On January 20, a year after Megaupload was raided in 2012, Kim Dotcom launched his new file-storage service Mega.

In a matter of days the site’s membership went from zero to more than a million and in the weeks that followed the site continued to expand its user base.

The introduction of Mega has been one of the most prominent tech launches this year and the privacy company has big plans to expand its business in the future. But despite the early successes, Kim Dotcom has chosen to move on.

Filings to the New Zealand Companies Office reveal that Dotcom was replaced as Mega Director last week. The move was confirmed to BusinessDesk by Mega CEO Vikram Kumar, who said that Mega’s founder will use the time to work on his many other projects.

One of the new ventures Dotcom will focus on is the music platform formerly known as Megabox. Unlike Mega, the new music service will be operated by a company owned by the Internet entrepreneur himself.

Dotcom previously told TorrentFreak that he dropped the Megabox name for a better one, to be revealed at a later date. Dotcom did say that unlike his other projects, he will not be using the “Mega” brand for the new music service.

There are currently 22 developers working on the project and it’s expected to launch a few months from now.

In addition to the music service, Dotcom also has political aspirations. A few days ago he told TorrentFreak that he has written a draft program for a new party that he wants to participate in New Zealand’s elections next year.

“I’m excited about the party and I’m confident that I can help make New Zealand a significant Internet economy player. Someone needs to lead New Zealand into the future. Unfortunately the current government doesn’t know what the future looks like,” Dotcom said.

Aside from the music venture and his political aspirations, Dotcom will also be focusing on Megaupload’s legal battles. He and several of his Megaupload colleagues are fighting an extradition request from the United States, where they are wanted for several alleged crimes.

Dotcom’s extradition hearing is currently scheduled for November this year, but may be pushed to April 2014 because legal arguments on a number of issues have complicated the case. In the United States, Megaupload has asked the court to dismiss the criminal indictment against the company, but a decision on this request is yet to arrive.

Source: Kim Dotcom Resigns as Mega Director to Focus on Music Venture

After years of negotiating and planning the “six-strikes” Copyright Alert System finally went live in February.

The Copyright Alert System’s main goal is to educate the public. People are informed that their connection is being used to share copyrighted material without permission, and told where they can find legal alternatives.

These alerts start out friendly, but repeat infringers face a temporary disconnection from the Internet, or another mitigation measure.

The program has not yet shared how many people have been warned thus far or how many have been punished. Since these statistics are not available we decided to look at another set of data to evaluate the effectiveness of the copyright alerts.

Ideally, the warnings should stop people from downloading copyrighted content through sites such as The Pirate Bay, resulting in a drop in visitors. However, half a year has passed since the introduction of the six-strikes scheme, and U.S Pirate Bay traffic appears to be unaffected.

The Pirate Bay shared its U.S. traffic statistics with TorrentFreak and the graph below shows how it developed since early 2011. The y-axis starts at an arbitrary point (we were asked not to disclose the full numbers) but it provides plenty of insights nonetheless.

One of the first data points that stands out is the huge spike in traffic during March this year, the first full month after the Copyright Alert System started. Instead of a decline in traffic, The Pirate Bay nearly broke a record number of page views that month, only trailing behind September 2012.

Compared to March 2012, the increase in page views is 31%, and compared to March 2011 this goes up to 113%.

Pirate Bay traffic

Not pictured in the graph but well worth mentioning, is that February 25 was at that point the best day in terms of traffic for 2013. Perhaps not a coincidence, as this was the day the Copyright Alert System began.

Perhaps all the talk about piracy in the mainstream press piqued the interest of new users?

After the big jump during March this year there was a slight drop in traffic, but the number of page views generated by U.S. visitors was still higher than last year. We should note that the growth rate in 2013 has been slower compared to the year before, but the 2012 pattern is an exception in the bigger picture most likely resulting from the Megaupload shutdown.

So as not to rely on one data source, TorrentFreak also asked ExtraTorrent to share some details on their United States traffic. One of the site’s operators informed us that there are no significant changes in the percentage of U.S. visitors, which floats around 15 percent.

Only time will tell how the number of U.S visits to torrent sites will develop over time. In any case, it is safe to conclude that the six-strikes scheme has thus far failed to encourage a clear decline in Pirate Bay traffic. If anything, it caused a temporary bump in visitors.

