Earthstation5 Responds to Malware Claims

Zip In The Wire writes "Random Nut, AKA Shaun Garriok, the Author of Kazaalite, has been a vocal critic of Earthstation5 because of a continual online insult war between himself and some rowdy Earthstation5 fans. This has motivated him to be extremely critical of Earthstation5." (We reported yesterday Garriok's claims that Earthstation5 contains spyware.) "We at Earthstation5 desire and request criticism at any time in fact we demand it as we believe that is the only way to make software truly superior." Read on for the rest of Zip In The Wire (Filehoover, ES5's lead programmer)'s explanation, in which he also points to an updated version of the software, and challenges all takers to find spyware within it.

"We at Earthstation5 are not perfect, but we acknowledge that Shaun Garriok might be and thank him for helping us root out bugs.

The problem with the Earthstation5 software that Shaun Garriok found truly exists; however, the sordid motives he attributes to Earthstation5 are incorrect. The following functions were put into Earthstation5 to allow automatic, remote upgrade of the Earthstation5 software.

These functions are:

1. Reload Earthstation5
2. Shutdown Earthstation5
   
3. Delete a File

All of these functions are necessary to perform when upgrading software.

We have long been admirers of Shaun Garriok's ability to superbly investigate even a fully compiled program. We believe that he is capable of finding ANY sort of trojan, worm, or bug inside a compiled program. We are relieved that all he could find was these remote upgrade functions. He didn't find any bugs that send user data anywhere, no spyware, no adware, nothing, in fact, that gives away any personal information about the user using Earthstation5.

It is also a fortunate fact that since Earthstation5 protects you from the RIAA lawsuits and hackers by hiding your ip address, the exploit program he wrote can only be used against your own computer, which he states in his exploit. If you want to delete files from your own computer, we feel you have the right to do that.

We are glad he found this bug and pointed it out. We completely removed the automatic software upgrade code because as it turns out automatic upgrade is no longer popular as it once was because it gives people an uneasy feeling and rightly so.

Since Shaun Garriok seems to be concerned about everyone's security, and is not on a personal quest for revenge, we would be grateful if he would download the latest Earthstation5 (version 1.1.31), and verify that we have truly removed the remote-update function which his exploit program accessed. We think his dedication to the good of all concerned would motivate him to do this. Anyone else who is concerned can do the same; download the latest Earthstation5 and test the exploit code against it.

-- Filehoover, Lead Programmer of ES5."

Comments

I'm surprised

[Anonymous Coward]

that these people are based in the middle east... their statements have a certain nigerian ring to them.

I WISH THIS MY PROPOSAL WILL NOT COME TO YOU AS A SURPRISE... I CRAVE YOUR INDULGENCE AS I CONTACT YOU IN SUCH A SURPRISING MANNER. BUT I RESPECTFULLY INSIST YOU READ THIS LETTER CAREFULLY AS I AM OPTIMISTIC IT WILL OPEN DOORS FOR UNIMAGINABLE FINANCIAL REWARDS FOR BOTH OF US...

# Important Stuff: Please try to keep posts on topic. # Try to reply to other people's comments instead of starting new threads. # Read other people's messages before posting your own to avoid simply duplicating what has already been said. # Use a clear subject that describes what your message is about. # Offtopic, Inflammatory, Inappropriate, Illegal, or Offensive comments might be moderated. (You can read everything, even moderated posts, by adjusting your threshold on the User Preferences Page)

Re:I'm surprised

[JayBlalock]

A post with no point but to make fun of these guys' imperfect English gets modded up?

Geez...

Well?

[Distan]

The original exploit was a method that let anybody delete any arbitrary file from your PC? Could it have just been a poorly implemented version of the "we need to delete specific files" thing mentioned above?

I've seen worse things put into code on purpose, I might be able to accept this was a mistake, who knows?

But I've also heard rumours they've been behind some DDOS of good people. That might make be question their motives.

Either way, whenever you install anything that you didn't compile and read and understand every line of the source yourself, you are just deciding to trust whoever wrote it.

Re:Well?

[penguin7of9]

The original exploit was a method that let anybody delete any arbitrary file from your PC? Could it have just been a poorly implemented version of the "we need to delete specific files" thing mentioned above?

An RPM package upgrade can, in principle, delete arbitrary files, so why shouldn't this upgrade code? Any code that performs remote upgrades may have to be able to perform pretty much arbitrary file system operations.

The real issue is that application programs have to have this sort of thing in them in the first place. That's because neither Microsoft nor Apple have yet found a way of creating a uniform, reliable system for remote upgrades. They have piecemeal solutions for the OS and for packaging, but nothing that compares to what you can get for Linux.

Re:Well?

[S.Lemmon]

It's a bit different - RPMs may delete files but don't sit and listen on an open socket accepting delete requests from a remote server somewhere. That's a whole 'nother kettel of calling the fish black!

A reasonable auto-upgrade would just have code for the client to delete itself and run the new install I'd think. Also just because ES5 hides IPs doesn't mean someone can't just scan to find people running it. If anyone can connect to you and delete any file, that's a little more than an auto-upgrade feature.

Re:Well?

[Lusa]

Automatic update my ass. No way was this a mistake, if the program needs to delete files (be it for an upgrade or other reason) it should do it itself when the new program is run and not when a remote server instructs it to by sending a suitably encoded packet (out of curiosity, how does this remote server know when to delete the file for an upgrade, so to speak, or where if the IP is truly hidden?)

Re:Well?

[penguin7of9]

A reasonable auto-upgrade would just have code for the client to delete itself and run the new install I'd think.

No. They may have to remove old DLLs, temporary files, etc., for the same reason an RPM package does.

RPMs may delete files but don't sit and listen on an open socket accepting delete requests from a remote server somewhere.

Yes, that part is different and quite worrisome. But no matter who originates the upgrade, the code doing the upgrading needs to be able to perform pretty much arbitrary file system operations.

So, complain about them for having remote upgrade capabilities in there in the first place. But it makes little sense to complain that their remote ugprade capabilities do what most other package managers and upgraders have as well.

Re:Well?

[S.Lemmon]

The original client can most certainly delete itself, including all DLLs and so forth, with no help from the "new" version. It may have to unload and run a temp process so its files aren't in use, but that's a common procedure. Most auto-update are in fact initiated from the client, not the server. Usually something like

1) client looks for new version
2) client downloads new version
3) client check digital signature of download
4) client runs temp program
5) temp program uninstalls old client and installs new.

It's also possible the old client may just run the install for the new one (and let the new one run the old one's uninstaller), but in any case everything's under the old client's control as much as possible. Never does the remote server tell it what to delete.

Re:Well?

[ajs318]

An RPM package upgrade can, in principle, delete arbitrary files, so why shouldn't this upgrade code?

An RPM package upgrade is performed only when and because the root user says so. This is quite different from arbitrary code downloading itself from a remote server, executing itself and deleting files without your say-so.

I still stand by my earlier statement about closed-source code. Why should I trust any executable if the authors won't even let me look at the source code? Surely if they had nothing to hide, then they would have nothing to fear.

Re:Well?

[Anonymous Coward]

heres a quote from an es5 reg: "..FileHoover could dispel a lot of the rhetoric by making it clear that the code in question was designed for use inhouse, that is before ES5 was released for public usage. Many people have the impression that it was in place to auto-update remote end-users. It was explained to me that it was used in the development of es5 to quickly update all test machines, thats it."

The point being that this code the exploit adresses is only logically explained by the reason Filehoover mentions. It is only suited for a closed environment, it is only suited for developing stages, and last but not least, there simply is no likely motive for es5 to include this code for malicious purposes. What would their material gain be? They are a buisness, thats no secret. They cannot possibly be connected with the American leech industry. First of all, because they are streaming first run movies, second because all evidence gained through the client would be entrapment, third because some employees of the company has made statements someone affiliated with the American industry would never make.

Re:Well?

[penguin7of9]

It's also possible the old client may just run the install for the new one (and let the new one run the old one's uninstaller), but in any case everything's under the old client's control as much as possible. Never does the remote server tell it what to delete.

Come on, think a little. If it can download an entire application over the net and then install it, that means it can run arbitrary code. In particular, it can delete whatever the user running it has permission to delete. There simply is no meaningful sense in which you could restrict the code to do less on a standard Windows machine.

The only way you can prevent that is to have some separate piece of software, certified to be good by an independent entity, verify that all the operations requested by the package install/upgrade make sense and do the install for the software. But Windows and Macintosh seem to be lacking such an independent piece of software, and the Linux package systems also still run arbitrary scripts as root.

Most auto-update are in fact initiated from the client, not the server. Usually something like

Again, you are confusing the mechanism they chose (server-push of updates) and its security problems with what you actually find in the code.


1) client looks for new version
2) client downloads new version
3) client check digital signature of download
4) client runs temp program
5) temp program uninstalls old client and installs new.


Yes, and a client that updates itself that way will still appear to contain code to delete arbitrary files somewhere in it. It just happens to be less likely that that code is used to actually delete things it shouldn't delete.

Re:Well?

[Anonymous Coward]

arbitrary code downloading itself from a remote server, executing itself and deleting files without your say-so.

Actually no.

ES5 is actually an application receiving a command from an arbitrary server and deleting the files without your say-so, and then downloading and executing arbitrary code.

The exploit shows that it's not necessary to download anything - files can be deleted without having to do an upgrade.

Re:Well?

[Stephen Samuel]

You forgot to also mention that I can decompose an RPM into it's SPEC file and scripts and easily see if they do anything that I don't like. On the other hand, if someone comes along and realizes that I run ES5 and figures out my IP address (either because they have access to the central ES5 server or because they found out outside of ES5) they can then connect an beat my system to a pulp.

I don't have to do anything to have it happen, and I can't do anything to stop it from happening (other than not running a malware version of ES5)

Re:Well?

[S.Lemmon]

You're being silly - unless sandboxed, any application with access to the OS API can delete files. No one but you even said the problem was that the "application can delete files". You started that with the odd statement saying ES5's backdoor was doing nothing more than what RPMs do when it's not even remotely alike.

Likewise, it's not auto-updating itself that's the problem. If you trust a binary application enough to install it to begin with, you've already taken the risk of running "unknown" code. Though I agree updates are better left to the user's discretion, no one's complaining that IE5 had auto-update features.

However, even if you believe this ES5 mis-feature, was really for updates, it was the worst possible way to do it. As I explained above, there's no need for the server to "push" the update to begin with, and there's no excuse for allowing anyone - even the server - to connect remotely and delete files. Why people are upset *is* (as you put it) "the mechanism they chose". Auto-updates was just their inexcusable excuse for that mechanism.

Re:Well?

