Hackers Run Wild Spending BitTorrent Tracker’s Donations
Written by enigmax on December 29, 2007The SuperTorrents BitTorrent tracker has been the subject of a major security breach, with hackers gaining access to private accounts from which they donated all the site’s money to a religious group. The hackers even went as far as contacting the site’s host and canceled all of their seedboxes.
Earlier this year, the anti-piracy company MediaDefender was torn apart when its email system was compromised and hackers laid the company’s secrets bare for the world to see. Some months later, the SuperTorrents (ST) BitTorrent tracker has been the victim of hackers. According to a so-called ’scene notice’ circulating at the moment, the 35,000 member site was compromised when the hackers discovered that the admin of ST used the same password on a lot of other sites, as he does on other accounts - email etc. This is the same mistake that MediaDefender made.
The notice begins:
Now this is the story all about how Ersan’s life got flipped turned upside down and I’d like to take a minute and just sit right there and tell you how Ersan became the prince of a town called bel air. This weeks source of lulz is provided free of charge via a site called supertorrents.org and the nicest Administrator you’ve ever met, Ersan.
The hackers discovered that the same password secured the site’s PayPal donations account. They claimed that due to the admin of ST making derogatory comments about a religious group, they decided to donate all the site’s available donations - over $2000 - to an Internet portal dedicated to that same religion.
While the hackers said they had fun deleting and disabling some more minor accounts like the admins YouTube account, they had rather more malice in mind when they managed to get access to the admins Gmail account (same as MediaDefender again). They discovered the admin’s real name, address, age and even the car he drives. After having fun making a mess of the account, the hackers said: “At this point we just deleted his account, because maximum lulz were achieved.”
The hackers then accessed the site’s admin panel for communicating with their host: “we logged into his [hosts] account panel where he hosts the supertorrents seedboxes and canceled them.”
The hackers give an explanation of the way they compromised the site:
“This all began a few days ago. Me and some friends were scoping around supertorrents irc network, when we discovered that they had a public prechan. Upon discovering this moderate scene security problem some friends and I decided to check the security of said prebot, turns out it was not so secure. Upon rooting the box and grabbing the unsecure predb and some scripts to play with we then rainbow tabled’d his password hash”
The motives for hacking the site seem to be twofold. Many Scene members consider torrent sites to be to blame for compromising their security and there does seem to be indication that this provoked the hacking in part. Money is mentioned quite a lot, in that it seems the hackers are annoyed at the level of donations at SuperTorrents, even appealing to the members to consider where their money is going.
It’s also claimed that many torrent sites are getting their releases from the same place and there are suggestions that this supply to the BitTorrent community should be strangled.
No doubt the MPAA will be delighted to hear this.
Update: More information is coming through which suggests that Ersan feels that his address hasn’t been compromised and he doesn’t drive the car the hackers say he does. Ersan says that his host did not cancel the seedboxes and he further says that his Google email (far from being deleted) is actually recovered and the password has been reset. He continues: “From what I can tell, the server that they’re talking about was not rooted, but I’m going to reload the OS on it anyway. This has no effect on SuperTorrents in any way, it just screws with my personal email and finances for a few days. The worst part is not knowing the extent of the damages that have been done, if all that was done was what was stated above then I’ll be fine. If they downloaded all of my emails and chat logs or something then I have a real problem on my hands”
Update 2: The hackers seem to have responded: “Nice attempt at damage control. :/ We do have your real street address, among with a few others you were using. If we were just going to blank it out anyway, whats it matter? Shouldn’t you be happy we did that, I guess we could go with the unedited copies of your name and addresses for the third notice. You just made an order XXXXXXX.com (lol, nerd) would you like us to post the usps tracking number & address? (1) Your address is talked about many times in google chats, once again you’re lucky we dont post them here. You did buy a BRANDX(car), for $12,000. Heres some screenshots (2&3). We could always post more information about it, as we have your entire email box from a few weeks ago until now. Would you like us to? was it your father or brother that you got the carfax for, lol?”
In reponse to Ersan’s claim that the host did not cancel his servers: “Correct, [host] did not cancel your servers, they did however cancel your account. Oh well I guess we can’t win them all.”
The hackers then go on to deny that Ersan has recoverd his Gmail account and provide some sort of screenshot as proof. They also ask Ersan to stop sending ‘forgot my password’ to his own account as “it’s not helping.” They then go on to use Ersan’s real name and in what could be seen as a veiled threat say: “Be thankful Eric, that we didn’t give you the raging that was easily possible with all of the email and google chat logs we have. We PROBABLY won’t release those, but hey you never know! :)”
thanks r10t
Previously: Steal This Film 2 Goes Live
Next: Top 10 Most Popular Torrent Sites of 2007
247 Responses
Pages: « 1 2 [3] 4 5 6 7 8 9 10 » Show All
I gues it is oke, to make a point. If your neighbours wifi router is not protected, then you could think that your neighbours are oke with it, that you hit a ride on there internet. It does not mean, that you open, there (standard paasword router website, and change it so that your neighbours can not use it anymore. It is to much what these so called hackers (read scriptkiddy) did. If they just did change the index.php, would be more lol and gives the victum a change to learn
This seems like a rude thing to do. Perhaps it makes them feel better to bully people online because they themselves get bullied in real life. One has to imagine the geeks who are responsible for this, probably in between games of Warcraft no doubt.