Contrary to the above, in 2011 the French three-strikes law caused a 29% decrease in visits to P2P “pirate” sites. Why “six-strikes” has not caused a dent in Pirate Bay’s traffic is hard to explain without further details. It could be that the number of notices is still relatively low, or perhaps pirates are harder to “educate” than expected.

Source: Six-Strikes Fails to Halt U.S. Pirate Bay Growth

Kim Dotcom’s Mega.co.nz launched as the ‘Privacy Company’ with a special emphasis on the security of its users’ files. The company says that due to encryption, no one can access a user’s files hosted on Mega unless the user gives his permission.

In the wake of the NSA scandal the usefulness of encryption has really come to the forefront and MEGA is now placed to release encrypted messaging and email services utilizing similar technology. However, the company’s claims also mean that it becomes a target for those seeking to point out potential weaknesses in its system.

A few hours ago a software developer called Michael Koziarski released a new tool which he claims highlights a fundamental issue with the encryption mechanism implemented by Mega.

The software, known as MEGApwn, is a Javascript bookmarklet that runs in a web browser. Once a user is logged into MEGA it claims to reveal that user’s MEGA master key. Koziarski says that this proves that the master key itself is not encrypted and that anyone with access to a MEGA user’s computer can access it.

However, this is not the most controversial claim. Koziarski says that MEGA itself is able to grab a key and use it to access a user’s files.

“Your web browser trusts whatever it receives from MEGA, which means they can grab your master key whenever you visit their site and then use it to decrypt and read your files. You’d never know,” Koziarski explains.

The dev, who maintains several open source projects, says that if MEGA was issued with a subpoena it could be forced to obtain a user’s master key and be forbidden by law to reveal anything about it. He also claims that ANY installed browser extension could also access a user’s master key.

The revelations provoked an exchange with MEGA programmer Bram Van der Kolk, who questioned how MEGA would stop anyone gaining access to a user’s computer.

“You seriously want MEGA to protect users against this?” he said.

“No, I want users to understand just how easily you could read all their files if you wanted to,” Koziarski responded.

“You mean how easily the user himself can read his own files. How exactly can an external attacker take advantage of this?” der Kolk questioned.

“So you agree MEGA is only secure against external attackers, that you can read my files if you wanted to?” Koziarski fired back.

“Are you seriously suggesting that we will serve trojaned JavaScript? Install one of our browser extensions and turn off auto-updates,” der Kolk countered.

To try and get a clearer idea of how serious (or not) this issue is, TorrentFreak contacted both MEGA and Koziarski for comment on the new tool. We are yet to receive a response but in the meantime the latter is suggesting that while any site uses Javascript for security, the highlighted problem cannot be overcome.

“Does this code hack or break into MEGA? No, it simply demonstrates one of the many serious and insoluble problems you face when doing cryptography in Javascript web applications. There are many other problems like this which is why numerous respected cryptographers have warned against doing this for years,” he concludes.

Update: Both MEGA and Koziarski are preparing answers to our questions so those will be published here as soon as we have them.

Update 2: Comments from Michael Koziarski

I made the tool because I’d noticed that people fell into one of two camps when it came to MEGA’s encryption. If they knew about the limitations of in-browser JavaScript cryptography, they understood that MEGA’s cryptography could easily be bypassed by MEGA or anyone else with access to their web servers. But users who didn’t know anything about cryptography seemed to think that there was something amazingly secure about MEGA.

By contrast, if you encrypt your files with PGP before uploading them, there’s nothing MEGA or anyone else can do to recover them. We already have the tools we need to [cure the problem].

I released MEGApwn to make it easier to show novice users how easily MEGA (or the Feds with a warrant) could circumvent the encryption if they wanted to. Everyone in the infosec industry already knew this.

As for how it works, it’s very very simple. Browsers don’t have a secure location to store sensitive data like your master key, so MEGA uses the html5 local storage API. However this data is available to anyone using your computer, or any JavaScript code running on the mega.co.nz domain. MEGApwn simply reads the key from localstorage and displays it to you.

Fundamentally the problem is that your browser will faithfully execute any code it downloads from mega.co.nz, and your browser has to download that code basically every time you visit the MEGA site.

MEGA have configured their web servers for SSL and HSTS, and don’t embed any third party code on their site, so it’s relatively secure against a 3rd party injecting code.

