected, I won't be watching TV, and I'll just be one high-income but UNREACHABLE to advertisers "permanently potential consumer" thanks to you. Ask GM, Proctor and Gamble, and Pepsico how they feel about that. I will also be unable to view your campaign ads or those of like-minded fools who run for office in my district.
When ALL movies are only rentable on DVD (about 50% are only on DVD at my local Blockbuster now), I'll stop renting movies, AND MPAA MEMBER COMPANIES will stop receiving that much more of my large income -- as a frame of reference, I currently rent about 3 movies a week. By then, maybe even my wife will be so incensed that I'll be able to convince her of what I've been unsuccesful at convincing her in the past -- that we should stop going to movies alltogether.
If it gets to the point where music is only available on media or devices that are likewise crippled, I'll DISCONTINUE ALL MUSIC PURCHASES. I've already greatly curtailed my previously prodigious music buying behavior due to my outrage at this whole DRM regime bullshit.
And you know what? That's all fine by me. I own a guitar and a computer that can record music; I'll make my own music, and probably even give it away -- PROBABLY BECOMING ONE OF JUST MANY PROVIDING COMPLETELY FREE COMPETING PRODUCT for "consumers" to choose over that of your corporate pimps.
I have friends who own conventional and digital flim equipment.
I have a computer with which to compose and disseminate my views.
Unless you plan on making all means for individual citizens to produce their own entertainment and their own news media, you'll eventually fulfill the exact opposite goal of all this legislation; you'll help impoverish the very companies you're trying to protect. Let's see if they continue to fund your campaigns then!
Our forefathers died for (and grandfathers fought world wars for) freedom, NOT FOR DISNEY!
But I guess you can't tell the difference.