Anti-piracy outfit hires VPN expert to help track down The Pirate Bay

https://torrentfreak.com/anti-piracy-outfit-hires-vpn-expert-to-help-track-down-the-pirate-bay-200821/

by Cantbekhan • 6 years ago

136 84 6 years ago

capableweb5• 6 years ago

“Although [OVPN] strive to store as little data as possible, there must be data connecting users and identities to make the VPN service work. In this case, a user has paid for a VPN account with the ability to connect a public static address to OVPN which the user has then chosen to link to the file sharing site ‘the piratebay’, i.e the user has configured his VPN account to point to the given domain.”

The article doesn't seem to go into why a VPN service _must_ have data connecting users and identities. AFAIK, Mullvad allows you to be completely anonymous with your purchase, granted they throw away the IP who made the purchase, which doesn't seem impossible to do. Simply store no data about the transactions and you have no data about it. Not sure I see the reason there has to be data about it.

ubercow13• 6 years ago

I think the article covers that. They are hosting a website at a static IP, so a mapping of public IP -> secret IP must be stored somewhere. They are hoping that knowing this secret IP will let them find their true hosting provider.

javajosh• 6 years ago

That's true - even if it's in memory somewhere the record exists, and is readable.

cesarb• 6 years ago

They are hosting a website at a static IP, so a mapping of public IP -> secret IP must be stored somewhere.

Not necessarily. The stored mapping could also be public IP -> username, plus a separate mapping username -> password or username -> key; with a mapping public IP -> TCP connection or public IP -> UDP connection existing only in memory and only while the connection is active. And from what I understood from the article, and from an earlier article linked to by the first link in this article, the connection has last been active in June.

wizzwizz4• 6 years ago

Sure, that works for outgoing connections. Incoming, though? Not so much; it has to know where to send the data.

mac01021• 6 years ago

If you pay with a credit card, then they at least need to keep track of which account to deactivate when the card stops paying.

capableweb5• 6 years ago

Depends on the implementation. Not sure exactly how OVPN works, but with Mullvad it works by top-up the account, so no need to keep track of CC <> Account number. When the account runs out, the VPN simply stops working until you refill.

mattmanser• 6 years ago

Not if you just buy credits in advance for an account.

blindm3• 6 years ago

AFAIK, Mullvad allows you to be completely anonymous with your purchase

I paid for Mullvad with Paypal and they used my Paypal email as the login email! Strange that they done that. Never assume a Paypal email is the one a user will use for the login. I like to compartment my emails for different things, so one dedicated to Paypal, another specifically for Mullvad etc

capableweb5• 6 years ago

they used my Paypal email as the login email

Login email? There is no such thing in Mullvad. All you have is a Account Number, and there should be no identifiers beyond that. Where do you even find any inputs to enter your email?

SahAssar• 6 years ago

I paid for Mullvad with Paypal

Well, there's your problem. If you want to be anonymous don't use payment methods that aren't.

they used my Paypal email as the login email!

Mullvad has no login email at all. You seem to be mistaken.

bsaul2• 6 years ago

Why not hit at the DNS registrar ?

TheNorthman2• 6 years ago

I'm not sure what you mean, that is where they started. The full story is as follows: Their DNS registrar stores the following A records for `thepiratebay.org`:

  ;; ANSWER SECTION:
  thepiratebay.org. 300 IN A 162.159.136.6
  thepiratebay.org. 300 IN A 162.159.137.6

Those IPs are owned by Cloudflare. The Rights Alliance then asked Cloudflare what IP address those IPs redirect cache-misses to. Cloudflare then gave them an IP address that belongs to a Swedish ISP. In turn, that ISP pointed to the VPN provider `OVPN.se` as the user of that IP address.

This article then updates on a lawsuit between the Rights Alliance and the VPN provider, since they're refusing to give out the VPN user of that IP address (because they can't).

0xbkt• 6 years ago

These IP addresses are also routed through so-called premium PoPs of Cloudflare. I get never routed through IST when connecting to websites on Free plan. Seeing that Cloudflare accepts card payments and PayPal only, why the adversary is not focusing on the payment method that made the purchase?

cosarara• 6 years ago

Who's paying the registrar? Can DNS records be paid for anonymously?

