Forgot your password?
typodupeerror
The Internet Government The Courts News

How To Frame a Printer For Copyright Infringement 325

Posted by timothy
from the point-the-finger-point-it-well dept.
An anonymous reader writes "Have you ever wondered what it takes to get 'caught' for copyright infringement on the Internet? Surprisingly, actual infringement is not required. The New York Times reports that researchers from the computer science department at the University of Washington have just released a study that examines how enforcement agencies monitor P2P networks and what it takes to receive a complaint today. Without downloading or sharing a single file, their study attracted more than 400 copyright infringement complaints. Even more disturbing is their discovery that illegal P2P participation can be easily spoofed; the researchers managed to frame innocent desktop machines and even several university printers, all of which received bogus complaints."
This discussion has been archived. No new comments can be posted.

How To Frame a Printer For Copyright Infringement

Comments Filter:
  • by pwnies (1034518) * <j@jjcm.org> on Thursday June 05, 2008 @02:35PM (#23671811) Homepage Journal
    While entirely laughable, I'm glad this story is in the New York Times. Getting the Spanish Inquisition-esque ways of the these enforcement agencies out into the media is going to be one of the few ways to make it stop. Hopefully people (meaning the general public, and not just us here on /.) will soon realize just how ludicrous these methods are.
  • by GigaHurtsMyRobot (1143329) on Thursday June 05, 2008 @02:37PM (#23671847) Journal
    Maybe now my employer will have to take down that LaserJet IIIp and upgrade to a newer model.
  • Sweet! (Score:5, Funny)

    by Hankapobe (1290722) on Thursday June 05, 2008 @02:40PM (#23671903)
    An inanimate object could also get the blame. The researchers rigged the software agents to implicate three laserjet printers, which were then accused in takedown letters by the M.P.A.A. of downloading copies of âoeIron Manâ and the latest Indiana Jones film.

    1. Download movies and sell them
    2. pin it on cop's printer
    3. in the meantime while they're arresting the printer
    4. Profit!
    • Re:Sweet! (Score:5, Interesting)

      by McFly69 (603543) on Thursday June 05, 2008 @03:14PM (#23672353) Homepage
      1. Download movies 2. Pin it on RIAA's website IP address (76.74.24.143) 3. Let the cops arrest RIAA 4. Peace and Quiet 5. Profit! But seriously... if you can spoof using any IP address (Printer, Website, etc), then everyone can claim it was not them downloading anything and there is not sure way to prove it. Just food for Thought.
      • Re: (Score:3, Informative)

        by despe666 (802244)
        Ding ding ding! You figured it out. I'm guessing these guys will be very busy being expert witnesses in upcoming trials.
      • Re: (Score:3, Interesting)

        by gstoddart (321705)

        But seriously... if you can spoof using any IP address

        I don't think you can spoof any IP address. I think you'd still need to be on the same subnet/domain in order for routing to work.

        You can spoof your neighbor, but you can't spoof something in a different network range.

        At least, I don't think you could spoof an arbitrary IP address.

        Cheers
        • Re: (Score:3, Informative)

          by xappax (876447)
          From the report:

          based on the inconclusive nature of the current monitoring methods, we find that it is possible for amalicious user (or buggy software) to implicate (frame) seemingly any network endpoint in the sharing of copyrighted materials
          (emphasis added)
        • Re: (Score:3, Informative)

          http://wiki.theory.org/BitTorrentSpecification#Tracker_Request_Parameters [theory.org]

          # ip: Optional. The true IP address of the client machine, in dotted quad format or rfc3513 defined hexed IPv6 address. Notes: In general this parameter is not necessary as the address of the client can be determined from the IP address from which the HTTP request came. The parameter is only needed in the case where the IP address that the request came in on is not the IP address of the client. This happens if the client is communicating to the tracker through a proxy (or a transparent web proxy/cache.) It also is necessary when both the client and the tracker are on the same local side of a NAT gateway. The reason for this is that otherwise the tracker would give out the internal (RFC1918) address of the client, which is not routeable. Therefore the client must explicitly state its (external, routeable) IP address to be given out to external peers. Various trackers treat this parameter differently. Some only honor it only if the IP address that the request came in on is in RFC1918 space. Others honor it unconditionally, while others ignore it completely. In case of IPv6 address (e.g.: 2001:db8:1:2::100) it indicates only that client can communicate via IPv6.

          Depending on the tracker, you may be able to impersonate anyone at all.

      • by Weaselmancer (533834) on Thursday June 05, 2008 @04:02PM (#23673171)

        Apparently since a DDOS is a legal move in this game (if you'll recall the MediaDefender fiasco recently), [slashdot.org] maybe we could use this technique and flood P2P space with false positives.

