Site Sponsor:

mcafee_logo.gif
line

Now Available:

Featured Resource:

line

Newsletter

Email Address:


line

Ask the Expert

Have a question for our resident expert? Email your questions to Dan or post a comment to the blog.

« Verizon: We Can't Make Money with Open Access So No One Else Should | Main | Microsoft Pushes Updates without Permission »

Privacy Train Wrecks: Embarrassing Email Leaks, Anonymous Server Admin Arrested

Did you ever think privacy on the Internet is just on big crap shoot? And the only reason your own personal information hasn't been leaked or monitored is that it competes with so many other's personal information for attention? That position is a bit extreme but here are a couple of stories that came out over the weekend that won't help assuage your concerns.

A wholesale dumping of 70MB of internal emails from Media Defender, an anti-piracy group accused of entrapping illegal downloaders with the MiiVi.com site, includes emails that will leave many wondering about their tactics:

We get details and some of the emails from TorrentFreak

However, in comments made to Ars technica, Media Defender’s Randy Saaf chose to rubbish our claims, calling it an ‘accidentally un-secured internal project’.

From the emails we cannot be sure that it’s an entrapment site or that it is related to the MPAA (perhaps it’s a legit a P2P video client?), but it does look suspicious.

Unfortunately for Media Defender - a company dedicated to mitigating the effects of internet leaks - they can do nothing about being the subject of the biggest BitTorrent leak of all time. Over 700mb of their own internal emails, dating back over 6 months have been leaked to the internet in what will be a devastating blow to the company. Many are very recent, having September 2007 dates and the majority involve the most senior people in the company. Apparently this is not the first time that a MediaDefender email leaked onto the Internet.

According to the .nfo file posted with the Mbox file the emails were obtained by a group called “MediaDefender-Defenders”. It states: “By releasing these emails we hope to secure the privacy and personal integrity of all peer-to-peer users. The emails contains information about the various tactics and technical solutions for tracking p2p users, and disrupt p2p services,”

Unfortunately for Media Defender, someone inside the organization forwarded all his email to his Gmail account which was hacked.

Ars Technica reports on this story as well citing an even more incriminating set of comments:

MediaDefender went to great lengths to obscure its affiliation with MiiVi. "I don't want MediaDefender anywhere in your e-mail replies to people contacting Miivi," Saaf instructed company employees. "Make sure MediaDefender can not be seen in any of the hidden email data crap that smart people can look in." Grodsky and Saaf also began discussing new ways to drive traffic to the MiiVi site. "If we want more users, Dylan's eDonkey messages would get us a lot of Europeans that are a little bit older crowd," Grodsky wrote. "I would like it if our pictures were indexed with goggle [sic]. We need to get as much search traffic as we can," Saaf replied.

The second story of privacy gone missing comes from Germany where an operator of a Tor anonymous-izerr server was arrested but later released:


I explained them that I was a Tor-operator and what Tor is about. I showed them the letters from the Feds from the earlier incident to proove that I’m not bullshitting them. However, the coppers weren’t not so much into Tech-stuff and told me that a forensic unit will care about all my equippment. They searched everything: My attic, my office, my car, they digged through my wifes underwear, they found my old chmistry books very interesting, the flak-vest I own which I use when I go to strange countries, they found the fertilizer which I use for my chilli-plants, my microcontroller-experiments looked like an IED to them: Basically, EVERYTHING was suspicious.

and the story ends (for now anyway) with:


The consequences: I’ve shut down my Tor-server. I can’t do this any more, my wife and I were scared to death. I’m at the end of my civil courage. I’ll keep engaged in the Tor-project but I won’t run a server any more. Sorry. No.



I'll close with a thanks to TorrentFreak for editing the Media Defender emails, at least someone has a sense of boundaries.

Note: The mbox formatted file is circulating publicly on BitTorrent, completely unedited. However, for publication here we have removed the username and password logins for Media Defender’s servers, and replaced them with asterisks and avoided publishing emails of a personal nature, e.g pay negotiations etc. We believe that the emails are the real deal and all the info posted here serves the public interest.

Perhaps there is hope for privacy after all.

TrackBack

TrackBack URL for this entry:
http://www.realtime-websecurity.com/type/mt-tb.cgi/429

Post a comment

(All comments are approved by site leader before appearing here. Thanks for commenting!)

line

Dan Sullivan's Bio:

Dan Sullivan is a systems architect with 20 years of IT experience that includes engagements in enterprise security, application design, and systems architecture. His experience includes a broad range of industries, including financial services, manufacturing, government, retail, gas and oil production, power generation, and education. Dan’s security-related project work has ranged from requirements analysis for enterprise information security to designing and implementing security for database applications and enterprise portals. Dan has written about information security and other enterprise information management topics for Business Security Advisor, DM Review, Intelligent Enterprise, and E-Business Advisor. You can contact Dan at: dan_sullivan@realtimepublishers.net