Risk

2/25/2010
04:31 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Cryptome Back Online After Brief DMCA Battle

Website reportedly taken down for posting sensitive Microsoft document on criminal investigation compliance

In a bizarre up-and-down -- literally -- series of events, the controversial site Cryptome.org was forced offline yesterday after posting a sensitive Microsoft document on its site, but was back online today.

It all started when Cryptome, which operates as a repository for freedom of speech, cryptography, spy, and surveillance information and documents, posted a Microsoft surveillance compliance document titled "Microsoft Online Services Global Criminal Compliance Handbook." Next Microsoft filed a Digital Millennium Copyright Act (DMCA) notice, and Cryptome refused to remove the document from the site.

Cryptome went back online today, posting a letter that appeared to be from its hosting provider, Network Solutions, stating that Microsoft had withdrawn its DCMA complaint. The site boasts it "welcomes documents for publication that are prohibited by governments worldwide, in particular material on freedom of expression, privacy, cryptology, dual-use technologies, national security, intelligence, and secret governance -- open, secret and classified documents -- but not limited to those."

Microsoft reportedly said today it did not want Cryptome taken down. "We did not ask that this site be taken down, only that Microsoft copyrighted content be removed," Microsoft said in a statement to PC Magazine>. "We are requesting to have the site restored and are no longer seeking the document's removal."

Meanwhile, the document in question offers a little insight into information Microsoft keeps. According to a report in Wired, the document says, among other things, that Microsoft's Xbox Live records and stores IP addresses used to log into the gaming console.

And Microsoft's Hotmail and MSN Premium email services keep email account registration records "for the life of the account," according to the document, and IP connection history data for 60 days.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Google to Delete 'Secure' Label from HTTPS Sites
Kelly Sheridan, Staff Editor, Dark Reading,  5/21/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-2598
PUBLISHED: 2018-05-23
Jenkins before versions 2.44, 2.32.2 uses AES ECB block cipher mode without IV for encrypting secrets which makes Jenkins and the stored secrets vulnerable to unnecessary risks (SECURITY-304).
CVE-2018-1124
PUBLISHED: 2018-05-23
procps-ng before version 3.3.15 is vulnerable to multiple integer overflows leading to a heap corruption in file2strvec function. This allows a privilege escalation for a local attacker who can create entries in procfs by starting processes, which could result in crashes or arbitrary code execution ...
CVE-2018-1126
PUBLISHED: 2018-05-23
procps-ng before version 3.3.15 is vulnerable to an incorrect integer size in proc/alloc.* leading to truncation/integer overflow issues. This flaw is related to CVE-2018-1124.
CVE-2018-11396
PUBLISHED: 2018-05-23
ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that triggers access to a NULL URL, as demonstrated by a crafted window.open call.
CVE-2018-8176
PUBLISHED: 2018-05-23
A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly validate XML content, aka "Microsoft PowerPoint Remote Code Execution Vulnerability." This affects Microsoft Office.