Wednesday, July 27, 2022

TorrentFreak's Latest News

 

GeoComply Expands VPN 'Piracy' Detection By Blocking Residential IP-Addresses
Ernesto Van der Sar, 27 Jul 12:09 PM

geoguardVPN services are a useful tool to protect internet users' online privacy. In addition, they can also help to bypass geographical restrictions.

The latter can be helpful if people want to access the content library of a streaming service in another country. While this often goes against the terms of service, some VPNs openly advertise this feature.

Blocking Geo-Pirates

This 'geo piracy' issue isn't new. Netflix famously started blocking VPN users for this very reason seven years ago and other streaming providers have taken similar measures. These countermeasures are effective but far from perfect.

There are various ways VPN services have managed to circumvent these blocking efforts. Most keep the technical details private, but it's commonly known that some are using residential IP addresses as proxies, to make it look like VPN users are regular ISP subscribers.

These residential IP addresses are used to establish the connection with the streaming service and because they are typically not associated with a VPN, they can effectively bypass traditional blocklists.

GeoComply Blocks Residential IPs

Rightsholders and streaming providers are aware of this trick, but it's hard to do anything about it. This week, however, cybersecurity and VPN detection service GeoComply offered a solution. The company announced an "industry-first technology" for streaming providers that "tightens the net around pirate viewers."

"The new technology enhancement to GeoGuard allows streaming providers to block the growing number of VPN users who spoof their location using hijacked residential IP addresses," the company writes in a press release.

geoguard-feature

GeoComply uses the term "hijacked" IP addresses, which deserves some nuance. In reality, these addresses often belong to users of free VPNs or proxies who allow their connections to be resold to third parties. This reselling right is often hidden in the fine print of terms of service agreements, which most people don't read.

"Free VPN providers profit by selling hijacked residential IP addresses to the highest bidder, usually a provider of 'undetectable' premium VPN services. These services give subscribers the ability to spoof their location using the hijacked addresses," GeoComply notes.

For example, users of the free Hola VPN service agree to have their connections used by Bright Data, which offers access to residential IP addresses to third parties. This has been going on for several years already but most users are simply not aware of it.

GeoComply reports that its GeoGuard service can now spot these 'hijacked' residential IP addresses, which should make it harder for VPN services to evade blocking measures.

"To combat this problem, we can now accurately detect users accessing streaming services using hijacked residential IP addresses to help uphold the territorial licensing models our customers depend on," GeoComply's James Clark says.

Overblocking?

According to GeoComply, an estimated 200 million internet users are the "victim of residential proxy IP abuse." That implies that there's a huge market for its new blocking capability but there are also downsides to consider.

Blocking residential IP addresses means that the unknowing 'victims' can also find themselves blocked by streaming services, even though they're not doing anything wrong. This is what we previously saw when Netflix expanded its VPN blocking capability too far.

TorrentFreak reached out to GeoComply which informed us that its service can differentiate between VPN users who use 'hijacked' residential IP addresses and the actual owner of this address. While errors can never be ruled out completely, this should minimize overblocking.

All in all it's clear that GeoComply takes VPN blocking very seriously. In addition to rolling out these new blocking capabilities, the company recently petitioned the US Government to make VPN detection tools a mandatory copyright protection measure under the DMCA.

From: TF, for the latest news on copyright battles, piracy and more.

HeHeStreams: Pirate IPTV Owner Admits Cybercrime, Forfeits $500K
Andy Maxwell, 26 Jul 08:12 PM

hackerThere are many options for those seeking a cheap pirate IPTV package but it's rare for any single provider to offer consistently solid streams, in decent quality, and at a fair price. HeHeStreams was one of the few to exceed expectations.

With a focus on MLB, NBA, NFL, and NHL content, HeHeStreams built an enthusiastic customer base so when it disappeared last year following an investigation by the Alliance for Creativity (ACE) and Motion Picture Association (MPA), obvious replacements were in short supply.

The same couldn't be said about the controversy that was about to engulf HeHeStream's owner.

HeHeStreams Settled With Hollywood, But Not the US Govt.

