Category Archives: Hot Topic

MegaUpload Shut Down by the Feds, Founder Arrested

Posted on by

MegaUpload, one of the largest file-sharing sites on the Internet, has been shut down by federal prosecutors in Virginia. The site’s founder Kim Dotcom and three others were arrested by the police in New Zealand at the request of US authorities. MegaVideo, the streaming site belonging to same company, and a total of 18 domains connected to the Mega company were seized and datacenters in three countries raided.

Just a few weeks ago, MegaUpload founder Kim Dotcom told us that his Mega venturesImage is Loading.... have nothing to worry about, as they operate within the rules of the law.

“Mega has nothing to fear. Our business is legitimate and protected by the DMCA and similar laws around the world. We work with the best lawyers and play by the rules.

“We take our legal obligations seriously. Mega’s war chest is full and we have strong supporters backing us,” Dotcom said.

But behind the scenes powerful forces were at work, plotting the forceful demise of MegaUpload, one of the world’s biggest websites.

An indictment unsealed today by the Department of Justice claims that MegaUpload has caused the entertainment industries more than $500 million in lost revenue and generated $175 million “in criminal proceeds.”

Two corporations – Megaupload Limited and Vestor Limited – were indicted by a grand jury in the Eastern District of Virginia on January 5th, 2012, and charged with “engaging in a racketeering conspiracy, conspiring to commit copyright infringement, conspiring to commit money laundering and two substantive counts of criminal copyright infringement.”

Today, the authorities executed in excess of 20 search warrants in the United States and eight other countries.

Data centers in the Netherlands, Canada and Washington housing MegaUpload’s equipment were raided. In an apparent reference to the latter location, a source has just informed us that the FBI are currently detaining everyone at the ISP Cogent Communications’ headquarters in Washington DC, in connection with a Mega-related search warrant.

In addition to MegaUpload founder Kim Dotcom who was arrested today in New Zealand, another six alleged members of the Mega “conspiracy” were charged in the indictment:

- Finn Batato, 38, Mega’s chief marketing officer and a citizen and resident of Germany
- Julius Bencko, 35, Mega’s graphic designer from Slovakia
- Sven Echternach, 39,Mega’s German head of business development;
- Mathias Ortmann, 40, the German CTO, co-founder and director of Mega
- Andrus Nomm, 32, programmer and head of the development from Estonia
- Bram van der Kolk, 29, a Dutch citizen who oversaw programming and network issues.

Dotcom, Batato, Ortmann and van der Kolk were arrested today in Auckland, New Zealand, by authorities there. Bencko, Echternach and Nomm are still at large.

The authorities seized approximately $50 million in assets, which appears to include Kim Dotcom’s treasured collection of several dozen cars, as detailed below.

Image is Loading.....
A total of 18 Mega-related domains were also seized by authorities including Megastuff.co, Megaworld.com, Megaclicks.co, Megastuff.info, Megaclicks.org, Megaworld.mobi, Megastuff.org, Megaclick.us, Mageclick.com, HDmegaporn.com, Megavkdeo.com, Megaupload.com, Megaupload.org, Megarotic.com, Megaclick.com, Megavideo.com, Megavideoclips.com and Megaporn.com.

According to the Department of Justice, the individuals named in the indictment face a maximum penalty of 20 years in prison on the charge of conspiracy to commit racketeering, five years in prison on the charge of conspiracy to commit copyright infringement, 20 years in prison on the charge of conspiracy to commit money laundering and five years in prison on each of the substantive charges of criminal copyright infringement.

The legal action against Mega will set a precedent for similar cloud-hosting services. The MegaUpload site itself had no search function to discover content directly, but according to the indictment this was done to “conceal the scope of its infringement.” Would the same be true for services such as Dropbox?

 

 

Major Vulnerability Found in Leaked Anti-Piracy Software

Posted on by

Trident Media Guard, the company entrusted by the French government to monitor file-sharing networks for copyright infringement, recently had some of their tools leaked onto the Internet following a security breach. Now researchers have published an analysis, with claims that an auto-update feature makes TMG’s servers vulnerable to remote code injection and execution.

Image is Loading....As detailed in our earlier reports, anti-piracy company Trident Media Guard (TMG) recently failed to secure some of their systems. Blogger and security researcher Olivier Laurelli, aka Bluetouff, originally reported the breach which included a wide open virtual ‘test’ machine containing various tools. These, of course, spilled into the wild.

From the various files made available, some were easily viewable with a standard text editor, others – such as an executable called server_interface.exe – were more tricky. Thanks to a admittedly fairly hostile Full Disclosure security report we now have a clearer idea of what the package is capable of.

Penned by ‘CULT OF THE DEAD HADOPI’, the report refers to TMG as “Too Many Gremlins” along with reports not to expose them to bright lights. In it the server_interface.exe code is described as a Delphi service to which anyone can connect and start sending commands, no authentication (username/password) required. Perhaps even more worrying is a script which accepts auto-updates.

“An attacker can use the ‘Auto Update’ feature (\x82) to force the server to download updates from an evil FTP server he controls. Of course, a downloaded file is executed
just after the download,” write the researchers.

“Hence, anyone who wants to raise an army against Too Many Gremlins, look for an open port on TCP 8500,” they add.

The implication here is that if this software was present on all TMG servers, in addition to being able to turn them on and off at will a hacker could take them over with custom code of his own choosing, potentially creating “an army” which could be used to attack TMG or indeed, anyone else.

Commenting on the research, Bluetouff told us that the discovery of the vulnerabilities mean that the French 3 strikes program might already have been compromised.

“If TMG is vulnerable to injectioning on the system used to provide IP addresses to the HADOPI, the whole process is fu**** up,” he explained.

