|
A group of Argentinian hackers have managed to gain access to The Pirate Bay’s admin panel through a security breach. Via the backend of The Pirate Bay website they were able to delete torrents and expose users’ IP-addresses, emails and MD5-hashed passwords. The Pirate Bay is currently working on a fix while the site is offline.
In the past we has covered several weaknesses in websites belonging to anti-piracy websites such as the RIAA. However, a recent posting by the Argentinian hacker Ch Russó shows that The Pirate Bay is not invulnerable to such exploits either.
Russó, who claims to be researcher born in Buenos Aires, has published a video that shows how he got into the Pirate Bay admin panel. Here, the hacker could manage all torrents in the site’s database with full admin access. In addition, Russó shows that he had access to sensitive user information such as IP-addresses and emails.
We have contacted a Pirate Bay insider who informed us that that several people are currently looking into the issue while the site is offline for upgrades. The downtime is not related to the hack, but it will be used to solve the vulnerabilities. “We decided to rewrite all database-handling anyway, since it was 6 years old,” we were told.
According to our source at The Pirate Bay, who didn’t want to give out too many details at the moment, the hackers were only able to execute the SQL injections after they gained access to the admin panel.
Russó claims that he has no bad intentions and that he merely wants to inform the public that their information is not as secure as they like it to be. A humble goal, wrongly executed. In the process he exposes several email addresses and other privacy sensitive information that is clearly visible in the video.
Although the information obtained by Russó might be worth a few bucks to some interested anti-piracy outfits, he has no plans to sell any of the information to any third parties.
“Probably these groups would be very interested in this information, but we are not [trying] to sell it,” Russó told KrebsOnSecurity. “Instead we wanted to tell people that their information may not be so well protected.”
The Pirate Bay folks on the other hand are confident that the problem will be fixed during the current downtime period. They further assured us that it was impossible for the hackers to find out the true passwords of the site’s users.
Update: The Pirate Bay is back…
_________________
Admit Nothing, Deny EVERYTHING, DEMAND Pr00f!
|
