Posts tagged ‘Censorship’

TorrentFreak: ISPs Agree to Block The Pirate Bay in Iceland

This post was syndicated from: TorrentFreak and was written by: Ernesto. Original post: at TorrentFreak

icelandflagAs the arch-rival of many copyright groups, The Pirate Bay has become one of the most censored websites on the Internet in recent years.

Courts all around the world have ordered Internet providers to block subscriber access to the torrent site and the list continues to expand.

This week Icelandic ISPs reached an agreement with local entertainment industry representatives to prevent subscribers from accessing the notorious torrent site.

In addition to The Pirate Bay, the Internet providers also promised to block, Iceland’s most popular private torrent tracker.

The agreement follows a court decision from last fall when the Reykjavík District Court handed down an injunction to ISPs Vodafone and Hringdu, forcing them to block the two sites.

Iceland’s local equivalent of the RIAA (STEF) wasn’t satisfied with the limited scope of the order and wanted other providers to follow suit. The group set an ultimatum threatening legal action last year, but the parties eventually decided to settle the matter out of court.

The decision to block access to The Pirate Bay does not come without protest. The local Pirate Party, which is the most popular party with a third of all ‘votes’ in recent polls, describes it as censorship.

“We are of course against this, especially because of the circumstances,” Ásta Helgadóttir, Member of Parliament for the Icelandic Pirate Party, informs TF.

The Pirate Party views a private censorship agreement between ISPs and copyright holders as a worrying development, and warns that the judicial system should not be bypassed.

“The blocking itself is currently nothing other than an inconvenience which is quite easy to circumvent with some googling or setting up a VPN. What’s more serious is the way the rightsholders could bypass the judicial authority to get their censorship measures through with the ISPs,” Ásta tells TF.

Instead of asking for pointless DNS blockades copyright holders should focus on negotiating better contracts with the artists they are supposed to represent.

“The real problem is the poor negotiation status of the individual artist when it comes to signing contracts. That is the real problem, not private sharing of culture,” Ásta says.

According to local reports the Internet providers have agreed to block The Pirate Bay’s main domain names and any new ones that subsequently arise. However, for now, many of the well known proxy sites are still available.

Recent history has shown that people who want to access blocked sites can always find a way. Circumvention tools such as TOR, VPN services or the specialized Piratebrowser are readily available and growing in popularity as blocking efforts expand.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Errata Security: What’s that drama?

This post was syndicated from: Errata Security and was written by: Robert Graham. Original post: at Errata Security

The infosec community is known for its drama on places like Twitter. People missing the pieces can’t figure out what happened. So I thought I’d write up the latest drama.

It starts with “Wesley McGrew” (@McGrewSecurity), an assistant professor at Mississippi state. He’s been a frequent source of infosec drama for years now. Since I, myself, don’t shy away from drama, I can’t say that he’s necessarily at fault, I’m just pointing out that he’s been involved in several Big Infosec Drama Blowups.
Then there is “Adrian Crenshaw” (@irongeeek_adc) (aka. “Irongeek”) who maintains a website, which hosts a lot of infosec videos. He’ll work with conferences to make sure talks get recorded and uploaded to his site. A lot of smaller cons host their video there. If you frequently watch infosec videos, then you know the site.
I think this specific drama started back in April, when Irongeek made this April Fool’s joke:
Many, most especially McGew, criticized Irongeek for this, claiming it was an “unfunny slap to women in security”.
I don’t know when it happened, but Irongeek punished McGrew by blocking students from McGrew’s university, Mississippi State. This was noticed last week.
Irongeek responded to criticisms by changing the “block” to a simple “warning”, and removed the word “mangina”.
After further drama, Irongeek backed down and removed the thing altogether, so now Mississippi state students see the same site as before.
Today, BSidesLV, the most important of the “small conferences” that work with Irongeek, severed their relationship with the site:
A lot of people are now upset with BSidesLV because of this. On the other hand, had they kept their relationship with Irongeek, a lot of different people would be upset. There’s pretty much nothing they could have done to avoid getting sucked into the drama.
I think this is a complete summary of recent drama.
Update: Not so complete, apparently sponsors and board members left BSidesLV in protest. I don’t know which way they protested. Since a lot of these people have personal relationships, there’s obviously a lot going on behind the scenes that we are unaware of.


I apologize, but I can’t resist commenting.
BSidesLV can’t have a relationship with Irongeek if they pull these sorts of stunts. They aren’t responding to the content, but that otherwise innocent MSU students had to suffer. They make no mention of the content. In other words, unlike the BSidesSF/VioletBlue drama of a couple years ago, they aren’t censoring somebody’s speech because of content.
On the other hand, I’m rabidly opposed to anything that even looks like censorship. I’d’ve hoped for a different resolution, such as a commitment from Irongeek that such things wouldn’t happen in the future. It’s going to hurt all of us at the next con when talks aren’t recorded.
Irongeek’s April Fools joke is funny. We are all feminists, but still many of us oppose the “radical feminists”. Nothing should be above mockery, most especially the “radical” of anything. Maybe Irongeek’s joke was inappropriate — but before I accept that, you have to show me jokes about radical feminists that meet your criteria of appropriateness.
McGrew is a typical radical feminist who attacks “old white males” with hate speech. He rejects the idea that this is even hate speech. But here’s the thing: groups like GamerGate are filled with otherwise feminists who are tired of all the hate directed their way, frustrated by the fact that as white males, it’s been declared that they cannot defend themselves in any legitimate way. So they lash out with immature anger, as gamers are apt to do. My point is that we are all feminists, but we are still going to disagree on the particulars. I vehemently disagree with McGrew’s approach.


Looking back through McGrew’s timeline to get the details for this post, I found this tweet, so I retweeted without comment to troll people. I really am a bad person.

TorrentFreak: Pirate Party Offers Uncensored DNS to Bypass Pirate Bay Blockade

This post was syndicated from: TorrentFreak and was written by: Ernesto. Original post: at TorrentFreak

pirate bayLast week Norway became the latest country to block access to The Pirate Bay.

A local court ordered Internet providers to block users’ access to several large ‘pirate’ websites in the hope that it will decrease online copyright infringement.

The local Pirate Party is now vigorously protesting the ruling and has decided to fight back. Since the sites will be blocked on the DNS level the party is countering by providing their own DNS servers.

“We want a free and open Internet for everyone. The copyright industry’s fight for control over culture has put us in a situation where this is no longer the case in Norway,” Pirate Party co-chairman Øystein Middelthun tells TF.

“The censorship is easy to bypass, by simply changing your name server, so we decided to practice what we preach and offer such a service to all those affected by the problem,” he adds.

Indeed, since the sites’ IP-addresses are not blocked the blockade can be easily circumvented by changing the DNS settings on one’s device or computer. The Pirate Party is not the only company offering alternative DNS, OpenDNS and Google have a similar service.

The Pirate Party’s DNS has added benefits though, as it supports additional Top Level Domains including .geek or .pirate, and the Namecoin based .bit. In addition, it operates from Norway with minimal logging to guarantee users’ privacy.

The Pirates note that the order will have minimal effect on people’s sharing habits. However, Middelthun is concerned about the slippery slope, where companies and the authorities get to dictate what people are allowed to see online.

“The blocking order is yet another sad step down the road towards the dystopic world imagined by George Orwell. At the same time it achieves absolutely nothing of what the plaintiffs are hoping for,” he tells TF.

“The dangerous thing about it is that it sets a precedent. It is easy to imagine how the scope could be expanded to include other websites somehow considered immoral, and while the current technical implementation is easy to circumvent, hardening it is equally easy once society has accepted censorship in the first place,” Middelthun adds.

The DNS service is not limited to Norwegians. Everyone who wants an unfiltered DNS service is welcome to use it.

Previously the UK Pirate Party ran into trouble when they launched a Pirate Bay proxy in response to a local blockade. The Norwegian Pirates don’t expect that their DNS will be targeted, but if it does they are prepared to fight back.

“Running a public DNS service is fully legal, so we do not expect any legal trouble. A scenario to consider is if the copyright industry, or surveillance hungry politicians, started pushing for strictly regulating DNS- and/or VPN-services,” Middelthun says.

“If this scenario came true, we will fight it with everything in our power. It is paramount that the Internet remains free, or society would suffer greatly,” he concludes.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

TorrentFreak: Gucci Sets Trend for Broad Internet ‘Censorship’

This post was syndicated from: TorrentFreak and was written by: Ernesto. Original post: at TorrentFreak

gucciIn July the movie streaming site MovieTube was sued by the MPAA, which tried to shut it down with a broad injunction.

Last month a coalition of global tech firms including Google, Facebook, Twitter protested the MPAA’s request, which would require search engines, ISPs and hosting companies to stop linking to or offering services to MovieTube.

