Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

RIAA Website Hacked

Posted by CmdrTaco on Mon Jan 21, 2008 09:43 AM
from the maybe-someone-just-typed-rm--rf dept.
Security IT
gattaca writes "A lack of security controls allowed hackers to "wipe" the Recording Industry Association of America's (RIAA) website on Sunday. The existence of an SQL injection attack on the RIAA's site came to light via social network news site Reddit. Soon after hackers were making merry, turning the site into a blank slate, among other things. The RIAA has restored RIAA.org, although whether it's any more secure than before remains open to question, TorrentFreak reports."
+ -
story

Related Stories

Submission: RIAA Website Hacked by Anonymous Coward
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

RIAA Website Hacked 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Well (Score:5, Funny)

    by Chas (5144) on Monday January 21 2008, @09:45AM (#22126250) Homepage Journal
    Normally I don't advocate cracking someone's site. It's childish and petty. Kinda like the RIAA itself.

    But, for some reason, I'm having a really hard time working up any real sense of moral outrage over it.

    This probably makes me a bad, biased person.

    C'est la vie!
    • Same here. *Rubs hands and indulges in a meglomaniacal chuckle*

    • But, for some reason, I'm having a really hard time working up any real sense of moral outrage over it.
      Four words: They had it coming.

      You can't really going around acting like an ass and then expect to be treated with respect by anyone, especially if your site is riddled with basic security problems like SQL injection. Next time, hire a Web developer who isn't a stupid fscktard before gallivanting around, suing everyone, their 80-year-old grandmothers and their 6-year old children into oblivion.

      • Well-It's all relative. (Score:5, Insightful)

        by Anonymous Coward on Monday January 21 2008, @10:26AM (#22126712)
        "Four words: They had it coming."

        Well if we're going to use that excuse then why stop at web site defacement? Why not put out a contract on the heads of the music companies? After all "they had it coming". What's that? Society says it's not OK? So's copyright infringement and that's not stopping anyone. Why should this be any different?

          • Murder by Fractions (Score:4, Funny)

            by Dr_Barnowl (709838) on Monday January 21 2008, @11:57AM (#22127780)
            Given that socio-economic status has a strong correlation to both absolute and "healthy" life expectancy, each successful "life-ruining" lawsuit which results in a corresponding drop in socio-economic status could be interpreted as being some fraction of a murder.

            I'm sure they have accumulated enough fractions by now to cover the members of the board, and maybe a few tiers of upper management too. Since they are the most compensated, they must be the most responsible, right?

            NB. Tongue is firmly in cheek.

  • Why wipe it? (Score:5, Funny)

    by Loibisch (964797) on Monday January 21 2008, @09:51AM (#22126334)
    It would have been so much better to make it a temporary mirror for thepiratebay.org :D

    Wonder if they would have started a lawsuit against themselves...

    • Re:Why wipe it? (Score:5, Insightful)

      by webmaster404 (1148909) on Monday January 21 2008, @09:54AM (#22126388)
      Nah, how about a bunch of press releases saying that "the RIAA was wrong to sue music fans for sharing songs therefore we are dropping all the charges" and then seeing if the judge would say that if it was a cracked site or the RIAA itself. Or how about a plea to stop DRM by saying "it is not working" or at least informing people about the evils of DRM. The possibilities are endless, just blanking a page.... how unprofessional, it did no good to the world the way then the way it could have been done.

      • Re:Why wipe it? (Score:4, Insightful)

        by Speare (84249) on Monday January 21 2008, @10:17AM (#22126610) Homepage
        If one of your neighbors is disappointed in your lawn care or your dog's poops, there are positive ways of stating the disagreement, and there are negative ways. Certainly, if they spraypainted their message in 2ft high letters on the exterior of your house, you'd be understandably less interested in the actual message than in cleaning the graffiti and contacting the constabulary. Likewise, defacing the website with a thoughtful "open letter" isn't likely to actually communicate anything.

        • Re:Why wipe it? (Score:5, Interesting)

          by techpawn (969834) on Monday January 21 2008, @10:34AM (#22126788) Journal
          But, could that open letter be used as evidence? It came from their website then if they try to use "well, anyone can make things on the internet look that way! Just because the IP address and website are ours it doesn't mean it's our data!" couldn't we counter argue that with their IP sniffing and screen shots or whatever?

          I know it would never work. The judge would ph34r t3h ev1l h4xx0rz! But, if fun to dream isn't it?

      • Re:Why wipe it? (Score:5, Insightful)

        by Machtyn (759119) on Monday January 21 2008, @11:18AM (#22127228) Homepage
        My question is how often does the average consumer really visit a website like mpaa.org, riaa.org, or any other corporate entity presence? For me, it is less than 0.005 (or less than a 1/2%). I think the last time I visited riaa.org was a couple years ago when /. mentioned the site had been hacked. I've never visited a General Motors website, the company that makes my favorite breakfast cereal or laundry detergent. I've just never had the desire.