If they wanted to, any MEGA employee could include code which extracted your secret key and uploaded it to their servers. It wouldn’t warn you, it wouldn’t be obviously broken, you’d just never know. We know from the Hushmail case[1] that courts will issue warrants compelling them to do so in some circumstances,

When you get down to the root of the issue, MEGA’s approach to cryptography is secure if, and only if, you trust MEGA not to extract your keys[2]. From where i sit that’s not all that different from having to trust any other more traditional cloud storage provider not to read your files.

It’s important people understand that.

Update 3: Comments from Bram Van der Kolk of MEGA

We would like to thank a high-profile member of the MEGA community for highlighting two of the potential security risks associated with using computers in general and JavaScript-based cryptography in particular. All of these issues have been covered in our FAQ from the start, but we would like to use the opportunity and reiterate them here in case you have missed that:

1. If you have access to a computer, you can break MEGA (and everything else, too)

This problem is illustrated by a MEGA-specific browser bookmarklet that allows the victim to break into his or her own MEGA account. A more generalized approach is outlined in Brian Kaplan’s paper RAM is Key – Extracting Disk Encryption Keys From Volatile Memory. And, needless to say, if the victim installs remote monitoring software (such as a keylogger/screen grabber) on his machine, the potential security breach becomes pretty much all-encompassing.

2. JavaScript cryptography is weak, because the code is loaded on the fly

There are two trust issues associated with on-the-fly code loading: How secure is the delivery mechanism? And will the service provider send me trojaned code upon receipt of e.g. a National Security Letter?

2.1 JavaScript delivery

The integrity of our JavaScript code depends on the integrity of all SSL certificate issuers that your browser trusts, plus the ISPs between you and our root server cluster and/or the DNS servers involved. Or, put bluntly, “if you can break SSL, you can break MEGA”. Of course, if you can break SSL, there might be more interesting targets for you to break than MEGA…

In addition, we are continuously monitoring our root and API server SSL certificates from a variety of points around the globe. Should any breach be detected, we will immediately shut down MEGA and only resume service once the situation is clarified.

2.2 Intentional delivery of backdoored JavaScript code by us to specific users

Technically, we could serve you backdoored JavaScript code that sends your master encryption key back to us. But that would be pointless, because any such attempt could easily be detected and would completely ruin our credibility. Some juristictions force service providers to install backdoors, but MEGA will always migrate to a jurisdiction that respects your right to privacy instead of putting your data at risk. Major software vendors, e.g. in the United States, could easily be forced by their local government to abuse their update mechanisms to deliver backdoor code to specific targets. We will never provide any government with any backdoors, period.

The fundamental difference between traditional (server-side encrypting) and secure (client-side end-to-end encrypting) cloud storage providers is that the former can intercept all data of all users without the victims having a way of finding out, while the latter have to do something that is detectable on the client side.

2.3 Solutions

If you are worried about the risks outlined above, you should use MEGA in a way that does not rely on code delivered on the fly.

2.3.1 Loading MEGA’s JavaScript code base from your local machine

We offer a browser extension (currently available for Chrome, coming soon for Firefox) that holds all of MEGA’s code locally. If you install a version that someone you trust has code-audited and turn off automatic updates, we cannot backdoor you even if we wanted to.

2.3.2 Using a client application

In a similar vein, non-autoupdating client applications that were written or audited by someone you trust are immune against dynamic backdooring.

3. Untrusted JavaScript loaded from a website is still safer than an untrusted executable loaded from the same website

It is a common misperception that JavaScript is inherently insecure and that native machine code is a much better choice for cryptography. While it is true that full access to the host machine’s features allows for some additional degree of security (such as preventing keys from being sent to swap space), malicious JavaScript executing in your browser’s sandbox (assuming, of course, that no known browser vulnerabilities exist — an admittedly rather weak assumption) at least cannot take over your entire user account or, if you work as root/Administrator, system!

Source: New Browser Tool Claims to Reveal MEGA Users’ Master Key

With 2.4 million downloads, Showtime’s Homeland was one of the most pirated TV-shows of 2012.

Later this month the third season of Homeland will premiere, and this time the number of downloads may even be higher as pirates have access to the premiere four weeks in advance.

Homeland’s season premiere turned up online a few hours ago and already 100,000 people have grabbed an advance copy via one of the Internet’s many torrent sites. While other TV-shows have come out ahead of schedule in the past, the source of this Homeland leak is rather unique, as the copy is not completely finished.

The leak is a so-called workprint, an unfinished copy that lacks some final touches. In two instances some visual effects of bomb craters are still to be added and the opening credits are also missing. In addition, there’s one scene where the voice of the actor is dubbed.