The MPAA eventually dropped the request as MovieTube shut down voluntarily, but we can expect more of these requests in the future. In fact, they are already quite common in the fashion industry.

This year alone Gucci has targeted hundreds of “infringing” websites that sell knockoffs without permission, and the fashion icon has no trouble getting courts to shut these sites down through similar injunctions.

Gucci’s most recent case was filed three weeks ago (pdf). It targets 221 websites and is similar to lawsuits that were filed previously, which accuse site owners of selling counterfeit merchandise.

In the complaint Gucci asks for a preliminary injunction to prevent all third parties from doing business with the site. This includes payment services, social networks and other online services.

Furthermore, Gucci specifically requests an order to prevent “search engines, Web hosts, domain-name registrars and domain-name registries” from facilitating access to the sites in question.

Gucci’s request

While this case is still pending, the designer company has had success with previous requests. In May, for example, Gucci obtained an injunction which prohibits search engines from linking to 184 sites, while ordering domain name registrars to hand over the domains.

Unlike with the MovieTube case, there has been little public outcry about the Gucci cases. However, the Electronic Frontier Foundation believes that they pose a significant threat.

“The Gucci cases are certainly of concern for the same reasons as the MovieTube case, and they deserve more public scrutiny,” EFF attorney Mitch Stoltz informs TF.

“Vaguely written orders that could be used to co-opt numerous Internet intermediaries into blocking or filtering websites are an abuse of the law and threaten some of the same harms as the infamous SOPA bill did,” he adds.

In all fairness, Gucci shouldn’t get all the ‘credit’ here. Several other designer brands have successfully requested similar injunctions in the past, including Louis Vuitton and Chanel.

Similarly, media company ABS-CBN has been granted broad injunctions by American courts before.

Still, none of these cases triggered the same response as the MovieTube case did. Perhaps the involvement of the MPAA was needed to really hit a nerve with the tech companies?

In any case, it’s clear that Hollywood isn’t setting the trend here, they’re simply following a path already laid out by others.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Schneier on Security: China’s “Great Cannon”

This post was syndicated from: Schneier on Security and was written by: schneier. Original post: at Schneier on Security

Interesting research: “An Analysis of China’s ‘Great Cannon.’

Abstract: On March 16th, 2015, the Chinese censorship apparatus employed a new tool, the “Great Cannon”, to engineer a denial-of-service attack on, an organization dedicated to resisting China’s censorship. We present a technical analysis of the attack and what it reveals about the Great Cannon’s working, underscoring that in essence it constitutes a selective nation-state Man-in-the-Middle attack tool. Although sharing some code similarities and network locations with the Great Firewall, the Great Cannon is a distinct tool, designed to compromise foreign visitors to Chinese sites. We identify the Great Cannon’s operational behavior, localize it in the network topology, verify its distinctive side-channel, and attribute the system as likely operated by the Chinese government. We also discuss the substantial policy implications raised by its use, including the potential imposition on any user whose browser might visit (even inadvertently) a Chinese web site.

TorrentFreak: Movie Studios and Record Labels Target Pirate Bay in New Lawsuit

This post was syndicated from: TorrentFreak and was written by: Andy. Original post: at TorrentFreak

tpbIn 2009, the IFPI and several local movie studios demanded that Norwegian ISP Telenor should block The Pirate Bay. The ISP refused and legal action commenced.

A subsequent ruling determined that there was no legal basis for site blocking and in 2010 a rightsholder appeal also failed. If sites were to be blocked, a change in the law was required.

In May 2011 the Ministry of Culture announced that it had put forward proposals for amendments to the Copyright Act, to include web blocking, and on July 1, 2013 the new law came into effect.

After more than two years of threats, local and international copyright holders have now made good on their promises to use the new legislation to stamp down on piracy.

In a lawsuit filed at the Oslo District Court, Disney, Warner Bros. and Sony plus local producers and representatives from the recording industry are teaming up to sue eleven local ISPs. Also targeted in the action are the alleged operators of eight ‘pirate’ sites.

Although the sites are yet to be publicly revealed, The Pirate Bay is among them and site co-founder Fredrik Neij is named as a party in the case.

According to Dagens Næringsliv, studios and labels filed an initial complaint with ISPs back in April via anti-piracy outfit Rights Alliance. It was sent to the country’s largest ISP Telenor plus others including Get, NextGenTel and Altibox.

The rightsholders’ demands are familiar. All the main local ISPs must block The Pirate Bay and related sites so that subscribers can no longer access the domains directly.

“We understand licensees’ struggle for their rights. For us it is important that the court must take these decisions, and that we do not assume a censorship role,” says Telenor communications manager Tormod Sandstø.

Also of interest is how the legal process is being handled. The Oslo District Court is dealing with the case in writing so the whole process is completely closed to the public. After processing the case during the summer, early estimations suggest that the court will have made its decision within the next 10 days.

The news follows several key Norwegian anti-piracy developments in 2015. In March, an investigation by Rights Alliance culminated in a police raid against local pirate site Norskfilm.

In July, Rights Alliance placed the blame for a piracy explosion firmly on the shoulders of Popcorn Time, with the group announcing last week that up to 75,000 users of the application could now be contacted by mail. The message they will receive remains unclear but comments from Rights Alliance during the past few days have leaned away from lawsuits.

Interestingly, Popcorn Time related sites are not among the batch of domains currently under consideration by the Oslo District Court as the service was not considered a priority when the original Rights Alliance complaint was being put together. Should the current blocking attempt prove successful, expect Popcorn Time domains to appear in an upcoming lawsuit.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

TorrentFreak: Tech Giants Want to Punish DMCA Takedown Abusers

This post was syndicated from: TorrentFreak and was written by: Ernesto. Original post: at TorrentFreak

copyright-brandedEvery day copyright holders send millions of DMCA takedown notices to various Internet services.

Most of these requests are legitimate, aimed at disabling access to copyright-infringing material. However, there are also many overbroad and abusive takedown notices which lead to unwarranted censorship.

These abuses are a thorn in the side of major tech companies such as Google, Facebook and Microsoft. These companies face serious legal consequences if they fail to take content down, but copyright holders who don’t play by the rules often walk free.

This problem is one of the main issues highlighted in a new research report (pdf) published by the CCIA, a trade group which lists many prominent tech companies among its members.

The report proposes several changes to copyright legislation that should bring it in line with the current state of the digital landscape. One of the suggestions is to introduce statutory damages for people who abuse the takedown process.

“One shortcoming of the DMCA is that the injunctive-like remedy of a takedown, combined with a lack of due process, encourages abuse by individuals and entities interested in suppressing content,” CCIA writes.

“Although most rightsholders make good faith use of the DMCA, there are numerous well-documented cases of misuse of the DMCA’s extraordinary remedy. In many cases, bad actors have forced the removal of material that did not infringe copyright.”

The report lists several examples, including DMCA notices which are used to chill political speech by demanding the takedown of news clips, suppress consumer reviews, or retaliate against critics.

Many Internet services are hesitant to refuse these type of takedown requests at it may cause them to lose their safe harbor protection, while the abusers themselves don’t face any serious legal risk.

The CCIA proposes to change this by introducing statutory damage awards for abusive takedown requests. This means that the senders would face the same consequences as the copyright infringers.

“To more effectively deter intentional DMCA abuse, Congress should extend Section 512(f) remedies for willful misrepresentations under the DMCA to include statutory awards, as it has for willful infringement under Section 504(c),” CCIA writes.

In addition to tackling DMCA abuse the tech companies propose several other changes to copyright law.

One of the suggestions is to change the minimum and maximum statutory damages for copyright infringement, which are currently $750 and $150,000 per work.

According to the CCIA the minimum should be lowered to suit cases that involve many infringements, such as a user who hosts thousands of infringing works on a cloud storage platform.

The $150,000 maximum, on the other hand, is open to abuse by copyright trolls and rightsholders who may use it as a pressure tool.

The tech companies hopes that U.S. lawmakers will consider these and other suggestions put forward in the research paper, to improve copyright law and make it future proof.

“Since copyright law was written more than 100 years ago, the goal has been to encourage creativity to benefit the overall public good. It’s important as copyright is modernized to ensure that reforms continue to benefit not just rightsholders, but the overall public good,” the CCIA concludes.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

TorrentFreak: Takedown Resistant ‘Hydra Proxy’ Launches to Beat Censorship

This post was syndicated from: TorrentFreak and was written by: Andy. Original post: at TorrentFreak

In July 2013 a brand new anti-censorship service burst onto the scene. Aiming to service those who found VPNs too expensive but couldn’t live with the slow speeds provided by Tor, Immunicity provided swift, free access to a wide range of blocked websites.

