full-disclosure - MediaSentry false positives?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: kkadow at gmail.com (Kevin)
Subject: MediaSentry false positives?

Has anybody received "Notice of claimed infringement" from MediaSentry
for IP addresses which, while registered to you or your organization,
are in a range not actively in use?

I recently received two notices from MediaSentry for MPAA material,
each listing a single file shared via Kazaa, for two very different IP
addresses for which I am a contact.

In both cases, the IP addresses reported were in fact within the range
allocated, however the address shown is not only not in use, no
address with the same first three octets is either used or announced
via BGP, nor have they ever been publicly visible.

I see two likely possibilities -- either MediaSentry is not using due
diligence in verifying that the material for which they send
infringement notices is actually shared from the address they show in
the complaint,  or somebody on the Internet is spoofing BGP route
announcements for unused address space out of larger allocations.

Before I panic and start researching solutions to address the latter
problem, I'm hoping to first verify whether in fact the MediaSentry
notices have any basis in fact?

Thanks,

Kevin Kadow

(P.S. If you have received a similar "Notice of claimed infringement"
letter from MediaSentry for unused IP addresses, please feel free to
contact me privately.)