The French company Trident MediaGuard (TMG) specialized in detecting downloads of illegal content has made the headlines. TMG is the company that scouts the net for the French HADOPI. HADOPI is the organism in charge of the graduated response.

In a nutshell, a French expert by the code name of Bluetouff discovered one of TMG’s server with public access. On the server, he found many valuable data such as a password in the clear ( ), list of hashes of content to detect, list of IP addresses of detected clients, and executable! He disclosed his discovery here. After that the community analyzed content of the server, and spread it. You may find a good description of the full findings here by cult.of.the.dead.HADOPI (homage to cdc). Among the disclosed data is the a list of IP addresses owned by TMG. No doubt that they will be blacklisted by the major tracker sites.

TMG’s official answer is that this server was a test server and thus having no critical information. Even if this is true, there were some hiccups that a test server should not have, such as a public access or personal information such collected IP addresses.

Lesson: when you are on the side of Law enforcement on the net, you’d better use the best security practice. It is about your credibility.

Thanks to Patrice and Olivier for the good pointers.