The service quickly gained an enthusiastic following but just a year later in 2014 it was all over. With support from Hollywood, City of London Police arrested Immunicity’s then 20-year-old operator. A full 12 months later he remains on bail facing an uncertain future.

To mark this anniversary a new service has debuted to finish the job Immunicity started. Titled ‘HydraProxy’, the service isn’t just another run-of-the-mill unblocking tool but one that aims to grow like a hydra.

Hydra Proxy (HP) acts as a frontend to PacketFlagon, a system which in turn is based on the RoutingPacketsisNotaCrime software detailed in our earlier article.

“After the fall of Immunicity it would appear that most people have migrated to using SSH tunnels, Tor or commercial VPN products,” an HP developer informs TF.

“Unfortunately not everyone can afford (or wants) to do that so [Hydra Proxy] will allow those people to continue to evade overzealous filters at libraries, homes, coffee shops, mobile networks and fixed lines at no cost.”

Central to the system is the ability of popular browsers to use Proxy Auto-Config (PAC) files. Browsers are easily configured to use PAC files and in just a couple of minutes users are able to create their own to access any blocked site. Once configured, blocked sites open as usual.

“Essentially the software has been bundled up into a quickly deployable ‘shard’ which talks to a TLS secured common backend API to create, update and view Proxy Auto-Config (PAC) files,” Hydra Proxy’s developer informs TorrentFreak.

One of the main advantages of the project is that since anyone with the know-how can operate their own Hydra Proxy shard, the system becomes more diverse and capable of evading censorship.

“Volunteers can deploy HydraProxy shards which can create and serve PAC files whilst synchronizing with the central node to help frustrate blocks of the PAC serving servers. Or, they can deploy an entire stand-alone platform,” HP’s dev explains.


There are already more than half a dozen Hydra Proxy shards in operation but the project is welcoming more.

“I’d encourage people to register other domains and we will even host them for free – they register a domain for use with PacketFlagon, they contact us and we’ll provide an IP to point the DNS at and then we’ll handle configuring the server and keeping the shard software up-to-date,” the dev says.

The hosting will be provided by Brass Horn Communications, a non-profit entity which not only operates PacketFlagon but also other ISP-esque services such as Tor exits, web hosting and Unix shells. Brass Horn Communications is its own ISP and has “mere-conduit” protection.

Somewhat refreshingly, HP’s developer says he is more than happy to share the fun with others.

“Everything is open-source under a BSD license rather than GPL as it’s more permissive. The goal is undermining censorship not bickering about who owned / misused what,” he explains.

“If someone has the time to take this software and create a commercial model then have at it, if someone wants to create their own independent infrastructure with new branding; please do!”

In conclusion, Hydra Proxy sends the following message.

“Centralization is what allowed the Internet to get in the mess where one DMCA against two companies kills an innocent users uploaded videos or a single court order against four ISPs censors 90% of the population. So take this truly free (as in speech and as in beer) software and help kick the censors’ ass!”

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Lauren Weinstein's Blog: EU Demands Google Forget “The Right To Be Forgotten”

This post was syndicated from: Lauren Weinstein's Blog and was written by: Lauren. Original post: at Lauren Weinstein's Blog

Brussels, Belgium (ZAP) – The European Union today issued a preliminary order requiring that Google and all other Search Engines and similar services remove all search results related to the EU “Right To Be Forgotten” (RTBF). “We’ve been deliberating on this issue for a very long time,” noted Winston Charrington, Minister of the European Union World Censorship Directorate. “We’ve come…

TorrentFreak: MPAA Ducks Censorship Battle With Google, Twitter and Facebook

This post was syndicated from: TorrentFreak and was written by: Ernesto. Original post: at TorrentFreak

movietubeLast month the MPAA sued several popular movie streaming websites which all operated under the MovieTube flag.

As part of the lawsuit the major movie studios asked for a preliminary injunction ordering several third-party companies to stop linking or providing services to the sites.

For several tech companies this request went too far. Last week Google, Facebook, Twitter, Tumblr and Yahoo explained to the court that it could result in broad Internet censorship, similar to the blocking provisions that were listed in the controversial SOPA bill.

The filing appeared to be the start of a new standoff between Hollywood and the tech companies, but a letter submitted by the MPAA yesterday puts it on hold.

The MPAA informed the court that a preliminary injunction is no longer required as the MovieTube sites have been offline for several weeks already.

“Plaintiffs are no longer seeking preliminary injunctive relief at this time but will seek permanent relief as soon as possible,” the MPAA’s lawyers write.

The decision to drop the request may very well have been triggered by the Amici Curiae brief of the tech companies. After all, the MovieTube sites were already offline when the MPAA submitted the injunction request weeks ago.

In their letter to the court the MPAA stress that the opposition brief should no longer be considered now that they have pulled their request for an injunction.

“…because Plaintiffs have withdrawn their motion for preliminary injunctive relief, the arguments offered by Amici Curiae in opposition to that motion are not ripe for consideration and are otherwise inapplicable.”

“To the extent Amici are requesting what amounts to an advisory opinion, such a request is improper and should not be entertained,” they add.

It appears that it’s a strategic move from the MPAA not to challenge the tech companies, for now. However, the movie industry group has made it clear that website blocking is one of their main anti-piracy priorities so we can expect this battle to reignite in the future.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Krebs on Security: Stress-Testing the Booter Services, Financially

This post was syndicated from: Krebs on Security and was written by: BrianKrebs. Original post: at Krebs on Security

The past few years have witnessed a rapid proliferation of cheap, Web-based services that troublemakers can hire to knock virtually any person or site offline for hours on end. Such services succeed partly because they’ve enabled users to pay for attacks with PayPal. But a collaborative effort by PayPal and security researchers has made it far more difficult for these services to transact with their would-be customers.



By offering a low-cost, shared distributed denial-of-service (DDoS) attack infrastructure, these so-called “booter” and “stresser” services have attracted thousands of malicious customers and are responsible for hundreds of thousands of attacks per year. Indeed, KrebsOnSecurity has repeatedly been targeted in fairly high-volume attacks from booter services — most notably a service run by the Lizard Squad band of miscreants who took responsibility for sidelining the the Microsoft xBox and Sony Playstation on Christmas Day 2014.

For more than two months in the summer 2014, researchers with George Mason University, UC Berkeley’s International Computer Science Institute, and the University of Maryland began following the money, posing as buyers of nearly two dozen booter services in a bid to discover the PayPal accounts that booter services were using to accept payments. In response to their investigations, PayPal began seizing booter service PayPal accounts and balances, effectively launching their own preemptive denial-of-service attacks against the payment infrastructure for these services.

PayPal will initially limit reported merchant accounts that are found to violate its terms of service (turns out, accepting payments for abusive services is a no-no). Once an account is limited, the merchant cannot withdraw or spend any of the funds in their account. This results in the loss of funds in these accounts at the time of freezing, and potentially additional losses due to opportunity costs the proprietors incur while establishing a new account. In addition, PayPal performed their own investigation to identify additional booter domains and limited accounts linked to these domains as well.

The efforts of the research team apparently brought some big-time disruption for nearly two-dozen of the top booter services. The researchers said that within a day or two following their interventions, they saw the percentage of active booters quickly dropping from 70 to 80 percent to around 50 percent, and continuing to decrease to a low of around 10 percent that were still active.


While some of the booter services went out of business shortly thereafter, more than a half-dozen shifted to accepting payments via Bitcoin (although the researchers found that this dramatically cut down on the services’ overall number of active customers). Once the target intervention began, they found the average lifespan of an account dropped to around 3.5 days, with many booters’ PayPal accounts only averaging around two days before they were no longer used again.

The researchers also corroborated the outages by monitoring hacker forums where the services were marketed, chronicling complaints from angry customers and booter service operators who were inconvenienced by the disruption (see screen shot galley below).

A booter service proprietor advertising his wares on the forum Hackforums complains about Paypal repeatedly limiting his account.

A booter service proprietor advertising his wares on the forum Hackforums complains about Paypal repeatedly limiting his account.

Another booter seller on Hackforums whinges about PayPal limiting the account he uses to accept attack payments from customers.

Another booter seller on Hackforums whinges about PayPal limiting the account he uses to accept attack payments from customers.

"It's a shame PayPal had to shut us down several times causing us to take money out of our own pocket to purchase servers, hosting and more," says this now-defunct booter service to its former customers.

“It’s a shame PayPal had to shut us down several times causing us to take money out of our own pocket to purchase servers, hosting and more,” says this now-defunct booter service to its former customers.

Deadlyboot went dead after the PayPal interventions. So sad.

Deadlyboot went dead after the PayPal interventions. So sad.

Daily attacks from Infected Stresser dropped off precipitously following the researchers' work.

Daily attacks from Infected Stresser dropped off precipitously following the researchers’ work.