Under pressure from the ACE anti-piracy coalition, HeHe's owner Joshua Streit (aka Josh Brody) accepted an offer to settle his case and move on. That involved giving up his domain names to the MPA and shutting down his site. No cash settlement was mentioned publicly but it's likely that ACE members received financial compensation.

In theory that should've ended Streit's legal problems but that wasn't how things panned out. More serious problems lay ahead and were directly connected to Streit's skills and HeHe's unique mode of operation.

Traditional IPTV suppliers provide access to pirate streams by rebroadcasting captured content from their own servers. It's bandwidth-intensive, expensive, and prone to issues. HeHeStreams eliminated most of these additional costs by using techniques to connect customers to genuine streams, offered by the sports broadcasters themselves, directly from their own servers.

The upsides could be found in rock-solid streams, low server costs, and many happy customers. The downsides proved more complicated for Streit.

A Criminal Investigation Was Already Underway

There are two angles on what happened next, depending on the mood, tone and lighting. Ultimately, only one mattered.

According to the US government, Streit emailed an MLB (Major League Baseball) employee in March 2021 to explain that he'd previously disclosed a network vulnerability in their systems (i.e a way to get streaming content without paying for it) and was disappointed by the lack of gratitude.

The US government says that in a follow-up email, Streit complained to MLB that other vulnerabilities he'd disclosed hadn't been given proper attention either. An MLB executive eventually telephoned Streit and informed him that the company operated no 'bug bounty' style programs.

According to the US government, Streit then indicated that financial compensation for his security work would be appropriate under the circumstances.

streit-bug bounty

Placed in a deliberately more favorable light for a moment, Streit's approach to MLB could've been seen as an opportunity to stop operations like his from accessing MLB content from company servers. With the benefit of the doubt and weighed against much bigger savings, $150,000 might even sound like a good security consultancy opportunity.

In the cold light of day, Streit's comment about being chased down on the basis of his "unauthorized access to systems" was to prove prophetic. Both MLB and the FBI framed Streit's conduct as extortion.

US Government Indicts Joshua Streit

In October 21, the Department of Justice announced that Streit had been charged with several crimes, including one under a new law designed to reduce illegal streaming. The 30-year-old from Minnesota was charged as follows:

One count of knowingly accessing a protected computer in furtherance of a criminal act and for purposes of commercial advantage and private financial gain (max five years in prison). One count of knowingly accessing a protected computer in furtherance of fraud (max five years in prison), one count of wire fraud (20 years), and one count of sending interstate threats with the intent to extort (20 years).

A final count of illicit digital transmission, carrying a potential five-year sentence, was added for good measure. The details of that count weren't made public but could've been a reference to the Protecting Lawful Streaming Act (PLSA) signed into law late 2020.

With such a lot on the line, Streit entered into negotiations with the government. The ins and outs of those talks aren't for public consumption but we can reveal that a deal has been reached. It's hard to imagine Streit being pleased with the outcome but when stuck between a rock and a hard place, something had to give.

Streit Enters Guilty Plea on a Single Count

Around June 13, 2022, Streit pleaded guilty to one count of 'Computer Fraud – Unauthorized Access to Obtain Information From a Protected Computer'.

According to the charge, from around July 2017 to around July 2021, Streit intentionally accessed and attempted to access computers without authorization. As a result, he obtained information from protected computers, for the purposes of commercial advantage and private financial gain.

Specifically, Streit obtained unauthorized access to the online accounts of users of a website belonging to Major League Baseball and used that access to "conduct illegal streaming of sporting events" that he sold to others for a profit.

In advance of his sentencing on that single count, the matter of forfeiture has been settled.

$500,000 to Be Forfeited to the United States

In a consent preliminary order of forfeiture submitted to a New York district court, the single count against Streit is repeated alongside details of forfeiture pursuant to 18 U.S. Code § 1030(i).

The forfeiture relates to "any and all property, real or personal, constituting or derived from, any proceeds that such person obtained, directly or indirectly, as a result of the offense," plus "any and all personal property that was used or intended to be used to commit or to facilitate the commission of the offense."