        I suspect that the average person visits their favorite news site, gaming portal (like games.yahoo.com or legitgames.com or whatever), fark/digg/slashdot, and blogs of the different varieties. My wife will occasionally do searches for recipes, information on baby stuff, etc. We'll hit newegg.com, amazon.com, or other storefronts.

        Am I wrong in my thinking that the average person would visit a site like mpaa.org, riaa.org, or other industry specific org sites? We all use tires to drive on, have you ever visited the site for Michelen or Dunlap tires? Do they have a trade org site that issues news, warnings, and user information regarding recalls/defects of certain tires? If so, I've never even considered searching it out.

        My point is that very few people would see it to make it worth putting information touting your propaganda. However, if it was outrageous enough, perhaps it would make news and people might visit (by which time it would be too late, as the site would be fixed).

      • You bring to mind an interesting point (Score:5, Interesting)

        by Weaselmancer (533834) on Monday January 21 2008, @03:01PM (#22129976)

        Nah, how about a bunch of press releases saying that "the RIAA was wrong to sue music fans for sharing songs therefore we are dropping all the charges" and then seeing if the judge would say that if it was a cracked site or the RIAA itself.

        The linchpin of the RIAA's lawsuit factory rests on the supposition that an IP address is exactly identical to a person. What the IP address does is legally identical to a person doing it. That's their argument.

        So, if their website were to be hacked, wouldn't that exact same rule apply to whatever content was there? Their IP address is legally the same as the person/corporation/entity who owns it, right? That IS their argument, after all.

        So why not use that against them in a legal sense?

        It would be brilliant. The RIAA lawyers when they were brought into court for whatever happened to be uploaded there would have to make the argument that an IP address DOES NOT equate to the owner of the IP address in order to defend themselves.

        They'd have to make our argument for us, and in front of a judge.

        You couldn't ask for a better precedent.

  • I wouldn't have wiped... (Score:5, Funny)

    by blake1 (1148613) on Monday January 21 2008, @09:53AM (#22126366)
    instead I would have used my cunning to download the latest Britney album to their server in DRM-free MP3 format. And then promptly reported them to themselves.

  • It would've been funnier (Score:5, Interesting)

    by SirLurksAlot (1169039) on Monday January 21 2008, @09:53AM (#22126368)

    if they made innocuous little changes here and there, such as changing the words "do not support file-sharing" to "fully support file-sharing." It probably would've the RIAA much longer to realize they've been had, and I'm sure they would've gotten some interesting calls and e-mails :-D

  • RIAA will use this (Score:5, Insightful)

    by BadHaggis (1179673) on Monday January 21 2008, @09:57AM (#22126402)
    to justify further restrictions on P2P software. I'm sure they will be able to twist this attack into some type of political message to show that the P2P community is just a bunch of cracking criminals which need to be stopped.

    While I hold little sympathy for RIAA in this matter, I would rather people found different and legal ways to thwart the RIAA's mission.

    • Re:RIAA will use this (Score:5, Insightful)

      by webmaster404 (1148909) on Monday January 21 2008, @10:07AM (#22126526)
      We have found legal ways. Its called not buying albums or buying into DRM. However, the RIAA thinks that it is always P2P networks that are to blame for every loss that they suffer. So if the RIAA loses sales, its not because more people are buying indie band CDs or downloading non-RIAA songs, its because of those pirates never ever because most of the music is more noise then music. The RIAA has no logic, they are used to being a monopoly. Even when we win we lose.

      • Re:RIAA will use this (Score:5, Interesting)

        by chortick (979856) on Monday January 21 2008, @11:03AM (#22127078)
        From a recent Economist article http://www.economist.com/business/displaystory.cfm?story_id=10498664 [economist.com]:

        "IN 2006 EMI, the world's fourth-biggest recorded-music company, invited some teenagers into its headquarters in London to talk to its top managers about their listening habits. At the end of the session the EMI bosses thanked them for their comments and told them to help themselves to a big pile of CDs sitting on a table. But none of the teens took any of the CDs, even though they were free. "That was the moment we realised the game was completely up," says a person who was there."

  • Or is it? (Score:4, Insightful)

    by mach1980 (1114097) on Monday January 21 2008, @10:01AM (#22126452)
    Do not rule out the RIAA to hire someone to do the hacking to win moral high ground.

    RIAA may now turn their media machine to connect evil hackers with the pirate bay and try to put them in the same corner as child molesters and nazis.

  • What should have been hosted (Score:4, Funny)

    by IndustrialComplex (975015) on Monday January 21 2008, @10:06AM (#22126512)
    If you are going to break into a website, then you need some sort of plan for when/if you succeed.

    How about a statement like this:

    "The protections applied to this website were more robust than the Digital Rights Management that is applied to CDs DVDs and other forms of digital media. Yet even that didn't stop a determined individual. If this website were a CD, it would be leaked all over the internet, and once cracked, DRM simply becomes an impediment to the legitimate users."

