How To Frame a Printer For Copyright Infringement 325
An anonymous reader writes "Have you ever wondered what it takes to get 'caught' for copyright infringement on the Internet? Surprisingly, actual infringement is not required. The New York Times reports that researchers from the computer science department at the University of Washington have just released a study that examines how enforcement agencies monitor P2P networks and what it takes to receive a complaint today. Without downloading or sharing a single file, their study attracted more than 400 copyright infringement complaints. Even more disturbing is their discovery that illegal P2P participation can be easily spoofed; the researchers managed to frame innocent desktop machines and even several university printers, all of which received bogus complaints."
Glad it's in a reputable media source (Score:5, Insightful)
Re:Glad it's in a reputable media source (Score:5, Funny)
Re:Glad it's in a reputable media source (Score:5, Funny)
Re: (Score:3, Funny)
Re:Glad it's in a reputable media source (Score:4, Funny)
Re:Glad it's in a reputable media source (Score:4, Funny)
Re:Glad it's in a reputable media source (Score:4, Funny)
Re:Glad it's in a reputable media source (Score:5, Funny)
Re:Glad it's in a reputable media source (Score:5, Funny)
Re:Glad it's in a reputable media source (Score:5, Funny)
Ha HAH! The Spanish Inquisition never expected a Hewlett Packard !
Re:Glad it's in a reputable media source (Score:5, Funny)
"You are accused of heresy, in thought, word and deed! How do you plead?"
PC LOAD LETTER
Re:Glad it's in a reputable media source (Score:5, Funny)
Re: (Score:3, Informative)
Re: (Score:3, Funny)
Indeed this subtle joke was missed by the HP Printer posting on slashdot.
Re:Glad it's in a reputable media source (Score:5, Funny)
Re:Glad it's in a reputable media source (Score:5, Interesting)
Unless the little guys can pony up the cash to get these guys as expert witnesses, the MAFIAA will simply commission their own, contradictory study in order to discredit this one.
I hope at some point (and some point SOON) we get a critical mass of people and evidence against the big industry players so that they'll stop this crap. I don't think it'll happen though--there's just too many dollars at stake for them to give up.
Re:Glad it's in a reputable media source (Score:5, Informative)
Re:Is this safe? (Score:5, Insightful)
What? Conspire to subvert the legal system, and come close to perjury? I say, bring it on and let the jail terms fly.
Presumably, the EFF would vet their people, but I should think intentionally doing what you suggest might get you some kind of sanctions.
Then again, your cynicism might not be completely unfounded. Which, is a depressing thought.
Cheers
Re:Is this safe? (Score:4, Interesting)
Re: (Score:3, Insightful)
Your point makes me wonder if in this day and age we don't need non-biased experts in the same way we need non-biased jurors. I would propose that each court district should have and online listing of which experts are needed, and volunteering to fill that need woul
Re:Glad it's in a reputable media source (Score:5, Insightful)
I think there is another reason to be glad that is more important than being in the media, IMHO. An NSF grant-backed publication from a large research institution will carry some weight in court.
IP address spoofing has been invoked by the defense in previous lawsuits to attack the prosecution's investigation methods, however, this assertion has always had to be provided by an expert witness. A scholarly publication backed by the U of W and the NSF will bolster this point. It might even stick with a jury (who knows). Anyway, this will come in handy in the courtroom, I think.
Re:Glad it's in a reputable media source (Score:5, Interesting)
The other favored method these days seems to be sending out non-sensical Cease and Desist [demystify.info] Letters claiming all sorts of things, including copyright infringement, and CRIMINAL charges because someone has a domain that you want.
Caton Commercial [willcounty...tcourt.com] engages in this, and seems to find this practice acceptable.
Case 08OV003345 (Score:5, Funny)
Re: (Score:3, Funny)
Re:Glad it's in a reputable media source (Score:4, Funny)
PC LOAD MUSIC (Score:4, Funny)
Re:PC LOAD MUSIC (Score:5, Funny)
WTF does that mean?