According to the plea agreement reached with the US government, Streit will forfeit $500,000, an amount said to represent "the amount of proceeds traceable to the commission of the offense."

streit-500k

Streit will also forfeit a small mountain of computer and electronics hardware seized from him in October 2021. The haul includes six Apple MacBook Pro devices, several Apple, Google, and Samsung-branded smartphones, tablets, hard drives, and other assorted storage media.

Potentially Lengthy Prison Sentence Ahead

The specific charge Streit faces relates to an offense under 18 U.S. Code § 1030 (Fraud and related activity in connection with computers) where information valued at more than $5,000 was obtained.

At least potentially he could face up to five years in prison. If he'd previously been convicted of a crime under § 1030, the sentence could reach ten years but we understand that's not the case here.

Documents related to the charge and forfeiture can be found here (1,2, pdf)

From: TF, for the latest news on copyright battles, piracy and more.

'Rojadirecta Ordered to Pay Over €500,000 in Sports Piracy Damages'
Ernesto Van der Sar, 26 Jul 01:06 PM

Red CardFounded more than 16 years ago, Rojadirecta is one of the oldest and most popular linking sites for sports streaming events.

The site, which is operated by the Spanish company Puerto 80 Projects, has built a loyal user base over the years. At the same time, it has fought quite a few legal battles too.

The Spanish site famously challenged a domain seizure by the U.S. Government, with success. On its home turf, there have been some victories in court as well but, in recent years, the tide has turned.

Rojadirecta Blocked and Outlawed

Today, Rojadirecta is outlawed in Spain despite repeated appeals. In several other countries including the UK, Denmark, and Uruguay, internet service providers have been ordered to block the site.

After being outlawed in Spain, Rojadirecta was also taken to court in Italy by local media giant Mediaset (RTI). Italy's largest broadcaster argued that the streaming portal facilitates mass infringement of several sports events, causing substantial damages to rightsholders.

The case in question was presented to the Court of Rome which reached a verdict last week. According to the court, Rojadirecta bears full responsibility for the pirating activities that take place through its site, even though the streaming activity doesn't take place on the site itself.

Damages Award: €529,579.50

To compensate Mediaset for the damages it suffered, the court reportedly ordered Rojadirecta to pay €529,579.50 in compensation. In addition, the streaming portal must pay €24,786.00 to cover accrued interest and legal fees.

Mediaset's attorney Alessandro La Rosa informs us that the case resolved around infringements of football matches of the Italian Serie A and the UEFA Champions League. The Court of Rome confirmed, based on EU jurisprudence, that links to third-party portals can be sufficient to invoke liability.

TorrentFreak reached out to Rojadirecta founder and operator Igor Seoane, who prefers not to comment on the matter. In the past Rojadirecta has appealed similar verdicts so it's possible the same will happen here.

The information reported above all comes directly from Mediaset. However, a source who's familiar with the defense informs us that the verdict doesn't only bring good news for the Italian broadcaster.

Missing Details?

The Court of Rome did not grant the trademark infringement and unfair competition claims, for example. In addition, the damages are much lower than the €29 million euro Mediaset presumably requested in court. These details are not mentioned in Mediaset's press release.

If we receive a copy of the full verdict we will update the article accordingly. There is no denying, however, that the legal landscape is shifting against Rojadirecta's interests.

Years ago the site won two lawsuits in Spain, which declared the site as operating legally under local law. More recent court decisions are unfavorable and there could be more trouble ahead.

In addition to the civil lawsuits, Rojadirecta's operator was previously arrested on suspicion of illegal activities. Following an in-depth investigation, the Spanish authorities announced a criminal prosecution which could see Seoane facing a multi-year prison sentence, as well as millions of dollars in damages.

Update: This article was updated to include additional information provided by Mediaset attorney Alessandro La Rosa. The attorney was not able to share the verdict but shared several excerpts that confirm the earlier reporting.

From: TF, for the latest news on copyright battles, piracy and more.

 
 
Powered by Mad Mimi®A GoDaddy® company

No comments: