In July 2008, security researcher Laurent Gaffié found a bug in two of the latest versions of the official software – Soulseek 157 NS & 156. The problem was so serious he informed the Soulseek developer on 3rd September 2008. Unfortunately, Laurent heard nothing back so on 14 October 2008 he contacted the developer again. He appears to have been ignored. On 16 May 2009 Laurent tried again to contact the Soulseek team – yet again he had no response so decided to reveal his findings.

So what exactly is the problem? First of all it’s necessary to understand a little about how the Soulseek search works. When a user searches for an MP3 via their contact list or on a Soulseek IRC channel, their Soulseek client sends the query to the Soulseek server. The server then sends a distributed search query on the whole channel.

Laurent told TorrentFreak, “The P2P Soulseek bug is critical because of the nature of the bug. It appears when you send an overly long search request to the server, and it redirects it directly to everyone without checking the length of the request, then a memory corruption happens in every client that received this query.”

“By corrupting the Soulseek memory it becomes possible to control the program memory flow and redirect it anywhere you want,” Laurent explained. “In this case, you redirect the program to a shellcode you’ve placed in the memory and then code execution occurs. The problem with this type of “buffer overflow” is the nature of it, it’s a SEH overflow (Exception Handler) which will work on most Windows platforms.”

Laurent told TorrentFreak that there is no need to have any interaction with a targeted channel or user, it’s just possible to log on and send the distributed search. This makes the Soulseek vulnerability perfect for a very fast spreading worm scenario.

“I’ve released a very limited proof of concept, to avoid scripts-kiddies problem on the Soulseek network,” notes Laurent, “but this doesn’t avoid a worm scenario, because this binary protocol is not so hard to reverse.”

Apart from being a perfect scenario for a fast spreading worm or mass Soulseek client exploitation, Laurent told us this attack can be used to remotely control any machine connected to the Internet with a Soulseek client. Let’s hope the Soulseek team take notice and get this fixed.

In the meantime, worried Soulseek users can avoid this vulnerability by ditching the official client and using the Python Nicotine Plus client instead.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

SACEM, the French association for music producers and SCPP, which represents record labels including Universal, EMI, BMG, Warner have filed a complaint against the filesharing application.

The industry bodies argue that Soulseek, an application created by former Napster programmer Nir Arbel, is designed to permit unauthorized access to copyrighted works. According to a French law adopted in 2006, distributing such software is an offense that can lead to a 3 year jail sentence, as well as a fine up to 300,000 euros.

While Soulseek can be used to share any type of file, it is almost exclusively used to share music. Soulseek has a multitude of sub-communities, each dedicated to their chosen musical genres. The members can be incredibly passionate and many of them are experts in their field. Although mainstream music is available, the majority of the files shared on the network are underground independent music.

On the Soulseek website, it is clearly stated that the intention of their application is not to infringe copyright. Instead, it aims “to help unsigned and/or independent artists find a place in the ever-growing music industry, in a place where discussion and the creation of music can take place.”

Similar to other music sharing communities such as the BitTorrent sites What.cd and Waffles.fm, many members are artists themselves, who share their music freely. True to this spirit, members of the Soulseek community founded Soulseek Records (or SLSK Records), a non-profit netlabel where artists publish their music for free, under a Creative Commons license.

Instead of supporting this creative platform, the French music industry continues its witch-hunt, effectively killing their own business. If they are successful, this case, or the lawsuits against the other four p2p clients, will undoubtedly impact other filesharing applications.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

Created by former Napster programmer Nir Arbel, Soulseek can be used to share any type of file, but music is king on this network. Although mainstream music is available, if your tastes wander from the mainstream, if your musical dreams are a little avant garde and independent label-leaning, or you thrive on low frequencies and can’t get enough drum and bass or techno, Soulseek is for you.