[ajs318]

Exactly. But that's my whole argument. Running closed source software is just plain suicidal. Don't do it, kids! You can live without closed source. If you want to share your files with others, run Apache!

Re:Well?

[penguin7of9]

You're being silly - unless sandboxed, any application with access to the OS API can delete files.

Yes. And furthermore, just about any installation/update program will contain data-driven file system manipulation. It will therefore appear to contain a system call to delete files whose names are specified by data.

The ES5 explanation that this was part of their remote auto-update feature is perfectly credible.

However, even if you believe this ES5 mis-feature, was really for updates, it was the worst possible way to do it.

Of course it was. They said so themselves. But that's not the issue. The issue is whether there is any evidence that they did anything malicious, rather than merely being stupid. And, from what we know, there is no evidence that they did.

As I explained above, there's no need for the server to "push" the update to begin with, and there's no excuse for allowing anyone

We are not debating whether their update mechanism was good (it wasn't), but whether the presence of arbitrary, data-driven file deletion code indicates malicious intent. It doesn't. That's all there is to it. They already admitted to the stupidity of their actions themselves.

Re:Well?

[S.Lemmon]

But that's not the issue. The issue is whether there is any evidence that they did anything malicious, rather than merely being stupid. And, from what we know, there is no evidence that they did.

Well, you can believe their story if you like, but answer me this...

1) If it was for "updates" why did it delete files from the *share* folder - not the program folder? You could only delete other folders by tricking it with relative paths.

2) Since the delete is done from the running app, it's exe and DLLs would be in use and locked by windows. How could the command then possibly be used to remove the old (currently running) version?

3) Even if you could get by 1 and 2, the app you're sending commands to is now gone. How do you then load the update?

Again, that's just not how updates of any kind work.

We are not debating whether their update mechanism was good (it wasn't), but whether the presence of arbitrary, data-driven file deletion code indicates malicious intent. It doesn't. That's all there is to it.

Again, that's not at all what we were debating. You're arguing an point you invented. The problem is not that the app had code to delete files (many, if not most, programs have that), the problem is that is had code to allow *anyone* to connect to the PC and delete files.

This was addressed yesterday...

[LearningHard]

On the full-disclosure list. It seems that after ES5 found out people had discovered the malware contained in it. They decided to upload a new version which will probably have those functions taken out. I see this as a suspicious move and would be very hesitant to use any of their software myself.

Re:This was addressed yesterday...

[MstrFool]

You would rather they waited weeks or months to fix a problem they were told about? The idea, as I see it, is to fix problems as soon as they can be fixed. It seems a bit unreasonable to falt them for fixing it quickly when we gripe at others for fixing problems so slowly. They could have put it there with bad intent, or it could be exactly what they clame, a poorly made auto-upgrader. Lord knows they wouldn't be the first to let out a program with less then perfect code. BTW, if it is what they clame, then all they would have to do is recompile it with out the source code for the auto-updater, hardly a time consuming fix.

Re:This was addressed yesterday...

[kfg]

And herein lies the root of all conspriacy theory.

If you do something nasty, get caught, and backpedal it looks suspicious.

If you do something inadvertent for perfectly altruistic reasons and get accused of falling into the prior catagory and say, "Oh, shit. Ok, we fixed it," it looks just as suspicious.

If you suspect conspiracy everything always looks like it.

KFG

Re:This was addressed yesterday...

[Anonymous Coward]

I just don't like the software. Its claims, of functionality, implementation, popularity, etc. The way it was (and still is) astroturfed. Attacks against various competitors and critics. Most importantly, I don't like the language they use EVERYWHERE. It's uncomfortable. Forced. Fake. Overstated. Glossed. For example, consider their statement in this article. Is it possible to make it any more insulting?

Re:This was addressed yesterday...

[kfg]

Ah, well, I never said they weren't assholes. :)

KFG

Re:This was addressed yesterday...

[iq214]

Obviously you are the kind of person who takes the paacking over the package. So, nothing is good enough if it doesnt fit your idea of what things should look like. For instance, are you saying that the response isnt worded nicely enough for a response to some amateur coders paranoid and immature theories? Are you saying it should have been more of an appology? For being attacked in a very harmfull way by some scriptkiddies who cannot possibly fathom the consequences of their actions? I know that you have never tried eartstation five, youve never been aroundthe forums to see whats going on, because if you had you would know that earthstation 5 is on a mission in the name of p2p. They have done and are doing what NOONE ever dared to do before. You sir, should jumpstart that old brain of yours, dust off the decadence and get the fuck real, pardon my French.

Re:This was addressed yesterday...

[Anonymous Coward]

Of course the packaging is important. Are you telling me you download and install every peice of software you come accross to try it out before deciding? Obviously not. Some of it is blantent spy/malware, and such decisions are largly based on impresson of trust of the author. If you have two guys on a street corner Christmas eve asking for money for charity, one in a santa outfit, one looking like homeless guy, who do you think's going to get more money? Impressions are important.

Re:This was addressed yesterday...

[Wolfrider]

--Actually this is the first communication from ES5 I've ever read, and was pretty impressed by it. They bring a new level to "tongue in cheeky."

Re:This was addressed yesterday...

[shachart]

Being an outfit operating out of a refuge camp near the village of Jenin, Israel, I wouldn't put too much trust in their software/

Adults or children?

[AsherD]

If the tone of that statement wasn't so sarcastic and flippant I might feel that RandomNut may have jumped the gun, but ES5 isn't making any more friends by being immature and insulting.

Re:Adults or children?

[Anonymous Coward]

I don't know about you, but I've never heard 5th graders on the playground resort to screaming "your code sucks and has exploits idiot!" "oh yeah? well your mother uses windows!" So I'd say they've sunk below the level of calling one another "stupid-face" and such...even kids are more mature than that.

Personally, I've never used their software, nor do I intend to, one look at the website made me suspicious...the site just gives me a feeling of insecurity and untrustworthyness.

Re:Adults or children?

[r.future]

Granted the comments above by ES5 , which I believe were a diplomatic masterpiece of double speak, could be seen as humble at a surface glance, but in reality they were absolutely dripping with sarcasm.

But, I think we also need to take into account that ES5, for better or for worse, is attempting to fight back against the RIAA --a group that takes children to court for downloading music! So for what it's worth my opinion is; if you want to call ES5 childish, and compare them to a grade school playground argument that's fine. Just be sure to keep in mind that the other metaphorical 3'rd grader is the RIAA.

-r.future

Re:Adults or children?

[MattCohn.com]

In the first few sentances was this gem:

"We at Earthstation5 are not perfect, but we acknowledge that Shaun Garriok might be..."

For me, I don't see how this could seem humble on the surface. When I read this, that comment set the tone, and I instantly knew everything after there was nothing but sarcasm.

I also think ES5 defending their upgrade code is childish. There is NO REASON that upgrade code has to be able to delete files.

Here's what you need:
1. Program queries a ([List Of](Domain XOR IP Address)) and checks to see if an update is availible.
2. If said update is availible, program downloads update onto some fixed file name from the response in step 1, and then kills itself/runs update program.
3. Profit!

And I got to run, so feel free to add anything anyone

Re:Adults or children?

[Anonymous Coward]

____ is an insult to the very things that make humanity great!

As in...?

That's what I thought. Dumbass.

Re:Adults or children?

[kfg]

On the other hand Samuel Clemens made a damned fine living at it. You should read some of his letters to the editor and responses to various critics.

Try his criticism of James Fennimore Cooper. Although the target was dead his fans were legion and rabid.

Sometimes a flippant and well crafted sacastic reply is just what the situation calls for. My own experience is that the brighter the responder the more likely is sarcasm in a rebuttal.

Unless you live in a world of gray flannel suits walking stiffly and acting "professional."

KFG

Re:Adults or children?

[Anonymous Coward]

Granted the comments above by ES5 , which I believe were a diplomatic masterpiece of double speak, could be seen as humble at a surface glance, but in reality they were absolutely dripping with sarcasm.

Oh please! The hallmark of a "diplomatic masterpiece" is in its subtlety, where a statement is taken at face value on its surface but has a hidden meaning which is revealed upon further consideration. Take, for example, giving someone a reference for a job. The phrase "I wouldn't hesitate in considering this individual for employment" is, at face value, complimentary, "don't delay, hire now!" -- however, it also carries the message "I wouldn't waste my time by considering this person...".

There's nothing even remotely subtle about the ES5 statement. The "surface glance" comes across as arrogant, antagonistic, and wholly sarcastic. It is so obviously dripping with sarcasm to such an extent that a double meaning is wholly impossible. There's no other way to take it.

But, I think we also need to take into account that ES5, for better or for worse, is attempting to fight back against the RIAA --a group that takes children to court for downloading music! So for what it's worth my opinion is; if you want to call ES5 childish, and compare them to a grade school playground argument that's fine. Just be sure to keep in mind that the other metaphorical 3'rd grader is the RIAA.

Be realistic. The RIAA is enforcing copyright law and sometimes they issue subpoenas against anonymous users who, unbeknownst to them, are children. Now that doesn't mean I like their tactics. Nor does it mean that I endorse their outdated/overpriced model of music distribution. However, they are fully within their legal right to sue people who violate copyright.

And if to "fight back" means resorting to flagrantly breaking copyright laws, then who is the one being childish here? If you don't like the way the RIAA does business, then vote with your wallet. Take your money elsewhere. Find a way of acquiring RIAA music using a service which meets your requirements (single-song purchases at iTunes Music Store perhaps) or, if such an ideologically-compatible service doesn't exist, don't listen to RIAA music. There's plenty of independent artists who create excellent music and offer their music on very reasonable terms. Some even give their music away for free.

The kind of logic you're espousing puzzles me. It's like someone saying that they hate the way Disney does business, yet they sneak into Disneyland, enjoy the sites, and go on the rides anyway. How is that not the height of hypocrisy?

Re:Adults or children?

[yerricde]

There's plenty of independent artists who create excellent music and offer their music on very reasonable terms. Some even give their music away for free.

I wonder how these independent artists avoid getting sued by major music publishers.

Re:Adults or children?

[JayBlalock]

Look at it from their point of view. (we'll assume for this post that it was not an intentional exploit, just a bug) If it WAS just a bug, and Garriok had just been spewing FUD to discredit them? I'd be more than a little pissed off. His little post led to, I'm sure, a lot of users deleting their software just on his say-so. (a lot of /.ers said as much) He didn't quietly alert them to the problem first, or issue a standard BugTraq style release - he lept straight from "hmm, here's an exploit that can delete local files." to "EVIL CONSPIRACY TO DESTROY YOUR COMPUTER!!!!"

If the ONLY negative response they made was diplomatically-phrased sarcasm, I'd say they held it together pretty well. I'd be fuming.

