Feeds

Old Morpheus still works for unhacked users

P2P networks hack given a fresh twist

  • alert
  • submit to reddit

Website security in corporate America

Updated Older versions of the Morpheus file sharing utility still work, Register readers have discovered to their surprise.

Earlier this month Music City Morpheus ditched support for the P2P stack supplied by developer FastTrack and embraced the open source Gnutella protocol, with the launch of Morpheus Preview Edition.

The move was accompanied by accusations from Morpheus that its servers had been subject to a denial of service attack, and that messages which changed its users' registry setting had made the service unavailable.

Music City pointed the finger of blame towards KaZaA.com (recently acquired by Sharman Network Services), which like MusicCity's Morpheus and Grokster has licensed the FastTrack P2P stack. MusicCity described FastTrack-KaZaA software as a security risk (or a vector for spyware).

Not so, says FastTrack-KaZaA.

KaZaA founder Niklas Zennstrom told CNet that StreamCast Networks, the firm behind Music City Morpheus, had failed to pay its bills, so the license for its P2P stack was terminated.

Sharman Network Services and KaZaA deny any involvement in the hacking attacks, and Sharman has issued a statement saying KaZaA.com was also subjected to malicious DoS attacks.

On February 28, the KaZaA.com Web site was "bombarded by hundreds of thousands of http requests", which prevented users from accessing the site or downloading KaZaA Media Desktop 1.5 for five hours, it said.

Whoever did it is hard to say, but we've recently received evidence that someone with in-depth knowledge of KaZaA has been playing silly buggers.

Shenanigans

Register reader Haavard Pettersen's recent experiences suggest someone had indeed tampered with people's computers to prevent them from using Morpheus.

When Pettersen tried to use an older version of Morpheus (on a Windows 98 partition), that hasn't been used since before Morpheus went down, he discovered to his surprise that it still worked.

In XP, he couldn't get either old Morpheus or Preview Edition to work, incidentally.

Russ Spooner, a security consultants at Interrorem and former Morpheus user, confirms Pettersen's experience.

"Clearly the FastTrack client part of the software (used in KaZaA, Grokster and Morpheus) has a backdoor in it that allows the knowledgeable few to fire special packets at clients logged into the FastTrack network which will enable them to modify registry settings," Spooner told us.

"It would appear that for a period of time they had effectively a login script sitting on the authentication servers that basically said 'if (client==morpheus ){ modify registry}'," he added.

The offending login script has now been removed, he notes, so now the original clients work fine, "just so long as they were not exposed to the evil pathogen".

Sharman Network Services (which contrary to what we earlier reported only licenses the FastTrack stack) referred our queries on this to KaZaA founder Niklas Zennstrom. We'll fill you on what he says when he gets back to us.

Both Morpheus and KaZaA are embroiled in copyright violation lawsuits brought against them by the music industry. Yesterday StreamCast Networks announced plans to use digital rights management technology called CintoA to protect the copyright of independent artists, while allowing its users to continue sharing free files.

Whether this will appease its critics, such as the Recording Industry Ass. of America and the Motion Picture Ass. of America, seems doubtful. ®

Related stories

Morpheus fesses up to user lockout security breach
Morpheus goes to sleep - users locked out
Morpheus application is 'safe'
KaZaA.com 'evaluates' Dutch court ban
Ala-KaZaA-m!
KaZaA ordered to cease infringing copyright
Napster to ask court to reaffirm Appeal Court ruling
Get your filthy hands off my CDs
RIAA targets post-Napster MP3 sharers
Popular file-share utilities contain Trojans

Choosing a cloud hosting partner with confidence

More from The Register

next story
'Windows 9' LEAK: Microsoft's playing catchup with Linux
Multiple desktops and live tiles in restored Start button star in new vids
Not appy with your Chromebook? Well now it can run Android apps
Google offers beta of tricky OS-inside-OS tech
New 'Cosmos' browser surfs the net by TXT alone
No data plan? No WiFi? No worries ... except sluggish download speed
SUSE Linux owner Attachmate gobbled by Micro Focus for $2.3bn
Merger will lead to mainframe and COBOL powerhouse
iOS 8 release: WebGL now runs everywhere. Hurrah for 3D graphics!
HTML 5's pretty neat ... when your browser supports it
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
NHS grows a NoSQL backbone and rips out its Oracle Spine
Open source? In the government? Ha ha! What, wait ...?
Google extends app refund window to two hours
You now have 120 minutes to finish that game instead of 15
Intel: Hey, enterprises, drop everything and DO HADOOP
Big Data analytics projected to run on more servers than any other app
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.