Re: (Score:2, Informative)
PC (Paper Cartridge) Load LETTER
(out of letter sized paper)
Re:PC LOAD MUSIC (Score:5, Insightful)
Re:PC LOAD MUSIC (Score:4, Informative)
The term was popularized by the comedy cult film Office Space. Michael Bolton (David Herman), one of the three main characters, reads the error message from the LCD status display on a fax machine, after which he asks, "'PC Load Letter'? What the fuck does that mean?"
Re:PC LOAD MUSIC (Score:4, Funny)
It means you need to restart the printer's download of Geto Boys MP3s.
Sweet! (Score:5, Funny)
Re:Sweet! (Score:5, Interesting)
Re: (Score:3, Informative)
Re: (Score:3, Interesting)
I don't think you can spoof any IP address. I think you'd still need to be on the same subnet/domain in order for routing to work.
You can spoof your neighbor, but you can't spoof something in a different network range.
At least, I don't think you could spoof an arbitrary IP address.
Cheers
Re: (Score:3, Informative)
based on the inconclusive nature of the current monitoring methods, we find that it is possible for amalicious user (or buggy software) to implicate (frame) seemingly any network endpoint in the sharing of copyrighted materials
(emphasis added)
Re:Sweet! (Score:5, Informative)
Sorry, I have to debunk the theory that it is only technically possible to spoof a source address on your local subnet, it's just not true.
First of all, you can send people in your local subnet messages with any fake outside source IP you want, and there are various techniques to convince your local subnet's router to send _you_ the response traffic instead of the rightful recipient, so you can have full socket connectivity in both directions.
(I.E. ICMP redirect packets sent to the default gateway, static routes, etc)
Also, there are methods to spoof source IPs outside your subnet, even when sending to destinations outside your subnet, unless your provider is specifically using techniques to block spoofed traffic (which possibly, some are now).
If you can guess the right sequence numbers and port numbers (very hard), then you can even inject data into someone else's live TCP connection, or just force that connection to close (by sending a RST)
Use of technologies such as SSL or TLS protect against sending unauthorized commands or allowing corrupt data to be transmitted, but don't protect against a third party forcibly closing the connection.
Spoofing outside the subnet is just extremely difficult, and fairly improbable for targets utilizing modern TCP stacks -- but theoretically possible; IRC networks used to have problems with script kiddies generating spoofed clone floods.
(This tactic was thwarted by taking advantage of the fact that spoofed users could effectively SEND spoofed traffic but not RECEIVE messages, so a CAPTCHA-style feature called "nospoof" was introduced into the connection process.)
Receiving traffic in both directions over a spoofed connection is also possible, but hard, I.E. requires hijacking the legitimate equipment's IP, and fooling network equipment into sending traffic to the wrong place (the spoofer's computer).
I'm not saying it's easy, safe, invisible, non-destructive, or you won't easily get caught, but I must say that such spoofing is 100% possible.
Re: (Score:3, Interesting)
Sorry, at some point when it's so extraordinarily difficult to do you just accept that it's impossible. Sending source-routed packets out is very difficult these days unless you have an old school ISP like an AT&T or a business pipe.
Most of the problems of the 90s were indeed solved and much of the issues you describe went the way of the dodo then. At this point is so easy to secure against these types of attacks that any ISP would be negligent not too.
Also most of your techniques involved compromis
Re: (Score:3, Informative)
Yes, we agree exactly. Indirect IP connectivity is through the ISP's router and not a direct connection to your neighbor. Some cable providers don't do this well as you say, they are in the same broadcast domain with their immediate neighbor but there are never very many customers on a single pop.