If you like the sound of Soulseek and also happen to have a jail-broken iPhone, musical Christmas just came early. Last night, iPhone users with jail-broken devices saw a new application available for download from the ‘Big Boss’ source – ‘iSlsk’ – a free Soulseek port for the iPhone. TorrentFreak caught up with the developer for the lowdown:

TF: Please describe iSlsk

errrick: iSlsk is simply an application that lets you connect, download (and share, in the future) music directly from your iPod/iPhone through the Soulseek network. Anywhere, no computer required. That’s what makes “iSlsk” special and different from all other Soulseek clients out there.

TF: When did you start work on iSlsk and what motivated you to do so?

errrick: On February, 2008. What motivated me? Well. First of all, I saw all the capabilities this little gadget had and then thought “why didn’t someone already do something like this?”. A long time ago I did some little web application (just for fun) which let me connect to the Soulseek chat rooms from a web interface (written entirely in ASP.NET and C#). So I already had some experience with the protocol. Then I saw new applications being added everyday so I thought “Hey, making applications for the iPhone shouldn’t be that hard”… And thought how useful it would be to have a P2P client (first for me, then for the people) so I started learning and developing it myself.

TF: Tell us a little more about iSlsk from a technical viewpoint

errrick: In terms of code and programming, it’s entirely written in Objective-C (like most Cocoa and iPhone apps). The core of the application was made with the help of some open source Soulseek clients for mac (SolarSeek, SoleSeek). When I started developing it I was really afraid the iPhone/iPod wouldn’t be able to support for example, a high number of connections, constant byte transferring from peers and such. At that time I ran into thousands of problems which almost frustrated me, but most of them were really because I was a total newbie to Cocoa and Obj-C and not because of a hardware or software limitation like I thought.

TF: Thanks for your time.

Downloading and installation of the 224.5kb package takes a few seconds and then you’re away. At this point it has a basic file search and a display of any downloads queued along with progress. Media is downloaded to /var/mobile/Media/Downloads on any firmware above 1.1.3.

A nice feature is the ability to import the downloaded files straight into the iPod music database so they can be played immediately with the normal controls. There have been issues with this feature which are being addressed for the next update but in the meantime, here is a full workaround and great general tutorial from iPhoneFreakz.

Here is a video of iSlsk v0.1b in action:

The developer, ‘errrick’, can be found here.

Of course, Soulseek is not just for iPhone and as there are many thousands of unsigned artists populating the network, it’s worth checking out the PC version too.

Thanks to IIIALC

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

According to its homepage, Packet Garden is ‘an experimental artwork that seeks to provide an alternative and accessible approach to visualising daily internet use’ and I would agree, this is a good description.

This open-source software which is available in Windows, Linux and OS X flavors, can capture data concerning your daily BitTorrent, eMule, LimeWire, Soulseek, HTTP, FTP and IRC transfers and use them to ‘grow’ a 3D digital ‘garden’ you can explore. Indeed, any type of internet traffic can be used to develop your creation, including online gaming and email.

Packet Garden does this by remembering the servers you visit, their location and the sort of data you are accessing and converting it into a 3D landscape. Your uploads create hills on the landscape while downloads carve valleys, their respective heights and depths governed by the amounts of data you send or receive. Where they appear on your map is down to the geographic location of the servers you visit.

To brighten up the world, PacketGarden (PG) is able to grow virtual plants, relating to the protocols it detects being used on your network. Visiting a website will result in the growth of an ‘HTTP Plant’ while sharing via BitTorrent or eMule will cause some ‘P2P Plants’ to appear. PG can only detect protocols based on their developer-assigned ports so if you use non-standard ports, some tweaking of the configuration is needed. The good news is that even if you don’t configure the exact ports, the software is still able to generate landscapes albeit in a less creative way.

Each time you generate a unique world based on your day’s internet activities, it’s saved so that over time you can see how your worlds develop as your bandwidth usage habits change. Users worried about privacy have nothing to fear as the software is free from both adware and spyware and your personal information is kept on your own machine and is never available to others.

Why not install it and post pictures of your world in the comments? First prize to the person who grows the most beautiful BitTorrent plant!

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.