[unisog] another round of bogus DMCA notices

Bill Cotter bcotter at uky.edu
Wed Nov 1 12:04:13 GMT 2006


This might not be related, but coincidental:

Here at UK we found that a number of the DMCA complaints had 
changed their time reporting format. There was an element of 
redundancy added (time & GMT offset) that tripped up the parsing 
routine. This change caused an error in the address mapping which 
resolves the public address/time into the correct NAT'ed address of 
the student.

The issue was discovered when we had a high number of students who 
were accused of piracy, yet had no P2P or media on their computers.

Tnx - Bill


At 12:07 PM 10/31/2006, you wrote:
>Michael Holstein wrote:
> > I know this has happened several times in the past, but today I 
> got a
> > round of DMCA notices for non-existent IP addresses.
> >
> > Is anybody saving these and their supporting evidence (that 
> they're bogus)?
>
>What do you mean by "bogus" or "non-existent?"  If the IP addresses
>are valid within your netblocks, but are just not active at the time
>you look (or you are just doing "ping IP-ADDRESS" to verify, I
>would assume some clever miscreant has simply decided to start
>doing short-lived IP aliasing, firewalling, or something else
>designed to make verification of piracy harder.  You may have
>to start logging traffic across your border to verify the claim.
>
>--
>Dave Dittrich                          Information Assurance 
>Researcher,
>dittrich at u.washington.edu              The iSchool
>http://staff.washington.edu/dittrich   University of Washington
>
>PGP key      http://staff.washington.edu/dittrich/pgpkey.txt
>Fingerprint  FE97 0C57 0843 F3EB 49A1  0CD0 8E0C D0BE C838 CCB5
>_______________________________________________
>unisog mailing list
>unisog at lists.dshield.org
>https://lists.sans.org/mailman/listinfo/unisog



More information about the unisog mailing list