Indictment Highlights File-Sharing Risks

Bomarc writes "Via the KOMO-TV website, an article from the Associated Press about how Gregory Thomas Kopiloff used Limewire, Soulseek and other peer-to-peer file-sharing programs to troll other computers for financial information, which he used to open credit cards for an online shopping spree, according to a four-count indictment unsealed in US District Court on Thursday. The news article isn't big on details, but it does outline the risks with peer-to-peer file-sharing programs."

Comments

Filesharing isn't a risk

[Anonymous Coward]

however poorly configured software is, wether its MSIE or OpenSSH or SMB if they are poorly configured you will get bitten

anyway this smells like another "OMG p2p teh evill!!!" anti-p2p propaganda

Re:Filesharing isn't a risk

[Apatharch]

however poorly configured software is, wether its MSIE or OpenSSH or SMB if they are poorly configured you will get bitten

anyway this smells like another "OMG p2p teh evill!!!" anti-p2p propaganda

Precisely. Preventing personal data from leaking onto P2P networks is simply a matter of proper configuration of the client. As the summary states, there's very little detail in the article about how the information was actually accessed; all that would be required is a few pointers to help people prevent the sharing of sensitive files, but TFA seems to be following the fear-mongering route instead with quotes like "If you are running file-sharing software, you are giving criminals the keys to your computer".

And then, right at the end, we have:

Kopiloff also obtained some sensitive information the old-fashioned way, from associates who would steal mail or go "Dumpster diving" for discarded financial records, the indictment said, adding that he would open credit accounts and then go shopping online

Who wants to bet that a more significant proportion of the information came from that source?

Re:Filesharing isn't a risk

[rucs_hack]

I'm in Audible...

Well if you going share C:\ expect bad things.

[woodchip]

(n/t) DUH.

My way

[Anonymous Coward]

c:\credit-info.goatse.cx.jpg
Get's em every time.

Search for 'Resume'

[0100010001010011]

An old Kazaa trick I used to entertain myself back in the day. Mainly to see what NOT to do on a resume, but you could get pretty adequate information from them. Some people included birthday, SSN, other stuff that should never be on a resume.

Fun times.

Re:Search for 'Resume'

[langelgjm]

Yeah, we used to do this on a college file-sharing network. We'd search for files that were on the root of the drive, like "io.sys", and find all the people who were sharing their entire hard drives. Then we'd root through their documents and find compromising pictures of them and make fun of them in the main chat, usually followed by the advice "STOP SHARING YOUR ENTIRE DRIVE."

There was also a correspondence between assigned IPs and the different dormitories, which was apparently easy enough to figure out, with the result that the ops often freaked out new users by telling them where they lived.

Re:Search for 'Resume'

[0100010001010011]

I forgot about this one. We had a student at my first university that put up a search engine for the network. Twice a day it'd ping all the computers on campus (1600 students, maybe 800 living on campus) and then store the results in a database.

It was just a 'dumb' spider so it went everywhere it could.

jpg would turn up 'private' party pictures. doc's would turn up Resume's and homework solutions... those were the days.

And we did the same thing you did. Anyone sharing everything would get a nice desktop text file "README". /Anyone remember searchtree?

It outlines something...

[Anonymous Coward]

But not the risk of file-sharing. It outlines the risk of not knowing what your doing. Same could be said about just about everything.

P2P isn't the danger for your security

[Opportunist]

Cluelessness is. Plain and simple. Operating something that can potentially compromise your personal and private information without even having the foggiest idea what you're doing is stupid.

Unfortunately, exactly that conclusion is very hard to understand by stupid people.

Don't want to learn? No problem. Nobody is forced to be "on the internet". Nobody is being forced to put their private information into their computer. You can live without either.

But don't blame technology for your stupidity. Do you call your car dangerous and evil if you're too stupid to see the difference between the funny things down there that ruin your shoes (aka pedals)?

Just to get a car analogy into it again...

try .tax

[Chapter80]

In April, it's fun to search the file sharing networks for ".tax" files (and other common files used for tax returns by Turbo Tx, Taxcut, etc.)

I would never recommend viewing such information or committing any crimes, but it's interesting to see one IP address with tens or hundreds of tax returns shared. If you hire an outside tax preparer, be aware!

Imagine - your SSN, name, address, a list of banks that have paid you interest, a list of stocks that you own, your taxable income and amount of tax paid (which the IRS uses as proof that you are who you say you are, if you perform an online inquiry), etc.

And the victim doesn't even realize that their PAID PREPARER is sharing the information with the world! No lie! There are hundreds available every April!

PS, Don't try to call any of the individuals and tip them off - they have a tendency to shoot the messenger!

Filesharing is a great way to backup stuf!!

[Rexdude]

1) zip Backup.zip ~/stuff
2) mv Backup.zip ~/Kazaa/share/Britney&ParisDoAHorse.mpg
3) ??
4) Profit!!