As I’ve noted in past stories on booter service proprietors I’ve tracked down here in the United States, many of these service owners and operators are kids operating within easy reach of U.S. law enforcement. Based on the aggregated geo-location information provided by PayPal, the researchers found that over 44% of the customer and merchant PayPal accounts associated with booters are potentially owned by someone in the United States.


The research team also pored over leaked and scraped data from three popular booter services —”Asylum Stresser,” another one called “VDO,” and the booter service referenced above called “Lizard Stresser.” All three of these booter services had been previously hacked by unknown individuals. By examining the leaked data from these services, the researchers found these three services alone had attracted over 6,000 subscribers and had launched over 600,000 attacks against over 100,000 distinct victims.

Data based on leaked databases from these three booter services.

Data based on leaked databases from these three booter services.

Like other booter services, Asylum, Lizard Stresser and VDO rely on a subscription model, where customers or subscribers can launch an unlimited number of attacks that have a duration typically ranging from 30 seconds to 1-3 hours and are limited to 1-4 concurrent attacks depending on the tier of subscription purchased. The price for a subscription normally ranges from $10-$300 USD per a month depending on the duration and number of concurrent attacks provided.

“We also find that the majority of booter customers prefer paying via PayPal and that Lizard Stresser, which only accepted Bitcoin, had a minuscule 2% signup to paid subscriber conversion rate compared to 15% for Asylum Stresser and 23% for VDO 1, which both accepted PayPal,” they wrote.

The research team found that some of the biggest attacks from these booter services take advantage of common Internet-based hardware and software — everything from consumer gaming consoles to routers and modems to Web site content management systems — that ships with networking features which can easily be abused for attacks and that are turned on by default.

Specific examples of these include DNS amplification attacks, network time protocol (NTP) attacksSimple Service Discovery Protocol (SSDP) attacks, and XML-RPC attacks. These attack methods are particularly appealing for booter services because they hide the true source of attacks and/or can amplify a tiny amount of attack bandwidth into a much larger assault on the victim. Such attack methods also offer the booter service virtually unlimited, free attack bandwidth, because there are tens of millions of misconfigured devices online that can be abused in these attacks.

Finally, the researchers observed a stubborn fact about these booter services that I’ve noted in several stories: That the booter service front-end Web sites where customers go to pay for service and order attacks were all protected by CloudFlare, a content distribution network that specializes in helping networks stay online in the fact of withering online attacks.

I have on several occasions noted that if CloudFlare adopted a policy of not enabling booter services, it could eliminate a huge conflict of interest for the company and — more importantly — help eradicate the booter industry. The company has responded that this would lead to a slippery slope of censorship, but that it will respond to all proper requests from law enforcement regarding booters. I won’t rehash this debate again here (anyone interested in CloudFlare’s take on this should see this story).

In any case, the researchers note that they contacted CloudFlare’s abuse email on June 21st, 2014 to notify the company of the abusive nature of these services.

“As of the time of writing this paper, we have not received any response to our complaints and they continue to use CloudFlare,” the paper notes. “This supports the notion that at least for our set of booters CloudFlare is a robust solution to protect their frontend servers. In addition, has a list of over 100 booters that are using CloudFlare’s services to protect their frontend servers.”

A copy of the research paper is available here (PDF).

Lauren Weinstein's Blog: Why the “Right To Be Forgotten” is the Worst Kind of Censorship

This post was syndicated from: Lauren Weinstein's Blog and was written by: Lauren. Original post: at Lauren Weinstein's Blog

Let’s start from a foundational premise on which we hopefully can all agree. Our abilities to interpret and understand the world around us are predicated on the availability of information. In the far past, that information was usually entirely based on what we could sense directly or were told by others. Later, written and the printed materials vastly expanded our…

TorrentFreak: Indian Porn Block Spiked Interest in VPN Services

This post was syndicated from: TorrentFreak and was written by: Ernesto. Original post: at TorrentFreak

stop-blockedOpponents of website blocking often argue that it’s ineffective, as people have many options to circumvent censorship.

We have seen examples of this in the past when courts ordered popular torrent sites such as The Pirate Bay and KickassTorrents to be blocked.

Last week, the Internet witnessed one of the broadest website blockades in history. With a single order the Indian Government blocked millions of people from accessing popular porn sites.

The authorities argued that the sites threaten the morality and decency of Indians but following a public revolt the Government lifted the ban after just a few days.

Since the measures affected millions of Internet users we decided to take a look at the effects the blockade had on interest in circumvention tools such as VPNs and proxies. With help from Google trends, we can show that it was quite significant.

As soon as the blocks became active searches for “VPN” spiked in India, as shown in the graph below.

VPN search trends in India (90 days)

Similarly, Indian searches for “proxy,” referring to proxy sites that allow users to bypass ISPs blockades, went up as well.

Based on these two search trends it is safe to say that even if the Indian Government had decided to keep the porn ban intact, it’s effectiveness would be rather limited.

Proxy search trends in India (90 days)

The response to India’s censorship efforts are another shining example of how Internet users find ways to bypass access restrictions in the Internet. Whether it’s porn or torrents, people usually find a way.

To quote John Gilmore once again: “The Net interprets censorship as damage and routes around it.”

Proof of the ineffectiveness of Pirate Bay blockades was previously highlighted by several Dutch and UK Internet providers. Similarly, an Italian study found that local blocking efforts moved traffic to other pirate sites.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and the best VPN services.

TorrentFreak: EFF Told to “Shut the Hell Up” About SOPA

This post was syndicated from: TorrentFreak and was written by: Andy. Original post: at TorrentFreak

effAfter a massive wave of opposition more than three years ago, the Stop Online Piracy Act died and dozens of technology-focused companies and websites breathed a sigh of relief. But despite its demise the memory of SOPA has lived on, particularly in the minds of those who opposed it.

On that front there can be few more notable than the EFF who played an important role in bringing SOPA to its knees. It should therefore come as no surprise that when the EFF spots efforts by corporations to achieve SOPA-like powers through other means, the group quickly tells the world.

This week in a piece titled ‘Movie Studios Seek SOPA Power Through Broad Site-Blocking Order‘, EFF lawyer Mitch Stoltz told the story of how the MPAA aims to wipe a group of websites from the Internet without trial.

[The] studios are asking for one court order to bind every domain name registrar, registry, hosting provider, payment processor, caching service, advertising network, social network, and bulletin board—in short, the entire Internet—to block and filter a site called Movietube,” Stoltz warned.

“If they succeed, the studios could set a dangerous precedent for quick website blocking with little or no court supervision, and with Internet service and infrastructure companies conscripted as enforcers.”

The piece appears to have touched a nerve with elements of the movie industry who have lined up over the past 24 hours to criticize both Stoltz and the EFF. First up, filmmaker and anti-piracy activist Ellen Seidler.

“Stoltz sounded the alarm by dusting off the well-worn SOPA canard and cries of ‘censorship’ and ‘abuse.’ His love of the word ‘abuse’ was so strong, in fact, variations of the term appear 9 times in his piece,” Seidler writes.

“Isn’t it time for those at the EFF and others who yell ‘SOPA’ each time the movie industry takes legal action against online pirates to shut the hell up? What is abusive is the way online piracy (for profit) is allowed to flourish, made sacrosanct by tech apologists.”

Next up to admonish the EFF is filmmaker David Newhoff. Likening the rights group to Monty Python’s ‘Knights Who Say Ni’ and suggesting that at best they maintain a “loose relationship” with reality, Newhoff accuses the EFF of trying to scare the public.

“For instance, in this recent missive, EFFer Mitch Stoltz uses the acronym SOPA seven times in the first four paragraphs, which might lead the reader to think that the subject of the article has something to do with SOPA. Of course, it has nothing to do with SOPA,” Newhoff writes.

“They say SOPA, and hope the peasants cringe,” the filmmaker adds. “Thus, the EFF invests tremendous energy in this strategy, breathlessly warning us about the inevitable doom that will surely follow if, heaven-forbid, the rule of law might apply to trade across our precious tubes.”

Last but certainly not least, Ruth Vitale of anti-piracy group Creative Future weighs in with her take on the EFF piece in her rebuttal titled ‘If You’re Reading This The Internet Ain’t Broke‘.

“I know that ‘stop censorship’ and ‘don’t break the internet’ were effective talking points more than three years ago. That’s the past and a reference to legislative history. I think we’re all a bit wiser now. Can we finally collectively agree that piracy is not free speech?” Vitale writes.

“If we can come to that understanding, I and many in Hollywood would applaud EFF’s efforts to eliminate real censorship all over the world – but EFF’s relentless attacks on efforts by creative industries to protect their work damages its credibility.”

While the EFF and its critics are naturally miles apart on the topic, what’s puzzling here is the apparent unwillingness to grasp what Internet users are driving at when they refer to ‘SOPA-like’ activity.