        I'll bet once every single judge in the USA gets a "Cease and Desist" letter they'll eventually see that the RIAA's tactics aren't valid.

  • Wow .... (Score:5, Funny)

    by gstoddart (321705) on Thursday June 05, 2008 @02:43PM (#23671959) Homepage
    So, will we have a variant on the Chewbacca defense?

    "Why would a printer, an inanimate object with no reproductive organs, be downloading pornography? It doesn't fit ... if the toner cartridge won't fit, you must acquit."

    Seriously though, it's good to see some credible research demonstrating that the methods that are used to identify file-sharers are completely arbitrary and can't be demonstrated to be valid.

    It would be nice to finally have enough evidence that Judges could basically say "Well, this methodology has been dis-credited, you need actual evidence."

    Now, if you excuse me, I'm going to try to devise a way to make it look like our printer has been downloading Will Farrel movies and films with Natalie Portman. :-P

    Cheers
  • Sweet! (Score:5, Funny)

    by Layer 3 Ninja (862455) on Thursday June 05, 2008 @02:45PM (#23671993) Journal
    Time to exact my revenge on that stupid Lexmark E240 of the 5th floor.
  • And? (Score:3, Funny)

    by Colin Smith (2679) on Thursday June 05, 2008 @02:49PM (#23672019)
    Were the printers imprisoned?

     
  • As I said (Score:3, Funny)

    by davburns (49244) <davburns+slashdot.cat@pdx@edu> on Thursday June 05, 2008 @02:49PM (#23672023) Homepage Journal
    It's so nice when one's uniformed speculation [slashdot.org] is proved correct.

    Yay.

  • by the_womble (580291) on Thursday June 05, 2008 @02:52PM (#23672059) Homepage Journal
    ....it might change things. Legislators in the US and EU, for example.
    • by Jor-Al (1298017)
      Nah, they'll weasel themselves out of it through some sort of retroactive immunity.
  • by DeadDecoy (877617) on Thursday June 05, 2008 @02:54PM (#23672113)
    Clippy: Looks like you're making a letter. Would you like help?
    Clippy: Looks like your letter is finished. Would you like me to print it?
    Clippy: Looks like you're infringing on a copyright. Would you like me to call you a lawyer?
    * Throws computer out window *
    • Re: (Score:3, Funny)

      by DaveM753 (844913)
      See, this is exactly why nobody likes Clippy. If Microsoft wants people to like Clippy, get him (it) to say stuff like

      Clippy: Looks like you're infringing on a copyright. Would you like DVD5 or DVD9? ...much more useful. (Uh oh. I'm off-topic... apologies)
  • I appreciate them giving me a tracker and url for iron man. Haven't seen it yet.

    (just kidding, I'll wait for it to be released on dvd first)
  • Ridiculous! (Score:5, Funny)

    by saterdaies (842986) on Thursday June 05, 2008 @02:57PM (#23672145)
    This is completely ridiculous and I'm sure any judge would see a printer downloading copyrighted songs as completely silly.

    So, anyone wanna help me get NetBSD on my Epson?
  • Too flimsy (Score:5, Insightful)

    by Endo13 (1000782) on Thursday June 05, 2008 @02:59PM (#23672169)
    While I'm all for anything and everything that helps bring down the MAFIAA, sadly the case in this article is very weak. It only points out two things, both of which are already commonly known by almost everyone in IT.

    1. IP addresses can be spoofed.
    2. IP addresses assigned by DHCP will not always be assigned to the same MAC address.

    Then there's a lot of hand-waving and implications that there's also all kind of other likely flaws in the methods used to find out who's participating in file-sharing.

    The worst part of it though is how they throw in the whole thing of "we weren't actually downloading or sharing anything". No, they were just connecting to the tracker. And of course, everyone knows "pirates" commonly connect to torrent trackers to do nothing.

    This bothers because if anyone were to point out how weak this case is in main-stream media, it could end up doing more harm than good.

    We need some heavy ammo to shut them down, and I'm afraid this is not it.
    • Re:Too flimsy (Score:5, Insightful)

      by gstoddart (321705) on Thursday June 05, 2008 @03:11PM (#23672285) Homepage

      The worst part of it though is how they throw in the whole thing of "we weren't actually downloading or sharing anything". No, they were just connecting to the tracker. And of course, everyone knows "pirates" commonly connect to torrent trackers to do nothing.

      Well, it does two things.

      First, it shows that you can get a subpoena for not actually doing anything illegal. Presumably, connecting to a tracker isn't illegal.

