Copy Link
Add to Bookmark
Report
2600 Hacker Quarterly Summer 2004
2600 Hacker Quarterly Summer 2004
A Guide To Internet Piracy
--------------------------
by b-bstf
charmss5@hotmail.com
I've written this article after reading a few
letter which show that some readers seem to
know little about piracy on the Internet. I don't
know everything about piracy on the net, but I
would go so far to say that I know a fair bit
about it.
First off, piracy isn't just a few guys who
work at cinemas and software stores taking the
odd film or game home and sharing it on their
home FTP servers or KaZaA.
Piracy on the Internet, or "the warez scene"
(as those into it like to call it) is suprisingly
organized. Pirated software/games/movies/
anything are called warez and will referred
to as that from now on.
The Piracy "Food Chain"
Top
Warez/Release Groups - People who release
the warez to the warez community. Often
linked with Site Traders.
Site Traders - People who trade the releases
from the above groups on fast servers.
FXP Boards - Skript Kiddies who
scan/hack/fill vulnerable computers with
warez.
IRC Kiddies - Users of IRC (Internet Relay
Chat) who download from "XDCC Bots" or
"Fserves."
KaZaA Kiddies - Users of KaZaA and other
p2p (peer to peer) programs.
We'll start at the bottom.
KaZaA Kiddies
At the bottom of the piracy food chain we
have the KaZaA Kiddies. There appear to be
two groups of these KaZaA Kiddies. First, the
13 year old kids with broadband downloading
the odd mp3 here and there because they can't
afford outrageously overpriced CDs from
stores. Harmless kids, costing no one any real
money, pursuing their musical interest. Also,
these are the people being labeled "pirates."
These are the ones "Killing the Music Indus-
try." These are the ones who are being sued by
the RIAA for thousands of dollars. Sigh.
Second are the older, p2p veterans who use
other p2p networks (Gnutella, BitTorrent,
EMule) and programs as well as KaZaA. In ad-
dition to using p2p for music the may also
download games, programs, movies, etc.
IRC Kiddies
Not far up from KaZaA Kiddies we
have the pople who go to IRC for their warez
fix. These folks can be more knowledgeable
about computers and the Internet but tend to be
just as irritating as the KaZaA Kiddies. Warez
Channels are often run by people who have ac-
cess to a fair amount of pirated materieal (more
about them later). There are generally two types
of these Warez Channels:
Fserve Chans. These can often be run by
the same KaZaA or IRC kiddies. They don't re-
ally have a reason to run them; they just like to
feel important. They mainly use the mIRC
client's File Server function and some "133t
skript" to share their warez direct from their
hard drives.
XDCC Chans. These are usually run by
people into FXP Boards and Sitetrading. They
have access to fast, new warez. They "employ"
people to "hack" into computers with fast In-
ternet connections and install XDCC Clients
(usually iroffer - www.iroffer.org) which are
used to share out pirated goods. From what I've
seen, the people running these channels must
primarily do it because they like to have power
over a lot of people (being a chan op), but also
they will often be given free shell accounts to
run BNCs, Eggdrops, etc. by shell companies
in exchange for an advert in the topic of the
channel.
IRC Kiddies can be found on EFnet
(irc.efnet.net) or Rizon (irc.rizon.net). Other
servers and channels can be found through
www.packetnews.org.
FXP Boards
FXP is the File eXchange Protocol. It isn't
an actual protocol, just a method of transfer
making use of a vulnerability in FTP. It allows
the transfer of files between two FTP servers.
Rather than client to server, the tranfer be-
comes server to server. FXP usually allows
faster transfer speeds altthough it is generally
not enabled on commercial servers as it is also
a vulnerability known as the "FTP Bounce
Attack."
The Boards. FXP Boards usually run Vbul-
letion (from software from www.vbulletin.org) and
its members consist of Scanners, Hackers, and
Fillers. There are also usually a few odd mem-
bers such as Graphics People or Administra-
tors but they don't do much.