Mountain_Skies• 6 years ago

IIRC, they have had their DNS entry cancelled before and at one point was briefly registered in North Korea. Not sure this is the best course of action especially since it can be abused for other purposes once a system is in place for making it possible.

hcrean• 6 years ago

They can do this without keeping any meaningful information quite easily: They sign a client certificate with an expiry date at time of purchase using their CA private key (that the court obviously can't force them to give up, HSM etcetera).

Into the client certificate's DN or extended field they write the allocated public IP.

The only information they need to store is that that IP is spoken for and not to be allocated again. They could also work this out on the fly.

When the client comes to connect, they note that the certificate is signed and presented, and they route the public IP to the in-tunnel address of the peer, which they will have standardized to something meaningless like 10.0.0.2

As long as they don't log anywhere in the process, the signing of certificates means you don't have to remember the client at all.

mindslight3• 6 years ago

The certificate approach has the advantage of the server storing nothing at all, but a standard username+password could accomplish something similar. It's not a big deal if the result of the query is a username and password. The central question is what type of records they kept for the payment.

lstamour2• 6 years ago

Username and password doesn’t inherently have an HMAC+timestamp, so it has to be kept alongside payments. A certificate could be a one-time transaction, so the payment could be logged while the certificate is issued, the only worry after is if timestamps are present in the transaction method and timestamps are present (obviously) in the certificate, then correlation is still possible. Perhaps a workaround would be to take orders at any time but process orders in batches, where payment for all customers and certificate issuance for all customers happen at the same time/date. Or decouple certificate issuance from payment such that payment can occur any time and what is provided is a certificate that was previously generated/allocated at the start of the month or year. The downside to the preallocation is that the certificate private key would also have to be known in advance, it weakens security, but is perhaps an acceptable trade off for privacy. If transaction proof is possible, perhaps again with an hmac secret, you could provide proof of transaction at the start of the next month to keep the certificate issuance secure by presenting and issuing key material at a later date from when the transaction occurred. Actually, an hmac probably isn’t tamper-resistant enough given its value, unless you include a timestamp and correlate to transaction dates, or use a really long secret, or both and rotate the secret, perhaps. So you’d exchange payment for tokens, and tokens for certificates, decoupling the two. If your tokens are trusted, you could sell multi-year certificates or multiple tokens at the same time at the cost of reduced privacy if different features or timestamps are present in the tokens or transaction cost.

kyran_adept• 6 years ago

Your method is probably the best you can do. I think the security firm claims, that while the tunnel is up, there is a connection - actual TCP connection, or UDP stream - that associates the client IP to the socket in the VPN infrastructure. If you could intercept that data and track it inside their infra, you could discover what IP PirateBay has on their backend.

TekMol• 6 years ago

Do I understand it correctly, that torrents are sent directly from user to user and that the Pirate Bay is only needed so the users find each other?

Like someone wants to know "Which user that is online now has The Matrix?" and then queries PB to get IPs of such users?

toomuchtodo• 6 years ago

Correct, the Pirate Bay simply hosts magnet links, which contain cryptographic hashes for the torrent contents and where to bootstrap the transfer from.

https://en.wikipedia.org/wiki/Magnet_URI_scheme

magicalhippo• 6 years ago

It's based on Kademlia[1], a distributed hash table for P2P networks. It's pretty neat, and used by other software as well.

[1] https://en.wikipedia.org/wiki/Kademlia

TheJoeMan• 6 years ago

That’s what’s so crazy, TPB doesn’t host or distribute any content. All they do is serve you a “magnet link” which means when you put “Titanic” in the search box they give you a string that uniquely identifies one specific copy of the movie. You then paste it into other peer-to-peer software.

the_pwner224• 6 years ago

No, TPB doesn't do that. Normally you would have a .torrent file which is a small file containing metadata (name, files in torrent) and a list of trackers which are servers that keep track of the peers. You acquire a .torrent, open it with a torrent client, and it connects to the trackers to get a list of peers and start p2p sharing. Peers can also directly exchange more peer information when connected.

Instead of a .torrent file you can instead use a magnet link which is a magnet://... that contains the same information. TBP hosts a lot of magnet links. Basically like if you made a webpage with a list of a bunch of hyperlinks to websites like google.com, and allowed people to submit more hyperlinks. You're not distributing the google.com page content, just links to the location of the information. Except instead of links that tell you where to find http webpages it's links that tell you where to find a torrent.

manigandham• 6 years ago

Pirate Bay is only needed to find the metadata for a given torrent so that users can then find each other.

flyGuyOnTheSly• 6 years ago

I don't understand how various governments cannot simply seize the domain at the registrar level?

Why chase them around the world through VPN providers if you can cut them off at the knees?

teddyh• 6 years ago

piratebayztemzmv.onion

McDyver• 6 years ago

This issue is due to copyright claims being enforced by Rights Alliance on behalf of big studios.

The Pirate Bay has a different view on copyright, file sharing and civil liberties.

This different in points of view is mainly ideological or political.

Governments and political views _should_ stay out of internet management, otherwise the remaining independence will be gone very soon

wongarsu• 6 years ago

It appears like actual court orders to force registrars to take down domains are hard to come by in Canada (where the registrar is incorperated), and their registrar famously refuses to take down domains just because someone writes a sternly worded letter asking for it [1]

Plenty of countries block or blocked the domain at ISP level.

https://en.wikipedia.org/wiki/EasyDNS#Controversies

salawat2• 6 years ago

Furthermore, DNS isn't necessary. From the inception of computer networking, it has only ever been a usability and discovery aid, that has arguably introduced more centralized control mechanisms than anyone intended.

If you think TPB is hard to legally pin down now, I can't wait to see the come-to-Jesus moment when authorities (in the U.S. in particular) have to come to terms with "the Pirate Bay" being nothing more than a nominative signpost passed between users, and the entity merely existing as a set of services popping up for a while on one IP address or another, with news of transfers spread by word of mouth, and someone has the chutzpah to challenge enforcement on free speech grounds.

This is why this Pirate Bay crusade is a losing gambit. Everyone isn't going to start using the abusive service providers in town just because you shut down one tunnel or branch of the local speakeasy.

Squash one, another pops up, because information wants to be free. You've already got private trackers that are very particular about the people they support, and actively forbid easy onboarding in order to keep the edifice from being trivially subverted by adversaries.

The natural state of human beings is change from the now to the ideal. Content creation companies are guilty of demanding the overly ambitious carve outs that lead to things like TPB existing at all. Get things more reasonable, and work on being better at making content on demand quickly accessible and cross-referenceable and you have a service that people will generally pay for either straight up, or by other means such as time and awareness. Clamp down on information dissemination, and watch as the castle sinks as the sand that would otherwise buoy it up screw off elsewhere where artificially barriers to getting things done aren't erected.

evo_9• 6 years ago

I’ve wondered for a while why eztv.it doesn’t get any such attention and they’ve been around for nearly as long.

crtasm• 6 years ago

Less of a cool brand? Plus it had a hostile takeover some years ago, original operators are no longer involved.

josho• 6 years ago

This illustrates just how hard it is to stay anonymous while conducting commerce. Ie. the pirate bay has been de-anonymized across several political jurisdictions and is one VPN bug or compromise away from being exposed and being shutdown again.

And is interesting to contrast to how seemingly easy it is for the wealthy (people and corporations) to Legally hide their wealth to minimize their taxes.

It’s telling who really has the power.

Fezzik2• 6 years ago

Let’s be honest, The Pirate Bay exists and is primarily used to illegally download porn, movies, video games, and other software. You can try to sugar coat what PB can theoretically be used for, but that’s not what it is actually used for. A fraction of a fraction of the data transactions that originate from the PB are for “conducting commerce”. I have no idea what that has to do with people legally following tax codes in multiple jurisdictions for their own financial gain... that just seems smart.

Edit, to add: given what the PB is generally used for, people should not be surprised that content creators are hiring people to try to disrupt its existence.

prophesi• 6 years ago

It's an odd time to tackle PB for these issues, however. The convenience of streaming services is well worth the cost to most people. Credential sharing is likely a much bigger issue for these markets.

kgwxd• 6 years ago

Just because it's illegal, doesn't mean it's wrong.

floatboth• 6 years ago

Huh? I would assume that "conducting commerce" means TPB selling ad space..

sixothree• 6 years ago

I have Netflix, Youtube TV, Tivo with OTA, Amazon Prime, Apple TV (from new iphone). I have no problem acquiring new subscriptions.

I still grab stuff off TPB just because it's easier, faster, and more convenient. I cannot stand this cluster-f of gimped interfaces (eg. youtube on pretty much any device), dangling boxes, remote controls, and hdmi switches.

I don't have time for all that crap. TPB downloads appear right at the top of the list of my primary device.

I don't mind paying. But we have to admit television is a mess right now and tpb fixes that mess.

edit: obvious caveat I'm sure many people on tpb are pirate

esarbe• 6 years ago

Bah. The powers that be are abusing their influence over the legislative to completely pervert the original intent of the copyright system. I have not problem whatsoever with TPB existing and applaud its continued presence on the web.

I guess with "Content creators" you mean the multinational corporations that bind the artists, rob them of their creations and strip them of their ability to ever be able to make money from their art?

grawprog• 6 years ago

illegally download porn

People use torrents to download porn? Actually? Why? Why would someone spend the time to torrent porn when there's a bajillion instantaneous free ways of seeing porn?

Viliam1234• 6 years ago

Let’s be honest, The Pirate Bay exists and is primarily used to illegally download porn

The plebs have digital porn, the rich have Epstein's phone number. A lot of resources is spent investigating the former...

vangelis• 6 years ago

Once you stop trying to shove DRM into everything, maybe people will pirate less.

toyg2• 6 years ago

is one VPN bug or compromise away from being exposed

You assume they use one vpn, after the sort of attack they suffered in the past? That's naïve.

TPB, by now, is likely a marvel of security engineering. They've definitely put too much trust in legal systems in the past, but I bet they won't make that mistake again.

latchkey• 6 years ago

It would be neat if they could document their setup so that others could benefit and replicate it, but in doing so, that would likely expose them.

CraneWorm3• 6 years ago

Is TPB relevant? I feel like it's gone stale and the knowing crowd moved to other sites (or has been using private trackers since always).

This is very much a witch-hunt for publicity.

akvadrako• 6 years ago

The Pirate Bay is still relevant for me; I’ve even setup my own proxy to avoid ISP blocks. It’s not stale - new stuff is added within a day or two of release.

But it’s less important than it used to be.

CraneWorm3• 6 years ago

Thanks for chiming in!

Myself, I had trouble accessing it often enough to seek alternatives.

Would you be able to comment on the accounts? Can you still register one? Do new releases have comments/larger discussions?

Beaver117• 6 years ago

True, I don't have any traffic numbers but based on some content lacking on TPB and present on other sites, I'd say the current king is somewhere else.

toyg2• 6 years ago

Is TPB relevant?

Its relevance, by now, is more political than practical.

baby• 6 years ago

What other sites?

CraneWorm3• 6 years ago

there is a sub-reddit, the name rhymes with privacy ;)

Mediterraneo10• 6 years ago

For me, TPB became irrelevant once high-speed broadband and cheap multi-terabyte storage became available. Today (and really for the past decade) there is no reason not to torrent full-size Blu-ray images or remuxes, but TPB never abandoned an overall culture of sharing only small-size and usually low-resolution transcodes.

stOneskull• 6 years ago

there's a world of people without that broadband and storage.

LifeLiverTransp• 6 years ago

Anti-Piracy wont save any industry which falls for revenue into the panem and circensis category. Your products price-points are capped by a political consesus to keep the population peacefull.

dependenttypes• 6 years ago

TPB used to host db dumps at https://thepiratebay.org/static/dump/ which would be useful in case it was ever taken down but it seems that they removed them.

Yc4win3• 6 years ago

TPB has been successfully hiding for ages, I sincerely doubt just hiring an expert opinion on the matter will stop them.

Long live the Jolly Rodger! :)

biolumonix• 6 years ago

But aren't there multiple hosts for TPB?

Anti-piracy outfit hires VPN expert to help track down The Pirate Bay

Related Stories