Slashdot Mirror
Indictment Highlights File-Sharing Risks
Bomarc writes "Via the KOMO-TV website, an article from the Associated Press about how Gregory Thomas Kopiloff used Limewire, Soulseek and other peer-to-peer file-sharing programs to troll other computers for financial information, which he used to open credit cards for an online shopping spree, according to a four-count indictment unsealed in US District Court on Thursday. The news article isn't big on details, but it does outline the risks with peer-to-peer file-sharing programs."
however poorly configured software is, wether its MSIE or OpenSSH or SMB if they are poorly configured you will get bitten
anyway this smells like another "OMG p2p teh evill!!!" anti-p2p propaganda
...then don't be suprised when someone takes it as a gift and goes to buy something nice for themselves! :)
/) and not knowing any better, blah blah blah.
(I know, I know, uneducated users, sharing C (or
Off to get myself that PS3 I'd never spend my hard earned dollars on....
Karma: Chameleon (mostly due to the fact that you come and go).
(n/t) DUH.
Why not just use bittorrent?
c:\credit-info.goatse.cx.jpg
Get's em every time.
An old Kazaa trick I used to entertain myself back in the day. Mainly to see what NOT to do on a resume, but you could get pretty adequate information from them. Some people included birthday, SSN, other stuff that should never be on a resume.
Fun times.
Newsbreak: Internet can be dangerous to privacy. Film at 11.
Just as with any case along these lines, services that may allow crimes to be committed need to be separated from the crimes themselves.
As far as I can tell, there are many ways to mine for personal information on the internet that do not require the use of P2P sharing programs. In this case, should the usage of the internet as a whole be deemed unlawful?
I don't keep any sensitive information on my computers, in stead I put all the information I want to secure, passwords, account numbers, on line payment information, and administration info, in a plane old paper address book. Even if someone came in and physically took my computers they would have no access to my accounts. Also, if I want to remove access to all information I simply pick up the one address book and walk away. Yes, it is a hassle to type in the information each time but I don't have to worry about someone breaching my security on a software level and ruining what little life I do have.
I remember when I used Limewire seeing every known file extension shared 'by default' in the settings. It seems like this applied to one shared folder though. Is this not the case (i.e. your entire hard drive is shared) or are people actually sticking non-music files in their shared music folders??
From the article: "If you are running file-sharing software, you are giving criminals the keys to your computer," said assistant U.S. attorney Kathryn Warma. "Criminals are getting access to incredibly valuable information."
This woman sure adds some emotions to her wordings! It's not like she's added any media spin! never! . Sheesh. This woman must be aiming for a job with microsoft. From the last link I just provided: "We know that Robert Soloway is one of the most prolific spammers in the world," Warma said before the hearing. "He has condemned them (his victims) to perpetual spam hell" unless they escape by canceling their domain names or changing their Internet protocol addresses.
Spam Hell? Although the woman does seem to prosecute for some good causes (people who use botnet attacks, etc), why does it seem like there's an excess of spin in her quotes to people? Seems like she wants to just scream "EEEVILLL" or something.
But not the risk of file-sharing. It outlines the risk of not knowing what your doing. Same could be said about just about everything.
You exemplify such a great attitude towards the world; it helps create what it is. To say, its the users fault for keeping information on his/her personal computer that could POTENTIALLY if not realistically be accessed by people who are breaching someone else's personal space is to misrepresent the problem. Keeping any kind of information, regardless of whether you are "file-sharing" or not does not mean another user has free reign to read/execute/extrapolate that information in any way they see fit. Saying they were asking is shameful! If we reinforced the concept that personal privacy is that and further reinforced the concept of social trust, we could actually live in a world where we didn't have to lock our doors, encrypt our software and live in oppression under the threat of hypothetical terrorists. But instead, the human condition roles on.
...and it should be known by now
Cornhole your system to the universe?
Y/N: N
Share your files to [INSERT]
Y/N: Y
HAH! TRICK QUESTION! AYBABTU!
*SCHLORP!*
Seriously, this reminds me of morons who used to share their entire hard drives out to file sharing apps.
I remember seeing printouts of peoples' password lists, even full bank account and investment broker information, complete with contact info, and all the personal ID data, etc. All found by people trolling the network for more than just MP3s.
Chas - The one, the only.
THANK GOD!!!
File sharing is like Sex, once you've started doing it, it is almost impossible to stop.
... {counting} ... 18 years. Well, that and that I'm a single slashdot reader.
OTOH, there are lots of diseases out there and really bad things can happen with both - but most of the time, it is just fun.
I guess this explains why I haven't had sex in
Perhaps, but it's overkill. Just change your email address and remove the catch-all. Once you've done that, don't publish in plain text.
WTF? that won't even help since the domain will be looked up and converted to the IP address.