The Scanner. The Scanner's job is to scan IP
ranges where fast Internet connection are
knwon to lie (usually university, etc.) for com-
puters with remote-root vulnerabilities. We're
talking brute forcing MS SQL and Netbios
passwords, sacnning for servers with the IIS
Unicode bug (yes that three-year-old one). Oh
yes, FXP Boards are where the lowest of the
low Script Kiddies lurk. The Scanner will of-
ten use already "hacked" computers for his
scanning (known as scanstro's), using "remote
scan" programs such as SQLHF, XScan, Fs-
can, and HScan alsong with a nice programs to
hide them (hiderun.exe) from the user of the
computer. Once the Scanner has gotten his re-
sults, he'll run off to his FXP Board and post it.
This is where the "Hacker" comes into play.
The "Hacker"/Script Kiddie/dot-slash Kid-
die. Now I think it's fairly obvious what the
"Hackers" do. (They actually call themselves
hackers!) Yes, they break into computers.
Their OS of choice (for breaking into) is usu-
ally Windows. There are many easy to exploit
vulnerabilities and *nix scares these people.
The Hacker's job is to run his application and
"root" the scanned server. The program he uses
(of course) depends upon the vulnerability the
Scanner has scanned for. For example, if it's
Netbios Password he will often either use
psexec (www.sysinternals.com) or DameWare
NT Utilities. There are various other vulnera-
bilities and programs used - too many to list
here. Once he has "rooted" the computer (this
usually means getting a remote shell with ad-
min rights), he will use a technique known as
"the tftp method" or "the echo methods" (tftp -i
IP get file.exe) to upload and install an FTPD
(this is almost always Serv-U) on his target. (In
the case of the IRC Kiddies this would also be
iroffer.) Once the FTPD is installed and work-
ing he'll post the "admin" logins to the FTP
server on his FXP Board. Depending on the
speed of the compromised computer's (or
"pubstro"/"stro") Internet connection and the
hard drive space, it will be "taken" either by a
Filler or a Scanner.
The Filler. Now if the "pubstro" is fast
enough and has enough hard drive space, it's
the Filler's job to get to work filling it with the
latest warez (the Filler usually has another
source for his warez such as Site Trading).
Once he's done FXPing his warez, the Filler
goes back to the board and posts "leech logins"
(read only logins) for one and all to use. What
a great community!
FXP Boards are mostly full of Script Kid-
dies and people with too much time on their
hands. They like to think the FBI are after them
and get very paranoid, but in reality no one re-
ally gives a damn what they're up to except the
unlucky sysops who get all their bandwidth
eaten up because they forgot to patch a three
year-old vulnerability. The true "n00b" FXP
Boards can be found on wondernet (irc.won-
dernet.nu) so, if you like, go sign up on one
and see what it's all about. Tip: Pretend to be
female. This will almost guarantee you a place
on a board. Say you can scan/hack dcom, net-
bios, sql, apache, and have a 10mbit.eu 0hour
source.
Site Trading
Next on the list and pretty much at the top
or near the top (as far as I've seen) are the Site
Traders. These are generally just people with
too much time on their hands who have possi-
bly workrd their way up through FXP Boards.
Site Trading is basically theraing of pirated
material between sites.
The Sites. These sites have very fast Inter-
net connections (10mbit is considered the min-
imum, 100mbit good, and anything higher
pretty damn good) and huge hard disk drives
(200GB would probably be the minimum).
These sites are often hosted at schools, univer-
sities, people's work,, and in Sweden (10mbit
lines are damn cheap in .se). These sites are re-
ferred to as being "legit." This means that the
owner of the computer knowns that they are
there and being run. Fast connections mean a
lot to some people. If you have access to a
100mbit line (and are wiling to run a warez
server there), there are people who would quite
happily pay for and have a computer shipped
to you just for hosting a site that they will
make absolutely no profit from (you can meet
them on EFnet). Unfortunately, this is where
credit card fraud can come into Site Trading.
This is frowned upon by pretty much everyone
(there is already enough paranoia and risk in
Site Trading) but some people do use stolen
credit card information to buy hard drives and
such. To be fair, Site Traders aren't a bad bunch
- the majority don't even beleieve in making any
money out of it and insist they are just do-
ing it for fun. Anyways, back to the sites.
GLFTPD is considered to be the FTPD to use
(in fact, a lot of Site Traders and warez groups
will not join a site unless it is running
GLFTPD). This also means that *nix is the OS
of choice (as there is no GLFTPD win port).