A good number of ISPs use transparent proxies as you describe as well which further makes direct connection difficult. Of course most of the transparent proxies only function with HTTP traffic so anything with a
Re: (Score:3, Informative)
# ip: Optional. The true IP address of the client machine, in dotted quad format or rfc3513 defined hexed IPv6 address. Notes: In general this parameter is not necessary as the address of the client can be determined from the IP address from which the HTTP request came. The parameter is only needed in the case where the IP address that the request came in on is not the IP address of the client. This happens if the client is communicating to the tracker through a proxy (or a transparent web proxy/cache.) It also is necessary when both the client and the tracker are on the same local side of a NAT gateway. The reason for this is that otherwise the tracker would give out the internal (RFC1918) address of the client, which is not routeable. Therefore the client must explicitly state its (external, routeable) IP address to be given out to external peers. Various trackers treat this parameter differently. Some only honor it only if the IP address that the request came in on is in RFC1918 space. Others honor it unconditionally, while others ignore it completely. In case of IPv6 address (e.g.: 2001:db8:1:2::100) it indicates only that client can communicate via IPv6.
Depending on the tracker, you may be able to impersonate anyone at all.
You're on to something there (Score:5, Interesting)
Apparently since a DDOS is a legal move in this game (if you'll recall the MediaDefender fiasco recently), [slashdot.org] maybe we could use this technique and flood P2P space with false positives.
I'll bet once every single judge in the USA gets a "Cease and Desist" letter they'll eventually see that the RIAA's tactics aren't valid.
Subtlety is not required - brute force it (Score:4, Insightful)
An interested party could figure out a judge's address. And when you've got that then you'd know who their potential local providers are. And once you know those you know the range of possible IP addresses. And once you've got that - brute force. Ping everyone. Any return ping gets a spoofed false positive. Or if you're of the 'nuke it from orbit' mindset, false positive the whole subnet.
Piece of cake. If someone were so inclined, that is. Not that I'd advocate anyone ever doing this, of course. Oh heavens, no.
Wow .... (Score:5, Funny)
"Why would a printer, an inanimate object with no reproductive organs, be downloading pornography? It doesn't fit
Seriously though, it's good to see some credible research demonstrating that the methods that are used to identify file-sharers are completely arbitrary and can't be demonstrated to be valid.
It would be nice to finally have enough evidence that Judges could basically say "Well, this methodology has been dis-credited, you need actual evidence."
Now, if you excuse me, I'm going to try to devise a way to make it look like our printer has been downloading Will Farrel movies and films with Natalie Portman.
Cheers
Re:Wow .... (Score:5, Funny)
Re:Wow .... (Score:4, Funny)
Why the hell is this printer out of toner, again?! And where the hell is all of the kleenex?
Sweet! (Score:5, Funny)
Re: (Score:3, Funny)
And? (Score:3, Funny)
Re:And? (Score:5, Funny)
Re:And? (Score:5, Funny)
Re:And? (Score:5, Funny)
Re:And? (Score:4, Funny)
As I said (Score:3, Funny)
Yay.
Re:As I said (Score:5, Funny)
Re: (Score:3, Interesting)
Good catch. One missing 'n' makes a lot of difference. I *did* preview. And spell-checked. A grammar checker would not have helped.
Oh, well. Have fun.
If the right people get framed... (Score:5, Interesting)
Re: (Score:2)
Clippy helps me steal (Score:5, Funny)
Clippy: Looks like your letter is finished. Would you like me to print it?
Clippy: Looks like you're infringing on a copyright. Would you like me to call you a lawyer?
* Throws computer out window *
Re: (Score:3, Funny)
Clippy: Looks like you're infringing on a copyright. Would you like DVD5 or DVD9?
iron man url and tracker (Score:2)
(just kidding, I'll wait for it to be released on dvd first)
Re:iron man url and tracker (Score:5, Funny)
Ridiculous! (Score:5, Funny)
So, anyone wanna help me get NetBSD on my Epson?
