Every day thousands of “fake” torrents are uploaded from malicious sources, often labeled with the names of popular movies or TV-shows. Needless to say, those who download these torrents don’t get what they were looking for. Instead they are redirected to scam websites or lured into installing malware.

One of the prime platforms where these fake torrents are published is without doubt The Pirate Bay. To measure the scope of this problem and what can be done about it, a group of researchers decided to monitor all Pirate Bay uploads. The just-published results (pdf) are rather surprising.

During a two week period the researchers collected a total of 29,330 torrent files and found that 12,209 were “fake” and eventually removed from The Pirate Bay. Put differently, one in three torrent files uploaded to The Pirate Bay links to malware or scams of some kind.

This result may be surprising to many Pirate Bay users as these fake files rarely stay on the site for long. Moderators tend to delete the torrents in question within minutes or hours, but according to the researchers this is too late for the many people who’ve already started downloading the files.

The researchers estimate that in a year’s time millions of people will be downloading these fake files. Interestingly, people from the US, China and Brazil fall for these scams more than the average downloader. BitTorrent users from Spain, India and Great Britain on the other hand are best at avoiding them.

The researchers believe the mass distribution of these fake files poses a serious threat to the security of Internet users, but luckily they’ve also come up with a solution.

In addition to describing and analyzing the fake torrent phenomenon, the researchers have also developed a tool that allows BitTorrent users to check torrents before they’re downloaded. Their TorrentGuard application is available as a Vuze plugin and users can also test torrents via the website.

The researchers are able to accurately identify fake torrents because the vast majority of the files are uploaded by a small group of uploaders. They found that 90% of all fake files were initially seeded by just 20 different IP-addresses. By using the TorrentGuard tool, the researchers estimate that 10 million fake downloads per year can be prevented.

Talking to TorrentFreak, researcher Rubén Cuevas of Universidad Carlos III de Madrid explains that the research is important because it reveals the threat posed by these fake torrents. He hopes that more researchers will take this aspect of cyber-security seriously and that the research presents an opportunity to educate the public.

“Of course skilled users are aware of these risks and are able to identify fake torrents in most cases. However, a large percentage of BitTorrent users are unskilled and not capable of distinguishing between legitimate and fake torrents.”

“We hope that our research is able to make at least a fraction of the unskilled users aware of this threat, so that they become more careful when selecting the torrents to download,” Cuevas says.

Ideally, the research team would like BitTorrent portals and trackers to cooperate.

“In order to make TorrentGuard even more efficient, we would need the collaboration of both BitTorrent portals and BitTorrent trackers,” Cuevas told TorrentFreak.

This would not only make the TorrentGuard tool more effective, it would also prevent even more fake torrents from spreading as BitTorrent sites would be able to detect them earlier.

The Pirate Bay team informed TorrentFreak that they are interested in collaborating, especially if doing so can prevent millions of people from falling for these scams. OpenBitTorrent and PublicBitTorrent, the two largest public BitTorrent trackers, have also indicated that they want to work with the researchers to improve the tool.

If the collaboration leads to a practical solution which is adopted across all popular BitTorrent portals, the researchers predict that 35 million fake downloads can be prevented, making the Internet a safer place for all.

More information on TorrentGuard is available at the official website.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

In the past we’ve reported on the P2P advertising attempts of MediaDefender, but they are not the only company trying to make money from ads on filesharing networks. Last month, P2Pwords launched their adwords service, and more recently, PeerMatrix launched another advertising application targeted at P2P users. Although there is doubt that this type of advertising can be very effective, it’s the ideal cash cow for malware peddlers.

According to a press release from last Friday, PeerMatrix uses a “…revolutionary technology that morphs the name of an ad file to match whatever a P2P user is searching for, thereby dramatically increasing the probability that your ad file will be downloaded and viewed”.

In other words, with this (patented) “revolutionary technology” advertisers will have the possibility to rename their Viagra advert to ‘The Dark Knight Trailer.avi’, if that’s what the user is searching for. Even worse, the advertiser can do this with every file type, including executable malware applications, or trojan horses. The opportunities to use this piece of software to pollute search results are endless.

Angel Leon, lead developer at FrostWire told TorrentFreak that he is not impressed by PeerMatrix’s marketing pitch. Instead, he is worried. “We wouldn’t call this a “revolutionary technology,” he told us. “This is nothing but good old fake search results, otherwise known as spam, and it’s always been in the interest of the community to remove these results.”

PeerMatrix offers their application for free, and it runs on all recent Windows operating systems including Vista and XP. PeerMatrix’s business model is to make money by inserting a small percentage of their own ads along with the files that the ‘advertisers’ choose to spread.

We can’t help but see this application as the ultimate spamming tool. Luckily, most developers of Gnutella based filesharing applications agree with this view. “We’ll try our best to have FrostWire clients recognize these fakes and keep the experience clean, just the way it should be. If a search result doesn’t indicate in some way it’s an advertisement, it’s clearly a deceptive form of spam,” Leon said.

Bernard Trest, President of PeerMatrix disagrees with this description. “YouTube has also been experimenting with overlays and many websites use a similar overlay concept,” he told us. “Essentially the person does not request ads on YouTube however they are forced to view the ad anyhow. If what we are doing is “spam” then Google, Yahoo, and even YouTube are spamming.”