Since it is a workprint, the source of the leak is likely connected to a post-production studio. Unlike promotional screeners which are sent out to the press in advance, not many people have access to unfinished production work.

Somehow a copy leaked outside official channels, which are generally well protected, and eventually made its way to the scene.

Unlike regular scene releases, however, it was shared by an unknown group called “HOMELAND,” which is unusual as scene groups often take pride in their work. Whoever leaked it didn’t live up to scene standards though as the release was quickly “NUKED” by peers on a technicality.

Showtime hasn’t officially responded to the leak thus far, but it could be that they’re not too bothered by the free publicity. In recent months several TV insiders have gone on the record stating that piracy may actually help TV-shows, because of word-of-mouth promotion it generates.

And with such a unique leak, there is bound to be plenty of attention during the days to come.

The last time a high-profile workprint leaked was in 2009 when an unfinished copy of the movie Wolverine leaked a month early. The leak made headlines all over the world and 20th Century Fox quickly involved the FBI to find the leaker.

After eight months the FBI eventually arrested New York resident Gilberto Sanchez. Although he was most likely not the original source of the leak, in 2011 the then 48-year old Sanchez pleaded guilty to uploading a copy of the movie to Megaupload. He was later sentenced to one year in jail.

Whether a 20th Century Fox-like manhunt or a more relaxed HBO attitude will be adopted should become apparent in the near future. In any case, the FBI will be watching.

Source: Homeland Season 3 Workprint Leaks a Month in Advance

During the past couple of years it has become evident that attempts at bringing tough but workable anti-piracy measures into law – particularly ones that target consumers directly – have not been as straightforward as rightsholders would have liked.

After immense effort and with a background of controversy, in 2010 the then Labour government rushed through the Digital Economy Act (DEA) in the UK. That legislation contained provisions which would allow rightsholders to monitor alleged file-sharers and send them warning letters via their Internet service providers. But three years on and the implementation of the law is still well over a year (maybe two) away.

In the meantime the music business has concentrated on legal action to have file-sharing sites such as The Pirate Bay and KickassTorrents blocked at the ISP level. But despite their claims that this is an effective anti-piracy technique (and in the face of reports to the contrary), the labels have grown weary of waiting for the additional powers allocated to them by the DEA.

According to a Guardian report, the labels are currently in talks with Virgin Media, BSkyB and TalkTalk in an effort to have the ISPs implement a voluntary graduated response scheme for dealing with errant subscribers.

And the music biz, headed by the BPI, aren’t on their own. The negotiations have also included the British Video Association, an organization which represents a wide range of Hollywood studios and local broadcasters including the BBC and Channel 4.

So what do the labels and Hollywood want?

At the core is a three-strikes or graduated response-style scheme, which will see rightsholders monitor networks such as BitTorrent for infringements and send warning notifications to Internet subscribers via their ISPs. It appears a US-style ‘Copyright Alert’ model would be desirable but it’s almost certain that there will be calls for a tougher regime with harsher punishments such as throttling and disconnections. But industry dreams aside, there are issues with introducing a system like this on a voluntary basis in the UK.

In order to create an escalating response to serial offenders, someone will need to keep track of which subscribers have had letters in the past. It’s pretty much a certainty that on privacy grounds the ISPs would not freely share this information with rightsholders, but even holding onto this data themselves as part of a voluntary scheme could get them into trouble under the Data Protection Act.

And as far as negotiations go, already there appears to be problems. TalkTalk, a company that previously ran a campaign in direct opposition to any kind of anti-piracy punishment that includes subscriber disconnection, told the Guardian that while talks are indeed underway, the company would “never agree to anything” that would compromise their customers.

Virgin Media went further still, describing the industry’s demands as “unworkable.”

As Prime Minister David Cameron invites key UK music figures to Number 10 to have a chat about government support for their industry, the BPI have confirmed that anti-piracy proposals are on the agenda.

“We expect a range of issues to be covered, including encouraging the growth of legal digital music services in the UK and overseas exports,” a BPI spokesperson said.

“As concerns the Digital Economy Act, we will discuss with Government the need for swifter action to reduce online copyright theft, improve consumer awareness of legal services and make the UK the leading digital economy in Europe.”

Source: Copyright Holders Want Voluntary UK Three-Strikes Anti-Piracy Scheme