Hackers Steal ‘User Database’ From Popular Private Tracker

August 01, 2008 by sharky

Last weekend, www.TTi.nu - the popular Swedish/English private tracker, became the latest BitTorrent site to fall prey to hackers. But what makes this particular situation a little different is that the hackers didn’t shut down the site (or even the tracker), or attempt to cause any other disturbances. Eerily, and uncharacteristically of most hackers, they wanted to slip in and out completely unnoticed - not wreak havoc as expected. They had a specific target; a clear agenda. The hackers wanted the entire site database of all users’ information - and they were successful.

Here’s the message left on TTi’s news page from the administration:

From the looks of it, the hackers made off with IP numbers of all members, and their email addresses (that were used to sign up for the account). Apparently the account passwords are safe, likely due to heavy encryption techniques, although users are changing their passwords en masse anyways, just to be safe.

The Motives

FSF asked around to see if we could get a straight answer as to the motives behind the attack. No one seems to know for sure, although the most likely reason is to get a hold of that list of valid email addresses (21,000 of them), and sell them on the black market to a botnet. To suggest the going rate for a valid email is around $0.05, this translates to over $1,000 for the lot - no small potatoes for one night’s work.

Another theory is that the IFPI (or even Brein) is somehow involved, in an effort to combat piracy - although it seems like a very unlikely scenario since the tracker was left online. But picture this if you will: 21,000 users receiving threatening letters from IFPI affiliates for involvement in illegal file-sharing activities. Perhaps it’s not all that far-fetched after all.

TTi.nu has stated it’ll keep members posted on additional information as it becomes available. Still no update yet on the situation, and there’s very little mention of it in their forums or IRC channel. We’ll update this article once the dust settles.