Re:Ridiculous! (Score:5, Insightful)
Too flimsy (Score:5, Insightful)
1. IP addresses can be spoofed.
2. IP addresses assigned by DHCP will not always be assigned to the same MAC address.
Then there's a lot of hand-waving and implications that there's also all kind of other likely flaws in the methods used to find out who's participating in file-sharing.
The worst part of it though is how they throw in the whole thing of "we weren't actually downloading or sharing anything". No, they were just connecting to the tracker. And of course, everyone knows "pirates" commonly connect to torrent trackers to do nothing.
This bothers because if anyone were to point out how weak this case is in main-stream media, it could end up doing more harm than good.
We need some heavy ammo to shut them down, and I'm afraid this is not it.
Re:Too flimsy (Score:5, Insightful)
Well, it does two things.
First, it shows that you can get a subpoena for not actually doing anything illegal. Presumably, connecting to a tracker isn't illegal.
Second, it begins to dispel the myths that the content holders have perpetuated about how they actually gather their evidence and if the collection methodology is valid.
I think actual University research which is covered by the NYT might be an awful good start. It's by no means everything that needs to happen, but starting to establish that their data collection is faulty is better than nothing.
Cheers
Re: (Score:3, Insightful)
The reason is to prevent an "I was framed!" defense as much as preventing framing innocent parties. It's not unheard of for people to plant evidence of their own guilt. Discredit the planted evidence and most people will (reasonably) have a lot of doubt about the rest of it.
Re:Too flimsy (Score:5, Insightful)
Remember, innocent until proven guilty. They aren't even trying to actually determine this.
Re:Too flimsy (Score:4, Insightful)
Re: (Score:3, Insightful)
I.e. linux distro trackers surge in the hours following a release, the curves for TV shows, movies, games, books, whatever.
So long as you don't claim you didn't download anything you have committed an error of omission, not a factual lie (IANAL), assuming you did download the torrent in question. However, so lon
Re:Too flimsy (Score:5, Insightful)
Re: (Score:3, Informative)
The article does talk about mistaken identification based on a shorter DHCP timeout than tracker timeout, which might be closer to what you're talking about. That could be extended by manually setting your IP address to one authenticated by someone else. This is especially possible in a dorm
Re: (Score:3, Insightful)
What I did miss was their explanation in the article on exactly what they did to get the printer implicated.
Re:Too flimsy (Score:5, Insightful)
Re: (Score:3, Interesting)
Re:Too flimsy...not really (Score:5, Interesting)
Re: (Score:3, Informative)
Also, consider this: As commonly compressed, each reported peer takes up essentially 6 bytes; 4 for the IPv4 address, 2 for the port, because the less data the trackers have to push out during a scrape, the better.
That gives a two-third chance that any corruption (undetected by the
Re: (Score:2)
[This] article is very weak . . . [it] only points out two things, both of which are already commonly known by almost everyone in IT.
Granted, but the study is being reported in the New York Times, not a trade magazine. Now we don't have to stroke our neck beards and demand the ignorant just understand, we can just point with "hey, look, it's in the New York Times," and continue to stroke our neck beards because, frankly, it's quite soothing.
The worst part of it though is how they throw in the whole thing of "we weren't actually downloading or sharing anything". No, they were just connecting to the tracker. And of course, everyone knows "pirates" commonly connect to torrent trackers to do nothing.
Here's the detail, though, should connecting to another computer, something as simple as a handshake, immediately trigger a Cease & Desist? If it goes for BitTorrent connections to trackers, why
Re: (Score:3, Interesting)
Not anymore. Thanks to this paper, people are going to connect just to inject noise into the system.