      Second, it begins to dispel the myths that the content holders have perpetuated about how they actually gather their evidence and if the collection methodology is valid.

      I think actual University research which is covered by the NYT might be an awful good start. It's by no means everything that needs to happen, but starting to establish that their data collection is faulty is better than nothing.

      Cheers
      • Re: (Score:3, Insightful)

        by coyote-san (38515)
        I vaguely recall there being a key legal point that you have to be able to simultaneously point to one party and exclude all others. Check with a lawyer (or law school student) to be sure.

        The reason is to prevent an "I was framed!" defense as much as preventing framing innocent parties. It's not unheard of for people to plant evidence of their own guilt. Discredit the planted evidence and most people will (reasonably) have a lot of doubt about the rest of it.
    • Re:Too flimsy (Score:5, Insightful)

      by link-error (143838) on Thursday June 05, 2008 @03:11PM (#23672301)

      The worst part of it though is how they throw in the whole thing of "we weren't actually downloading or sharing anything". No, they were just connecting to the tracker. And of course, everyone knows "pirates" commonly connect to torrent trackers to do nothing.
      Actually, that is the worst part.. they are sending out take-down notices/suing people that didn't download anything..
          Remember, innocent until proven guilty. They aren't even trying to actually determine this.
    • Re:Too flimsy (Score:5, Insightful)

      by Bryansix (761547) on Thursday June 05, 2008 @03:12PM (#23672311) Homepage
      Maybe you missed the part where they framed the printer? The point is they just connected to a tracker but in real life what is more likely is that the guy in the dorm next to me is actually downloading the film that he didn't pay for but he pins it on me who wasn't involved in doing any copyright infringing at all. THAT IS THE POINT. Too many cases get brought up that are accusing the WRONG PERSON of doing the infringing.
      • Re: (Score:3, Informative)

        The IP spoofing described in this paper wouldn't allow for that. It involves telling a tracker another IP address to use instead of the one you're connecting from. Thus he couldn't actually download the illegal content.
        The article does talk about mistaken identification based on a shorter DHCP timeout than tracker timeout, which might be closer to what you're talking about. That could be extended by manually setting your IP address to one authenticated by someone else. This is especially possible in a dorm
    • Re:Too flimsy (Score:5, Insightful)

      by s.bots (1099921) on Thursday June 05, 2008 @03:13PM (#23672329)

      It only points out two things, both of which are already commonly known by almost everyone in IT.
      And that's why this is relevant. Because it is not common knowledge outside the IT field, and it makes an appearance in the New York Times. The article could be more in-depth, or provide more conclusive evidence I agree, but getting the facts out there to the average (NYT reading) Joe is a good first step.

      The worst part of it though is how they throw in the whole thing of "we weren't actually downloading or sharing anything". No, they were just connecting to the tracker. And of course, everyone knows "pirates" commonly connect to torrent trackers to do nothing.
      True, pirates don't connect to a tracker to observe, but the point being made is that an entity that was only observing (not doing anything illegal or warranting a takedown notice) is being pinned as a pirate.
    • by Fallen Kell (165468) on Thursday June 05, 2008 @03:17PM (#23672397)
      Yes, anyone in IT understands these issues. But the fact remains that no one in IT is being listened to when they are calling this same information proof of infringement. This study is to show that their "proof" which is being used in these same cases is as worthless as all the IT people have said it was from the beginning, and that the checks the **AA investigators are using to confirm that they are not accusing the wrong people are as worthless as well in terms of verifying/screening false positives. This study shows for a FACT that false positives are occurring and occurring ALL THE TIME.
    • Re: (Score:3, Informative)

      by Anonymous Coward
      Did you miss the part where any malicious client can send an alternate client IP address to a tracker which supports the appropriate protocol extensions; the tracker will then report that IP address as participating in the swarm?

      Also, consider this: As commonly compressed, each reported peer takes up essentially 6 bytes; 4 for the IPv4 address, 2 for the port, because the less data the trackers have to push out during a scrape, the better.

      That gives a two-third chance that any corruption (undetected by the
    • by Applekid (993327)

      [This] article is very weak . . . [it] only points out two things, both of which are already commonly known by almost everyone in IT.

      Granted, but the study is being reported in the New York Times, not a trade magazine. Now we don't have to stroke our neck beards and demand the ignorant just understand, we can just point with "hey, look, it's in the New York Times," and continue to stroke our neck beards because, frankly, it's quite soothing.

      The worst part of it though is how they throw in the whole thing of "we weren't actually downloading or sharing anything". No, they were just connecting to the tracker. And of course, everyone knows "pirates" commonly connect to torrent trackers to do nothing.