Not to mention, if you think that response was overly childish, you must never watch Congressional hearing coverage.

Re:Adults or children?

[NDPTAL85]

Sarcasm is a crutch used by the insecure.

Delete file is not required remotely to upgrade

[Anonymous Coward]

I am very suspicious of the claim that REMOTE deletion of a file is required when updating the software.

To me, this sounds like damage control, not an honest representation of why that code was in their program. Until the company that makes Earthstation comes up with a plausible explanation for what that code was doing in their program, I will regard Earthstation software as suspect.

Re:Delete file is not required remotely to upgrade

[Tuna_Shooter]

Actually deleting files during an upgrade is a common practice.. (i do this in my updater) and i surmise this might not be such a big issue of these (ES5) peeps were not from the middle east...I think we all are a little more paranoid since 9/11.....

Re:Delete file is not required remotely to upgrade

[Jugalator]

Actually deleting files during an upgrade is a common practice.. (i do this in my updater)

Well, for your application's security's sake, I sure hope the delete procedure isn't directly initiated by a server package, where the server is unverified as well. By adding 1 and 1, the resulting security exploits is quite easy to understand.

I think we all are a little more paranoid since 9/11.....

This hasn't anything to do with 9/11, this has to do with common sense regarding computer security and network protocol design.

Re:Delete file is not required remotely to upgrade

[S.Lemmon]

This is more than deleting files - this is having an open socket listening for requests from anyone to delete files. If your updater does that please tell me the name of the software so I can be sure to avoid it!

Also just beacuse ES5 doesn't reveal your IP in its protocol, doesn't mean someone can't scan IPs looking for it. Heck, that's usually how any other remote exploit works - just scan and you don't need a list of vulnerable IPs ahead of time.

Re:Delete file is not required remotely to upgrade

[Tuna_Shooter]

It?s strictly a client side issue after verification. I NEVER let the server initiate an update (only offer) unless the client fully agrees. And it needs a user with admin priv's on the client side to authorize the update. "This hasn't anything to do with 9/11, this has to do with common sense regarding computer security and network protocol design." i disagree with your comment. Having many clients, and dealing with computer security and network protocol design, is and always has been paramount. But i find that after 9/11 people are just a little bit more twitchy.!!

Re:Delete file is not required remotely to upgrade

[Jugalator]

Yes, maybe that's true, but in this case I think the criticism is well founded. No one wants a program that's able to remotely delete your files.

Re:Delete file is not required remotely to upgrade

[LordNightwalker]

This is more than deleting files - this is having an open socket listening for requests from anyone to delete files. If your updater does that please tell me the name of the software so I can be sure to avoid it!

So you insinuate being a security-aware person, but would still install anything on your box and need the author of the insecure application to actualy tell you his application is insecure in order to be able to avoid it?

Funny...

Re:Delete file is not required remotely to upgrade

[S.Lemmon]

Oh and I guess you go through and vet every line of code you ever run? Give me a break - running any software you don't write yourself involves a certain amount of trust, and I'm less likely to trust someone who admits they use an insecure methods.

Of course, I never said that's what I'd rely on, so please don't be so completely full of yourself. Honestly, if you must masturbate your ego, at least don't do it in public.

Re:Delete file is not required remotely to upgrade

[LordNightwalker]

Oh, come on, read the rest of his replies and be realistic about it. Besides, do you really consider the scenario where a server contacts each and every client separately and issues delete and upgrade packets realistic in any way?

And to answer your question: no, I don't read every line of code of the software I run either, but at least I don't diss other peoples' efforts in an halfass attempt at being clever/funny or whatever it was you were attempting back there.

I just hate it when people just criticize stuff while they got no clue what the heck they're talking about. There's a saying in my language; don't know if it exists in English as well, but it goes like this: "The best sailors stand ashore"... I think this saying certainly applies to your post .

Re:Delete file is not required remotely to upgrade

[S.Lemmon]

Oh, come on, read the rest of his replies and be realistic about it. Besides, do you really consider the scenario where a server contacts each and every client separately and issues delete and upgrade packets realistic in any way?

ha ha ha, man you are clueless! Scanning random IPs is exactly how blaster, code red and many other viruses spread. Seems to me those were pretty "realistic".

You kind of remind me of those lusers who don't even care if their PC is infecting others with a virus as long as it still works for them.

Re:Delete file is not required remotely to upgrade

[Anonymous Coward]

"No one wants a program that's able to remotely delete your files."

If that were true no one would be using windows!

Re:Delete file is not required remotely to upgrade

[LordNightwalker]

Very interresting, my cute little fluffy friend, but the clueless one is you: we're not discussing the spreading of virii here, but the remote upgrade of a piece of software.

There's a difference between scanning a couple of thousands of random IPs to find some hosts to infect, and scanning the whole fucking Internet to find each and every install of your client software to upgrade it. Wouldn't work either; firewalls, NAT etc... can make it impossible for the central server to reach all of its clients. Ergo, remote upgrading is always instantiated at the client side, unless perhaps in a development environment where you want to be able to "push" updates when debugging your app.

And comparing me, of all people, with those lusers spreading virii and not giving a rat's ass... Shows not only your ignorance, but also your limitless arrogance. Plus it has nothing to do with the current discussion. But in case you do want to come off as the "big man", calling other people names, try do a little background check before you decide which insult in that little notebook of yours you're gonna use for the occasion. Reading peoples' sigs might be a good start.

How do you not notice (elipsis)

[Jameth]

How do you not notice that being able to delete files remotely is a problem? Isn't that just about the most obvious thing ever?

Re:How do you not notice (elipsis)

[botzi]

That *IS* the problem with all the security-obscurity blabla. The guys obviously figured out that anyone will be capable of debugging their code to a level revealing the delete file packet function. Seems like they were wrong.

Re:How do you not notice (elipsis)

[zurab]

Basically, there were 2 conceivable ways out of this:

1. "I did not have sexual..." - deny, deny, deny! OR
2. "It's, not a bug, it's a feature!"
[there are other routes, but none as attractive]

Both are very well known methods used widely in mainstream accusations. A lot of /. comments on the previous article were right in this regard, and we saw route (2) played out today.

Re:How do you not notice (elipsis)

[kfg]

"The senator refused to deny allegations that he has had sex with a donkey."

This is also a well know method in mainstream accusations to accuse without being accussable of making accusations.

The maker of the statement knows that the public will interpret any denial with suspicion that the nonaccusation is true, (otherwise why would he deny it so vehemently?)and any refusal to deny it with suspicion that the nonaccusation is true (otherwise why doesn't he just deny it?).

KFG

Re:How do you not notice (elipsis)

[zurab]

"The senator refused to deny allegations that he has had sex with a donkey."
[...]
The maker of the statement knows that the public will interpret any denial with suspicion that the nonaccusation is true, (otherwise why would he deny it so vehemently?)and any refusal to deny it with suspicion that the nonaccusation is true (otherwise why doesn't he just deny it?).

That's true in general terms, but in this case (if indeed that was the case), it could have been easily avoided if, for example, none of the files had the reported md5 hash and/or files with those md5 hashes did not reproduce the same results as described. It seems to me both would have been easily detectable if they indeed have "15 million users" online at any point in time.

Second, they admitted that the functionality was there, which makes that argument moot.

Third, there was no "sex" and no "donkey". i.e., the accusation was not a mockery, personal attack, or an otherwise out of line comment, in which case it could have been safely ignored, but rather a more or less meaningful description of a potentially serious security flaw. It also came with an example demonstration code, as well as specific location of a function in question. If you really want to compare this to your example, it would be like presenting lab results from a donkey in question with the DNA evidence linking it to "the senator". I won't go into any more details on that one, you get the idea.

Re:How do you not notice (elipsis)

[kfg]

Well I certainly don't trust them any farther than I could throw even a rather small donkey. :)

KFG

Here is why I care, but it does NOT affect me...

[Eric_Cartman_South_P]

I use VMWare. I have one VMWare image just for P2P, of WinXP Pro with Norton, Adaware, Sygate Firewall, and Spybot. Inside this VMWare session, I have KazaaLite, Bearshare, eMule, and a half dozen other P2P apps. They can do whatever the fuck they want, because when I shut down my VMWare image all changes are discarded. Every time I boot up the image, I have my fresh, clean install of all my apps. After downloading, I scan the hell out of files, and if good, I'll FTP it to the main box and scan again. I leave internet open for the vmware image, because the firewall will tell me about anything dialing out as nothing has permision and every connection must ask. IMO this is the ONLY way to use P2P safely. My main box has NOTHING P2P on it. It's all inside the VMWare session.

:)

Hiding IP Address

[augustz]

"by hiding your ip address" they claim that this is not exploitable?

Somone scans a network of cables users, and sends them all the packet and command to delete boot.ini. How does 'hiding' your IP address help?

If they have the feature in for automatic updates (unsigned), then clearly they expect to be able to connect to it using, what else, an IP ADDRESS, "hidden" or not.

Hard to beleive they have 15 million folks on at the same time.

Re:Hiding IP Address

[krumms]

Article:

It is also a fortunate fact that since Earthstation5 protects you from the RIAA lawsuits and hackers by hiding your ip address, the exploit program he wrote can only be used against your own computer, which he states in his exploit. If you want to delete files from your own computer, we feel you have the right to do that.

augustz:

How does 'hiding' your IP address help?

It doesn't. He's full of shit - and I bet he's dumb enough to believe that shit.

He screwed up rather badly, it's just a shame he isn't man enough to pull his finger out of his ass and take the blame for what's obviously a horrendous security problem.

He's right about one thing though: it's not spyware - it's an exploitable security hole. Probably one that should come to the immediate attention of their '15 million' users.

Re:Hiding IP Address

[Izago909]

I think they are implying that hiding your IP in the GUI makes it safe. It's based on the theory that RIAA spies are sitting around with copies of P2P apps and a notepad writing down IPs.

In all honesty I really don't care if there is code that allows remote deletion of a file in ES5. I refused to use it long before this. Ignoring the horribly ugly GUI, there are still many other concerns. Who guarantees the proxies you use are safe and don't keep logs? Can't the RIAA's enforcers set up a bunch of "anonymous" proxies and advertise their presence on IRC, Usenet, and other file sharing circles? How is spouting propaganda about hiding the IPs in the GUI supposed to make me think you know jack about network security? Being based in such an unstable area may help protect the company and/or developers, but that doesn't say anything about the users. With the developers constantly taunting copyright enforcers, how long will it be before they start targeting users? An over inflated sense of security is the worst enemy of P2P users. Encrypted data transfers don't mean anything. The enforcers don't sniff packets anyway. All they do is download a shared file, verify it's copyrighted, and issue a subpoena. If they can't get past the proxy, they will just have it taken down. Just pray that it didn't keep some sort of log. Eventually, the only operating proxies will be so obscure, distant, slow, or overwhelmed that nobody will use them and he network would slow to a crawl. The only decent servers will be RIAA honey pots. All this because some developer got cocky and started running his mouth.