Re: (Score:3, Insightful)
Frame everybody (Score:2)
The time has come (Score:3, Funny)
How you think a singularity will decide to show up in such environment?
has the mafiaa ever fought an IT guy? (Score:4, Interesting)
I'm curious if the 'industry monitoring groups' have ever sent a C/D letter to a clueful sysadmin? we know that most laymen will simply cave in when they receive the 'fact' that their IP address was somehow connected to 'bad traffic'; but I wonder if anyone who knows networking ever called their bluff and really had a court case where he asked for MORE info than simply IP addrs. it would seem that if you can defend yourself in IP networking theory that they really have no firm case on you, especially if you run an 'open wireless AP' and that, itself, could create enough doubt as to who the real 'infringer' really is. they might be able to say its your network but they can't prove its YOU. it could be spyware that somehow got installed on your system. spyware does do 'strange things' as well all know and its not outside the realm of possibility that some virus is connecting to trackers while sitting inside your network. is that really your fault? should you be called 'an infringer' for that?
so I'm really curious if there are any examples of a tech-strong defendant really calling their bluff and demaning fine-grained specific evidence while at court or at some plea bargaining procedure.
Re: (Score:3, Insightful)
'home users' (even clueful ones) often don't keep 'logs' of AP activity. or, they simply roll-over and over-write log data, like a circular buffered log would do.
I keep intrusion logs from my firewall but that doesn't log ALL activity, just break-in attempts. and if you run an open AP that is outside your firewall (as is prudent to do) then there is no NEED to keep a log on that - its 'open' afterall. and if they want to get into your private LAN they need to jump thru your
Re: (Score:3, Informative)
The New Way To Evade Detection (Score:3, Interesting)
2: Set your NATting wireless router to mimic that printer's MAC address.
3: Insert your NATting router between the printer and the LAN and steal its IP address.
4: Connect to router and fileshare to your heart's content.
5: Watch printer be arrested for your piracy.
6: PROFIT!
I have been getting these five years ago (Score:4, Informative)
Eventually we get emails some trade association: "We are asking you in good faith to remove the material that infringes on out IP rights. The site in question is such and such and it contains a copy of a Nintendo game "Mr. Smith's Day Out"" or some other non-sense like that. I found those amusing.
Easier Way to Frame someone (Score:4, Insightful)
A New Plan (Score:3, Interesting)
This just in (Score:3, Insightful)
There. I just saved you 7 pages of walled text.
Blame everyone! (Score:4, Interesting)
Think of it... the most respected and powerful people in every community simultaneously getting bogus cease and desist letters. (Lawyers, judges, politicians, etc...) I'd be inclined to think *something* just might happen after that.
Re: (Score:3, Funny)
Re: (Score:2)
Re:Simply send this message to the printer: (Score:5, Funny)
Networked printer needs paper, badly.
Re: (Score:2, Insightful)
Re: (Score:3, Interesting)
If I go outside every night wearing overalls covered in blood stains, dig holes in my front yard, and bury body sized bundles wrapped in garbage bags every night for a couple of weeks, I'll probably be investigated for murder.
Investigated, sure. They'll cordon off your yard, bring in body-sniffing dogs, dig everything up, search your garbage bags, find nothing, and conclude that you were just fucking with them. They would do this, rather than immediately strapping you to the electric chair, because "first degree hacking up of people into little bits" is a criminal matter, not a civil one, and circumstantial evidence is not sufficient for a criminal conviction. It's not "beyond a reasonable doubt". In the civil arena, though, t
Re:Big surprise! (Score:5, Insightful)
You would be investigated, but if the only evidence presented at the case was the odd behavior you would be found not-guilty. The MPAA/RIAA use the odd behavior as not only the probable cause to investigate but also as the evidence to prosecute.
Re: (Score:3, Funny)
Unless you're black or hispanic and live in Texas.
Re: (Score:3, Interesting)
Re: (Score:3, Funny)
Hm, good point-- I better start using the back yard.
Re: (Score:3, Interesting)
It's not illegal to destroy your own property when you're done with it. Say, to tear up old, out-of-date travel guide books about Spain. It's your property, you can do what you want with it. It's not even illegal to do so on public property. I could do that and throw out the pieces in a public park, for instance.
However, if you try to do that in a public library, some old(er) ladies will have a fit...
When I was in