As well as running FTPD, the sites run an
eggdrop bot with various scripts installed. The
bot will amke an annoucement on an IRC
channel a directory is made or up-
load completed. It will also give race informa-
tiopn.
The People. There are basically two ranks
in sitetrading: "SiteOps" and "Racers."
SiteOps, as you will have guessed are the
administrators. There are usually between two
and five SiteOps. One is often the supplier of
the site, another the person who found the sup-
plier and guided them through the installation
of the FTPD. The other will be friends and
people involved in the arez scene. One or
more of the SiteOps will be the "nuker." IT is
his job to "nuke" any releases that are old or
fake (more about releases shorly).
Racers are the folks who will "race" re-
leases between sites. Usually they will have
access to a number of sites and will FXP re-
lease as soon as they're released. FXPing a re-
lease will gain credits. The ratio is usually 1:3,
so FXPing 100MB will get them 300MB cred-
its on the site, allowing them to FXP 300MB of
data from that site, which will gain them
900mb where they FXP that, etc., etc. "Rac-
ing" of releases occurs when two or more rac-
ers are uploading the same file. The "race" is to
upload the most of the release at the fastest
speed. Racing happends shortly after a release
is... released.
Warez/Release Groups/"grps"
These are the ones basically supplying
everyone with the warez. These are the ones
the MPAA and RIAA don't seem to be too wor-
ried about, or at least aren't making a big pub-
lic fuss about. However, these groups are
known to the FBI and they know that the FBI
and whatever other authorities are watching
them and collecting evidence. They know that
one day these authorities will strike as they
have done in the past. A lot of these people are
just hoping that they won't be caught when it
happens. As a result of this, anyone "high up"
is extremely paranoid. Most users will use
multiple BNCs (BouNCer, an IRC proxy) be-
fore even going near an IRC network. A lot of
large groups will own their own IRC Networks
and SSL is used at every opportunity (FTP,
IRC, etc.) It's hard to understand why these
people actually do it when there is such a risk.
The main reasons are, in my opinion, boredom.
At the end of the day, if you're sitting in front
of your computer for most of your life you may
as well be doung something other than flaming
AOLers on IRC, and this sort of thing keeps
you busy. Another reason is geekiness. Know-
ing that you were one of the first people on the
Internet to see that film, or that's because of
you that thousands of people are now playing
that leaked Halflife 2 alpha and there are news
articles everywhere about this "anonymous
leaker" - it feels good, in a geeky kind of way.
A lot of these people (not all, not all) may have
rather uneventful lives and to know that, al-
though at schol, college, or work they're con-
sidered a loser, they can go home at night and
be looked upon as some kind of god within
their group of online friends would feel good.
I do not believe that profit is a factor. These
groups insist that they don't do this soft of
thing for money, and I believe them.
There's a quote from a DEViANCE.nfo file:
We do this just for FUN. We are against any
profit or commercialisation of piracy. We do
not spread any release, others do that. In fact,
we BUY all our hames with our own hard
earned and worked for efforts. Which is from
our own real life non-scene jobs. As we love
game originals. Nother beats a quality origi-
nal. "If you like this game, BUY it. We did!"
A quote from Team Razor .nfo file: SUP-
PORT THE COMPANIES THAT PRODUCE
QUALITY SOFTWARE! IF YOU ENJOYED
THIS PRODUCT, BUY IT! SOFTARE AU-
THORS DESERVE SUPPORT!!
Releases
A release is a piece of pirated material
packaged and released by a warez group. The
format of the release varies, but in the case of
games or programs the release is usually in
bin/cue, compressed with RAR, and split into
15,000,000 bite files. The naming of the re-
lease will usually by something along the lines
of "New.Game.3-ReLEASEGROUP".
The types of releases vary. In games there
are mainly either CD Images (bin/cue format)
or Rips. Movies are either DivX/Xivds (two or
three bin/cue files). There are many different
types of movie releases. A great list of these
can be found at www.vcdquality.com. Releases
will almost always be accompanied by a .nfo
file. This will provide information about the re-
lease and the group.
Additional Info
The following information is not from first
hand experience, like the past information has
been. This has been obtained from text files,
told to me by people, and assumed. It will be
mostly accurate, but there may well be errors.