Re:Hiding IP Address

[pod]

Everything about this company, its software, its claims and statements, its employees/contributors, and its supporters, rubs me the wrong way. There's something wrong what the picture ES5 presents.

Re:Hiding IP Address

[platypus]

I think they are implying that hiding your IP in the GUI makes it safe. It's based on the theory that RIAA spies are sitting around with copies of P2P apps and a notepad writing down IPs.

No, he didn't want to imply anything. The context of this sentece which matters for him is exactly this:

It is also a fortunate fact that since Earthstation5 protects you from the RIAA lawsuits and hackers by hiding your ip address, bla bla bla bla

IOW, in worst marketing/politician manner, he wanted to plug once again his message, that's all.

What an assclown.

Re:Hiding IP Address

[bedessen]

And lord help us if the RIAA were to discover the evil nasty "netstat -an" command that works on most every computer! Worse yet, if they were to download TCPView from sysinternals.com. Heavens forbid -- IP addresses all over the
place! Nobody's safe!

In all seriousness, anyone that thinks you can "scramble" an IP address and still use a protocol like TCP is full of shit. I'm sure you could think of all sorts of bizarro schemes to bounce packets around using raw sockets and UDP spoofed source addresses or whatever... but all of the methods of doing that sort of thing are absolutely hideous as far as throughput is concerned, and they're connectionless and stateless. I.e. completely useless for transferring files.

Re:Oh no!

[t0ny]

Nah. If you want silly stupid internet drama, Slashdot presents it ALL, baby. Its kinda like the "Talk Soup" of the internet, just without Greg Kinnear.

One question

[edxwelch]

Before the usual Palestinian - Isreali flame war gets going, I would like to ask just one question:
Does anyone use Earthstation and how does it compare to the other p2p networks?

Re:One question

[mOoZik]

I tried it out a while ago, and it sucked. Besides the horrible GUI and the constant "We're Israeli, Palestinian, Jordanian..." messages, the results for even common files were poor. The same searches on Kazaa yielded better results in my evaluation, which is ironic, because ES5 claims they have 3 or 4 times more people at any given time.

Re:One question

[Izago909]

You'll have better search results with gnutella. That is, once you learn the GUI. Seriously, it's awkward, ugly, and just plain sucks. Most all of the "security" is actually useless and can be worked around. I'd say stick with K++ and shareaza.

Re:One question

[Potor]

.

I couldn't get it to work ... so I removed it.

From the sound of things, I am glad I did. But I wanted it cuz my university is blocking p2p clients on a program-by-program basis, and I was hoping they had not yet heard of ES5.

.

I admire their explanation...

[botzi]

...and it does seem believable. Random_Nut's comments with the exploit paper were a too influenced by his personal opinion....

Anyway, ES5 has a *baaaad* name and this last exploit is by far not the only reason of it.
Their claims of having zillions of users online(ever tried to use it???Well, not *exactly* true.), the chat snippet about DoS-ing bittorent sites(What kind of looser would do that???). A couple of "spammers" posting on the "concurrent" p2p tools boards.....
To conclude... ES5 has never been an option for me, and even if their claims on absolute privacy are a nice dream, I prefer sticking to Klite and Bittorent experimental.

Re:I admire their explanation...

[platypus]

No, it isn't reasonable at all. Try to figure how such an update would work:

1. delete files
2. ...
3. profit

(just joking).
But seriously, given you have the methods he cites, i.e. reload, shutdown, delete, please explain to me how such an upgrade should work? Remember how windows locks files which are in use.

And why on earth should it be necessary to remotely delete files for an upgrade?? And note that he just talks about reload (i.e. restart), delete, and shutdown, how did they intend to actually automatically transfer the files to the client? And start them?

Do End Users Want These Features (tm)

[johnhennessy]

Do users even want vendors to update their software remotely. I know if I want an upgrade, I much prefer to have to expicitly install the upgrade, rather than let the contents of my harddisk to the mercy of sales and marketing.

I'll accept that they've held up their hands and said sorry, and claimed it was only there for upgrading.

On the other hand, it would be very useful in a defense against a piracy lawsuit.

"I would like to point out that the defendant was not always in control of his computer, at several stages various software vendors took control and upgraded their software."

How can the RIAA prove that Earthstation5 didn't download those MP3s during an upgrade when you weren't in control of your computer.

Re:Do End Users Want These Features (tm)

[Jonah Hex]

Users don't really want or care about this functionality, however I'll tell you who does: administrators and programmers. In a biz environment where you may have hundreds or thousands of users version control and updating are very important issues, especially so when it comes to in-house applications or virus scan updates.

I spent about three weeks once working on a scripted install of Acrobat Reader, Netscape, VirusScan, NTSP4 and a few in-house apps; all with custom setup files/registry keys and setup for our in-house programmers to do their own "pushes" of updates to the call center computers. Over the course of a weekend 6 techs working at 3 locations (HQ, call center, print/packing center) updated over 5,000 computers by simply rebooting and letting the login script do all the work, then coming by and checking for errors. We ended up with 2 machines that had serious problems after the upgrade and another 10 or so that had minor issues, which is most likely less than we would of had if the techs would of had to do the procedure by hand on each machine.

Properly used, automatic updates are a wonderful thing. However it's alot harder to implement outside the corporate structure, since most users who are burned once by an auto-update tend to mistrust all such methods. Even companies that require all users to be patched to the latest version for the large online games such as Ultima Online or Everquest occasionally get bit by the "patch bug" and make alot of enemies in their userbase whenever it happens.

Jonah Hex

Re:Do End Users Want These Features (tm)

[ymgve]

Since all those 4000 machines were updated running a login script, I assume that those computers were directly under your administration. That means, you can format, delete, install Windows 1.0 or anything else as long as you and your company agrees it's the best way to do things. They are YOUR computers. And what you're describing is not automatic updates, it's just an automated rollout. Different things.

Now, if Acrobat and Netscape were to start running automatic updates without asking you for permission on those very same 4000 PCs - wouldn't you be slightly angered by it? Especially if one of those magical updates breaks something, and you now have 4000 non-working computers?

I don't think ANY admin wants automatic updates that do stuff outside their sphere of control. For end-users it might be nice feature, if properly implemented, as you said. But for admins, a subscription to the application's mailing list is much more desirable than rouge updates now and then.

Re:Do End Users Want These Features (tm)

[schon]

I'll accept that they've held up their hands and said sorry, and claimed it was only there for upgrading.

I won't. There is no legitimate reason for this "functionality" to exist. None. Zero. Nada. Not for upgrading, or anything else.

An upgrade may (will?) have to delete files, but that should be performed by the installer after the upgrade has been downloaded, it should not (and must not) be performed arbitrarily by an unknown, untrusted host, with no authentication mechanism at all, without any acknowlegement from the user.

Re:Do End Users Want These Features (tm)

[Anonymous Coward]

"I won't. There is no legitimate reason for this "functionality" to exist. None. Zero. Nada. Not for upgrading, or anything else."

You really ought to "get out" more. This kind of "functionality" is rampant and getting more ubiquitous by the day. Not everything in the world requires a LEGITIMATE reason, just a reason; what may not be legitimate to YOU may be a necessity to someone else. Arrogance is arrogance and you sir are arrogant without any LEGITIMATE reason.

Re:Do End Users Want These Features (tm)

[schon]

Not everything in the world requires a LEGITIMATE reason, just a reason; what may not be legitimate to YOU may be a necessity to someone else

I have explained my position as to why it's not legitimate. Why this functionality should not exist.

Please tell me why my position is wrong. Why is it necessary for a P2P app to allow anyone, anywhere, to delete arbitrary files, without any authentication, and without the consent of the user?

Until you can, please STFU.

IP Address Obfuscation

[Scoria]

It is also a fortunate fact that since Earthstation5 protects you from the RIAA lawsuits and hackers by hiding your ip address

If you are establishing connections to a remote machine, there is probably a method by which an individual can determine your IP address. "Intermediary proxy servers" are susceptible to compromise, too.

Re:IP Address Obfuscation

[pod]

"Intermediary proxy servers" are susceptible to compromise, too.

You don't need to compromise a proxy, just set up your own.

ES5 Other Employees Comments

[Anonymous Coward]

Just so ES5 PR doesn't get to have the only spin, perhaps people should see how other employees reacted to it such as:

I think its pretty fucking pathetic that he made a crack instead of a patch, so like I said, if I were him, I'd look behind my back. You attack me or my users, and yes, I will send people to your front door. I dont fuck around because the responsibility that I have to my users does not allow me to fuck around. Rules changed, and he probably doesnt know how to play them. My identity is sealed, so again, he doesnt know who his enemy is. He is not anonymous nor is his family.

This guy wants a patch to a closed application and would not listen to any one about exploits as the don't want to pay the $50,000 they would give to anyone finding an exploit. This guy posted Shaun's home address in the ES5 forums and threatened his family life.

This is thier network admin doing this, would you trust him with your IP and thier fancy anonymous security? If they want to keep any standing, at a minimum they need to fire that guy as his comments.. well I just don't trust him and in most places threats like he made are illegal.

Re:ES5 Other Employees Comments

[Anonymous Coward]

And just how did you get to their forums??? i just checked their site and found no links.... i did see however that you might have to install the software to use the forums.... is this just more fud ???

Re:ES5 Other Employees Comments

[AEton]

The forums can be accessed at http://formus.es5.com. It requires a username/password; I set up an account with u/p slashdot/slashdot, and that should work.

The quote in question is from the user "SharePro" in the thread "Danger do not use ES5, ES5 too easy to hack"; at present, it's on page 36 of the thread and it's the fourth post from the top. I can't find the home address of Random_nut (the person being berated by this fellow SharePro, a person who has 2666 posts on the EarthStation5 boards and is in "Group: Admin"); but one user has the address in his/her .sig - search for "Shaun AND Aberdeen" to see what I mean.

For context, here is the whole message (I have emboldened the part quoted by AC):

QUOTE (spinkmonkey @ Oct 3 2003, 06:58 PM)
If he had told you about the vulnerability you would have denied it and (like you have now) secretly modified the installer, I think that much is perfectly obvious to anyone. What he's done isn't about being good for ES5, in fact your right its completely the opposite, its good for the ES5 USERS because no one will trust this program anymore. Posting his details is the lowest of the low, quite frankly you are scum

You obviously dont know me very well if you think I am the type to deny shit. I have answered much more harder questions.

Obviously (and you can quote me), if I know about a breach in security, then its not an issue of denying it, its an issue of fixing it. Since now that Filehoover obviously got a message before I did, and its fixed, there is nothing to deny. I was not here today, and everybody on this board knows that I am here everyday, so if I wasnt here, then I WASNT HERE!

Should I just let the breach sit there and say "Hey everybody, here is a breach in security"? C'mon, you do have brains. So you really dont make sense. Filehoover may have re-compiled without that specific code, and not changed the build number. So what? What is your point? A cover up? What cover up?

I wasnt here today, and Filehoover isnt here now. It appears that he found out about it, and fixed it and now cased closed. ES5 is still the most securist P2P program.

Kazaa had an exploit not so long ago and it was also fixed that left their entire network vulnerable to be turned down. There is a difference between somebody hacking and something that was left over accidentily. Random Nut didnt hack ES5, all he did was see some extra code.

According to the build numbers he posted, he has spent months on this program and that is the most he can find? Code that is not in use and that was accidently left over? I would have expected more.

I agree and can be quoted as saying that it should not have been there. I WILL EVEN SCREAM THAT IT SHOULD NOT HAVE BEEN THERE. Deny? Wtf should I deny?

I think its pretty fucking pathetic that he made a crack instead of a patch, so like I said, if I were him, I'd look behind my back. You attack me or my users, and yes, I will send people to your front door. I dont fuck around because the responsibility that I have to my users does not allow me to fuck around. Rules changed, and he probably doesnt know how to play them. My identity is sealed, so again, he doesnt know who his enemy is. He is not anonymous nor is his family.

I have known who Random Nut is for a while. Did you know that Kazaa wants his address to sue the fuck out of him for manipulating their code and making a derivative out of it? I wouldnt give it to them because why should I? I'm not Random Slut, I dont fuck people simply to fuck them.

Did you know that the RIAA / MPAA wants his address to sue him? The list goes on including various law orgnizations. I wouldnt give it to the RIAA either because I hate the RIAA. I handle my own problems. But in reality, now that I am printing it, you can bet that it will appear everywhere by various people. I will also be printing pictures of him and

Re:ES5 Other Employees Comments

[Anonymous Coward]

Well I didn't have to yesterday, just registered and viewed.. forums.es5.com. SharePro is the name of the network admin who posted this and the guys personal info.

Re:ES5 Other Employees Comments

[AEton]

-3 points to self for misspelling "forums" and missing it.
http://forums.es5.com
FORUMS not formus. stupid self stupid.
Also I dug up the post wherein "Share_Pro" posts the alleged personal details (home address but no phone number). It's on page 32 of the above thread, the fifth post down. If you want to read really funny trollish material, read the rest of that one; he goes on about how ZeroPaid.com is "OWNED AND CONTROLLED by Digital Rights Management" and "their" allegations that EarthStation5 is a front for the RIAA are baseless because "We do in fact give you guys direct downloads from our servers so obviously we dont work with the RIAA. We stream movies for free, so obviously the same person who gives you TERMINATOR3 doesnt work with the MPAA."

Really rather a horrid response by this administrator; it was a little more than necessary to post his full name, home address, etc. and later implicitly threaten his family's life. Hm.

Re:ES5 Other Employees Comments

[Anonymous Coward]

• I will also be printing pictures of him and his family.

Ok, this 'SharePro' is scum for this reason. I hope he drives his car off a fucking cliff and dies in a horrible ball of flame. What a dickwad.

Re:ES5 Other Employees Comments

[Anonymous Coward]

Wll they are "palestinians" Threatening families is just how things are done.

Re:ES5 Other Employees Comments

[Anonymous Coward]

I think its pretty fucking pathetic that he made a crack instead of a patch, so like I said, if I were him, I'd look behind my back. You attack me or my users, and yes, I will send people to your front door. I dont fuck around because the responsibility that I have to my users does not allow me to fuck around. Rules changed, and he probably doesnt know how to play them. My identity is sealed, so again, he doesnt know who his enemy is. He is not anonymous nor is his family.

Automatic karma -5, overuse of the word, "fuck". Not to mention uttering threats.

Re:ES5 Other Employees Comments

[Anonymous Coward]

you are a retard

Re:ES5 Other Employees Comments

[Anonymous Coward]

The slashdot/slashdot password doesn't work anymore. They must have deleted the account.

Re:ES5 Other Employees Comments

[Anonymous Coward]

Somebody changed the account's password. I used the password retrieval interface to have a new one assigned (currently, it's 'slashdot' again). Some abusive user sent the user 'SharePro' a rather mean message; he replied asking (rather gregariously) why the harsh attitude; and one highly amusing troll replied to him:

I AM ON YOUR SIDE AND AGREE WITH YOU THAT ZEROPAID IS RUN BY A DIRTY JEW WHO DOES DRM.

Please don't reply as this account has been hacked and I am one of hundreds of people to which your reply will be sent. The best thing is for you to close this account.

If you find anti-Semitism amusing, that is. :/

Re:ES5 Other Employees Comments

[Ken aka Batman]

Sound to me like someone didn't get their Wheaties. Anyone who knows anything about how the Internet works would know there is no such thing as anonymity. If they (RIAA or whoever) wants your IP, they will get it. Any other claim is targeted to kids and/or rookies who know no better.

Re:Here is why I care, but it does NOT affect me..

[Anonymous Coward]

good idea. I'm sure it's just an idea, a thought exercise, and that you don't go to all that trouble on a regular basis, but, your thinking does get you one gold star today.

Should be changed to read

[krystal_blade]

"From the pissing contest department"...

And, as far as the "We at Earthstation5 desire and request criticism at any time in fact we demand it goes...

Earthstation5, you demanded criticism, here is mine.

YOU SUCK!

Disclaimer: The author has not read the article, and has not used ES5 software. However, being a good drone, complies with all "demands".

krystal_blade

Show me the code!

[ccady]

This is all very nice, but if you want to convince me that EarthStation V is safe, show me the code.

Don't trust ES5 anyway...

[plj]

...unless you can explain this.

Not that I'd trust that AC either, but be on your guard anyway.

Re:Don't trust ES5 anyway...

[Anonymous Coward]

You people should be careful about being to sure about that it is palestinans who does this. Since their internet is not fully controlled by themself. All communication goes throught israeli controlled computers and they can do pretty much whatever they want. And the israelies have been trying to frame palestinans before. And proved, like that al-Qaeda was running around there. Nothing but israeli agents, unfortunatly media put a cap on that quite quickly as usually when israel gets embarrased.

Re:Don't trust ES5 anyway...

[kfg]

Well, I'm not sure I see what the problem here is. It's pretty easy to explain.

The RIAA has formed a shell company under their control to infiltrate and infect the music file sharing networks. They have outsourced it into the the extralegal hands of Hamas. They will be using this network to gather data on p2p users, spread malicious code to make people afraid of using p2p networks and generally raising mayhem.

There. I've explained it. Does that mean I can trust them now?

KFG

Re:Don't trust ES5 anyway...

[Axess Denyd]

I'll explain it pretty quick:

It uses a DLL file that is also used by a keylogging trojan, but it doesn't actually install the trojan, just the DLL. I think it had something to do with some timing or other. I tried it myself after reading that post, but that was quite a while ago and I no longer have the software, so I don't remember the exact name.

Whoever originally posted that just didn't do his research.

moving along

[segment]

To be honest and blunt... Who gives a rat's ass? Let's be realistic about something here; if someone purchased a product which injures you, or doesn't work to your expectations, what do you do? You get your money back and move on to another program. So what's the big deal here?

Firstly it's a free damn program, so it's not like nothing is lost unless someone is a moron knowing what they 'could' do, and still using the product.

FYI do you know how many times I see emails from companies like Symantec, Windows, and others who send emails about users on our network with the same serials... FYI I work at a mid sized ISP, and I'm sure other engineers (sys/network) can verify this claim. So why not ramble on about that type of spyware, where you spent something. Not about some cheesy p2p program of which you have umpteen million other free programs to choose from

Re:moving along

[shepd]

If you purchase a product that harms you during normal use, you better damn well be giving more than a rat's ass.

If you install software on your computer that has code inside it to purposefully delete any file on your system remotely without even a password required, I'd say that's bordering on malicious. It's already gone way past negligence, that's for sure.

Too bad software makers (in general) can't be sued for dumb shit like this. It does not matter if it's free, or even if you pay someone to take it. If you offer a product which is advertised as being a fully functioning copy, and it harms people or their property on purpose, the price isn't important.

Just imagine if you put a sign outside that said "Free Very BlueBerry Koolaid" beside a jug of unlabeled antifreeze. The price isn't what matters. You'd be in just as much trouble as if the product cost $100 a glass.

>So why not ramble on about that type of spyware, where you spent something. Not about some cheesy p2p program of which you have umpteen million other free programs to choose from

Again, cost isn't an issue. If Ford gave the Pinto away, and advertised it as being a fully functioning car, they'd still be sued to high heaven.

In the case of sending serials back to the manufacturer, that's annoying, but hardly as serious as software being programmed to allow remote users to randomly delete your files! Imagine if your ISPs webpages were randomly deleted because of this! Sure, you'd fire the guy administrating the server, but that isn't the point.

Re:moving along

[Anonymous Coward]

Hey shped,

Remember me, your stalker? Well I'm back, and I'm ready to rumble baby.

Re:moving along

[Anonymous Coward]

>Remember me, your stalker? Well I'm back, and I'm ready to rumble baby.

That's nice.

Did Rob Malda finally lift the ban I asked him to put on you? Are you looking for something a little more permanent this time?

Much Ado About Nothing?

[NeoMoose]

There are all kinds of fanboys who either love a program or hate a program so much that they will claim that it has/does not have Malware in it when the opposite is true. Take GameSpy Arcade, for instance. There are people coming in all the time with claims that GSA has spyware in it when it really isn't there.

Why this is a story worthy of Slashdot confuses me in some ways. People make false claims all the time, and when it is one as inconsequential as this then why are we giving it so much attention? This looks like the demon-seed of a flame war if you ask me.

That is all.

BS - ESV Results were great!

[fluxrad]

I searched for "car bomb" and got over 800 results.

Re:BS - ESV Results were great!

[Anonymous Coward]

... Well, I laughed.

Internet Drama?

[MikeXpop]

You're new here, aren't you?

Need to be able to delete files to upgrade?

[Jugalator]

The following functions were put into Earthstation5 to allow automatic, remote upgrade of the Earthstation5 software.

These functions are:
Reload Earthstation5
Shutdown Earthstation5

Delete a File
All of these functions are necessary to perform when upgrading software.

Hell no.

These guys should learn something about computer security. Funny that the same guys who're using a solution that screams "EXPLOIT ME" is developing some application that's supposed to be focused on extra security.

