If you were mildly miffed about The Pirate Bay being down this morning, you’ve got bigger worries: Argentinian hacker Ch Russo recently announced that he and two associates managed to obtain the user names, e-mail information, and IP addresses of more than four million Pirate Bay users.
Russo claims to have done so by finding several SQL injection vulnerabilities, and his claims of breaching TPB’s security have been independently verified by KrebsOnSecurity.com’s Brian Krebs, who writes that Russo was able to obtain his e-mail address and a hash of his password when provided with only his Pirate Bay user name. According to Krebs, “the hackers had the ability to create, delete, modify or view all user information, including the number and name of file trackers or torrents uploaded by users.”
Luckily for Pirate Bay torrenters, Russo and company do not plan to pass along the information to a third party, although they did consider its worth to the likes of the RIAA, which is usually stuck in the circuitous route of supboenaing ISPs to get torrent users’ IP addresses; a discovery like this, however illicitly obtained, would be the RIAA’s motherload.
According to Russo, The Pirate Bay has since patched the vulnerabilities, at least partially; the site is currently down, displaying the message “Upgrading some stuff, database is in use for backups, soon back again.. Btw, it’s nice weather outside I think.” No direct word from The Pirate Bay yet on what’s transpired from their end, but we wouldn’t be surprised to see one of their signature blog posts when the site comes back up.
(Krebs on Security via Mashable)
