P2p malware issues

[joshbrandes_2_hot]

I was reading a paper about limewire inadvertent disclosure. Did limewire have malware that would change share folder settings and expose all your personal documents to the entire limewire network?
This is mainly a claim made by tiversa and really haven't seen this anywhere else. Only on ftc websites. But I know hackers could access your account directly I'm not questioning that. And I know p2p back in the day was filled with viruses. But did it really have some that would expose your entire user account to the entire limewire network in the share folder

[TheFu]

I'm slightly familiar with the tiversa and FTC claims against a small lab testing company, LabMD; met the former owner. No inside info, just many years as a Unix and Security guy. The CEO doesn't know much about technology and the IT people may be experts or complete noobs-can't say.

a) they were running Windows. Users could load unapproved software on their PCs. Linux was not involved.
b) the LabMD CEO believed tiversa hacked into their network to gain access to healthcare records in an attempt to "drum up business." That is putting it nicely. Tiversa's BoD has a former 4-star General with FTC connections. The CEO's version makes it seem that the FTC informally asked for an easy to bully company with healthcare data to be targeted. No proof exists about this. The CEO is a special-kind of stubborn. The FTC asked for an admission of guilt, a $50K fine and many years of pricey outside audits to have the case closed. The CEO asked for specific requirements to secure the network, computers, and data, which the FTC refused to provide. After all, the FTC is mostly lawyers and doesn't have IT/networking skills.
c) a former tiversa employee testified after the company was destroyed claiming improper actions related to this company. http://money.cnn.com/2015/05/07/technology/tiversa-labmd-ftc/
d) The LabMD CEO has testified to congress about the FTC abuses, but I don't remember anything coming of that. Once the FTC opens a case, there is no outside authority which can provide oversight. Nothing can be done, no appeals, until after the case is completed. I don't believe this case will ever be "closed" to prevent any outside parties from seeing the abuses.

Ok, back to your question. There is no way to ensure that any software isn't performing actions we don't want performed besides outside monitoring by other, trusted, HW and software which has also been vetted. In short, only time and monitoring can prove what you are asking.

Limewire having a bug and viruses being downloaded via peer-to-peer networks are vasty different things. If this document was available over limewire, I suspect it was user-error by the employee.

I don't see how limewire is any different than owncloud, dropbox, bittorrent, gotomypc, or any remote desktop tool that requires the use of a 3rd-party website. Very few people actually take the time to validate what a process can do and what it should do. I don't usually. My stance is to avoid software that shares files outside very specific locations NOT controlled by my userid. Sure, it is slightly less convenient, but convenience is often at-odds with security.

[joshbrandes_2_hot]

So most of the files that are shared over the network is probably user accidentally sharing them not some kind of malware?

[joshbrandes_2_hot]

The only place I've heard of this is from ftc websites and tiversa saying malware will change your share folder around to make your whole user account such as documents and etc available to the whole network. Is this a scare tactic from them

[TheFu]

There is no way to know the truth besides time and network monitoring.
You have to reach your own conclusions about whether Tiversa or the FTC can be trusted.

[joshbrandes_2_hot]

I've talked to a malware security tech and he said he has seen malware before designed for that but it didn't really work well and wasn't ever really classified as a threat because it was a huge program to design and they found easier methods.

[Geoffrey_Arndt]

There is no way I would use Limewire or any similar app anymore. The only way to protect yourself if you feel compelled to use it, is to use a secure secondary sandbox PC with full disk encryption. This can be an older PC - operated as stand-alone device, ethernet connected with firewall white-listing of allowed sites.

[joshbrandes_2_hot]

I haven't used it in years was just curious if it was true about that malware that changes folders. I know their is all kinds of viruses out there on p2p but not the kind that shares you entire computer with the whole world.