This is how to perform a teeny bit safer automatic upgrade:

- Server sends a packet containing a field that says it's an update packet, along with a version ID to update to, i.e. 110 for version 1.10 or whatever.

- Client receives packet and uses a partial client-side URL to the place where the new version can be downloaded. For example, the client could use the partial URL "http://www.es5.com/files/es", attach the received version ID (that is: "110") to the string, and finally the file extension, to form the URL "http://www.es5.com/files/es110.zip". The client then takes care of its shutdown, auto-install, and restart sequence.

Voila! Upgraded application without a RANDOM UNVERIFIED COMPUTER sending the CLIENT a message to DELETE something and it BLINDLY AGREES to. It's amazing that such poor programmers can even design something that compiles. Or are they hired by the RIAA to fool people into downloading their "new, cool and extra safe" application?

I wouldn't recommend anyone to download the DNS-faking "we-have-more-users-than-Kazaa" dudes' software.

Re:Need to be able to delete files to upgrade?

[S.Lemmon]

I'd add "only after verifying it's digital signature" to that list too.

Re:Need to be able to delete files to upgrade?

[Anonymous Coward]

maybe im just out of the loop.. but how can they have 15m users, when the first ive ever heard of them was the slashdot article just a couple of days ago? Everyone has heard of kazaa.. wtf is earthstation?

Re:Need to be able to delete files to upgrade?

[0ptix]

apropos security quick scenario,

evil earny breaks into ur firewall, provider, or whatevers between (or even just next to? ethernet?) u and the rest of the net. there he sets up up a fake dns server which redirects all ur requests for www.es5.com to the ip of the computer he just owned. a fake update server daemon he has running on the same computer recieves ur request and thus serves u a fake update.

crypto to the rescue!

each client software knows the update servers public key. when clients want an update they request one from the update server and only acept updates which are signed with the private key of corresponding to the public key they know.

Bwahahaha

[fluxrad]

This is a laught riot.

It is also a fortunate fact that since Earthstation5 protects you from the RIAA lawsuits and hackers by hiding your ip address, the exploit program he wrote can only be used against your own computer, which he states in his exploit.

• Broadband connection: $50
  
• 150GB Disk: $175
  
• Realizing your OS was wiped after trying to grab Britney's latest album: priceless!

There are some things money can't buy, for everything else, there's netstat -i

Re:Bwahahaha

[Anonymous Coward]

This is a laught riot.

Unfortunately, your post is not.

COINTELPRO

[Anonymous Coward]

Go read about COINTELPRO and then realize that EarthStation 5 is the MPAA/RIAA version.

Re:COINTELPRO

[SharePro]

Do you actually believe what you are writing or are you just bored? The RIAA cannot even protect their own website. I am streaming movies like Terminator 3, Die Hard, Matrix Reloaded, and hundreds more every day all day for FREE. So let me guess, I work for the MPAA yet I am hosting in Palestine? You may be a geek, but you definately have no brains or insight. The RIAA can easily scan Kazaa, yet our network and program is built on security. Sure there is always room for improvement. But Kazaa doesnt support multiple proxys, Kazaa doesnt support SSL, and when you share on Kazaa, the .dat file includes the source IP so I guess its fair to say that ES5 is a hell of a lot safer than Kazaa. Again, we are trying to help people. We are the only network in the world who offers DIRECT VERIFIED DOWNLOADS from our servers, we offer FREE streaming, we offer FREE FTP services, RADIO STATION and lots more. So again, first check us out and then talk. If you have suggestions or ideas, we are open to hearing them. But making shit up is not cool. Cheers, SharePro http://forums.es5.com

Re:COINTELPRO

[Anonymous Coward]

yo sharepro...

http://yro.slashdot.org/comments.pl?sid=75555&ci d= 6755733

got a response for that?

Feature proposal

[hackwrench]

When several reqests for a file comes in, a source sends it to someone with more bandwidth who then gives it out to the requesters. This has the added benefit of source cloaking.

Not to mention...

[OS24Ever]

..they have such a corny, geekified name. I mean doesn't Earth Station 5 sound like some lame sci-fi dream of a little geek who doesn't get out much? :)

Re:Not to mention...

[Anonymous Coward]

> doesn't Earth Station 5 sound like some lame sci-fi dream of a little geek who doesn't get out much?

You said it, OS24Ever.

Ouch

[jtheory]

IMO this is the ONLY way to use P2P safely.

You're not a record industry mole, are you? Just checking. Because how can anyone be so sure that free filesharing is here to stay if *this* is the only way to use P2P safely?

If you're like most people, and just hunting for that cool song you heard on the radio... it would be easier to buy the CD (and cheaper, if your time has any value).

Earthstation5 claims "Random Nut"...

[Anonymous Coward]

... is a random nut!

Re:Here is why I care, but it does NOT affect me..

[Eric_Cartman_South_P]

Trouble? Nope. You can actually use GHOST to make a GHOST image of your computer, as is, but the image on a CD, then inside VMWare, use a boot disk and GHOST to blast "your PC" into the VMWare "pc". 10 minutes and your done. Now delete all the personal info, and you have a box you can play with to your hearts content, knowing whenever you shutdown and restart your vmware you are starting fresh. Great for progamming, testing w@r3z^H^H^H^H^HHshareware, etc. Very little trouble.

I think having spyware, et. al. running on my box is MUCH more trouble than spending a bit of $ on VMWare and having an easy time clean yoru main box clean. I guess you could call it a P2P douche!

You either love it or you hate it...

[Pedrito]

Has anyone read these comments?

I love how all the positives sound almost the same. It's as if maybe 2 or 3 people (the people involved in ESV?) wrote all the positive comments. The negative comments speak for themselves.

the real question...

[Anonymous Coward]

Are you using a pirated version of VMware?

Re:Here is why I care, but it does NOT affect me..

[Dr Reducto]

Unfortunately, sir, you are a leech if you do that.

I am not trying to flame, but that's what the RIAA is trying to do: Make people afraid to share. If that happens, then the networks will die themselves. The RIAA doesn't give a flying fuck about downloaders, the same way cops don't really care about petty drug users. They both know that you must cut off supply.

No.

[Eric_Cartman_South_P]

That I bought. I was a programmer for a number of years and having several VMWare session running to simulate client, middle tier, and server were awesome. VMware is one the best pieces of software every made. Download a free demo, then buy the thing if you like it, at www.vmware.com

Runs on Win and Linux too!

OK Then

[nate nice]

Open your code base up and we'll have a look.

Are these guys working for the RIAA?

[HBI]

This is the best reason I have found yet to delete all P2P applications off my system and never install one again.

Sheesh. Talk about inspiring confidence.

Re:Are these guys working for the RIAA?

[Anonymous Coward]

Don't be a newb.

Install gnutella, it's nice, spyware-free opensource.

Re:Here is why I care, but it does NOT affect me..

[thinkninja]

Or use an open source client to connect to half a dozen p2p networks ( edonkey, overnet, bittorrent, gnutella, gnutella2, fasttrack, soulseek, direct-connect, and opennap)...

False?

[CharonIDRONES]

Yeh, I know that there are a lot people out there that take pride in the programs and everything, obviously Random_Nut liking his own K-Lite K++ a bit ;) But, the point was that these claims were not false, the lead programmer even admitted to them.

Whether or not these were implemented for remote upgrading wasn't the point, Random_Nut was showing it as a vulnerability that could be exploited in an already 'shady' program. I will admit, that I haven't used ES5 though, because I simply believe it is a load of bs, 15 million users, when KaZaA, the most downloaded program (www.downloads.com) has had a PEAK of 6 million, someone is lying.

KaZaA though is in its dying days, I no longer use it due to all the fake or corrupted files, its annoying when you have to download fifty different songs just to get one that works, which is why I started using Shareaza (yes, I am a fanboy, thank you) because of the higher quality and the support of four different P2P networks, plus its just cool ;) (www.shareaza.com)

Thats my little fanboy part, but, the point was that while they may have been claims, they weren't false claims, the code was present, which made the program, not so high on many people's download lists.

Re:False?

[NonSequor]

I've never actually gotten any fake files on Kazaa. It's probably due to what I listen to, but it is proof that Kazaa can still be useful.

Re:False?

[NeoMoose]

That mostly comes from the joys of not listening to mainstream music.

Re:False?

[Anonymous Coward]

I take it you listen to outdated music. Anything new is most likely fake. I mean, one Matrix Reloaded DiVX was 111 minutes of a blank screen and no sound, and another was actually Scarface. Software is much easier to get off of KaZaA - you can easily tell fakes, because they'll be much less than the norm for the app, or will have the real title somewhere in there.

Not afraid to share, afraid of the apps' authors!

[Eric_Cartman_South_P]

I am not afraid to share. I just don't want Bearshare installing some 3rd party marketing tracker type stuff on my box. I guess I'm wearing a tin foil hat, but this one is easy to wear.

Re:Here is why I care, but it does NOT affect me..

[acid_zebra]

I would call _you_ a P2P douche...bag that is.

Welcome to Paranoimia, please remember to wear your tinfoil hat at all times.

Hiding an IP address

[nate nice]

Is this accurate? Isn't this built into IPv6 that most systems use today and if not, it is built into the older IP standards, all part of the TCP/IP layers. I thought you would have to modify the kernel to make it such that a packet sent to your computer could not be traced back. And even if you do remove that part of TCP/IP protocol, the very next hop will attach it's IP so your IP is never more than 1 hop away. I should read their methods first I guess (proxy servers?), but if you send it, someone, somewhere, can trace it back to you.

Re:Hiding an IP address

[adb]

IPv6 that most systems use today Welcome, visitor from the future! In the twenty-fourth-and-a-half century, does the Linux IPv6 implementation finally work? Unfortunately, our current primitive networking technology provides no method of communicating directly with other computers anonymously. On the other hand, if you connect to only a few computers directly, and those computers cooperate to disguise the origin of your traffic, it may well be the case that nobody else knows who you are.

Re:Hiding an IP address

[nate nice]

IPv4, sorry :)

Yeah, I thought about methods for doing that, but eventually someone is sending you a packet that can be read from the buffer and easily decoded to see whom is sending this file. No?

Re:Hiding an IP address

[adb]

Yes, I don't think it's possible that "nobody" knows who you are. On the other hand, if you're connected directly to only a few people, it may be that only a few people know who you are, which is almost as good. (Contrast this with Napster, where anyone who wants to knows who you are.)

Oops.

[NeoMoose]

I wasn't really trying to pass judgement that the claims were false. I did wander off in that direction in the second part of the post, but I kind of missed out on trying to get my main point across that was that this is being blown out of proportion, at least it is IMO.

We don't get a Slashdot story every time Microsoft finds vulnerabilities in its software, do we? No. And thank God for that.

Re:Here is why I care, but it does NOT affect me..

[bluesnowmonkey]

I bet you wallpapered your house with tinfoil. Am I right?

suprise!

[Anonymous Coward]

In Soviet Russia Malware responds to Earthstation 5.

AWESOME LINK! THANKS :)

[Eric_Cartman_South_P]

Much appreciated. That looks like the Trillian of P2P apps.

Re:Not afraid to share, afraid of the apps' author

[NaDrew]

Suggestion: Allow the virtual OS read-only access to your media library (presumably on the real OS). This will let your file-sharing apps share your files with no risk of affecting your system.

These idiots cant code.

[Adolph_Hitler]

These functions are: 1. Reload Earthstation5 2. Shutdown Earthstation5 3. Delete a File All of these functions are necessary to perform when upgrading software. You dont need "delete", you can just overwrite pre-existing files to upgrade.

Re:These idiots cant code.

[Tisephone]

As if that's any better. All your music files were just overwritten by Madonna saying "What the fuck do you think you're doing?"

Sounds like earthstation's stepping up at least!

[192939495969798999]

I have never heard a company like Real, for example, come right out and say, "hey, our code does a, b, and c, and that's because we want the following relevant functionality." Huge, chocolate-coated kudos to Earthstation for having the cajones to just state what their supposed "spyware" is actually doing. If only other software makers would state what their software is up to (or perhaps just make the source open so we can figure it out), maybe there'd be less security scares!

Why would you ever need to delete a file?

[Adolph_Hitler]

Overwrite the file, install a new file and ignore the old files, but why delete?

Re:Why would you ever need to delete a file?

[pipingguy]

Shouldn't the username "Adolf Hitler" be self-cancelling?

Re:Why would you ever need to delete a file?

[Adolph_Hitler]

What are you talking about pipingguy? Stop smoking the bong for a moment and think with your big brain.

Re:Why would you ever need to delete a file?

[pipingguy]

What are you talking about pipingguy? Stop smoking the bong for a moment and think with your big brain.

Yeah, I remember when I had my first beer.

Re:Why would you ever need to delete a file?

[PepperGrunties]

Say hypothetically that they decided to include some 3rd party code in their release but their lawyer dropped the ball ("sure, you can use that for free") and misread the licensing agreement. So they rush out a fix that removes the code (perhaps a standalone executable) to avoid a steep licensing fee or a lawsuit.

How's that?

Re:Why would you ever need to delete a file?

[Wolfrider]

--See these two links for details on Godwin's Law:

http://www.xent.com/FoRK-archive/mar98/0250.html
http://web.morons.org/feature/rants/godwin2.jsp

What we got sent

[mr_tommy]

We at neowin.net ran this story, and got a reply from him (Earth Station 5 developers) yesterday. Note : i can't seem to find this on the Zeropaid site, so if its a repeat they've mailed to all press inquiries- then my appologies.

(from the neowin article)
"Last night, we posted astory which showed evidence that Earthstation 5, a file sharing tool which challenged the RIAA and the MPAA, included malicious code which enabled people to delete files on your computer. This morning, the developers of ESV have replied. An admission of the code is made, but it turns into more of a jab at the devloper of Kazaalite, another p2p file trading tool.

"Random Nut, AKA Shaun Garriok, the Author of Kazaalite, has been a vocal critic of Earthstation5 because of a continual online insult war between himself and some roudy Earthstation5 fans. This has motivated him to be extremely critical of Earthstation5. We at Earthstation5 desire and request criticism at any time in fact we demand it as we believe that is the only way to make software truly superior.

We at Earthstation5 are not perfect, but we acknowledge that Shaun Garriok might be and thank him for helping us root out bugs.

The problem with the Earthstation5 software that Shaun Garriok found truly exists, however the sordid motives he attributes to Earthstation5 are incorrect. The following functions were put into Earthtation5 to allow automatic, remote upgrade of the Earthstation5 software. These functions are:

1) Reload Earthstation5
2) Shutdown Earthstation5
3) Delete a File

All of these functions are necessary to perform when upgrading software.
We have long been admirers of Shaun Garriok's ability to superbly investigate even a fully compiled program. We believe that he is capable of finding ANY sort of trojan, worm, or bug inside a compiled program. We are relieved that all he could find was these remote upgrade functions. He didn't find any bugs that send user data anywhere, no spyware, no adware, nothing in fact that gives away any personal information about the user using Earthstation5.

It is also a fortunate fact that since Earthstation5 protects you from the RIAA lawsuits and hackers by hiding your ip address, the exploit program he wrote can only be used against your own computer which he states in his exploit. If you want to delete files from your own computer, we feel you have the right to do that.

We are glad he found this bug and pointed it out. We completely removed the automatic software upgrade code because as it turns out automatic upgrade is no longer popular as it once was because it gives people an uneasy feeling and rightly so.

Since Shaun Garriok seems to be concerned about everyone's security, and is not on a personal quest for revenge, we would be grateful if he would download the latest Earthstation5, version 1.1.31 (http://download.es5.com/es5_v1.1.31.exe) and verify that we have truly removed the remote update function which his exploit program accessed. We think his dedication to the good of all concerned would motivate him to do this. Anyone else who is concerned can do the same, download the latest Earthstation5 and test the exploit code against it.

Ras

View article : here

Re:Here is why I care, but it does NOT affect me..

[Anonymous Coward]

IMO this is the ONLY way to use P2P safely.

Man, if you don't have the box packed full of C4 and Tripwire configured to detonate it on the first sign of a breach, you aren't serious about security.

Re:AWESOME LINK! THANKS :)

[Anonymous Coward]

I have never been able to download ANYTHING off mldonkey.

I'll just stick to IRC where I can get a 3 CD SVCD screener in one big tar on a 10MB bot.

It sucks ass.

[Anonymous Coward]

It sucks ass.

Majorly.

Oh man this seems a bit weak as excuse go.

[aepervius]

I mean, I programmed this last month a test tool application on a LAN network, and frankly I *DO NOT* need to have a delete file command in the client. I mean,the client pretty well know which files it has to update (it is included in the update message) and it launch an updater application in background and stop itself so as to allow the files to be deleted/copied.

This is one solution, and I am pretty sure bunch of people here can come with others. But having a delete command is certainly a loosy way to do that. Heck on the net it OBVIOUSLY means that you open the door to an attacked reverse engineering your app for bad purpose and allow it a nice way to wreak havoc on a system. Either their application E.S.5 is not that great as they are hypping it (haha), or they really are searching excuse for obvious malware. If this is the second option which is true, the next malware code will be hidden behind encryption and packet won't be easily decoded.

people go away from ES5. You will from now on have now way to determine if you are not installing a trojan on your computer UNLESS they give you the source code and a compiler to compare the final binaries md5 with what you can generate...

Re:Oh man this seems a bit weak as excuse go.

[platypus]

And, I may be wrong on that, but I doubt an application on windows is really able to delete itself while running, because of the file locking semantics on windows.
I mean, nowhere I read that the network port was closed after the exploit code was issued, so the application continued to run. How could it then delete itself?
If this isn't possible, an automatic update (which they incidentally didn't use to push their new corrected version, you have to download it yourself, it seems) had to start another process anyway, to delete the remaining files of the app, so there's no point in remote deleting.

Dubios, dubios

it's still a security hole

[TheSHAD0W]

The reason for ES5's inclusion of the function is as bad as the function itself; if ES5 is remotely upgradeable without the user's okay, then the upgrade may contain malicious code.

Re:Here is why I care, but it does NOT affect me..

[cduffy]

Except that stemming the supply without decreasing demand means an increase in price, and thus incentive for those suppliers who are left to increase their operations, and for new suppliers to enter the market.

Trying to kill a thing by cutting off the supply is a Really Bad Idea.

They fixed the issue, that is good.

[nurb432]

Their intent is debatable, but assuming for just a moment its original intent was legit.. this is how it should work..

'find a bug or an issue, they release a fix soon afterwards'..

If they didn't, people would be bitching about that too.. Geez

( disclaimer" I'm NOT a supporter/user of the thing, but their treatment around here is rather hypocritical )

keylogger too?

[Meden Agan]

According to a post on this weblog (search for "ES5" on that page to find the relevant post), it seems like ES5 may also have a keylogger and some DRM software. How ironic that would be, for a company that claims to offer risk-free P2P to actually be collecting information about illegal filesharers and perhaps selling it to the RIAA/MPAA.

Re:AWESOME LINK! THANKS :)

[Anonymous Coward]

I think the fault lies with the various networks. Edonkey has always seemed slow to me. Soulseek is dead, I think. No, wait, they changed the domain again. I'm scared to even go on fasttrack anymore, even if the risk is vanishingly small.

IRC is best if you have a permanent connection; dial-up is too weak to queue anything.

Re:Here is why I care, but it does NOT affect me..

[mrclmn]

The RIAA/MPAA will have about the same success in cutting off the supply as the police have in "winning" the "War on drugs".

Earthstation 5 sounds better than KAZAA

[zymano]

and KAZAAlite.

It protects your identity.

All you guys are whining about a meaningless security hole thats been fixed.

I would rather use ES5 than kazaa because i don't want to be sued.

ES5 is worth trying.

Re:Here is why I care, but it does NOT affect me..

[Anonymous Coward]

If you didn't want to be a leech, the same setup could work except put all the program files on the nonpersistent disk, and put all your shared data on a persistent disk.

This way the only thing that could get modified would be the second disk. Ideally this would consist of just a small number of directories and would be easy to keep tabs on, as well as probably only containing "data" files that are difficult to exploit.

How much HDD space do you use for VMware images?

[antdude]

How much disk space do you give for each VMware session? You must have a lot of disk space assuming you only create disk space in the image and not sharing with the host's disk space.

Delete all personal info from Windows? Yeah right

[enosys]

How the heck do you delete all your personal info from Windows? Everything is probably riddled with it. I suppose a search and replace for your name in ASCII and unicode through the entire image would be a good start but it probably wouldn't be enough.

Re:Here is why I care, but it does NOT affect me..

[Anonymous Coward]

That actually might look interesting if done right

Re:I'm surprised by these Cunning Linguists

[Anonymous Coward]

Plus,they sound like cunning linguists,and lying Assholes.

Malware me once

[panxerox]

shame on you Malware me twice shame on me...

Re:Here is why I care, but it does NOT affect me..

[/dev/trash]

So how do you listen to the music you stole, when you wipe that VMWARE session?

Free Publicity

[SurgeonGeneral]

I really hope Shaun Garriok wasnt planning on ruining Earthstation5 with this little stunt. I, for one, just downloaded what I think is a cool program that previously I had never heard of, nor would get to know about, because I missed the earlier article on it.

