More on the Brilliant Digital oops - P2P-Zone

pod · 07-04-02, 11:07 PM

/. is running a story on this interesting short article:

http://www.cs.berkeley.edu/~nweaver/0wn2.html

snowman · 07-04-02, 11:45 PM

I was just going to post this.

Something Ihave been saying for months about the P2P programs. This is going to be a real serious problem if their system is co-oped.

Who is to say that the compiled C-NET Morpheus is really the same as the source code that is distributed?

Same goes for all the smaller P2P clients. Even the Kazaa light or the Morpheus light versions. Has any IP addresses been changed in the EXE? Server names in the string tables adjusted to point somewhere else? This stuff is not digitaly signed with somebody vouching for the quality.

JackSpratts · 08-04-02, 12:12 AM

good link guys! it's just the beginning.

- js.

TankGirl · 08-04-02, 12:44 AM

Quote:

Originally posted by JackSpratts
good link guys! it's just the beginning.

This might well kill what is left of FastTrack - especially if some hacker manages to crack the automatic upgrade lock and feed malicious code into the network. Considering how the FastTrack network has been effectively overtaken by Brilliant and millions of computers contaminated by their trojan software that might just be a good thing. Running any FastTrack client - official or 'neutered' - at this stage seems risky.

In retrospect, no wonder that Kazaa wanted to get rid of Morpheus. Realistic or not, Streamcast's business idea is still based on music trading whereas Brilliant wants to change the FastTrack network into a monsterous advertising machine. Well, what else can you expect from guys who pack six different spyware programs into their p2p software. Yikes.

- tg

JohnDoe345 · 08-04-02, 03:04 AM

After reading JackSpratts' thread named Spyware Deluge I'm realizing a new concern about this BDE issue.

The scary thing is that BDE might get away with this plan they are trying to do....well at least at the very early stages until more users become informed. With Kazaa's forum still down, I'm sure there are still many, many Kazaa users out there that don't know about this BDE issue and haven't even taken any steps in ridding themselves of their files.

I'm talking about users like JS's friend who seems to have taken little steps in "protecting" themselves. (sorry JS for using your friend as an example

) It would be great if we could reach all these users and "educate" them on how important it is to clean out their computers. Somehow, I think Kazaa (and to a less extent Morpheus) knew what they were doing by not bringing back their forum. They probably have read forums like here at NU and realize the damage all this information can cause them.

So far I haven't found anything remotely close to BDE on my computer from using Grokster, but after reading pod's link I'm beginning to wonder if FastTrack is really a good choice anymore. I'm continuing to use Grokster because of my website but this may have to change in the future. I guess because of my website I'm going to hold out a little longer and see how this all turns out....I'm hoping that FastTrack might change for the better......

Squid · 08-04-02, 08:40 AM

Some questions posed to BDE by David Coursey of ZDNet:

How is Brilliant's use of Kazaa to propagate its software any different from the distribution methods used by computer viruses? How is Brilliant's software different from a Trojan horse that gives a third party access to a user's computer without his or her knowledge?

You added your user agreement to Kazaa's--so thousands, if not millions, of users have already agreed (in many cases unwittingly) to let you use their computers. Why did you choose this clandestine method of licensing?

You promise that in the future, you'll ask people for permission to use their machines and (somehow) to compensate them. Why are you doing this now? And why didn't you start this way?

Many of the agreements between users and their ISPs prohibit servers, file-swapping services, and sharing Internet connections. Couldn't the Brilliant network cause people to violate these agreements?

Those same ISPs could pay the real price for the Brilliant service, because they'll end up supplying the bandwidth required by your network. Do you have agreements in place with any ISPs to compensate them for use of their networks?

Even if someone knowingly agrees to be part of your network, how can he or she be sure his or her machine will remain secure? For example, let's say someone hacks into the Brilliant network. What's to keep them from infecting every computer on that network with viruses or worse? Suppose they started storing illegal content--child pornography, say--on those machines. Who'd be responsible? Could the cops kick down my door because a hacker put illegal content on my machine using Brilliant's network?