LOLz loser script kiddies think they are “hackers”. Hacking is working with no tools, hacking is doing something new as an exploit. Scripting is going to a security site, reading about that exploit, developing the script, and distributing it out to losers like these would-be hackers that think they are cool. LMAO. losers. I don’t care if he wanted a couple of donations to keep his server running, I have no problems with pan handling while doing the community a service by running a tracker site. You jackass script kiddies just helped the enemies do you honestly think we like you? Or your damned pathetic religion you wanted to support? I can say whatever I like about religion because it is evil, why the hell should a jackass like you come along and punish me for my freedom to express myself? Know what religions say of us that don’t believe they crap?
These loser script kiddies had no point, and real hackers don’t trash people in that kind of way, and if they weren’t smart enough to forge the mac address and use a laptop on wifi, they are traceable. I hope you get your ass caught. :P fuckin wannabees.
[quote comment="251144"]LOLz loser script kiddies think they are “hackers”. Hacking is working with no tools, hacking is doing something new as an exploit. Scripting is going to a security site, reading about that exploit, developing the script, and distributing it out to losers like these would-be hackers that think they are cool. LMAO. losers. I don’t care if he wanted a couple of donations to keep his server running, I have no problems with pan handling while doing the community a service by running a tracker site. You jackass script kiddies just helped the enemies do you honestly think we like you? Or your damned pathetic religion you wanted to support? I can say whatever I like about religion because it is evil, why the hell should a jackass like you come along and punish me for my freedom to express myself? Know what religions say of us that don’t believe their crap?
These loser script kiddies had no point, and real hackers don’t trash people in that kind of way, and if they weren’t smart enough to forge the mac address and use a laptop on wifi, they are traceable. I hope you get your ass caught. :P fuckin wannabees.[/quote] They are probably MPAA trying to do their jobs.
Anonymous is pleased.
first he uses the same passwords everywhere. Then he tells the world his dad works for the government in law enforcement ? Not the brightest kid, I hope his dad forgives him if his son ever gets arrested and the media has a field day with that fact that its a son of a top law enforcement agent. That sounds like something that would ruin his career.
Oh well, hopefully nothing else bad happens because of all of this.
btw i like how he tells everyone he hasn’t lived there in months. So now the hackers know to just go to the post office and get the forwarding address everyone fills out when they move.
Good thing 19 yr olds don’t run the world, they arent the sharpest knives in the shed apparently.
It didn’t affect him at all, this whole thing has been blown out of proportion; most of what they said they did has been reversed already, so get a grip and don’t believe the hype!!!
http://www.panthermoderns.com/sexxah_n00ds_of_Ersan
poor erik
While I have the utmost respect for the scene, and can even understand what they did to an extent, I can’t stand the fact that they gave the 2k to a religious group. Why not something that bettered technology or something? Hell, even donating it to a circus would’ve been hilarious.
However, I can’t help but laugh at his stupidity of using the same password for everything.
I want a Lexus
[quote comment="251144"]Hacking is working with no tools, hacking is doing something new as an exploit.[/quote]
Half right, Hacking actually has no connetations towards breaking programs or any illicit activity. It has just become common usage. The bit about “no tools” is right though C ‘hackers’ use vi - or for those of a more infantile, coddled in cotton wool disposition - Notepad.
[quote comment="251168"][quote comment="251144"]Hacking is working with no tools, hacking is doing something new as an exploit.[/quote]
Half right, Hacking actually has no connetations towards breaking programs or any illicit activity. It has just become common usage. The bit about “no tools” is right though C ‘hackers’ use vi - or for those of a more infantile, coddled in cotton wool disposition - Notepad.[/quote]
he speaks da truth
Hackers on steroids fight back
looks like the hackers made it easy to find out who he is by what they release. look @ the 1 set of screens. in one email they blacked out the vin# in the subject but forgot to black it out in the email.
opps. with that type of info i could knock on his front door in 24 hhrs. lulz
I f-ing hate people who fudge with other peoples business. Do you think your providing some sort of justice? I mean come on you not only scare the shit out of all ST users and you make the admins life miserable. Shame on you for hurting people you don’t even know. I don’t care if he’s using the money for a car or whatever, as long as the site stays online and satisfies the latest torrent releases what does it matter.
Oh look I have mad hacking skillz I can use the same password that i stole on all these other sites. - Lame, you should rot in hell loser
Why are 4chan being mentioned here, we know it was Ebaumsworld and GaiaOnline doing this shit.
RULES 1 AND 2 NEWFAGS
embarassing for both parties, if you ask me
lol phags
thanks for the daily lulz!
Video of Ersan calling out the “hackers”
http://www.youtube.com/watch?v=eBGIQ7ZuuiU
hey this guy need to get some curtains and a happy dog, am i rite?
Hackers aint shit, Torrent sites are going to fall, we at gfy.com will see to it all
[quote comment="251186"]I f-ing hate people who fudge with other peoples business. Do you think your providing some sort of justice? I mean come on you not only scare the shit out of all ST users and you make the admins life miserable. Shame on you for hurting people you don’t even know. I don’t care if he’s using the money for a car or whatever, as long as the site stays online and satisfies the latest torrent releases what does it matter.
Oh look I have mad hacking skillz I can use the same password that i stole on all these other sites. - Lame, you should rot in hell loser[/quote]
Ersan has been known over the years to make enemies very fast and he has screwed over many people over the years. Basically what goes around comes around. I agree it’s fucked up to put someones info out like that…but if you dont go around fucking with other people then you yourself won’t be fucked with.
BTW is it not unfair that ST users donate their hard earned money and then the site owner uses that money to buy a lexus? I mean comon, im sure the users donate money to keep the site running. Not so some teenager can roll around in a lexus.
1 references to this post
Pages: « 1 2 [3] 4 5 6 7 8 9 10 » Show All
Responses are closed
All remaining responses will continue to be archived. Use the TorrentFreak forums if you want to discuss something.