I think what is more accurate (assuming the software only shares what you tell it) is "you're giving criminals keys to get into a single room where everything that you left in there cannot be stolen but can be copied indefinitely". I guess that doesn't have the same media punch as "user was dumb enough to share entire disk drive and not check what was specifically shared".
This story proves the argument that some people using filesharing software are not intentionally sharing music files. No one in their right mind would intentionally share their SSN, bank info, etc., that this guy was getting vial limewire. That info was being shared accidentally and not intentionally, and shows it is easy with these programs to accidentally share files you had no intention to share.
I can understand the other charges, but accessing a protected computer? I'd think it would be reasonable to assume files that are found on a p2p network are meant to be shared. IANAL, but if he gets convicted for that, wouldn't that allow a "I'm sorry, I never meant to share these mp3's" defense in most, if not all, of the RIAA cases?
Cluelessness is. Plain and simple. Operating something that can potentially compromise your personal and private information without even having the foggiest idea what you're doing is stupid.
Unfortunately, exactly that conclusion is very hard to understand by stupid people.
Don't want to learn? No problem. Nobody is forced to be "on the internet". Nobody is being forced to put their private information into their computer. You can live without either.
But don't blame technology for your stupidity. Do you call your car dangerous and evil if you're too stupid to see the difference between the funny things down there that ruin your shoes (aka pedals)?
Just to get a car analogy into it again...
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
This is exactly the angle the media companys should leverage. Instead of combating what they perceive as piracy with more complicated and restrictive drm, they should work on the simple solution of providing the best source for their product.
If the price / convenience / value ratios make you the best source for your product, people will scramble to get it from you. For money even! Back it up with an ad campaign reinforcing how safe and accessible you are and i guarantee you won't lose.
I wish i was a media company, i would be at profit already.
We need xml joke tags on here. :P
I had a mental image of someone running Windows as Administrator installing Kazaa, Limewire, whatever the p2p 1337 app of the week is, and manually sharing out their whole drive. Of course it's not okay to just abuse things, and there *should* be a reasonable level of security in keeping data on your computer.
That said, a computer should be operated as non-uid=0, and only switch when critical tasks MUST be done, but hey...that still wouldn't fix this. If I run a file sharing app on my home directory and share out all of ~, all of my personal data is still out there.
So really there's two strikes on this - 1, the uneducated end user, and 2, the naughty people stealing the data. So....we're more or less helpless to fix either one. So dangit, I'm gonna go get my PS3! (and I'm still kidding....)
Way to make me think far too hard on something that was supposed to be a flippant "Fist post!" remark. kthx.
Karma: Chameleon (mostly due to the fact that you come and go).
Sorry, my joke filter is off today...
Well a technical solution to making a mistake about something you don't even understand (inexperienced/ignorant users) is essentially impossible and may be why Win has the problems it has. My gripe really was with blaming the victim in that instance though, well, even if it is a joke. No worries, though.
...and it should be known by now
"Precisely. Preventing personal data from leaking onto P2P networks is simply a matter of proper configuration of the client."
The same can be said for Windows. Now why doesn't slashdot give it as fair a shake as it does P2P?
"As the summary states, there's very little detail in the article about how the information was actually accessed; all that would be required is a few pointers to help people prevent the sharing of sensitive files"
I'm reminded of a couple years back when a Red Hat distribution came by default with all services running. Must have been some work to secure that mistake.
"but TFA seems to be following the fear-mongering route instead with quotes like "If you are running file-sharing software, you are giving criminals the keys to your computer"."
And if you're running IE with default settings "you're giving criminals the keys to your computer".
"Who wants to bet that a more significant proportion of the information came from that source?"
A hole's a hole. Doesn't matter who has the bigger one.
The problem now is the value of recorded music is zero. Nobody I know pays. Why would they? Safety? Convenience? When a small bit of common sense will protect you from the robbers and thugs out there and everything you want is available?
No, the crash is going to come pretty soon I think. Anyone "selling" music is doomed, as is their entire infrastructure. If you create graphics for bands who pay you from music sales, better find a new job. If your job is supplying plastic for jewel cases used by CD manufacturers for music CDs, better find a new job. If you are a network admin for a advertising agency used by bands or record companies, better find a new job.
How far will this spread? Far. Really far. And I don't see any way to avoid it. No matter what the RIAA would like to do, they can't stop people outside the US sharing stuff into the US. And they can't stop everyone with a computer in the US taking advantage of the sharing. Today elementry school children learn how to use sharing software for what they want. Pay for it? They have no money. But they learn it is all out there for free and no need to pay by 4th grade. There is no way you are going to convince these children when they grow up they have to pay for something that is clearly available for free.
The user's computer exposure to web criminals was not due to the user's lack of attention to minute details of the program, but by the criminal negligence on the part of the programmer to shield the user's data from his program's access.
In other words, the programmer of the P2P software is at fault for allowing his program to default into a dangerous state! The P2P program should be forcing the user to create a new and specific folder on the hard disk for files that will be shared. Then the shared files must be specifically moved to this folder in order to be accessed by other users of the P2P program.
The days when a programmer can claim that a user was at fault for the consequences of poorly-designed software are gone. To claim otherwise is a throwback to the 1970s when it could be expected that computer users were tech professionals and therefore could be expected to plow through hundreds of pages of manuals to become aware of these 'gotcha' defects in a program's structure.
Also it is important that the computer professional community supercede the legal authorities in punishing criminals who use the web for identity theft and other computer crimes. We need to hunt these bozos down and punish them. Not by killing them, maiming them, or imprisoning them, but by ensuring that they don't have access to computer networks again for long periods of time. Or by deleting their bank account records and the computer profiles that all people need in advanced societies. Our punishment should exceed the legal system. The criminals who use the web that we created for crimes against the people that we serve should fear us more that any legal authority. Tracking down complex computer criminal cases takes a lot of work and resources from the law enforcement structures and these resources can be better used on other crimes that we are not able to solve.
And we should stop releasing junk software through open source and delude ourselves into believing that we are doing someone a favor.
I would never recommend viewing such information or committing any crimes, but it's interesting to see one IP address with tens or hundreds of tax returns shared. If you hire an outside tax preparer, be aware!
Imagine - your SSN, name, address, a list of banks that have paid you interest, a list of stocks that you own, your taxable income and amount of tax paid (which the IRS uses as proof that you are who you say you are, if you perform an online inquiry), etc.
And the victim doesn't even realize that their PAID PREPARER is sharing the information with the world! No lie! There are hundreds available every April!
PS, Don't try to call any of the individuals and tip them off - they have a tendency to shoot the messenger!
seriously, this reminds me of morons who used to share their entire hard drives out to file sharing apps.
maybe it reminds you of that because it is exactly what they are talking about.
I got into this for a minute, cookie files are pretty fruitful as well...
I've been a torrent monkey for a little while now...although, I was HUGE into Hotline back in its hayday.
By the by, anyone know if Hotline is still functional and in use?
Living With a Nerd
No, its the risks of non-technical people using a computer. Give people a terminal instead of a 'PC', and problems like this go away.
---- Booth was a patriot ----
This is the consumer equivalent of the age-old problem in the corporate world of printing something to the wrong printer, something that resulted in many a red face and more than a few leaks of confidential information. It is an information security problem -- how do you prevent a user from erroneously placing confidential information in an insecure space? The problem is the same whether the insecure space is a printer, an extranet site, or a directory structure shared by a file sharing program.
Systems designed for handling a mixture of documents of varying sensitivity deal with this by classifying the documents and then refusing to send secure documents to insecure resources. Sooner or later, one would hope that such systems will become practical for home users, although in a world where people still surf the web from their admin account we have a long way to go.
That P2P was involved is mere happenstance, since many other communications utilities (drive sharing in Windows Networking, for example) can be misconfigured the same way. You would think that AUSA Warma would be smart enough to realize that rather than treat this as a risk categorically unique to P2P.
ok, people stop sharing your C:\ drive! WTF! you're basically asking for people to steal your stuff then...
music - http://www.subatomicglue.com
It's not enough to bash in heads, you've got to bash in minds. - Captain Hammer
The user's computer exposure to web criminals was not due to the user's lack of attention to minute details of the program, but by the criminal negligence on the part of the programmer to shield the user's data from his program's access.
I'd go further and say that in at least some cases automatically sharing everything (or at least all media files) is an intentional (mis)feature of the P2P programs. The folks that make these programs often gain from the popularity of their programs either through advertising or through sales of paid versions and the easiest way to become popular is to make sure there is plenty of stuff for users to download. Of course the cheapest way to get content onto the network is to get users to provide it automatically.
Shockingly, if you share your entire hard drive in P2P that WILL include all your personal information and people WILL take it and possibly do bad things with it. Most P2P software actually includes warnings against doing this and by default, only shares a specific created directory. Users would have to manually add their whole hard drive.
To put it another way: Complete dipshits shouldn't be using P2P.
I can live with that.
I saw "sharing C" and thought, "What's wrong with sharing source code over P2P?".
1) zip Backup.zip ~/stuff
2) mv Backup.zip ~/Kazaa/share/Britney&ParisDoAHorse.mpg
3) ??
4) Profit!!
"..One hosts to look them up, one DNS to find them, and in the darkness BIND them."
lol
I download something from Napster
And the same guy I downloaded it from starts downloading it from me when I'm done
I message him and say "What are you doing? I just got that from you"
"getting my song back fucker"
"..One hosts to look them up, one DNS to find them, and in the darkness BIND them."