From the day of its public outing to the day of its demise and beyond, the SOPA acronym has become synonymous with any legislative effort to clamp down on Internet piracy by forcing hosting providers, domain companies, the DNS system, payment processors, advertisers and social networks to become entertainment industry enforcers. It’s an extremely unpopular proposal.

Underlying all of this is the nature of the entities pushing for these powers. One only has to look at the unfolding nightmare that is the MPAA’s assault on Google via Mississippi Attorney General Jim Hood to see how far Hollywood is prepared to go to get its way.

“[This kind of power] will be abused, which is why it’s important to stop it from being created in the first place,” the EFF warns.

Call it SOPA-like or call it something else, it’s difficult to argue with that conclusion. But as long as it has a recognizable name, people will understand what’s at stake, and for the EFF and other activists that’s more than half the battle.

SOPA might be dead but its name will live on – and the EFF isn’t likely to shut the hell up anytime soon.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and the best VPN services.

TorrentFreak: Torrent Site Proxies Rife With Malware Injecting Scripts

This post was syndicated from: TorrentFreak and was written by: Ernesto. Original post: at TorrentFreak

warningIn many countries including the UK, Italy, Denmark and France, the leading torrent sites are no longer freely accessible.

These court-ordered blockades requested by the music and movie industries are becoming widespread, but so are the tools to circumvent them.

For every domain name blocked, many proxies and mirrors emerge. These sites allow people to access the blocked sites and effectively bypass the restrictions put in place by the court.

Initially, the proxy sites were launched to help users gain access to their favorite torrent sites. However, more recently the demand for circumvention tools is being abused by people who are out to make hard cash.

Instead of offering a simple workaround, many proxies add their own scripts. In some cases these scripts are harmless, but according to security researcher Gabor Szathmari the majority serve questionable content.

Szathmari examined a sample of 6,158 proxy sites and found that over 99% added their own code. Only 21 sites in the sample did not modify the original site.

“99.7% of the tested torrent mirrors are injecting additional JavaScript into the web browsing traffic. A great share of these scripts serve content with malicious intent such as malware and click-fraud,” he notes.

The researcher informs TF that many of the researched proxies are suspicious because they use code that is either obfuscated or has a lot of random redirects. These scripts pretty much all use the domain name.


Taking a closer look at the proxies reveals that several of the ads link to malware. In addition, one of the scripts generated fake views of car racing videos in the background.

The original torrent sites, including The Pirate Bay, KickassTorrents and ExtraTorrent, are aware of the problem and are trying to minimize the damage by blocking suspicious proxies and mirrors.

“It’s a serious issue. We have been fighting against it for a long time,” the ExtraTorrent team informs TF.

“Most unauthorized proxy websites loaded ExtraTorrent in a frame and added malware JavaScript code or replaced ET’s banners with others,” they add.

ExtraTorrent has been able to block several proxies, but they can’t do anything against those that use a cached version of the site. To guide users in the right direction they therefore publish a list of official mirrors on their site.

Copyright holders often warn that pirate sites may serve malware, but this research suggests that they are only making the problem worse by censoring the original sites.

“I am an advocate for unfiltered Internet, and this example shows that censorship can violate the security of end-users,” Szathmari tells TF.

Of course, some of the original sites may also run dubious ads, but the malicious proxies appear to be much worse and should be avoided.

“I would advise downloaders to always use the original sites or the official proxy sites whenever possible,” the researcher says.

“If the original sites are blocked by the ISP, I would recommend to bypass the filtering with a reputable VPN service that does not modify traffic, or a reputable mirror that does not alter the website in any way.”

Szathmari published the full findings and his research methodology in a recent blog post.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and the best VPN services.

Krebs on Security: Chinese VPN Service as Attack Platform?

This post was syndicated from: Krebs on Security and was written by: BrianKrebs. Original post: at Krebs on Security

Hardly a week goes by without a news story about state-sponsored Chinese cyberspies breaking into Fortune 500 companies to steal intellectual property, personal data and other invaluable assets. Now, researchers say they’ve unearthed evidence that some of the same Chinese hackers also have been selling access to compromised computers within those companies to help perpetuate future breaches.

The so-called “Great Firewall of China” is an effort by the Chinese government to block citizens from accessing specific content and Web sites that the government has deemed objectionable. Consequently, many Chinese seek to evade such censorship by turning to virtual private network or “VPN” services that allow users to tunnel their Internet connections to locations beyond the control of the Great Firewall.


Security experts at RSA Research say they’ve identified an archipelago of Chinese-language virtual private network (VPN) services marketed to Chinese online gamers and those wishing to evade censorship, but which also appear to be used as an active platform for launching attacks on non-Chinese corporations while obscuring the origins of the attackers.

Dubbed by RSA as “Terracotta VPN” (a reference to the Chinese Terracotta Army), this satellite array of VPN services “may represent the first exposure of a PRC-based VPN operation that maliciously, efficiently and rapidly enlists vulnerable servers around the world,” the company said in a report released today.

The hacker group thought to be using Terracotta to launch and hide attacks is known by a number of code names, including the “Shell_Crew” and “Deep Panda.” Security experts have tied this Chinese espionage gang to some of the largest data breaches in U.S. history, including the recent attack on the U.S. Office of Personnel Management, as well as the breaches at U.S. healthcare insurers Anthem and Premera.

According to RSA, Terracotta VPN has more than 1,500 nodes around the world where users can pop up on the Internet. Many of those locations appear to be little more than servers at Internet service providers in the United States, Korea, Japan and elsewhere that offer cheap virtual private servers.

But RSA researchers said they discovered that many of Terracotta’s exit nodes were compromised Windows servers that were “harvested” without the victims’ knowledge or permission, including systems at a Fortune 500 hotel chain; a hi-tech manufacturer; a law firm; a doctor’s office; and a county government of a U.S. state.

The report steps through a forensics analysis that RSA conducted on one of the compromised VPN systems, tracking each step the intruders took to break into the server and ultimately enlist the system as part of the Terracotta VPN network.

“All of the compromised systems, confirmed through victim-communication by RSA Research, are Windows servers,” the company wrote. “RSA Research suspects that Terracotta is targeting vulnerable Windows servers because this platform includes VPN services that can be configured quickly (in a matter of seconds).”

RSA says suspected nation-state actors have leveraged at least 52 Terracotta VPN nodes to exploit sensitive targets among Western government and commercial organizations. The company said it received a specific report from a large defense contractor concerning 27 different Terracotta VPN node Internet addresses that were used to send phishing emails targeting users in their organization.

“Out of the thirteen different IP addresses used during this campaign against this one (APT) target, eleven (85%) were associated with Terracotta VPN nodes,” RSA wrote of one cyber espionage campaign it investigated. “Perhaps one of the benefits of using Terracotta for Advanced Threat Actors is that their espionage related network traffic can blend-in with ‘otherwise-legitimate’ VPN traffic.”


RSA’s report includes a single screen shot of software used by one of the commercial VPN services marketed on Chinese sites and tied to the Terracotta network, but for me this was just a tease: I wanted a closer look at this network, yet RSA (or more likely, the company’s lawyers) carefully omitted any information in its report that would make it easy to locate the sites selling or offering the Terracotta VPN.

RSA said the Web sites advertising the VPN services are marketed on Chinese-language Web sites that are for the most part linked by common domain name registrant email addresses and are often hosted on the same infrastructure with the same basic Web content. Along those lines, the company did include one very useful tidbit in its report: A section designed to help companies detect servers that may be compromised warned that any Web servers seen phoning home to 8800free[dot]info should be considered hacked.

A lookup at for the historic registration records on 8800free[dot]info show it was originally registered in 2010 to someone using the email address “” Among the nine other domains registered to is 517jiasu[dot]cn, an archived version of which is available here.

Domaintools shows that in 2013 the registration record for 8800free[dot]info was changed to include the email address “” Helpfully, that email was used to register at least 39 other sites, including quite a few that are or were at one time advertising similar-looking VPN services.

Pivoting off the historic registration records for many of those sites turns up a long list of VPN sites registered to other interesting email addresses, including “,” “” and “” (click the email addresses for a list of domains registered to each).

Armed with lists of dozens of VPN sites, it wasn’t hard to find several sites offering different VPN clients for download. I installed each on a carefully isolated virtual machine (don’t try this at home, kids!). Here’s one of those sites:

One of the sites offering the VPN software and service that RSA has dubbed "Terracotta."

A Google-translated version of one of the sites offering the VPN software and service that RSA has dubbed “Terracotta.”