“Someone could for example inject the Culture Ministry’s IP range, or worse, gain access between TMG and HADOPI’s VPN by stealing certificates… then gain access to a huge amount of personal data,” he added.

“For instance we don’t know if this new ‘test server’ leak can compromise the LAN(S) of TMG with this exploit. Opacity is even for HADOPI. That’s why they went to audit TMG’s infrastructure with the CNIL [French Data Protection Office].”

“Anyway, this new episode shows that HADOPI was right to close their access,” he concludes.

That closure of access is a reference to Hadopi severing their Internet links to TMG once they found out about the leak and resorting to shifting IP addresses around by DVD and the postal system instead. That is hardly efficient and undoubtedly TMG will be working hard to get back into the 21st century.

Read

ICE Seizes More Domains Today, Admin Says “We’ll Be Back”

Posted on by

Yesterday and without warning, US authorities resumed “Operation In Our Sites” seizing several domain names associated with copyright infringement and counterfeiting. Today, yet more domains were added to the growing list. We caught up with one site owner who told us that while they were taken by surprise by a “pointless” seizure, they’ll soon be back.

As indicated in our exclusive report yesterday, the Department of Justice (DOJ) and Immigration and Customs Enforcement (ICE) have resumed “Operation In Our Sites”, the domain name seizing initiative designed to crack down on copyright infringement.

Following on from the most recent set of seizures in February, yesterday’s action represents the fourth phase of the operation. The following six domains were taken:

* Re1ease.net
* Watchnewfilms.com
* Dvdcollectionsale.com
* Dvdscollection.com
* Dvdsetsonline.com
* Newstylerolex.com

Today the list has grown again to include the following:

* mygolfaccessory.com
* overbestmall.com

We managed to catch up with PiraCee, an admin at Re1ease.net, a portal that did not host any copyrighted material itself but linked to movie and TV shows on sites like Megavideo.com.

“We were not informed [that the seizure was imminent] in any way,” he told us. “I was just presented with the ICE image upon doing a page refresh.”

For those unfamiliar with the site, Re1ease.net was founded following PiraCee’s split with Ninjavideo.net in late 2008. NinjaVideo, readers will recall, succumbed to ICE raids in 2010 and never recovered.

While undoubtedly quite busy with around 10,000 visitors a day, Re1ease.net was not one the largest sites of its type on the Internet. Indeed, others with significantly higher levels of traffic remain intact, untouched by ICE.

“I don’t believe we were doing anything wrong at all. Many higher profile sites remain unaffected,” PiraCee told us.

So why was Re1ease singled out? Despite being operated from outside the United States, did they have a bad attitude to DMCA takedowns perhaps?

“We have only ever had two DMCA takedown requests – for Source Code and Hobo With a Shotgun,” PiraCee told us. “We removed both.”

But despite losing their domain, a body-blow event for any site, Re1ease.net aren’t giving in.

“We will be back,” said PiraCee, as the site mulled over a possible domain change this morning. “Give us about a week.”

That was a few hours ago though, and things move very quickly in this game.

“Scrrls.net will be our new domain and will be up and running soon as we fix our backend,” PiraCee assured us. Indeed, it appears to be fully functioning now.

We continues to monitor developments in phase 4 of Operation in Our Sites and if any additional domains are seized we will update this report.

Read

Pirate Party Servers Raided by German Police

Posted on by

This morning German police confiscated the servers of the Pirate Party, currently the sixth largest political party in Germany. Details of the raid are still scarce, but initial information indicates that the raid was targeted at a service running on the Party’s servers. The timing is unfortunate with the Pirate Party participating in the upcoming election in Bremen this Sunday.

Image is Loading....Just a few hours ago German police confiscated several servers belonging to the Pirate Party. The servers, hosted at AixIT in Offenbach, were taken following a request from the French authorities.

The reason for the raid is unclear at this point, but the Pirate Party believes that it’s unrelated to the party’s activities. The board of the Pirate Party has promised full transparency to assist with the investigation.

“At the moment, the Board does not expect delinquency on behalf of the Pirate Party. The investigation is not directed against the party or any of its subsidiaries, they are only involved as the server’s operators. The results are awaited with curiosity,” the Party said in a statement.

The information which the authorities provided to the Pirate Party suggests that the police were targeting a public service on a virtual server. The service has not been named, but there are concerns that the action to take the party’s entire server network down was disproportionate.

The timing of the raid is also unfortunate, as it happens just two days before the Bremen elections.

“The disconnection of all servers is a massive intrusion into the communications infrastructure of the sixth largest party in Germany. Considering the state elections taking place in Bremen in two days, this caused severe political damage, which the Board condemns decisively,” the Party continued.

“In relation to the ongoing investigations, it will have to be verified whether the issued search warrant was actually appropriate, especially whether the principle of proportionality was followed. After all, this action has led to a large-scale breakdown of the technical infrastructure of Pirate Party Germany.”

Although we can only speculate at this point, a plausible target of the raid could be the Piratepad service. Piratepad allows people to collaboratively draft documents, and unconfirmed rumors suggest that it was used to plan a DDoS attack against a French company.

Thus far, however, no official information has been provided about the nature of the French investigation. We will update this post accordingly as more information comes in.

Update: The Pirate Part released some additional information.

The servers were raided this morning 9:15 am following a warrant ordered by the Darmstadt prosecutor.

The investigation is not directed at the Pirate Party, but at unknown users of the Piratepad service who published an SSH Key which was allegedly used to attack a server of the French energy group EDF.

The Pirate Party stresses that the damage to their organization is enormous. Two days before the election their entire communication system was wiped out, and although the main page was brought back up, most services are still interrupted.

The Pirate Party further distances itself from the attacks on the websites of the German police, which started after the raid.

Read