Morpheus Users - Sharing More Than They Think? - Page 2 - P2P-Zone

JackSpratts · 04-02-02, 04:17 PM

It's starting to look like this is a very easy to do hack - against inexperienced users but in much the same vain as netstat -n. While different, it doesn't appear now to violate the drives of people who were careful about their set-ups. Although firewalls offer no protection you shouldn't have to worry if you're sure you did your initial share scheme correctly.

I'm going to continue recommending that regular, less savvy users avoid Morpheus until a patch is forthcoming (when that will be is an open question). I can't in good faith expose people to such a ridiculously easy attack. A seven year old can do this for Chr*st sake!

- js.

BuzzB2K · 04-02-02, 04:37 PM

Is this hack only in regards to Morpheus, or All of the FastTrack Clients?

All I have seen mentioned so far is Morphius...

Malk-a-mite · 04-02-02, 04:48 PM

Ok - still playing with this - and the information I have gotten from Jack.

Couple problems as I see them:

Quote:

"Member of the security group 2600 said they have been investigating this problem since coming across it on Friday."

http://news.bbc.co.uk/hi/english/sci...00/1798095.stm

2600 Security Group?
Very unlike Emmanuel Goldstein to post a security flaw in this manner which makes me think this is from a 2600 user group.

This was given to the press and not the security community despite the fact the "discovers" don't even know what the cause of it is:

Quote:

“We’re not sure what it is that makes some Morpheus members vulnerable to this,” said the anonymous security expert. “Potentially this could make every user’s computer available to anyone who wants to have a look at it.”

Conflicting reports as to if this effects Win9X paltforms, NT based systems or all of them. The "exploit" Jack has been speaking directly of is something that would only affect NT based systems. The idea behind it is simple enough and just involves someone sharing their boot drive by mistake.

I'm still waiting for more information - such as a supernode bufferoverflow - but at the moment the method by which this has been brought forth isn't giving me much faith in this group or "exploit".

We shall see - since most of us can afford to go without filesharing for a week might as well sit back and see what happens.

*shrug*

JackSpratts · 04-02-02, 05:01 PM

in the meantime...who hacked my manners!?

welcome to the board Ethen

. we're glad to call you a member! hope you find the info and community here at NU productive and entertaining

- js.

BuzzB2K · 04-02-02, 05:54 PM

Quote:

Originally posted by JackSpratts
in the meantime...who hacked my manners!?

welcome to the board Ethen. we're glad to call you a member! hope you find the info and community here at NU productive and entertaining

- js.

Great, now we have to worry about hacked manners as well?!?!

Welcome to the underground Ethen, I was so wrapped up in this "Morpheus Hack" issue I didn't even notice a new voice contributing to the discussion!

Make yourself at home, I am sure you will find it informative, at times fascinating and always entertaining here!!

Mowzer · 04-02-02, 07:47 PM

TankGirl · 04-02-02, 07:58 PM

Hi Ethen

, a warm welcome to you - I hope you enjoy your stay on the board!

- tg

JohnDoe345 · 04-02-02, 11:15 PM

This issue is becoming more problematic then I first thought. Thanks JackSpratts for digging deeper into the problem and not brushing it off so quickly like some of us.

If this is all true it just gives us more reasons to want version 2.0 to come out soon. Hopefully, they won't add 10 more bugs or security problems while they are at. I've been looking for more information about version 2.0 but it's just as hard to find as looking for information about this security issue.

As usually keep up the go work of informing us JS

AYB · 05-02-02, 03:32 AM

Is someone going to post details of the hack or would that be irresponsible?

Malk-a-mite · 05-02-02, 03:37 AM

Quote:

Originally posted by AYB
Is someone going to post details of the hack or would that be irresponsible?

If what Jack is suggesting is the hack it's not a hack at all just some users with the sharing on their drives wrong.

The basics of the one is just searching for a file that would only be on the root drive (such as autoexec.bat, command.sys) that gives you a list of people with root shared on their drives.

I'm still waiting to see if there's anything more to this.....

indiana_jones · 05-02-02, 05:52 AM

hey AIB
since with your MorpheusX you go through all d/l items, can you detect uploads with blank usename and automatically cancel them - would be a nice feature - ain't it?
indy

AYB · 05-02-02, 06:14 AM

Could do indy, same issue with refreshing paused downloads tho (i.e. reading whether they are paused or not). Should have a fix for that soon tho so could be possible

Reason I ask for details on the hack is because I want to know whether its worth coding a 3rd party fix for it...

BuzzB2K · 05-02-02, 03:55 PM

Quote:

Originally posted by TankGirl
If this is not a hoax, it is worrying news... BUT the story is very vague, referring to unidentified 'secury experts' that had obviously contacted BBC News Online directly before publishing any details of their findings in security-related bulletins... and BBC's comment sounds odd and uninformed to say the least:"It's definitely an accident from Morpheus' side, probably a worm. This is very dangerous."

If there is anything real to it, we should know in a few days from more reliable sources.

- tg

I have mentioned some of these sources before, but there are some newer developements and a new link to a posting at Gnutella.com.

Well, as you can see at the attached links the PAUL-SARSFIELD posts are spreading around the various forums.
They are all copies of the same post I first saw at Zeropaid
The latest is at Gnutella.com - General Discussion: MORPHEUS SECURITY HOLE. -PAUL SARSFIELD- and is being debunked by KayaMan -MusicCity IRC Admin who is taking it rather personal...