All told, I managed to download, install and use at least three VPN clients from VPN service domains tied to the above-mentioned email addresses. The Chinese-language clients were remarkably similar in overall appearance and function, and listed exit nodes via tabs for several countries, including the Canada, Japan, South Korea and the United States, among others. Here is one of the VPN clients I played with in researching this story:


This one was far more difficult to use, and crashed repeatedly when I first tried to take it for a test drive:


None of the VPN clients I tried would list the Internet addresses of the individual nodes. However, each node in the network can be discovered simply by running some type of network traffic monitoring tool in the background (I used Wireshark), and logging the address that is pinged when one clicks on a new connection.

RSA said it found more than 500 Terracotta servers that were U.S. based, but I must have gotten in on the fun after the company started notifying victim organizations because I found only a few dozen U.S.-based hosts in any of the VPN clients I checked. And most of the ones I did find that were based in the United States appeared to be virtual private servers at a handful of hosting companies.

The one exception I found was a VPN node tied to a dedicated Windows server for the Web site of a company in Michigan that manufactures custom-made chairs for offices, lounges and meeting rooms. That company did not return calls seeking comment.

In addition to the U.S.-based hosts, I managed to step through a huge number of systems based in South Korea. I didn’t have time to look through each record to see whether any of the Korean exit nodes were interesting, but here’s the list I came up with in case anyone is interested. I simply haven’t had time to look at and look up the rest of the clients in what RSA is calling the Terracotta network. Here’s a more simplified list of just the organizational names attached to each record.

Assuming RSA’s research is accurate (and I have no reason to doubt that it is) the idea of hackers selling access to hacked PCs for anonymity and stealth online is hardly a new one. In Sept. 2011, I wrote about how the Russian cybercriminals responsible for building the infamous TDSS botnet were selling access to computers sickened with the malware via a proxy service called AWMProxy, even allowing customers to pay for the access with PayPal, Visa and MasterCard.

It is, after all, incredibly common for malicious hackers to use systems they’ve hacked to help perpetrate future cybercrimes – particularly espionage attacks. A classified map of the United States obtained by NBC last week showing the victims of Chinese cyber espionage over the past five years lights up like so many exit nodes in a VPN network.

Source: NBC

Source: NBC

TorrentFreak: Anti-Web Blocking Site More Popular in the UK than Spotify & Skype

This post was syndicated from: TorrentFreak and was written by: Andy. Original post: at TorrentFreak

FCT tyFor citizens of the UK, web blocking is becoming a hot topic. Aside from the large and growing list of torrent, streaming and other downloading sites currently blocked by ISPs, netizens are now facing the specter of government enforced porn barriers.

That’s according to Prime Minister David Cameron, who this week fired off a broadside against adult content providers who he says are failing to control what other people’s children are viewing online.

“Our one nation government is working hard to make the internet a safer place for children, the next step in this campaign is to curb access to harmful pornographic content which is currently far too widely available,” the Prime Minister said. “I want to see age restrictions put into place or these websites will face being shut down.”

According to the government the UK’s top 10 adult sites account for over half (52%) of all site views so this is no trivial matter. The site’s aren’t mentioned by name so TF decided to look them up.

The most popular within the UK’s top 200 most-visited sites according to Alexa are Pornhub (#41), XHamster (#44), Xvideos (#47), RedTube (#92), TubeCup (#105) and YouPorn (#122). To give an idea of scale, PornHub is more popular than Netflix and YouPorn is more visited than Vimeo.

However, while compiling this list we stumbled across something else that’s both surprising on one hand and utterly predictable on the other. Occupying the position of the UK’s 192nd most-visited site is, a service entirely dedicated to unblocking blocked websites.

Breaking the top 200 is no mean feat for any site, especially when one considers the competition at that level. Nevertheless, after existing for much less than a year, is already more popular in the UK than both Spotify (#194) and Skype (#195).


While the skill of the site’s operator is no doubt a factor in its success, the huge popularity of is almost entirely down to restrictions being put in place by UK Internet service providers. Every time a blockade is put in place, provides a solution to the problem. It currently unblocks most major torrent and streaming sites plus the specialist ebook archives targeted in May.

“Fighting censorship has been the primary motivation behind running Unblocked,” the site’s operator informs TorrentFreak.

“It’s to show that whatever regulators do to censor things online, there will always be a way around it. The initial motivation came from when The Pirate Bay was blocked in the Netherlands. We set up to maintain a list of Pirate Bay proxy sites and show people how to create their own.”

In respect of porn sites, Cameron’s office suggests that users could be required to validate their ages with a credit card, but the operators of overseas ‘tube’ sites will be extremely reluctant to introduce such measures since they will mess with their business models by reducing traffic and ad revenue.

That will leave web-blocking as Cameron’s only other option but as highlighted by the Open Rights Group, that won’t work.

“While the government can shut down UK-based sites, these are few in number and represent a tiny proportion of the global porn industry. Cameron needs to clarify how he wishes to achieve his goals, given that most porn sites are hosted abroad,” says ORG’s Jim Killock.

“To block them, the government would have to introduce a national firewall, which would censor sites for everyone, and would likely be widely circumvented.”

While there are currently no dedicated adult sites in’s repertoire (since none are currently blocked in the UK), there can be little doubt that if the UK government decides to order blockades, Unblocked and similar sites will quickly offer wordarounds.

If that does indeed transpire, expect a successful service to break the top 50 most-visited sites in the country while jockeying for rankings with the likes of Apple and WordPress. It’s a battle the government simply can’t win, but that won’t stop them from trying.

In the meantime the Internet continues to interpret censorship as damage, and routes around it.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and the best VPN services.

TorrentFreak: MPAA Emails Expose Dirty Media Attack Against Google

This post was syndicated from: TorrentFreak and was written by: Ernesto. Original post: at TorrentFreak

google-bayLate last year leaked documents revealed that the MPAA helped Mississippi Attorney General (AG) Jim Hood to revive SOPA-like censorship efforts in the United States.

In a retaliatory move Google sued the Attorney General, hoping to find out more about the secret plan. The company also demanded copies of internal communications from the MPAA which are now revealing how far the anti-Google camp planned to go.

Emails between the MPAA and two of AG Hood’s top lawyers include a proposal that outlines how the parties could attack Google. In particular, they aim to smear Google through an advanced PR campaign involving high-profile news outlets such as The Today Show and The Wall Street Journal.

With help from Comcast and News Corp, they planned to hire a PR firm to “attack” Google and others who resisted the planned anti-piracy efforts. To hide links to the MPAA and the AG’s office, this firm should be hired through a seemingly unaffiliated nonprofit organization, the emails suggest.

“This PR firm can be funded through a nonprofit dedicated to IP issues. The ‘live buys’ should be available for the media to see, followed by a segment the next day on the Today Show (David green can help with this),” the plan reads (pdf).

The Today Show feature would be followed up by a statement from a large Google investor calling on the company to do more to tackle the piracy problem.

“After the Today Show segment, you want to have a large investor of Google (George can help us determine that) come forward and say that Google needs to change its behavior/demand reform.”

In addition, a planted piece in the Wall Street Journal should suggest that Google’s stock would lose value if the company doesn’t give in to the demands.

“Next, you want NewsCorp to develop and place an editorial in the WSJ emphasizing that Google’s stock will lose value in the face of a sustained attack by AGs and noting some of the possible causes of action we have developed,” the plan notes.


Previously, the MPAA accused Google of waging an “ongoing public relations war,” but the above shows that the Hollywood group is no different.

On top of the PR-campaign the plan also reveals details on how the parties would taint Google before the National Association of Attorneys General.

Through a series of live taped segments they would show how easy it is for minors to pirate R-rated movies, buy heroin and order an assault weapon with the help of Google’s search engine.

Finally, the plan includes a “final step” where Attorney General Hood would issue a civil investigatory demand to Google.

In its court filing (pdf) Google uses the information above to argue that the AG’s civil investigatory demand was not the basis of a legitimate investigation. Instead, it was another tool pressuring the company to implement more stringent anti-piracy measures.

Given this new information, Google hopes that the court will compel Fox, NBC and Viacom to hand over relevant internal documents, as they were “plainly privy” to the secretive campaign.

It’s now up to the judge to decide how to proceed, but based on the emails above, the MPAA and the AG’s office have some explaining to do.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and the best VPN services.

TorrentFreak: WordPress Rejects 43% Of All ‘Piracy’ Takedown Notices

This post was syndicated from: TorrentFreak and was written by: Ernesto. Original post: at TorrentFreak

wordpressAutomattic, the company behind the popular WordPress blogging platform, has seen a steady increase in DMCA takedown notices in recent years.

Some of these are legitimate, aimed at disabling access to copyright-infringing material. However, there are also many overbroad and abusive takedown notices which take up a lot of the company’s time and resources.

To give the public insight into the effort it takes to process the requests WordPress regularly publishes a transparency report. In the report WordPress outlines the number of DMCA takedown notices, but also how many were rejected due to inaccuracies or abuse.

“We work hard to make our DMCA process as fair, transparent, and balanced as possible, so we stringently review all notices we receive to quickly process valid infringement claims and push back on those that we see as abusive,” WordPress explains.

The latest update covering the past half year shows that 4,679 piracy takedown requests were received during this period. What stands out is that content was removed in barely half of the cases reported.

In total, 43% of all notices were rejected, either because they were incomplete or due to abuse. February and April were particularly bad months, as more than half of all notices were rejected.

According to WordPress’ figures more than 10% of the notices were abusive, and the company highlights some examples in its “Hall of Shame.”

WordPress’ most recent takedown statistics

For the first time WordPress has also released information on the organizations that submit the most complaints. Web Sheriff is listed on top here, followed by Audiolock and InternetSecurities.

Commenting on the new data Stephen Blythe, Community Guardian at Automattic, informs TF that they have seen a significant bump in rejections over the past months. This increase has two main causes.

“The first is that we rejected a large number of abusive takedown notifications from Web Sheriff that related to a single site. The second is that we are constantly refining our processes to ensure that we catch and push back on as many of these misuses as possible,” Blythe says.

WordPress currently doesn’t publish the takedown notices in full, but the company plans to highlight more abuse cases on its website in the coming months.

“We see numerous instances of abuse of the DMCA takedown process, on a regular basis. We plan to publish these via our transparency blog in future,” Blythe notes.

While the number of takedown requests WordPress receives pales in comparison to larger Internet services, it’s good to see that the company carefully reviews all notices to prevent unwarranted censorship. It will be interesting to see how the volume of request changes over time and whether copyright holders will improve their accuracy.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and the best VPN services.

TorrentFreak: Universal Asks Google to Censor “Furious 7″ IMDb Page, and More

This post was syndicated from: TorrentFreak and was written by: Ernesto. Original post: at TorrentFreak

face-palmIn an effort to make piracy less visible, copyright holders send dozens of millions of takedown notices to Google every month.

Unfortunately not all of these requests are as accurate as they should be.

Due to the high volume of often automated notices and the fact that copyright holders don’t check the validity of all requests, there are many questionable requests are made.

This week we spotted a dubious takedown notice from Universal Pictures, targeting several perfectly legitimate URLs. The movie studio’s tracking company apparently failed to properly screen the request as it lists the official IMDb page of the blockbuster Furious 7.

The Internet Movie Database is widely regarded as one of the top sources to find information on movies and having the page de-listed from Google certainly doesn’t help to prevent piracy.

Universal Pictures takedown request

Aside from Furious 7, the same notice targets “copyright infringing” links to the movie Hacker. Here, the movie studio also made an unfortunate mistake asking Google to remove a news article from Techdirt, covering the Hacking Team leak.

And while we’re on the topic of self censorship, it’s worth noting that Universal Pictures also asked Google, in a separate notice, to remove from the search results.

The mistakes were made by the French branch of the movie studio, which only recently began sending takedown notices to Google. The company has reported less than 200 URLs thus far including the mistakes above.

While Universal is the rightsholder, it’s worth noting the notices are sent by Trident Media Guard (TMG), the private company which also carried out file-sharing network monitoring for the French Government’s Hadopi scheme.

The good news is that Google hasn’t removed any of the inaccurately reported URLs just yet. The search engine is still validating the validity of the claims and will probably reject the requests.

In the meantime, Universal Pictures and TMG should reconsider their takedown campaign, or at least improve their monitoring tools.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and the best VPN services.

TorrentFreak: CloudFlare Forced to Censor Anti-Censorship Site

This post was syndicated from: TorrentFreak and was written by: Ernesto. Original post: at TorrentFreak

notresolvedLast May, Grooveshark shut down after settling with the RIAA. However, within days a new site was launched aiming to take its place.

The RIAA wasn’t happy with this development and quickly obtained an injunction, preventing various Internet service providers from offering their services to the site.

Through the lawsuit the companies hope to prevent further copyright infringements, but there is more at stake. Much more.

The case is also the first major test of how receptive the courts are to the notion of injunctions against hosting companies, domain name services, ISPs and search engines.

Fearing that these attempts may become commonplace several tech companies protested the injunction, including CloudFlare. The court order requires the CDN-service to ban all domain names that use the term “Grooveshark,” which the company believes is too broad.

This week CloudFlare informed the court that the order limits free-speech, impacting legitimate customers who use it for perfectly legitimate websites.

“CloudFlare has already been compelled by the injunction to deny service to at least one website that is plainly non-infringing, and to others that are arguably non-infringing and have no discernible connection with the Defendants in this case,” they write (pdf).

“This harm to CloudFlare’s business and potentially to customer’s businesses, and to the free speech rights of its customers, will continue without a modification of the Preliminary Injunction.”

As an example, CloudFlare says it had to terminate the account of “,” a site which protested the broad injunction as the screenshot below shows., before CloudFlare took it offline

Under the injunction CloudFlare had no other option than to disable its services for the domain, rendering it inaccessible.

In an email, the company informed the affected user about its actions explaining that it’s not allowed to provide any services that use the Grooveshark trademark in a domain name.

CloudFlare’s email

According to CloudFlare many other legitimate sites may be at risk of being censored if the broad injunction is upheld.

Despite these protests, the record labels maintain the position that the measures are “entirely appropriate.” They argue that it’s up to CloudFlare to determine whether a domain name is infringing, and consult the record labels if there’s any doubt.

For its part, CloudFlare wants the court to modify the injunction so that they only have to target domain names which the record labels point out to them, instead of banning the word Grooveshark altogether.

Shortly before publishing this article the court ruled (pdf) on the dispute, largely in favor of CloudFlare.

In a ruling issued a few hours ago District Court Judge Alison Nathan clarifies that CloudFlare is no longer required to ban all Grooveshark-related domains. Instead, the record labels must alert the company to possibly infringing sites.

However, Judge Nathan adds that if CloudFlare has knowledge of an infringing domain name it is required to take action on its own.

So, in the end it appears that the censored anti-censorship site has served its purpose. At the time of writing it still remains offline, but this may change during the coming hours.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and the best VPN services.

TorrentFreak: Censoring Pirate Sites is Counterproductive, Research Finds

This post was syndicated from: TorrentFreak and was written by: Ernesto. Original post: at TorrentFreak

stop-blockedRather than taking operators to court, copyright holders are increasingly relying on Internet providers to block ‘pirate’ domains.

Courts all around the world have ordered Internet providers to block subscriber access to various pirate sites, and in Italy this process is formalized through telecoms regulator AGCOM.

The idea behind these blockades is that they help to decrease online piracy. However, research increasingly suggests that this aim is not being fulfilled. In fact, a new study shows that blocking attempts may actually be counterproductive.

To find out whether blocking efforts are effective, University of Padua professor Giorgio Clemente decided to run a comprehensive analysis, comparing traffic data before and after the measures were implemented.

The research uses the same methodology as an earlier MPAA-commissioned study by Incopro which examined UK blockades. However, instead of merely looking at the blocked domains, Professor Clemente also took domain name changes into account because site operators commonly switch domains to bypass censorship efforts.

The results are quite revealing and show that Government-sanctioned blockades actually increase traffic to the targeted sites.

“The blocking efforts of the Italian ISPs are all being thwarted,” Professor Celemente writes.

“The analyzed data shows that after a year the overall effects can be summarized as a significant increase in Italian search engine traffic to the targeted sites and a consequent increase in piracy rather than a decline,” he adds.

In many cases the websites simply switched to a new domain name to evade the blocking efforts., for example, moved to a .li domain name and as a result of the attention the site received from the blocking efforts, search engine traffic spiked more than 1000%.

“AGCOM’s blocking measures have actually increased the site’s popularity, which went from 106,000 Italian search engine visitors in March 201 to 2,294,000 users a year later,” the report reads, adding that this caused a spike in piracy activity.

The same pattern was observed for other sites. Limetorrents, for example, saw Italian search engine traffic increase from 9,000 to 162,000 a few months later after, as shown below.

Limetorrents traffic increase

The measures also helped to promote previously unknown sites. TorrentDownloads had no Italian visits before the blocking measures but started to see traffic coming in after AGCOM put the site on its blocklist.

The full report lists a total of 27 sites which nearly all increased their visitor numbers. This leads to the overall conclusion that the time and money invested in the measures is wasted.

“The resources and energy which Internet providers put into the blocking efforts are completely unjustified, and so are the copyright protection activities of AGCOM, given the obvious ineffectiveness of the measures,” the report reads.

Professor Clemente notes that his research confirms a recent study by the European Commission’s Joint Research Centre, which reached a similar conclusion regarding the shutdown of the popular movie streaming portal

Italian lawyer Fulvio Sarzana, who represented the owners of several blocked websites, says the report confirms what many people already expected.

