Author Topic: Chat Room Listing Flooding (Read 10757 times)

RebelMX · « **on:** April 05, 2011, 10:06:50 am »

Right, well we have all heard of people "cloning" chat rooms, back in the day the teen rooms used to love it, and recently we have seen KM hijacking the channellist. However I am now being "attacked" by a new chat room listing attack, initiated by WMW's Tiny. I know that he has the best intentions in order to prevent KM hijacking his and WMW's hash, but instead with the method he is employing it is making my channel list virtually impossible to use. See attached screenshot.

Please could someone explain how that is in effect any different from what KM and the fake file flooders were doing?

Thanks,

---
edit: typo!

GhostShip · « **Reply #1 on:** April 05, 2011, 12:23:57 pm »

I notice your not using an official WinMX client and likely is hasn't had any code placed in it to limit identical entries, can I suggest you ask the client maker to add such an item as that will limit your exposure and make the client compatible with the current network specification.
Spoofing your own IP is in fact not as damaging as recklessly sending multiple false IPs into the network as KM and the cartel do as those end up at someones door and constitute an attack on thousands of innocent internet users, its actually a criminal offence in the UK to set out attacking in this way.

I cant see how you equate flooding your own IP address with a commercial scale anti p2p attack that costs millions of dollars a year to run but maybe I'm missing something. Nuisance yes, damage factor, little to none.

I for one agree things are turning to madness but the facts are that for days now KM has been attacking both this site, the voluntary peer caches and now the chatlist again by injecting fake traffic, and for those who make claims its not him etc that holds little water when the 1 traffic starts immediately KM was ejected from the wmw room for swearing and ranting, there is the remore possibility its some other childish attacker but its been noted no one else fired up a peer cache at KMs VPS IP that's likely been modified to index primaries and undertake such heavy attacks, also at the same time and we must never forget he alone was responsible for sharing tools and documents that can be modified to allow such attacks when we all know they cant be patched without extraordinary effort in contructing a new primary client.

Earlier on in the week he was spoofing this sites address to the peer caches, this was so when the peer caches did a validation check they would ddos the server, I,m afraid to say this is the KM I warned against and why he will never stop his childish actions, he is an abuser and his goal is to take down WMW and anyone else who doesn't bow to his megalomania, there is no dealing with this rogue element, he needs to banned and driven from the network one way or another before he destroys it out of pure malice in my opinion.

This particular attacker was always quick to say he doesn't censor anyone, its clear that is not the case and why one unstable person should never be in charge of anything, we took a lesson from his previous implosion in 2007 and ensured no one is in charge of everything here and thus his attacks whilst annoying are simply driving users away, its my belief he cares not how many users leave because of his actions as he himself no longer uses winmx and thus he cares little for its users or what financial cost his attacks bring on the communities volunteers.

Lagerlout666 · « **Reply #2 on:** April 05, 2011, 02:18:24 pm »

I am not flooding the chat list. i am running a chat server that is connected to 40 primarys, rather than the normal 7. all you are seeing thier is the fact your cleint isnt rejecting room packets recived over 4which winmx does. And im affraid the winmxworld room has been silenced from the network for days. It could no longer continue. And unlike KM i havent resorted to spoofing packets or floding 1.xxx trafic al over the place to get it to return i just gave the server a chance to be more promanat on the network and give its results quicker than KM's script.

edit

Can you tell me what that programe is you are using so i can replicate it too. As i have a feeling you will probably find it was the attacker more than me. As i was using a WCS server.

RebelMX · « **Reply #3 on:** April 05, 2011, 03:45:23 pm »

It seems that Tiny is no longer flooding the list, as after discussions he changed topic and yet the "flooding" topics were still there so i can only presume that someone else is also interferring with the listings...

White Stripes · « **Reply #4 on:** April 05, 2011, 06:23:33 pm »

@tiny n GS ... that screenshot is from robomx...

