Security hole in Morpheus

'Dangerous' hole discovered in Morpheus

MP3 fans using the Morpheus file-swapping service risk having their personal details exposed online, according to security experts.
Morpheus in now the most popular file-swapping service on the Internet. The security hole means that the personal details of millions of people are now at risk of exposure. According to the Web site of MusicCity--the company that created Morpheus--more than nine million copies of the client have been downloaded.

MusicCity Networks could not be contacted for comment.

A new security hole has been discovered in the peer-to-peer file-sharing application, which allows a random list to be generated of people using the service. A malicious hacker could then access the computers of those users and copy files from anywhere on their hard disk. Usually, Morpheus only allows access to files placed in a specific folder, like other peer to peer file-sharing clients.

The privacy risk was reported to BBC News Online by a group of security experts, who are choosing to remain anonymous. They have described the exploit as "very dangerous", and have warned that this could make every Morpheus user's computer available to anyone who wants to access it.

The Morpheus peer-to-peer application allows users to search for digital media, such as music and videos, on the MusicCity network. The service also allows content providers to deploy third-party digital rights management technology to protect their copyright works. This protects the copyrights of artists involved, and has helped it to prevent a Napster-style shutdown.

http://zdnet.com.com/2100-1106-828592.html

do you know how this is done? i have morpheus. i would like to protect my computer from this.:)

First off.. Turn off File-Sharing.
Second. Morpheus shouldent ''show the user'' on the search list cause if you just follow a lil click on the user then you can easily trace and monitor the package.

So Morpheus. - take out the show user feature.

/artic.

I saw this article and freaked. Everyone I know, including myself uses Morpheus, so I was pretty surprised to read that there is such a serious hole in the program. That really sucks.

I think I will be writing MusicCity and ask what they plan on doing about this. A patch would really be appreciated.

Ive searched high and low for more info on this warning but theirs nothing there. general concensus seems to be that this is a rumor started by the record industry to stem file sharing.
they might be right.

I am not sure if this is the hole that has been reported. I have known about this for quite some time. But i'll paste it anyway, i'm sure someone will tell me if it is old news or not :)

Quote:

---

Hello, I wrote this text file just because I felt like typing and because a lot of people use morpheus and don't know they can be "hacked". Morpheus and Kazaa are a big comunity just like Napster and some other. This file explains a hole found by me (just_a_dude) which later on I discovered someone else had found it already :( but I felt like writting a text file about
it so here it goes. I'll be referring to Morpheus/Kazza as M/K.

---

Morpheus/KaZaA

I'm not sure how available files in non-shared directories are. I will experiment with this when I am off the corporate network. It seems that if I do netstat -a and get a list of systems I am connecting to I can then either do ftp <IP> and attempt a logon or net use <ip> or map network drive <ip> with the second 2 choices I will only see files in shared folders. It is a security hole but a simple enough patch is disable sharing in drives/directories you don't want outsiders to see (I think by default 2000/nt c drive is shared -thank you m$).

Cheers,
-D

Morpheus file sharing is just like when I was a kid. I got a new walkman for my b-day and

when I borrowed my friends cassette to listen to it got tangled up, ate the cassette and

broke my walkman. maybe the metallica scrooge was right, u SHOULD buy c.d.'s. and software
Just to be safe (not that anyone ever wil again) N.

Quote:

---

Originally posted by dspeidel
(I think by default 2000/nt c drive is shared -thank you m$)

---

yes, c is shared by default. its under the name c$. you need admin access to get into it. if it werent there and you had admin access you could easily enough create it. for once, i dont think there is anything wrong with what microsuck did.

this way(i wouldn't call it exlpoiting morpheus) gives you via a web browser a list of everything that person has on morpheus, which is a feature they have anyway. what you do is make a connection with somebody(download/upload) and in DOS run netstat -n command to get their ip. then in your browser just connect to their ip on port 1214."http://x.x.x.x.:1214" the x's being the ip.

how this relates to the leeching of someones c:/ drive, i dont know.


"edit"

Quote:

---

I am not sure if this is the hole that has been reported. I have known...

---

i guess someone beat me to it.

I've heard that KaZaa has a hole in it placed by the FBI so that they can moniter you. Is this true, or is it just an out-of-control rumour?

MusicCity's official response...

Quote:

---

MusicCity

Several stories have been printed, leading with a story that was printed in the BBC Online, reporting a security leak in Morpheus. The report is not true - The report of a security hole in Morpheus is FALSE.

THIS REPORT IS FALSE

· The report was allegedly made by an “anonymous” security consultant. Neither this consultant nor any others have contacted StreamCast directly to report a breach in security.

· Several false postings have been made on behalf of StreamCast and Morpheus. One was reported by a source named Paul Sarsfield, who claimed to be a “Morpheus” employee. StreamCast does not employ any person by that name, nor have any StreamCast employees or company representatives posted any responses to this matter.

· There has never been a security breech in Morpheus since its introduction in April 2001.

---

I guess this is the place to mention "supernode" and all the false alarms it will give your firewall.

This "hole" in morpheous seems to me to be a known problem in file sharing applications such as this. Also it is a problem in AIM.

Its scary with all security risks filesharing progs are giving the normal user. Another thread was alive earlier today about the same security problems. I have to tell that I'm quite happy to use ftp for filesharing, less security issues with ftp but not failsafe though :D.

Quote:

---

Originally by ThePreacher
This "hole" in morpheous seems to me to be a known problem in file sharing applications such as this. Also it is a problem in AIM.

---

Thats true, when will they learn to secure their products in a better way?

Quote:

---

Originally by Negative
Several stories have been printed, leading with a story that was printed in the BBC Online, reporting a security leak in Morpheus. The report is not true - The report of a security hole in Morpheus is FALSE.

---

What is the truth, who should we listen to? Can anyone here verify the problem?

Quote:

---

Originally by antihaxor
I guess this is the place to mention "supernode" and all the false alarms it will give your firewall.

---

This "Supernode" should be the first "feature" to be turned off.

I'm found an article which explain issue ...
http://groups.yahoo.com/group/intern...ti/message/363 (it. language)

Well, I had reserched a lot of stuff ... ihihih

1st:
i'm found a post on Gnutella of PAUL SARSFIELD, which announce:
"Yes. We have confirmed the reports that Morpheus does indeed contain the security hole. Our programmers are working diligently on a fix and we hope to have it ready within the week."

...

Thank you,
-Paul Sarsfield,
Tech Support
MusicCity Morpheus

Well, the italian article's author has writed to KELLY O'NEIL of StreamCast Networks:
she has confirmed which aren't employees whit that name !!!

2st:
Who is PAUL SARSFIELD?
Well, is an owner of a web site which has published an article for denigrate BBC:
http://gamerspage.dingojunction.com/morpheus.htm

3rd:
Morpheus is secure:
KELLY O'NEIL has replied:
http://www.theregister.co.uk/content/55/23842.html

and MusicCity too:
See at Negative's post or
http://www.musiccity.com/

PS: original BBC's article:
http://news.bbc.co.uk/hi/english/sci...00/1798095.stm

Have funny