    At least they could have tried to make it relevant. However, it is quite possible that they didn't have all that much time or total access to the site. (though if you can erase something, I'm pretty sure that is as close to total access as you need) I'm not too familiar with databases and websites so I don't know how far they could go with it.
  • I like the site a bunch, so I say this with a twinge of reluctance. And I certainly don't like the RIAA. But that kind of behavior is plain criminal. Doesn't matter who owns the computer, it is private property and deserves respect as such.

    • Re: (Score:3, Funny)

      by Anonymous Coward
      C'mon man - it's not like they hacked in to COPY the site, god dammit.

    • Re:This gives reddit a bad name (Score:5, Interesting)

      by Rahga (13479) on Monday January 21 2008, @10:38AM (#22126828) Homepage Journal
      Can you co-opt the police and feds to conduct raids of private property on your behalf? No? The RIAA can and regularly does, confiscating anything that could conceivably be used to produce and distribute music, including vehicles and computers. It doesn't even matter if an organization, such as authorized mixtape producers, are acting within the law... their property is confiscated first and questions are asked later, usually past the point where a business can survive.

      The RIAA are among the least of those who deserve to have their property rights defended.

  • Maybe the RIAA's New Plan Caused It (Score:3, Insightful)

    by briggsb (217215) on Monday January 21 2008, @10:18AM (#22126626)
    Maybe it was people protesting the RIAA's plan to put RFID chips on CDs [bbspot.com] to combat piracy that caused the attack.

  • wow (Score:5, Insightful)

    by kellyb9 (954229) on Monday January 21 2008, @10:26AM (#22126704)
    So you're the most hated site on the internet essentially, especially by people who proudly go by the name "pirates". And you don't protect your site??? Who exactly is running this operation?

    • Re:wow (Score:5, Funny)

      by Osurak (1013927) on Monday January 21 2008, @10:48AM (#22126930)

      So you're the most hated site on the internet essentially, especially by people who proudly go by the name "pirates". And you don't protect your site??? Who exactly is running this operation?
      Ninjas.

  • Obligatory Nelson quote (Score:4, Funny)

    by ndtechnologies (814381) on Monday January 21 2008, @10:26AM (#22126714)
    "HA HA!"

  • Slashdotting (Score:5, Funny)

    by megazork (953335) on Monday January 21 2008, @10:30AM (#22126754)
    The OP should have posted a link to RIAA.org so that it could have been slashdotted. =)

  • Sigh.... missed opportunity (Score:5, Insightful)

    by Maxo-Texas (864189) on Monday January 21 2008, @10:44AM (#22126886)
    First... I agree that shutting someone else up is not a great way to have a conversation...

    But if you are going to do something like this, then have a little panache.

    For example, you could upload a few Mp3's with links to download them from the site.

    Or upload some key quotes "Copyright should be good for forever less one day".

    Or upload Jefferson's statements on copyright.

    ah well...

  • This is not good (Score:4, Insightful)

    by Anonymous Coward on Monday January 21 2008, @11:03AM (#22127062)
    Attacking their website will only aid them in public opinion. This gives credit to their argument that people who oppose them are criminals.

  • Archive.org (Score:5, Funny)

    by RAMMS+EIN (578166) on Monday January 21 2008, @02:07PM (#22129390) Homepage Journal
    Fortunately for the RIAA, the old content of the site has been archived by the Internet Archive.

    Although that poses a rather uncomfortable dilemma for the RIAA: should they thank archive.org for saving their content...or sue them for copyright infringement?

    • Re:Let me be the first to cry (Score:5, Funny)

      by gnick (1211984) on Monday January 21 2008, @09:52AM (#22126354) Homepage
      No, this falls far short of justice. Justice would have been posting a bunch of copywritten songs and announcing to the world where to find them. Even better:
      * Record an original piece
      * Post it
      * Sue the RIAA for hosting it

      Just blanking a site is lazy.

    • Re:Let me be the first to cry (Score:4, Insightful)

      by LordEd (840443) on Monday January 21 2008, @09:52AM (#22126358)
      So you're saying that wrecking a database on an informational website that could likely be replaced from backup in less than an hour is the equivalent to the RIAA's normal business practices?

      Well there you go Slashdot, we're even now. No complaining about the RIAA until they do something new.

      • Re:Let me be the first to cry (Score:5, Funny)

        by smitty_one_each (243267) * on Monday January 21 2008, @12:17PM (#22128044) Homepage Journal
        If they just restore the site from backup, without patching the SQL injection vulnerability, then the RIAA is RIAAlly st00p3d.
        Now, parking a whole bunch of Scientology materials on their server would be quite funny.

        • Re:Let me be the first to cry (Score:5, Funny)

          by SoulRider (148285) on Monday January 21 2008, @05:43PM (#22131566)
          I heard the scientology site got hacked this weekend and so did the RIAA website. Someone...PLEASE!...someone do it again only this time post negaive scientology propoganda on the the RIAA website and RIAA properties on the scientology website. They would have to sue each other, and considering the tactics both sides like to use the resulting trial could take 100 years or more.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.