, SecurityFocus 2008-05-30
Story continued from Page 1
In the latest case, however, MediaDefender's tactics took down a company that appears to be completely innocent.
Like many online firms, Revision3 uses the BitTorrent peer-to-peer file sharing technology to save money. Rather than serve content from a central server -- and footing the bill for the bandwidth fees -- Revision3's use of BitTorrent allows its viewers to quickly download content cached on a collection of users' systems. The video-content creator hosts the central directory, or tracker, that knows the location of the pieces of each file distributed among users' systems.
While content companies have slammed BitTorrent technology in the past because of its association with digital piracy, the companies have now come to embrace the technology.
"BitTorrent is an amazing technology," said MPAA spokeswoman Elizabeth Thompson. "We think it is a phenomenal opportunity to get content out to a lot of people ... but we want to make sure that people use it responsibly."
Because its tracker had problems in the past, Revision3 had turned off a white-list function that had limited the posting of torrents -- files that identify what content is available -- to only corporate employees. The lack of a whitelist allowed file sharers to post torrents pointing to illegal copies of digital content, MediaDefender allegedly told Revision3's executives during a conference call this week. Instead of warning the online video company of the problem, however, MediaDefender exploited the issue to attempt to identify anyone downloading the files, Louderback said.
"Basically, the answer for us from a technical perspective is that we should put a load balancer up there instead of a firewall," Louderback said. "But that is no excuse for what they did to us."
Revision3 will not likely pursue a civil lawsuit against MediaDefender, Louderback said. While the company reported the incident to the FBI and they "appear interested," pursuing legal action may be difficult.
To be a felony violation of computer crime statutes, the company would have to have knowingly accessed Revision3's server without authorization and knowingly caused damage, said Jennifer Granick, civil liberties director at the Electronic Frontier Foundation and a former cybercrime attorney.
"You have to have some knowledge that their access was unauthorized," Granick said. "Did they (MediaDefender) know they were not supposed to put their files up on their (Revision3's) servers?"
Negligently causing damage is typically a misdemeanor, she said.
According to Revision3's summary of the incident, MediaDefender told the video content creator that it had fixed the problem that inadvertently caused the attack. Louderback, however, still wants to recoup the time, effort and advertising revenue lost to the attack.
His solution? "I may send them bill," he said.
If you have tips or insights on this topic, please contact SecurityFocus.