The main members of any release group
are:
The Supplier. This is the guy working at the
local cinema or games store, the guy with the
digital camera happy to sneak into the cin-
ema , etc. Generally these people have to have
access to new material, usually before anyone
else gets to it. Often they will also have to have
a fairly decent upload speed.
The Cracker. (only in games/apps groups)
This wlll vary between groups. For example, a
VCD/SVCD group would not require a
cracker. But the cracker plays an important
role. He will have to crack the game's protec-
tion that stops the game from being pleyed
without the official CD. This guy usually has a
fair bit of programming experience and can be
quite smart.
Site Supplier. Similar to Site Trading, how-
ever warez groups are often more picky about
the sites they choose. The minimum speed is
usually 100Mbit and often groups will only
accept site that are being supplied by the ac-
tual System Ops/Admins themselves.
Courier. This guy's role is basically Site
Trading. He has to distribute the group's re-
lease to other sites.
Terms you may have hard and their mean-
ings:
PRE/PRE'd. When a release is released an-
nouncements will be made across many IRC
channels called "PRE Chans." This is called
the "PRE Time" and is the official time of re-
lease. PRE Time is used mainly in site trading.
0*. This is reference to how new the re-
lease is.
0sec. This is a dream - n00b IRC Chans of-
then use this term but they are lying.
0hour. Mean the release was PRE'd under
an hour ago.
0day. Mean the release was PRE'd under a day
ago. (Typo-error in article, was "an hour ago".)
And so on...
Nuked. If a release is Nuked, the uplaoder
of the release will lose credits on the site he is
Nuked on. A release is Nuked when it is break-
ing site rules (like eight hours of PRE or ear-
lier).
Pubstro/Stro. This is a computer that has
been compromised and has an FTPD running
on it. It will be used to share warez, mainly to
the FXP Community.
ScanStro. Similar to the above, but is used
to scan for other vulneralbe computers.
Pub/Pubbing. Pubs are dard. These are
from the old days when many university and
business FTP servers had write access enabled
on anonymous accounts. So instead of break-
ing into a computer, the warez kiddies would
just upload their warez and give the IP address
to their friends. This war very popular but died
out for obvious reasons.
Tagging. Once found a Pub would be
"tagged" (a folder with the name
"tagged.by.lamepubkiddie" or something simi-
lar would be made). The idea was that if a Pub
war already "tagged" other Pubbers would
leave it alone. This apparently worked for a
while, with people respecting other people's
tags and leaving the Pubs alone. But it cer-
tainly hasn't worked for a very long time.
Dir Locking. This war used in Pubbing to
stop people other that your warez group find-
ing and downloading your warez (and slowing
the server down). You would hide it, using di-
rectory names such as "com1" and "." These
directory names would also be hard to delete or
even open, so it could take some time before
the warez were found by the server admin.
Raping. The act of Raping an FTP server is
when someone downloads pretty much every-
thing then can from it at a very fast speed. It's
frowned upon.
Leeching. Downlaoding a lot without up-
loading.
PubStealing/Rehacking. Back "in the day"
this would have been referring to as uploading
to an already tagged Pub. Now it means replac-
ing someone else's Serv-U with yours- Pub-
Stealing is frowned upon and people will often
be banned from FXP Boards if they are found
to be doing it.
Securing. The act of Securing a pubstro
would involve deleting key files such as
ftp.exe, tftp.exe, cmd.exe, etc. or changing the
username/password. Securing methods depend
upon the vulnerability.
Some warez related links:
www.nforce.nl - a site that archive .nfos and
releases. This site is frowned upon by people
in "the scene".
www.isonews.com - a site seized by the federal
government.
www.vcdquality.com - for movies specifically.
www.fxp.nl - fxp stuff
www.jtpfxp.net - rather large archive of
fxp/script kiddie tutorials.
www.packetnews.org - XDCC search engine.
www.downhillbattle.org - not related, but fuck
the RIAA!
If I've mentioned a program and not give a
link it's because it can be easily found through
Google.
That's all. I hope this has give someone a
better view of piracy.
---------------------------------------------------
ASCII CONVERSION BY DALEK
---------------------------------------------------
