Apple and Facebook behind the shutting down of KickassTorrents

How Apple and Facebook helped to bust the world’s biggest torrent site, KickassTorrents

KickassTorrents (KAT), one of the most popular websites for illegal file sharing was shut down after the alleged 30-year-old Ukranian owner and operator, Artem “Tirm” Vaulin was arrested in Poland on Wednesday at the behest of the U.S. government. The U.S. authorities also seized seven of the site’s domains, all of which are now offline.

Vaulin has been charged for criminal copyright infringement and money laundering. He has also been accused of illegally reproducing and distributing hundreds of millions of copies of movies, video games, TV shows and music albums totalling more than $1 billion. The U.S. is now waiting to extradite him.

So, what led to the downfall of KickassTorrents? Apparently, it turns out that a couple of purchases on iTunes and email helped to bring down the mastermind behind KickassTorrents. It is also said Apple and Facebook were among the companies that handed over data to the U.S.

The U.S. Department of Homeland Security initially exposed information about Vaulin by tracing the IP addresses used to host the KickassTorrents domains, according to a 48-page criminal complaint (PDF) filed with the U.S. District Court in Chicago.

That led investigators to a Canadian ISP (Internet service provider), which turned over server data that disclosed numerous files, including emails and user information about KickassTorrents’ operators.

Not only was he operating a KickasssTorrents Facebook page, but was doing so with a personal email address.

How personal? It was a ‘@me.com’ address, which is owned by Apple (and is the forerunner to @icloud.com). The account was used to make iTunes purchases from two IP addresses — both of which also accessed a Facebook account promoting KickassTorrents.

His email was discovered when authorities sent Facebook a warrant for information having to do with the site’s page. For example, Facebook handed over IP-address logs from the KAT fanpage to the U.S. authorities. From there, the U.S. Government turned to Apple. They were then able to cross-reference this with an IP-address Vaulin used for an iTunes transaction.

“Records provided by Apple showed that tirm@me.com conducted an iTunes transaction using IP Address 109.86.226.203 on or about July 31, 2015. The same IP Address was used on the same day to login into the KAT Facebook Account,” Homeland Security Investigations (HSI) agent Jared Der-Yeghiayan said. His IP addresses linked to KAT’s Facebook page was also used to access Vaulin’s Coinbase account, suggesting that the Bitcoin wallet also assisted in the investigation.

By handing over user data to the government, Apple and Facebook were acting within the legal limits, and probably there was nothing about the government’s requests that raised any red flags. It is just a normal routine.

The fact that Vaulin was using a single, personal email address for so many features and services is absurd. To just have one single email linked to something as personal as your Apple ID, which is directly applicable to you is just unbelievably unwise. This is likely going to seal his fate.

While KickassTorrents itself is dead, a clone of the file-sharing site has already appeared online, which may shut down shortly. Whether KickassTorrents or Vaulin will make a Pirate Bay-style comeback, only time will tell.

SOURCES: FOSSBYTES

iCloud account hacked?

40 Million iCloud Accounts Hacked? Hackers Hold iOS Devices To Ransom

Massive 40 Million iCloud Accounts Hack Could Hold Apple Devices Hostage For Russian Ransomware

Apple’s iCloud account appears to have been so severely hacked by some urbane hackers that some iPhones have essentially been held hostage for Russian ransomware. It is guessed that an astounding 40 million iCloud accounts (approximately) are rumoured to be at risk, according to CSO Online.

Some iPhone users, dating back to February this year, have discovered that their devices have been compromised, and are held hostage by Russian hackers. The attack is almost too simple.

An iCloud account is broken into (with the help of leaked credentials), and the service’s “Find My iPhone” feature.

“It starts with a compromised Apple ID. From there, the attacker uses Find My iPhone and places the victim’s device into lost mode. At this point, they can lock the device, post a message to the lock screen and trigger a sound to play, drawing attention to it.

In each of the cases reported publicly, the ransom demanded is usually $30 to $50. If a victim contacts the referenced email address, in addition to payment instructions, they’re told they have 12 hours to comply or their data will be deleted,” said CSO security blog Salted Hash.

If a slew of iCloud accounts are breached, you can multiply that $30 – $50 by 1,000 or even more, and the scheme suddenly looks rather lucrative to the hackers.

Given that the Apple ID credentials involved in the ransom attacks are believed to originate from online security breaches, Salted Hash pointed towards a recently compromised Mac-Forums.com database, which allegedly includes 291,214 accounts, being sold for around $775 on the darknet.

However, some security experts are claiming that the victim count of 40 million is likely way overblown. It does make sense, because even if only a small percentage of the list were being attacked, a few hundred thousand victims within a few months would standout like a beacon. In short, there would be no way to keep such attacks under the radar. That’s not a glitch that would escape Apple’s radar, as you can imagine.

At this point of time, there is no evidence to suggest that the Mac-Forums database has any relation to these ransom attacks. However, if you wish to tread caution, it is highly recommended that you immediately change your iCloud password, and if you haven’t already, enable two-step verification. Both these changes can be done inside of your iCloud Settings screen.

SOURCES: TECHWORM, CSO ONLINE