The problem with PeerMatrix, however, is that there is no control over the content that the advertisers put on the P2P networks, even executable files are not a problem. In addition, Trest admitted to us that the ads inserted by their software are not listed as ads in the search results. “The advertising, whether targeted or untargeted, is not designated as advertising,” he said.

If this isn’t the ultimate spamming tool, then what is? We sincerely hope that the developers of filesharing applications will keep a close eye on this new spamming tool, and filter it from the results wherever possible. If that proves to be a problem, many P2P users might have to switch to BitTorrent.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

Although most scams can be avoided easily when a few simple rules are followed, they still manage to trick thousands of novices every day – and this is not going to end anytime soon. Since BitTorrent has become more or less mainstream, with millions of users worldwide, it also proves an interesting target for email spammers.

The latest scam, unlike the others we have reported on before, is one that is sent by email. The email is disguised as a message from the anti-piracy company MediaDefender (using their logo etc.), and warns the recipient that his or her download behavior has been logged. The email has a report attached with more details about the infringed material, which turns out to be a virus (A Mytob worm which installs a trojan, and allows outsiders to gain access to your computer).

Dear User!

Your recent internet activity was logged on the following sites:

* Btjunkie
* SumoTorrent
* isoHunt
* Btscene
* Mininova
* Fenopy
* Monova
* Yotoshi
* GetInvites
* Btmon

We have attached a report about the copyrighted movies, music, softwares you
downloaded or searched on these webpages. We strongly advise you to stop any
future activities regarding the downloading of illegal content or you can
expect prosecution by 17 U.S.C. §§ 512, 1201?1205, 1301?1332; 28 U.S.C. §
4001 laws.

Sincerely,

MediaDefender Inc.

To the more experienced and BitTorrent savvy users it is clear that the email is a scam. First of all, MediaDefender has never been involved in anti-piracy enforcement. The only thing they do is spoofing, flood BitTorrent sites with fake files, and the occasional DDoS attack on Revision3.

In addition, the email claims to have data on what the user searched for on the sites, which is irrelevant and practically impossible. It seems that the spammers should have done some more research on the topic. A good spammer would have included The Pirate Bay in the list of sites instead of Getinvites, which is a BitTorrent invite trading site, and not a search engine

A related scam email, sent out by the same group of people judging by the style and format, is also targeted at filesharers and threatens to suspend their Internet connection. The email claims to be sent by the Internet service provider consortium, and again includes an infected attachment with a report.

The email is a clever scam that shows how mainstream BitTorrent has become. The emails are sent out randomly, but many recipients, scared by be cut off by their ISP, or sued for downloading copyrighted material, might open the infected attachment without realizing that it is a scam.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

A good way to check whether a torrent is legit or not is by looking at the comments. If people found the torrent to be fake, it will probably reported there. But up until now there was no central database for checking fake and spam torrents – TorrentSpam is trying to fill this gap. A search for the torrent name on TorrentSpam will return a list of torrents, and the score each torrent has indicates how likely it is that this torrent is actually SPAM.

Some administrators of BitTorrent sites (not all of them) already spend hours every day removing and blocking these fake or malware ridden torrents, but it is nearly impossible to have a 100% clean site at all times.

TorrentSpam will be really useful if admins of BitTorrent sites have access to their database, something that will happen in the near future. The site is currently working on an API section so all torrent sites can utilize TorrentSpam. In the meantime they obviously need you to fill (and check) the database.

Or as the admin of TorrentSpam puts it: “The more reported torrents the better the P2P experience! By letting people know of invalid torrents, the less data will be jamming the networks.”

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

The partnership is all about advertising. Sprint has bought the rights to have their name and logo embedded into tracks from the Atlantic Records hip-hop artist Plies.

It appears that Atlantic will supply Media Defender with a small number of Plies tracks, which will then be embedded with the Sprint logo which will appear on PC screens and digital devices playing the tracks. In return for a reported six-figure investment shared between the anti-piracy outfit, Atlantic Records and Plies, Media Defender will then flood P2P networks with the tracks over a 3 month period. Previously, Media Defender worked with Suretone Records to spam P2P networks with partial songs and videos in an attempt to generate traffic to their client’s website.

ArtistDirect’s CEO Jon Diamond said the project has a three-pronged approach of generating advertising revenue for record labels, linking brands to a particular artist to reach a certain demographic and in the process, limiting piracy.

However, most file-sharers want a plain MP3 track with nothing added and are unlikely to want tracks which cause advertising pop-ups or similar on their PC. As ‘vanilla’ MP3′s of tracks from the same artist will be widely available on the same P2P networks, it’s likely that file-sharers will be drawn towards those downloads instead of the ‘infected’ versions offered by Media Defender. So, this strategy will most likely NOT limit piracy.

Besides setting up fake BitTorrent trackers and fake video download sites, Media Defender is currently in talks with other artists and is likely to announce similar partnerships shortly.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.

Some time after we started mininova there were a few people that thought that uploading spam torrents would be a good idea to advertise their “GET A FREE XBOX 360″ links (or PSP, or HDTV, or well you get the point ;)).

At this time we banned 3651 people (some of which are people who received multiple bans). To see if some country has more (persistant) spammers than others, I decided to compare some statistics.

If you take a look at the stats you’ll see that Germany has some hard-core spammers.

Source: TorrentFreak, for the latest info on copyright, file-sharing and anonymous VPN services.