Napster

Napster works like this: Jane signs up and downloads the Napster client. The client registers all the MP3 music files on Jane's computer with Napster's server. When Jane tells Napster she wants to download Icky Sticky Vibes by the group Left Nuts, Napster offers her a list of computers that have that title on them and how fast their Internet connections are. Jane then downloads the title directly from the computer with the fastest connection, without any involvement by the owner of that computer. Similarly, if someone wants a title on Jane's computer, they can download it without Jane even knowing that is happening.

Jane calls this "sharing", and a lot of musicians, and the RIAA (Recording Industry Association of America), call this "stealing", but that's for the courts to decide (in litigation now). The company Jane works for calls it "bandwidth hogging", and has tried to stamp out Napster use, but they're old fuddy duddys who just don't understand how important music is to Jane and her co-workers.

So what's the security problem here?

Wrapster, That's What

Wrapster can be "Trojanized" to operate without the knowledge or permission of the computer owner. For more on Trojans, see our articles on Viruses and Cult of the Dead Cow's Back Orifice. Wrapster can be propagated to computers by the same means any other virus or Trojan is distributed.

What Wrapster can do is find certain files or types of files on Jane's network. In the uniform Microsoft environment, it knows just where to look and what to look for. It can then makes copies of interesting files, nicely wrap them up to look like MP3 music files, title them, and see that they are registered on Napster's server.

Wrapster's perpetrator simply asks Napster for those titles, and they are downloaded to the perpetrator's computer, while Jane remains blissfully unaware that her most confidential information is being downloaded for the amusement and enjoyment of others, along with her company's marketing plans, contracts and other useful information.

Countermeasures

• Make it very clear to all employees that anyone found with Napster (or any variant) client software on their computer will be severely disciplined and why.
• Keep your anti-virus software updated. This will not protect you from new and improved versions of Wrapster, but may protect you from older ones as anti-virus publishers add them.