Peer-to-Peer Network Security

Written by Nafeesa Syeed – The Associated Press

WASHINGTON – The headache of tax day is gone, but your returns could still be floating somewhere online if you use file-sharing programs to download music and movies, security analysts say.

Identity thieves are exploiting the programs to reach into people’s computers and pluck documents containing social security numbers, bank account information or credit card numbers. As the economy has spiraled, there’s been an uptick in the number of searches for personal information in peer-to-peer file networks such as LimeWire, identity theft experts say.

Victims sometimes leave the sensitive documents in the folders they make available on the file-sharing networks, but in other cases thieves use dirty tricks to snatch them from other areas of the computer. Viruses coded into movies and songs shared on the networks can reset computer preferences to make protected files available.

As a result, anyone who types “tax return” into a file-sharing program can find the documents on other users’ computers or on servers where thieves have stored them for trade on the black market. Torrent-style sharing programs also are susceptible.

On tax day last week, researchers from Tiversa Inc., a Pittsburgh-based company, traced more than 50,000 tax returns belonging to people from the Washington area during one search of file-sharing programs.

The company uses technology that allows them to track searches across all file-sharing networks, much like online search engines such as Google can track what words users are typing into search fields.

Since September, the firm has found a nearly 60 percent rise in the number of searches for personal information over these file-sharing networks. In the past, the average annual increase was around 10 percent.

“We’ve been watching this for several years, and our only rationalization is now the economy has taken a downward turn and the rise in searches is directly related to that,” said Robert Boback, CEO of Tiversa, which offers data-leakage protection services.

The trend, however, does not include outlets such as iTunes or other sites where you pay for content, because of their secure servers. A person must opt into the file-sharing networks by loading software onto their computers.

In the past, these networks have been popular among people who distribute popular music, movies and commercial software without paying legally required copyright fees. But they’re also emerging as a low-cost way of distributing legal content , in particular, video.

Those who do swipe others’ personal information rarely get caught, said Todd Davis, CEO of LifeLock, a Phoenix-based company that provides identity theft protection services.

“In this economy it’s a little too tempting for the criminals or the would-be criminals to take action,” said Davis, who helped organize an identity theft summit in Gaithersburg, Md., on Wednesday for dozens of local and federal law enforcement agencies.

Among those in attendance was Gaithersburg Police Sgt. Rudy Wagner, who said authorities have a lot to learn about identify theft.

“It’s one of the most misunderstood crimes, so I think law enforcement needs to be informed about what the trends are,” he said.

The Federal Trade Commission has raised concerns in recent years about peer-to-peer software, providing testimony about the risks of inadvertent file sharing.

Although the FTC does not track the trend specifically, a February report from the agency found that government documents and benefits fraud was the second-most reported type of identity theft last year. Fraudulent tax return-related identity theft, which falls under government documents and benefits fraud, also increased nearly six percentage points since 2006, according to the report.

The Internal Revenue Service recommends taxpayers who use computers for their taxes to consider keeping their financial information in a folder separate from the files they want to share in peer-to-peer networks.

Many people are unaware about how identity thieves are using technology, said Will Marling, executive director of the National Organization for Victim Assistance based in Alexandria, Va. Marling said his group, which connects victims to resources, has taken a number of calls recently from identity theft victims, who were unprepared for the emotional aftermath of the crime.

“What we’ve discovered is the emotional reactions to identity theft look very similar to violent crime victimization,” Marling said. People feel as though criminals are “taking my good name and destroying it, and emotionally that’s devastating,” he said.

File-sharing industry groups say they have been proactive in ensuring their programs are secure with upgraded software that allows people to restrict which files are shared.

It’s important for users to download the latest versions of the programs so they can get optimum protection and performance, said Marty Lafferty, CEO of the Distributed Computing Industry Association, a Washington-based group that represents 125 companies, including peer-to-peer networks and developers.

“Our industry takes this very seriously,” Lafferty said. “You can see exactly what’s being shared; the user has enormous control over it.”

,,,

Associated Press Writer Gillian Gaynair in Gaithersburg, Md., contributed to this report.