RIAA-Approved File-Sharing Service Hacked, 51m User Details Leaked

[Len]

Around 51 million user records of a file-sharing service that was first sued and then approved by the RIAA has been leaked online. The iMesh service was part of a shady group of former P2P services operating under the Bearshare, Lphant and Shareaza brands, despite the latter being obtained in the most questionable of circumstances.

Back in 2003, when file-sharing technology was still in its relative infancy, several platforms had aspirations of becoming the next Napster. One of those was Israel-based iMesh, which at four years old was practically a veteran already.

But in September that year an increasingly irritable RIAA said enough is enough and sued iMesh in the United States. At the time, both parties were defiant. The RIAA insisted that iMesh should be shut down, while iMesh’s owners claimed they’d done nothing wrong.

However, in the summer of 2014 an unusual peace was reached, with iMesh paying the RIAA more than $4m in compensation and continuing business as normal. As strange as it may seem, the RIAA appeared to have licensed people they’d already branded as pirates.

There were changes though. iMesh was forced to release a new client that carried filtering technology provided by Audible Magic, with the aim of stopping infringement on the network. From the release of iMesh v6 in October 2005, it’s almost certain that the RIAA had access to vast amounts of iMesh user data.

Now, however, some of that data has landed in the public arena. Following the sudden disappearance of iMesh in recent weeks, LeakedSource is reporting that it has obtained an iMesh database containing 51,310,759 user records.

“Each record contains an email address, a username, one password, an IP address, a Country location and a join date,” the site says.

The breach, which appears to have taken place in September 2013, lists users from 55 countries participating on iMesh. With 13.7m users, the United States was by far the most popular country.

 

 

Sadly, as is often the case when such breaches are made public, the password situation on iMesh was pretty bleak.

“Passwords were stored in multiple MD5 rounds with salting. ‘Salting’ makes decrypting passwords exponentially harder when dealing with large numbers such as these, and is better than what LinkedIn and MySpace did but MD5 itself is not nearly hard enough for modern computing. The methods iMesh used, albeit 3 years ago were still insufficient for the times,” LeakedSource notes.

Only making matters worse are the passwords deployed by users. Close to a million of iMesh’s users went for ‘123456’, with more than 330,000 going for the slightly longer variant ‘123456789’.

 

 

For what would turn into a largely crippled file-sharing network, iMesh was still attracting plenty of new users. The leak shows that in 2006, just after the release of the RIAA-approved client, iMesh had 4.8 million people sign up. During 2011, 9.4 million jumped on board. The last data available shows 2.5 million new members in 2013.

Now, however, iMesh is suddenly no more. After more than a decade of working with the RIAA (and even the MPAA who had a deal to limit movie sharing on the service), several weeks ago iMesh suddenly shut down. May 5 is the last date an active page is available on Wayback Machine, boasting access to 15 million licensed songs and videos.

Unsurprisingly, the iMesh shutdown is just one of many. At the same time several other platforms closed down including Bearshare, Shareaza and Lphant. Each show an almost identical shutdown message on their homepages since underneath they were all one and the same software operated by the same company.

But while it is customary for file-sharing fans to mourn the loss of file-sharing services, few with knowledge of how this network operated will be disappointed that these have gone, and not just because of the RIAA deal either.

The original Shareaza and Lphant projects were both subjected to hostile action by Discordia, the owners of iMesh, in circumstances that remain murky to this day. The original and safe version of Shareaza continues on Sourceforge, somewhat against the odds.

Users concerned that their data may have been compromised can check here.

 

https://torrentfreak.com/riaa-approved-file-sharing-service-hacked-51m-user-details-leaked-160613/