Seized Megaupload Domains Link to Scam Ads and Malware

Well over three years have passed since Megaupload was shutdown, but there is still little progress in the criminal proceedings against the operation.

The United States hopes that New Zealand will extradite Kim Dotcom and his colleagues, but the hearings have been delayed several times already.

Meanwhile, several domain names including the popular Megaupload.com and Megavideo.com remain under the control of the U.S. Government. At least, that should be the case. In reality, however, they’re now being exploited by ‘cyber criminals.’

Instead of a banner announcing that the domains names have been seized as part of a criminal investigation they now direct people to a Zero-Click adverting feed. This feed often links to malware installers and other malicious ads.

One of the many malicious “ads” the Megaupload and Megavideo domain names are serving links to a fake BBC article, suggesting people can get an iPhone 6 for only £1.

And here is another example of a malicious ad prompting visitors to update their browser.

The question that immediately comes to mind is this: How can it be that the Department of Justice is allowing the domains to be used for such nefarious purposes?

Looking at the Whois records everything seems to be in order. The domain name still lists Megaupload Limited as registrant, which is as it was before. Nothing out of the ordinary.

The nameserver PLEASEDROPTHISHOST15525.CIRFU.BIZ, on the other hand, triggers several alarm bells.

CIRFU refers to the FBI’s Cyber Initiative and Resource Fusion Unit, a specialized tech team tasked with handling online crime and scams. The unit used the CIRFU.NET domain name as nameserver for various seized domains, including the Mega ones.

Interestingly, the CIRFU.NET domain now lists “Syndk8 Media Limited” as registrant, which doesn’t appear to have any connections with the FBI. Similarly, CIRFU.BIZ is not an official CIRFU domain either and points to a server in the Netherlands hosted by LeaseWeb.

It appears that the domain which the Department of Justice (DoJ) used as nameserver is no longer in control of the Government. Perhaps it expired, or was taken over via other means.

Link (TorrentFreak)

White House sides with Oracle, tells Supreme Court APIs are copyrightable

This is, to put it mildly, a disaster for anyone who does programming

The Justice Department is weighing in on the hot-button intellectual property dispute between Google and Oracle, telling the Supreme Court that APIs are protected by copyright.

The Obama administration’s position means it is siding with Oracle and a federal appeals court that said application programming interfaces are subject to copyright protections. The high court in January asked for the government’s views on the closely watched case.

The dispute centers on Google copying names, declarations, and header lines of the Java APIs in Android. Oracle filed suit, and in 2012, a San Francisco federal judge sided with Google. The judge ruled that the code in question could not be copyrighted. Oracle prevailed on appeal, however. A federal appeals court ruled that the “declaring code and the structure, sequence, and organization of the API packages are entitled to copyright protection.”

Google maintained that the code at issue is not entitled to copyright protection because it constitutes a “method of operation” or “system” that allows programs to communicate with one another.

Link (Ars Technica)

TSA Body Scanner Lobbyist Now Overseeing Spending on TSA Security

Rapiscan Systems lobbied aggressively to win a major contract with the Transportation Security Administration to provide X-ray body scanners at airports, only to lose the contract in 2013 after the company failed to deliver software to protect the privacy of passengers.

Rapiscan now has a friend on the inside.

Earlier this month, Rapiscan lobbyist Christopher Romig took a job with the House Appropriations Committee’s Homeland Security Subcommittee, which oversees the TSA budget.

During the previous push for a TSA contract, Rapiscan employed Michael Chertoff, former Secretary of Homeland Security, who now works as a pundit and a homeland security industry consultant through his firm the Chertoff Group. According to the Huffington Post, Rapiscan previously spent as much as $271,500 on lobbying per year to help secure business with the TSA.

Romig’s shift through the revolving door was first noted by Legistorm.

In his last lobbying filing statement, Romig disclosed that he lobbied Congress on “aviation, port and border security,” as well as the “budget and appropriation.” All areas he will now supervise as a professional staff member.

Link (The Intercept)

Chicago Police Put Antlers on Black Man and Posed for Pictures –

The photo shows two white Chicago Police officers posing with an unidentified black man. The officers — Timothy McDermott and Jerome Finnigan — are holding rifles as the black man lies on the floor with a dazed look on his face and with antlers on his head as if he were a prized, big buck finally hunted down.

Finnegan is smiling and grabbing the right antler, while McDermott is holding up the man’s head as if it were his trophy.

The photo was taken in a police station on the West Side of Chicago sometime between 1999 and 2003. The Chicago Police Department successfully kept it hidden from the public until a judge refused to keep it under seal and the Chicago Sun-Times pulled a copy from a court filing.

Finnigan is a notoriously dirty ex-cop who was a member of the police department’s elite Special Operations Section (SOS) until 2006, when he was charged with leading a gang of fellow officers who robbed suspects, illegally invaded homes and stole thousands of dollars in cash. He’s now serving 12 years in federal prison.

In a 2012 interview with Playboy, Finnigan admitted the SOS beat and tortured multiple suspects, and described shutting down an internal affairs investigation by appealing to one of his comrades in blue who worked in the Internal Affairs Division.

Link (The Intercept)

Court scolds copyright troll Malibu Media for improper litigation tactics

An Ohio Judge Timothy Black clearly understands the shakedown nature of the Malibu Media/XArt pornotrolling cases, and he is irritated. Judge Black admonished the troll on more than one occasionin the past, and I find it astonishing that Malibu’s local, telephonophob Yousef Faroniya, and hispuppeteers in Miami continue playing games with this judge.

Today Judge Black issued orders to show cause in two Malibu Media v. Doe cases assigned to him (OHSD 14-cv-00707 and 14-cv-00718). This is the third OSC in each case. The first one was about Malibu not serving the defendants timely. The second OSC dealt with Malibu’s delay to apply for entry of default. And the third one was issued today — to show cause why these two cases shouldn’t be dismissed for failure to timely move for default judgement — despite explicit orders to file such motions within 21 days.

Judge’s patience is surprising, borderline frustrating, but as we read past the first three pages, it becomes clear that his patience is so thin that the next violation, no matter how small, will be disastrous for Faroniya and Lipscomb. What started as a narrow, case-related stuff, developed into a holistic, damning description of the troll’s modus operandi:

The Court does not view Malibu Media’s conduct in this action in isolation. Rather, the Court views it as part of an unmistakable pattern that has emerged in other actions before this Court and in context of observations made by multiple other federal judges in cases involving Malibu Media.

This Court has observed the conduct of Malibu Media and its counsel of record in over 60 cases filed in this District in the past twelve months. This is not the first case in which Malibu Media has filed a summons return well after the date of service. Counsel appears to have made a misrepresentation in seeking an extension of time to complete service in two cases. The Court also issued an order to show cause after counsel publicly filed a defendant’s name in direct violation of two orders unambiguously ordering counsel to file that information under seal.

Link (Fight Copyright Trolls)

Creationist: The Flintstones was an accurate portrayal of Dino-human coexistence

Ken Ham, an Australian young-Earth creationist, says he is on the verge of proving that dinosaurs and humans coexisted only a couple of thousand years ago.

According to a report on news.com.au, Ham – along with a Dr David Menton – declared that he will soon publish “world-changing” evidence disproving that dinosaurs were present on the earth over 65 million years ago.

“It is understood Mr Ham will claim that a bunch of donated Edmontosaurus bones are only a few thousand years old, based on the fact that they still contain remnants of bone marrow,” the Australian news site said.

Soft tissue has been known to survive in fossils in particular circumstances, and those circumstances are also by now well understood.

Despite this, news.com.au notes, the “young Earth creationists quickly claimed [their] discovery as evidence that dinosaur fossils were not millions of years old after all, while established scientists familiar with the study of these bones say that it showed, instead, a misunderstanding about how decay works”.

Last year, a public debate between Ken Ham and Bill Nye brought the former enough attention and money to commence building his Ark Encounter, a Noah’s Ark and creationism-inspired theme park in Kentucky, which would compliment his existing Creation Museum.

“Ken Ham routinely dismisses findings of palaeontologists, geologists, and other scientists who look at evidence to determine what Earth must have been like before recorded history,” news.com.au explained. “Mr Ham has asserted that scientists cannot claim to have proof of their theories if they weren’t there at the time to observe those theories in action.”

However, the site continues that “in a new post on the pro-creationism website Answers In Genesis, Ken Ham now asserts that Dr David Menton can indeed look at fossilised dinosaur bones and determine things that happened before either of them was born — as long as it supports his own ideas.”

Link (The Register)

EU dropped plans for safer pesticides after pressure from US

EU plans to regulate hormone-damaging chemicals found in pesticides have been dropped because of threats from the US that this would adversely affect negotiations for the Transatlantic Trade and Investment Partnership (TTIP), according to a report in The Guardian. Draft EU regulations would have banned 31 pesticides containing endocrine disrupting chemicals (EDCs) that have been linked to testicular cancer and male infertility.

Just after the official launch of the TTIP negotiations on 13 June 2013, a US business delegation visited EU officials to demand that the proposed regulations governing EDCs should be thrown out in favour of a further “impact study.” Minutes of the meeting on June 26 show Commission officials saying that “although they want the TTIP to be successful, they would not like to be seen as lowering the EU standards.” Nonetheless, the European Commission capitulated shortly afterwards.

That climbdown was despite repeated promises from the European Commission that TTIP would not jeopardise EU health and safety standards. For example, a Commission factsheet on Pesticides in TTIP from February 2015 states: “TTIP will not lower the food safety standards for pesticides.” The Guardian report demonstrates that plans to strengthen regulations governing EDCs were blocked, which is equivalent to a lowering of future standards that would have been introduced had it not been for TTIP.

Link (Techdirt)

Rightscorp Offered Internet Provider a Cut of Piracy Settlements

Piracy monetization firm Rightscorp has made headlines over the past year, often because of its aggressive attempts to obtain settlements from allegedly pirating Internet users.

Working on behalf of various copyright owners including Warner Bros. and BMG the company sends copyright infringement notices to Internet providers in the U.S. and Canada. These notices include a settlement proposal, offering alleged downloaders an option to pay off their “debt.”

Rightscorp’s practices haven’t been without controversy. The company and its clients have been sued for abuse and harassment and various large ISPs refuse to forward the settlements to their subscribers.

Cox Communications, one of the larger Internet providers in the U.S. also chose not to work with Rightscorp. The ISP didn’t comment on this refusal initially, but now that Cox has been sued by several Rightscorp clients, it reveals why.

In a statement that leaves little to the imagination, Cox notes that Rightscorp is “threatening” subscribers with “extortionate” letters.

“Rightscorp is in the business of threatening Internet users on behalf of copyright owners. Rightscorp specifically threatens subscribers of ISPs with loss of their Internet service — a punishment that is not within Rightscorp’s control — unless the subscribers pay a settlement demand,” Cox writes.

As a result, the ISP decided not to participate in the controversial scheme unless Rightscorp revised the notifications and removed the extortion-like language.

“Because Rightscorp’s purported DMCA notices were, in fact, improper threats against consumers to scare them into paying settlements to Rightscorp, Cox refused to accept or forward those notices, or otherwise to participate in Rightscorp’s extortionate scheme.”

“Cox expressly and repeatedly informed Rightscorp that it would not accept Rightscorp’s improper extortion threat communications, unless and until Rightscorp revised them to be proper notices.”

The two parties went back and forth over the details and somewhere in this process Rightscorp came up with a controversial proposal. The company offered Cox a cut of the settlement money its subscribers would pay, so the ISP could also profit.

Link (TorrentFreak)

Thanks for the Really Counter-Productive DMCA Complaints

One of today’s favored anti-piracy methods is to have Google de-index alleged pirate links from its search results. The theory is that if users don’t find content on search pages 1, 2 or 3, there’s more chance of them heading off to an official source.

The trouble is, Google’s indexes are massive and therefore return a lot of data. This results in copyright holders resorting to automated tools to identify infringing content en masse and while for some people these seem to work well (the UK’s BPI appears to have a very good record), others aren’t so good at it.

Errors get made and here at TF we like to keep an eye out for the real clangers – obviously it’s of particular interest when we become the targets. After being wrongfully accused by NBC Universal eight times in February, we had to wait until April for the world-famous Web Sheriff to ride into town.

In a DMCA notice sent on behalf of The Weinstein Company, Web Sheriff tackles dozens of domains for alleged offering the company’s content for download. However, for reasons best known to the gun-slinging Sheriff, he told Google that TF’s list of the most popular torrent sites of 2015 is infringing on his client’s copyrights.

We weren’t the only targets though. The Sheriff also tried to have three pages removed from business networking site Linkedin and one each from movie promo sites ComingSoon and Fandango (which are both legitimately advertising Weinstein movies).

However, the real genius came when the Sheriff tried to take down the Kickstarter page for Weinstein’s own movie, Keep On Keepin’ On. Fortunately, Google is on the ball and rejected every attempt.

Link (TorrentFreak)

‘How Movie Studios Exploit Video on Demand Services’

The best way for Hollywood to defeat piracy is by making content available, legally. To further this effort dozens of video on demand services have been launched throughout the world. However, not all of these services are happy with how the major studios treat them, and today we hear why.

The account below comes from an employee of a mid-sized video on demand (VOD) service in Europe.

To avoid repercussions from the major studios the author prefers to remain anonymous

Link (TorrentFreak)