      Here's the detail, though, should connecting to another computer, something as simple as a handshake, immediately trigger a Cease & Desist? If it goes for BitTorrent connections to trackers, why

  • With this approach, it seems like it would be possible to frame every Internet user, or at least a significant number of them. What a monkey-wrench that would throw into the works! The modern version of 'I, Spartacus'.
  • by gmuslera (3436) on Thursday June 05, 2008 @03:23PM (#23672509) Homepage Journal
    We need an UN declaration on Machine Rights. There are no punishment for smash, throw out windows, sued for file sharing without a fair judgement or even (is hard for me to write this, human cruelty have no limits) install windows in them.

    How you think a singularity will decide to show up in such environment?
  • by TheGratefulNet (143330) on Thursday June 05, 2008 @03:26PM (#23672563)
    I have not read about this - has anyone heard any anecdotes on this subject?

    I'm curious if the 'industry monitoring groups' have ever sent a C/D letter to a clueful sysadmin? we know that most laymen will simply cave in when they receive the 'fact' that their IP address was somehow connected to 'bad traffic'; but I wonder if anyone who knows networking ever called their bluff and really had a court case where he asked for MORE info than simply IP addrs. it would seem that if you can defend yourself in IP networking theory that they really have no firm case on you, especially if you run an 'open wireless AP' and that, itself, could create enough doubt as to who the real 'infringer' really is. they might be able to say its your network but they can't prove its YOU. it could be spyware that somehow got installed on your system. spyware does do 'strange things' as well all know and its not outside the realm of possibility that some virus is connecting to trackers while sitting inside your network. is that really your fault? should you be called 'an infringer' for that?

    so I'm really curious if there are any examples of a tech-strong defendant really calling their bluff and demaning fine-grained specific evidence while at court or at some plea bargaining procedure.
  • by Nom du Keyboard (633989) on Thursday June 05, 2008 @03:30PM (#23672617)
    1: Find a network printer assigned an IP address.
    2: Set your NATting wireless router to mimic that printer's MAC address.
    3: Insert your NATting router between the printer and the LAN and steal its IP address.
    4: Connect to router and fileshare to your heart's content.
    5: Watch printer be arrested for your piracy.
    6: PROFIT!
  • by guacamole (24270) on Thursday June 05, 2008 @04:14PM (#23673367)
    I used to work as a sysadmin in academia and we used to get such false infringement notices on a regular basis. Here is a typical story. Some professor, let's call him Smith, puts some tar and zip files on this webpage or on his ftp site, which naturally has a URL like ftp:somehost.edu/pub/users/smith/bundle.zip [somehost.edu]

    Eventually we get emails some trade association: "We are asking you in good faith to remove the material that infringes on out IP rights. The site in question is such and such and it contains a copy of a Nintendo game "Mr. Smith's Day Out"" or some other non-sense like that. I found those amusing.
  • by Thergrim (1012321) on Thursday June 05, 2008 @04:27PM (#23673613)
    A much easier way to frame someone for infringement. You will need; -the IP address of the target -a copy of what an infringement letter looks like (find them on the Internet) -software to alter or create a fake infringement letter Using the target's IP address, look up their ISP's snailmail address. Fake up your Infringement letter. Mail it to the ISP. Do this 3 to 5 times and your target will get booted from their ISP. ISP's do not check the validity of these letters.
  • A New Plan (Score:3, Interesting)

    by camperdave (969942) on Thursday June 05, 2008 @04:55PM (#23674041) Journal
    1. Install embedded processor and storage in printer
    2. Download stuff
    3. If RIAA come a'knocking, point to the printer
    4. Watch them go away embarrased
    5. Retrieve downloads from the printer
    6. Profit
  • This just in (Score:3, Insightful)

    by greymond (539980) on Thursday June 05, 2008 @05:49PM (#23674893) Homepage Journal
    Apparently IP spoofing still works.

    There. I just saved you 7 pages of walled text.
  • Blame everyone! (Score:4, Interesting)

    by Bones3D_mac (324952) on Thursday June 05, 2008 @07:47PM (#23676345)
    How difficult would it be to coordinate a spoofing system like this that is gradually directed at every used IP across the internet? If it's shown that the *entire* internet is somehow participating in acts of copyright infringement from every IP address across the board, maybe someone might actually begin questioning the current system used to identify those illegally download copyrighted material.

    Think of it... the most respected and powerful people in every community simultaneously getting bogus cease and desist letters. (Lawyers, judges, politicians, etc...) I'd be inclined to think *something* just might happen after that.

I am the wandering glitch -- catch me if you can.

Working...