“The research by the University of Padua shows what everyone already knows: administrative copyright enforcement by blocking access to websites is an unnecessary and harmful waste time,” he tells TF.

The controversial AGCOM measures are up for a review at the Italian Constitutional Court later this year which will look at whether they limit people’s right to free expression. If the court rules the measures unlawful, Sarzana says that the affected sites may be entitled to a substantial damage claim for being unfairly blocked.

However, taking the results of Professor Clemente into consideration there’s little damage to complain about.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and the best VPN services.

TorrentFreak: Israeli Court Lifts Ineffective Popcorn Time Ban

This post was syndicated from: TorrentFreak and was written by: Ernesto. Original post: at TorrentFreak

popcorntBranded a “Netflix for Pirates,” the Popcorn Time app quickly gathered a user base of millions of people over the past year.

The application has some of the major media giants shaking in their boots, including Netflix which sees the pirate app as a serious competitor.

In Israel, local anti-piracy group ZIRA took several Internet providers to court this year, with the goal to have several prominent Popcorn Time sites blocked. This effort resulted in an initial success when a preliminary injunction was granted in May.

However, after a careful review the Tel Aviv court has now reversed this decision. One of the arguments of the court is that blocking Popcorn Time domain names is relatively ineffective.

The court concluded that since the developers of the software can’t be tracked down, there’s nothing that prohibits them from launching new websites to render the blockade useless.

“Therefore, blockage or shutting down Popcorn Time sites does not guarantee that the application can no longer be downloaded,” the judgment reads.

In addition, the court points out that Popcorn Time applications that have been downloaded already will continue to work, even if the sites are blocked.

“This shows that the benefit of the requested measures is minimal, if any,” the verdict notes.

The Internet providers who protested the blocking requests further argued that the blockades would require a lot of resources and hurt their image, which the court largely agreed with.

“The cost of making ISPs some kind of censorship authority is at least equivalent, if not higher, than the cost of copyright infringement,” the verdict reads, mentioning that free competition and freedom of speech may be at risk.

Finally, the court gave ZIRA a slap on the wrist by pointing out that the requested blockade wasn’t as urgent as the copyright holders claimed, since Popcorn Time has been around for a long time.

“These sites, which presumably were visible to everyone, have been online for a long time. Given that, it seems that the applicant delayed the submission of the application which contradicts their urgency claim on the requested preliminary measures”, the judgment reads.

The outcome is a blow for ZIRA and the copyright holders they represent.

In addition to the negative outcome, the court also ordered the anti-piracy group to pay $1,060 to cover the legal fees of one ISP. The other ISPs settled the fees in question out of court.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and the best VPN services.

TorrentFreak: Police Let Seized ‘Pirate’ Domains Expire, Some Up For Sale

This post was syndicated from: TorrentFreak and was written by: Andy. Original post: at TorrentFreak

cityoflondonpoliceFor the past several years the Police Intellectual Property Crime Unit (PIPCU) has been at the forefront of Internet-focused anti-piracy activity in the UK. The government-funded unit has been responsible for several high-profile operations and has been praised by a broad range of entertainment industry companies.

After carrying out raids against the operators of dozens of sites, PIPCU likes to take control of their domains. They do this for two key reasons – one, so that the sites can no longer operate as they did before and two, so they can be used to ‘educate’ former users of the downed sites.

That ‘education’ takes place when visitors to the now-seized ‘pirate’ domains are confronted not with a torrent, proxy, streaming or links site, but a banner published by PIPCU themselves. It’s aim is to send a message that sites offering copyrighted content will be dealt with under the law and to suggest that their visitors have been noted.

Earlier comments by PIPCU suggest that its banner has been seen millions of times by people who tried to access a ‘pirate’ site but subsequently discovered that it no longer exists. Last month in an announcement on Twitter, the unit revealed that since Jul 2015 it has diverted more than 11m ‘pirate’ site visits.

While the hits continue to mount for many domains PIPCU has seized (or gained control over by forcing site operators or registrars into compliance), it’s now likely that the group’s educational efforts will reach a smaller audience. Tests carried out by TorrentFreak reveal that PIPCU has somehow lost influence over several previously controlled domains.

Instead of the now-familiar PIPCU ‘busted’ banner, visitors to a range of defunct sites are now greeted with expired, advert-laden or ‘for sale’ domains., for example, currently displays ads/affiliate links. The same goes for, a domain that was linked to a high-profile PIPCU raid in 2014. Former proxies and, plus former streaming links site complete the batch.


Other domains don’t carry ads but are instead listed for sale. They include former anti-censorship tool site, proxy index and H33T proxy

The fate of the final set of domains is much less glamorous.,,,, and all appear to have simply expired.

Whether these domains will be snapped up at the first opportunity or left to die will largely hinge on whether people believe they can make a profit from them. Some have already changed hands and are now being touted for a couple of thousand dollars each but others are lying in limbo.

In any event, none of these domains seem destined to display PIPCU’s banner in the future. Whether or not the unit cares right now is up for debate, but if any of the domains spring back into life with a ‘pirate’ mission, that could soon change.

Unlike Megaupload’s old domains they don’t appear linked to obvious scams, so that’s probably the main thing.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and the best VPN services.

TorrentFreak: Popcorn Time Blamed For Movie Streaming Piracy Explosion

This post was syndicated from: TorrentFreak and was written by: Andy. Original post: at TorrentFreak

Up until last year, downloading content using BitTorrent was an activity that needed a reasonable level of technical competence. In addition to choosing the correct software and setting everything up, users needed to make themselves familiar with any number torrent indexes and platforms.

Then along came Popcorn Time and simplified the process to the point that almost anyone can now download the software and access a wide range of (mostly) infringing content within minutes. Needless to say, the various forks of the software have been a thorn in the side of the movie and TV show industry ever since.

With complaints being made against the software in most western countries, it’s now Norway’s turn to make some noise. While the country has expressed concerns about the software in the past, a report published in June by consultancy firm Mediavision is adding fuel to the fire.

According to the company, which analyzes consumer behavior within the sphere of digital media, around 750,000 Norwegians from a five million population are now obtaining video from illegal sources, up 17% on the previous year. However, it is the manner in which they are doing it that’s causing additional concern. According to the researchers, illegal consumption of streaming content has doubled in the past year. And no prizes for guessing who anti-piracy groups are blaming.

“The reason for the increase in piracy is Popcorn Time,” says Rights Alliance Norway chief Willy Johansen.

“It is unfortunately an incredibly easy way to watch movies. But one should be aware that this is a criminal offense. We are now collecting the IP addresses of Norwegian users of Popcorn Time.”

While users will be disappointed to hear that they are being tracked by a Hollywood-backed anti-piracy outfit, the big question is what Rights Alliance will choose to do with that data. The group says their hand may be forced.

“We have hoped for the longest time that we do not have to take on the end-user. But it is clear that if this does not stop, we will have no choice. Most people are now aware that they are doing something illegal, but many continue because ‘everyone else is doing it’,” Johansen says.

Also on the horizon are lawsuits against local ISPs. Rights Alliance hopes that by obtaining a blocking injunction against Popcorn Time-affiliated sites and services, the problem might be brought under control. However, things aren’t straightforward.

“It takes time in the Norwegian legal system, so there is a protracted process,” Johansen notes.

“There is nothing that can be sent to the court today. But we’re working on it together with our attorneys to look into the possibility of getting this stopped through a lawsuit against broadband providers.”

After changes in the law two years ago, these kinds of injunctions were supposed to be easy for groups like Rights Alliance to obtain, but it appears there are still significant hurdles to overcome. Not only are there very stringent requirements in order to obtain an injunction, all expenses incurred must be paid by the plaintiff.

“No independent licensees in Norway have the opportunity [to get injunctions], because they do not have the finances to do so. If we are to stop something, it must be an overall industry behind the lawsuit. It requires a very detailed presentation of evidence, says Johansen.

Interestingly, however, the group has been working on getting an injunction against another site, most probably The Pirate Bay. The results should become evident in a few weeks.

“The case we’re working on already started before Popcorn Time existed. The problem is that evidence is so extensive that the whole Popcorn Time phenomenon arose during the time we spent gathering evidence from the previous service,” the Rights Alliance chief adds.

As usual, however, the industry isn’t getting much help from ISPs including Telenor, Norway’s largest provider.

“We wish to contribute by relating to parliamentary procedure adopted in such cases,” says Telenor director Tormod Sandstø.

“So the court must make decisions in individual cases, also we will of course abide by those decisions. As an Internet provider we will not be a censorship body.”

The news that Norway may target end users is disappointing. The country has all but eliminated music piracy yet still prefers anti-piracy aggression over business model changes in the video sector.

Source: TorrentFreak, for the latest info on copyright, file-sharing, torrent sites and the best VPN services.