I'm not gonna hold my breath waiting for their answers.

07-04-02, 11:07 PM	#1
pod Bumbling idiot Join Date: Feb 2002 Location: Vancouver, CA Posts: 787	More on the Brilliant Digital oops /. is running a story on this interesting short article: http://www.cs.berkeley.edu/~nweaver/0wn2.html

07-04-02, 11:45 PM	#2
snowman Registered User Join Date: Mar 2002 Posts: 56	you beat me to it! I was just going to post this. Something Ihave been saying for months about the P2P programs. This is going to be a real serious problem if their system is co-oped. Who is to say that the compiled C-NET Morpheus is really the same as the source code that is distributed? Same goes for all the smaller P2P clients. Even the Kazaa light or the Morpheus light versions. Has any IP addresses been changed in the EXE? Server names in the string tables adjusted to point somewhere else? This stuff is not digitaly signed with somebody vouching for the quality. __________________ snow man

08-04-02, 03:04 AM	#5
JohnDoe345 Who's really in control here? Help me... Join Date: Jan 2002 Posts: 222	After reading JackSpratts' thread named Spyware Deluge I'm realizing a new concern about this BDE issue. The scary thing is that BDE might get away with this plan they are trying to do....well at least at the very early stages until more users become informed. With Kazaa's forum still down, I'm sure there are still many, many Kazaa users out there that don't know about this BDE issue and haven't even taken any steps in ridding themselves of their files. I'm talking about users like JS's friend who seems to have taken little steps in "protecting" themselves. (sorry JS for using your friend as an example) It would be great if we could reach all these users and "educate" them on how important it is to clean out their computers. Somehow, I think Kazaa (and to a less extent Morpheus) knew what they were doing by not bringing back their forum. They probably have read forums like here at NU and realize the damage all this information can cause them. So far I haven't found anything remotely close to BDE on my computer from using Grokster, but after reading pod's link I'm beginning to wonder if FastTrack is really a good choice anymore. I'm continuing to use Grokster because of my website but this may have to change in the future. I guess because of my website I'm going to hold out a little longer and see how this all turns out....I'm hoping that FastTrack might change for the better......

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

08-04-02, 12:12 AM	#3
JackSpratts Join Date: May 2001 Location: New England Posts: 10,018	good link guys! it's just the beginning. - js.

08-04-02, 08:40 AM	#6
Squid fish tacos ftw Join Date: May 2000 Posts: 2,809	Some questions posed to BDE by David Coursey of ZDNet: How is Brilliant's use of Kazaa to propagate its software any different from the distribution methods used by computer viruses? How is Brilliant's software different from a Trojan horse that gives a third party access to a user's computer without his or her knowledge? You added your user agreement to Kazaa's--so thousands, if not millions, of users have already agreed (in many cases unwittingly) to let you use their computers. Why did you choose this clandestine method of licensing? You promise that in the future, you'll ask people for permission to use their machines and (somehow) to compensate them. Why are you doing this now? And why didn't you start this way? Many of the agreements between users and their ISPs prohibit servers, file-swapping services, and sharing Internet connections. Couldn't the Brilliant network cause people to violate these agreements? Those same ISPs could pay the real price for the Brilliant service, because they'll end up supplying the bandwidth required by your network. Do you have agreements in place with any ISPs to compensate them for use of their networks? Even if someone knowingly agrees to be part of your network, how can he or she be sure his or her machine will remain secure? For example, let's say someone hacks into the Brilliant network. What's to keep them from infecting every computer on that network with viruses or worse? Suppose they started storing illegal content--child pornography, say--on those machines. Who'd be responsible? Could the cops kick down my door because a hacker put illegal content on my machine using Brilliant's network? I'm not gonna hold my breath waiting for their answers.