:: 24-Jul-1999 18:01 (Saturday) ::
Abuses, both big and small…
I apologize to everyone who has been receiving their password every day
at 13:00. Someone at 216.13.75.98 has been running a webcrawling robot
that doesn’t honor the robots.txt file.
“Mozilla/4.0 (compatible; BorderManager 3.0)”, whatever that thing is.
I’ve blocked the IP, so it should stop happening.
The more important issue is that It’s clear that I need to make a statement
regarding the Russian block vandal. Here’s the situation:
Last week, a user (rc5whs@chat.ru) started turning out some unbelievable
key rates. Literally overnight he began turning in keys at a rate of
several gigakeys a second. As we usually do when situations like this occur,
we contacted the user via email and tried to get a feel for his position.
At his point we were pretty sure we were dealing with a hacked client, but
until we knew the person’s disposition we weren’t sure quite how to react.
For a bit of historical background, this is hardly the first time that
someone has hacked a client to bypass the keytesting routine. Compromising
the client in this manner is not simple, but neither is it overly difficult.
We’ve relied primarily on the fact that most people with the skills required
to vandalize the project in this way are not vandals. When this has
happened, the key has always been to ascertain exactly what the person’s
motivation is. Many of you may recall the czcrack user from last year who
did the exact same thing that our Russian friend has done. With that
person, as soon as their stats disappeared, they did too. Another less-
publicized event happened recently when a well-known cracking group
threatened to release a cracked client as leverage to force us to adopt
their opensource philosophies. After much discussion, we all realized that
their position was a bit unfair unless they were prepared to explain how
that could be done without compromising the integrity of the project in
the exact same manner as their releasing a broken client would do.
In discussing the situation with the Russian vandal, he stated that his
goals for using a broken client were to prove to us that it was possible
to do so. Apparently unaware of previous situations of this nature, he
felt it important to stress that he feels our security is insufficient.
On IRC he stated that he plans on publishing a manifesto stating such on
his web page. If he does, I’ll put the url here in my .plan for those
who are interested.
All the blocks done by the vandal have been cleared from the keytables
on the keymaster, and his stats (the entire team, in fact) have been
pulled offline. As we have in the past, distributed.net has already
moved on. Turning in blocks that haven’t been checked is detectable by
our servers. While such activity, even on this scale, is disruptive
it does not compromise the integrity of the project.
I’d like to especially thank Maxxim Kochegarov for his assistance in
formulating a theory on the identity of the vandal. You can read his
thoughts at http://rc5.aha.ru/english/rc5whs-1.shtml
In the end, some good has come out of this situation. It’s prompted
our coders to start seriously considering what measures we can implement
which will allow us to respond to such situations in a more timely
and decisive manner. Already there are a number of “solutions” being
discussed which would allow for earlier detection and (most importantly)
better quantification of the scope of these events. I suppose we’re
simply beyond the point where we can rely on people’s good judgment
when it comes to vandalizing the project.
Sorry for the length and relative unreadability of this update. I hope
to clean it up some before I post it to the mailing list. I’m several
days late in getting the information posted, and couldn’t justify waiting
until I had sufficient time to write something better.
A few minor details:
o I wiped out the whole team, and all six or seven members. I suppose
it’s possible that some of those people are innocent of any wrongdoing.
I’ll be looking into that matter this week trying to determine if the
team should be re-instated. While we’re only aware of the wrong-doing
of the maxx@rc5.aha.ru member, I do find it unsettling that we received
no emails from any of the other members during his activity, and only
heard from them after the team had been removed.
o Yes, I know I’ve been impossibly vague on the technical details of both
the detection and the proposed improvements to the clients and servers.
This is for two reasons: one, there’s not enough space here to cover the
subject appropriately, and two, it would be better for the coders and
designers to discuss those issues as they’re more technically qualified
to do so. The plan is to move that discussion to the list for a full
treatment.
o The project has not been compromised by this event, nor any of the
other events of this nature. While this is uncomfortable and
inconvenient, it is hardly terminal.
Thanks, as always, for your patience and understanding.