Thanks for drawing it to my attention Shaun. I appreciate it.

Damn.

[fluxrad]

And here my post was spefically intended to make you laugh.

You don't get sued for using KaZaA . . .

[CharonIDRONES]

You get sued for sharing, distributing, and/or downloading files, on any peer to peer network. The only one so far that the RIAA has attacked as of late is the Fast-Track network, due to its incomparable size. Apparently people don't seem to remember a popular service known as Napster that also disappeared from existence by being sued. So, just because you use ES5, does not make you immune from lawsuits, because you are still violating the law. Using different programs, in my opinion, do give you a bit more freedom, as you don't ever hear of someone getting sued from using the Gnutella2 network (www.shareaza.com) for which I am an advocate of. So, it would just be time until they reached the other networks, unless they are stopped here, unless they are not allowed to go further, unless they can no longer hurl subpoenas at ISPs. But then again, those are just my hopes :) P.S. K-Lite K++ is an illegal modification of KaZaA (even though its superior for doing the oh-so-illegal things :D)

Re:You don't get sued for using KaZaA . . .

[zymano]

protects your ip address.

very important.

Re:You don't get sued for using KaZaA . . .

[paganizer]

From the very brief look I took at ES5, it protects your IP address by allowing you to route through a open proxy.
This only protects your identity from a VERY casual seeker; In many cases, your originating IP address may still be visible.
Overnet has the same feature, but warns you up front (well, on the FAQ page) that it only protects you in a very limited fashion.
And, of course, all the RIAA/MPAA (MAFIAA) has to do is put up a couple of open proxy servers, get them in to the samair.ru list or others, and quite a few ES5 users are going to have ALL their activity logged.

Freenet is the way to go, people.

Re:You don't get sued for using KaZaA . . .

[q.kontinuum]

Freenet is a good start, but it is way to slow. I think, we need something average, it does not need to be _that_ secure. The average number of hops used should be lowered, and a cypher wich is faster butnot 100% reliable should do as well. The only important thing is that the cipher remains strong enough that no court can expecteveryone to decrypt all files cached on his own harddisk or forwarded to other poeple. Funny thing: Due to DMCA in USA a very weak (and therefore fast!) algorithm should already do the trick, since the customer is probably not even allowed to decrypt data wich is supposed for him ;-))

Re:Here is why I care, but it does NOT affect me..

[Anonymous Coward]

You are paranoid as fuck.
What if VMWare is trojaned?

You are experiencing culture shock

[yerricde]

Most importantly, I don't like the language they use EVERYWHERE. It's uncomfortable. Forced. Fake. Overstated. Glossed.

In some cultures, language that is uncomfortable, forced, fake, overstated, and glossed is expected.

Re:Here is why I care, but it does NOT affect me..

[ShinmaWa]

stemming the supply without decreasing demand means an increase in price

You're right! If the RIAA cuts the supplers off.. the amount that the downloaders are currently paying to get stuff might double... triple... maybe, just maybe, even increase a hundredfold!!

I just don't know if I could still afford it.

I can believe the possibility...

[michaeltoe]

...but I also read the original report on the problem, and the person who authored it seemed to believe that it was more than a simple bug.

At this point, not being an expert, I'd reserve judgment... but I don't think we should completely dismiss the possibility that it was just sloppy programming.

Re:Here is why I care, but it does NOT affect me..

[cduffy]

*heh*. I knew that was coming.

So the price isn't mandatory cost of the software -- but folks who build P2P systems still have *some* kind of motivation, right?

Maybe it's ego -- doing something daring, dangerous and flashy. If there's plenty of supply of P2P software, folks running Yet Another P2P Network don't get nearly the ego boost as they would if they were one of a few and there were a huge crowd interested.

Maybe it's banner advertising money. If there are fewer P2P programs out there to buy banner ad space on, then that's all the more views (and thus income) for those that still exist.

Maybe it's monetary donations from users (either in response for a fancied-up version of the software or otherwise). Less competition -> more donations.

And so forth.

Some positives

[Anonymous Coward]

The gattling proxy feature of ES5 is pretty cool. Or it would be if it worked. And their idea of having built in VoIP that could go from PC to phone is also pretty cool, if only it was remotely possible. In all seriousness, though, the servers they have set up with direct downloads and streaming movies are pretty impressive, especially if they stay up.

Re:Here is why I care, but it does NOT affect me..

[ShinmaWa]

I understand what you are saying.. but there's one minor (read fundemental) flaw with your logic: The P2P companies aren't sharing materials; the users of their software are.

The RIAA shutting down the "sharers" has no (direct) effect on the P2P companies. The RIAA tried shutting down the P2P companies already and failed.

Re:How much HDD space do you use for VMware images

[Eric_Cartman_South_P]

How much disk space do you give for each VMware session?

Just 1 gig. I have a 120 gig serial ata drive, not too worried about space. Even so, VMWare only needs about 1 gig. That's for a full install of XP, and the few utils for antivirus, spybot, firewall, etc. A small price to pay IMO.

This is why: ALL GOOD P2P APPS ARE **OPEN SOURCE**

[torpor]

If you can't look at the source for a p2p system, then its not truly safe. It is as simple as that.

P2P opens up a whole different degree of responsibility for local system resource usage, and in fact the primary function of a p2p app is to manage local system resources on behalf of a 'greater good' of bigger resources provided to the community.

I wouldn't really put much faith in any p2p solution provider who didn't have full disclosure of source code as a priority in their front line for dealing with their users ...

I mean this as a potential professional user of p2p, as well as a personal user too.

Re:How much HDD space do you use for VMware images

[antdude]

How the heck do you manage to download huge files from P2P sources then?

Re:How much HDD space do you use for VMware images

[Eric_Cartman_South_P]

Hmmm... you download a file... then you scan it etc... then you ftp it or copy it via shared directory, to the main box. With hard drives being dirt cheap, you could make the vmware image 10 gigs if you want. No big deal. Although most of the stuff I download is not music at all, I'm hooked on downloading funny video clips etc. Idiot teanagers skateboarding off roofs. Funny stuff. I guess the VMWare thing is a bit "tin foil hat-ish" since I'm not heavy on P2P, but as a true geek I think it's a fun, and safe, setup.

Oh, and you can play with VMWare for free for 30 days I think. Time limit demo or something like that.

Investigative Info. on Some Blog

[shadowxtc]

Check this out... apparently this guy did some research into the domains and IP blocks owned by ES5 and it seems to back up the hoax theory... http://taosecurity.blogspot.com/2003_08_01_taosecu rity_archive.html

Observations on ES5

[heironymouscoward]

1. They spend a lot of energy attacking other P2P applications: much of their marketing is simply "we're better than such-and-such". I don't recall such hostility in the P2P camp before ES5 showed up.

2. Their application does not work. Pure and simple.

3. They lie about the number of users online.

4. They have an high number of "features" with no obvious sense or meaning.

5. They distract the user with chat, dating, movie downloads (?).

6. They are highly aggressive: "declare war on the RIAA, Palestinian camp, etc." It sounds like smoke.

Conclusion: the software is not what it seems. A true high quality P2P application needs no marketing whatsoever. It needs almost no "features" (compare ES5 to bittorrent), and it certainly does not need to provide dating, movie downloads (if this worked?), etc.

Software professionals do not build in remote exploits, and do not promote their software with flames. And I would not use something that was built by a non-professional.

Re:Here is why I care, but it does NOT affect me..

[acd294]

The only problem is that without any sharers, the networks die and therefore most likely the P2P companies would as well.

Re:Here is why I care, but it does NOT affect me..

[cduffy]

The P2P companies aren't sharing materials; the users of their software are.

What's your point? The users are (largely) guilty of copyright violation; the companies are (largely) guilty of knowingly facilitating them in this. Either is a fine target, and both have been succesfully sued.

The RIAA shutting down the "sharers" has no (direct) effect on the P2P companies.

Whatever your motivation, be it ego or advertising dollars -- take away your user base, and you no longer get any.

Cartoon of ES5

[Anonymous Coward]

Tell me what you think of these 2 cartoons i created, hopefully someone can make funnier versions ES5 Sucks Ass 1

Re:Cartoon of ES5

[hangingonwords]

that little movie definitely sucks. what a waste of my life to sit and watch that.

LOL

[Anonymous Coward]

Though for a minute the title sayd "Playstation5 responds". Got me worried there for a minute. LOL. Were still on PS2, i wish PS3 would soon come... LOL.

Re:Delete all personal info from Windows? Yeah rig

[Glonoinha]

You install a new copy into the VMware virtual machine and while doing so you fill it with bogus data. Shut down the virtual machine and just copy the files to a new directory every time you need a sandbox to play in.

Simple.

Re:Here is why I care, but it does NOT affect me..

[ShinmaWa]

Either is a fine target, and both have been succesfully sued.

Actually, that's not true. The RIAA has not won a single lawsuit against a P2P company since Napster.

Whatever your motivation, be it ego or advertising dollars -- take away your user base, and you no longer get any.

I think you are agreeing with me in a wholly interesting way. The argument that I thought was silly was "if you get rid of the sharers, the price of downloading will increase". When I made a joke about that, the argument quickly changed to "oh, I meant the price of P2P software will increase". I think that you and I agree that getting rid of sharers would make P2P software just go away rather than increase its price.

And the really scarry part of this is...

[Anonymous Coward]

That after all the things that have gone on (i.e. a exploitable "function" that is a "mistake" by the programmers who claim to have a secure application, threats, etc) I noticed a lot of people are quick to go right back and download the new version.

For example in a post here by gd_nimrod (appropriatly named I say) supports them because they MUST not be the RIAA and because give their users FREE MOVIES. Thus they must not have questionable motives, or intended to do anything with this "bug." One could say they are doing a good job of social engineering, but given how bright their user base is this is as easy as shooting fish in a barrel with a bazooka.

Just like email attachments, you tell someone all the bad things that can happen, yet they still go and open them anyway.

Re:Here is why I care, but it does NOT affect me..

[cduffy]

Actually, that's not true. The RIAA has not won a single lawsuit against a P2P company since Napster.

Oh, I'm sorry -- is Napster not a P2P company? Because if they were, then my statement (that at least one P2P company and at least one P2P user have been succesfully sued) would in fact be true.

oh, I meant the price of P2P software will increase

Huh? The price that's paid to the remaining producers of download-facilitation software will increase if the set of suppliers is reduced. That's what I was saying at the beginning, and it's what I'm saying now.

Granted, I intentionally used some wording that made fun of the whole economics thing, and you then used that in your jest -- but the difference that my jest was meant to be a bit of a laugh while supporting the idea that attacking the supply of downloading software (rather than the demand) is inherently futile, while your response struck me as being in favor of an opposing position.