Quote:

Subject: Re: MORPHEUS SECURITY HOLE. -PAUL SARSFIELD-
Date: February 5, 2002 @ 1:14 PM
The above post as " FROM: PAUL SARSFIELD, MORPHEUS"
is a FAKE being posted all over discussion boards by lamers attempting to defame MusicCity IRC Ops and the Morpheus Program itself. Pauls 'Gamer' real response can be seen here: www.gamerspage.com/morpheus.htm

-MusicCity IRC Admin
KayaMan
chat.musiccity.com/kaya.html
kayaman.net

P.S. Paul Sarsfield (Gamer) is one of the MusicCity IRC Ops (you can locate him in #help)

:smokin Buzz

P.S. I originally wrote this posting on onother another P2P Board and the Only bits of code to carry over correctly were the [b] & [quote]

JackSpratts · 05-02-02, 04:33 PM

Grokster is somewhat bent about that paul post too -

From their forum:
"Also the so called "Musiccity Support Technician" is clearly no such thing and that is a totally bogus post and he is misrepresenting himself. This is true for many reasons, but a couple of the more obvious are:

1) MusicCity is not known for issuing any type of support emails, and

2) Even if they had, why would they talk about Grokster, let alone claim they would post something on our website?

Other than sharing the same network, Grokster has absolutely no business connections to Morpheus and we certainly would not allow them to post anything to the Grokster website, now would we?

" - Support

oohkayyy.

- js.

BuzzB2K · 05-02-02, 04:52 PM

Quote:

Originally posted by JackSpratts
Grokster is somewhat bent about that paul post too -

1) MusicCity is not known for issuing any type of support emails

- js.

I think that one line speaks volumes...

04-02-02, 04:37 PM	#22
BuzzB2K Just another cat on the FastTrack... Join Date: Jan 2002 Location: Hamilton Posts: 727	Just Morpheus? Is this hack only in regards to Morpheus, or All of the FastTrack Clients? All I have seen mentioned so far is Morphius... __________________ Buzz FastTrack Central - FastTrackMovies.com - Sig2dat for Idiots

04-02-02, 07:47 PM	#26
Mowzer ' Join Date: Jan 2002 Posts: 209	Back door's for the RIAA . Last edited by Mowzer : 23-06-02 at 07:42 PM.

04-02-02, 11:15 PM	#28
JohnDoe345 Who's really in control here? Help me... Join Date: Jan 2002 Posts: 222	thanks JS This issue is becoming more problematic then I first thought. Thanks JackSpratts for digging deeper into the problem and not brushing it off so quickly like some of us. If this is all true it just gives us more reasons to want version 2.0 to come out soon. Hopefully, they won't add 10 more bugs or security problems while they are at. I've been looking for more information about version 2.0 but it's just as hard to find as looking for information about this security issue. As usually keep up the go work of informing us JS

05-02-02, 05:52 AM	#31
indiana_jones B2B Protagonist ... Life is ... Bubble to Bubble ... Beer to Beer ... love a VLAIBB (Very Lonesome Artificial Intelligence Brained Bubble) @ http://www.geocities.com/vlaibb vlaibb@yahoo.com Join Date: Jan 2002 Posts: 206	hey AIB since with your MorpheusX you go through all d/l items, can you detect uploads with blank usename and automatically cancel them - would be a nice feature - ain't it? indy __________________ VLAIBB - The Ultimate Gateway to P2P Sites File: surprise.mp3 Length:5845871Bytes UUHash:=1LDYkHDl65OprVz37xN1VSo9b00= Copy the lines above and use 'Paste from Clipboard' function of sig2dat 3.11.a (supports quicklinks) to create a startfile for your FastTrack p2p client for safe download

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

04-02-02, 04:17 PM	#21
JackSpratts Join Date: May 2001 Location: New England Posts: 10,017	It's starting to look like this is a very easy to do hack - against inexperienced users but in much the same vain as netstat -n. While different, it doesn't appear now to violate the drives of people who were careful about their set-ups. Although firewalls offer no protection you shouldn't have to worry if you're sure you did your initial share scheme correctly. I'm going to continue recommending that regular, less savvy users avoid Morpheus until a patch is forthcoming (when that will be is an open question). I can't in good faith expose people to such a ridiculously easy attack. A seven year old can do this for Chr*st sake! - js.

04-02-02, 05:01 PM	#24
JackSpratts Join Date: May 2001 Location: New England Posts: 10,017	in the meantime...who hacked my manners!? welcome to the board Ethen. we're glad to call you a member! hope you find the info and community here at NU productive and entertaining - js.

04-02-02, 07:58 PM	#27
TankGirl Madame Comrade Join Date: May 2000 Location: Area 25 Posts: 5,587	Hi Ethen , a warm welcome to you - I hope you enjoy your stay on the board! - tg

05-02-02, 03:32 AM	#29
AYB Registered User Join Date: Jan 2002 Posts: 82	Is someone going to post details of the hack or would that be irresponsible?

05-02-02, 06:14 AM	#32
AYB Registered User Join Date: Jan 2002 Posts: 82	Could do indy, same issue with refreshing paused downloads tho (i.e. reading whether they are paused or not). Should have a fix for that soon tho so could be possible Reason I ask for details on the hack is because I want to know whether its worth coding a 3rd party fix for it...

05-02-02, 04:33 PM	#34
JackSpratts Join Date: May 2001 Location: New England Posts: 10,017	Grokster is somewhat bent about that paul post too - From their forum: "Also the so called "Musiccity Support Technician" is clearly no such thing and that is a totally bogus post and he is misrepresenting himself. This is true for many reasons, but a couple of the more obvious are: 1) MusicCity is not known for issuing any type of support emails, and 2) Even if they had, why would they talk about Grokster, let alone claim they would post something on our website? Other than sharing the same network, Grokster has absolutely no business connections to Morpheus and we certainly would not allow them to post anything to the Grokster website, now would we? " - Support oohkayyy. - js.