@rebelmx .... win7? turn off transparancy on aero or turn off aero alltogether so alt+printscr doesnt catch a shot of whats behind the window while allowing you to include the titlebar in screenshot...

Lagerlout666 · « **Reply #5 on:** April 05, 2011, 06:28:20 pm »

At least we where able to clarify that I was infact the victim of somebody cloning my room name. The topic change certainly threw them. Its just one of the attacks I have come under today. The caches have been attacked. My winmx running primary has been attacked and only thanks to iptables could I keep it from crashing. I will be posting in awhile the attacks upon the caches when I have concluded the updated cache source is no longer affected and will be calling upon the users of winmx to put forward km's re-ensertion back to the blocklist to help hinder such attacks from this blatent terrorist who has only one purpose put to destroy the network that we all so enjoy and have worked hard to keep open.

White Stripes · « **Reply #6 on:** April 05, 2011, 06:51:30 pm »

but... km was already on the blocklist and still managed to completely wreck the channellisting.... has something changed that will allow the blocklist to stop that? or will it be another trainwreck waiting to happen?

GhostShip · « **Reply #7 on:** April 05, 2011, 08:19:40 pm »

I think it sounds like a game of cat and mouse is about to take place but who knows, as usual at this opportunity I ask all those who want to keep mx rolling to hold firm and stand united against any attack and if your a coder step up to the plate and offer your services as we need something sooner rather than later in the primary dept

JustSomeone · « **Reply #8 on:** April 06, 2011, 04:38:51 am »

Quote from: Tiny4eva on April 05, 2011, 02:18:24 pm

And unlike KM i havent resorted to spoofing packets or floding 1.xxx trafic al over the place to get it to return i just gave the server a chance to be more promanat on the network and give its results quicker than KM's script.

Just saw this and couldn't resist mentioning you DID do exactly that! the image posted in the other thread on here demonstrating the traffic YOU were attacking the network with: https://forum.winmxworld.com/index.php?action=dlattach;topic=10706.0;attach=3282;image

After hearing I was apparently being blamed for stuff again I went to see what i was being blamed for this time, and saw that indeed someone was flooding the network with channel list requests with fake source IPs, which appeared to be deliberately designed to look as much like that buggy beta version of WCS version as possible (no doubt to try and blame me) just at a far higher traffic level than that WCS bug would have produced had a user deliberately gone and found that specific version to run.

Requests such as these can be traced back to the source so I went and did so, and traced the source of the requests back to 87.106.62.247. Floods of such a high level take a while to die off but, within about 10-15 minutes of tiny being directly confronted with the evidence of his attacks being traced back to him the request levels had dropped to only a few requests per second (an attack of that level will take hours to completely vanish)

The raw data from tracing the attack: http://textuploader.com/?p=6&id=AL1302061915A4d9be35b684a1
This is a list of primary nodes that relayed the flood packets with a hop count indicating that they had received it directly from the source (that it hasn't been relayed through any other primaries), along with the list of nodes that they reported were connected to them.

Either WinMXWorld no longer has anybody competent to do anything technical relating to the WPN, or they deliberately chose to not trace the attacks as they already knew it was originating from one of their admins servers. I don't know for sure which it is, but I am reminded of how much governments love to use terrorism as an excuse to get away with doing stuff nobody in their right mind would agree to (such as the rationale for blocking a major japanese ISP, for hosting the same dynamic IP systems that have been operated for even longer on UK and US ISPs...)

DaBees-Knees · « **Reply #9 on:** April 06, 2011, 06:13:11 am »

JustSomeone ,
Is that a reply from the innocent? By the way I'm still waiting for a reply to the question that I asked in chat. You seem very reluctant to answer.

Having caused all the disruption that you have, in the so called interests of the users, I don't know how you have the cheek to be critical of others.

Lagerlout666 · « **Reply #10 on:** April 06, 2011, 03:28:50 pm »

The room was off for at least 15 minutes prior to me posting to the room that it was off. and suddenly then the traffic started to die down.

You are still posting pictures of the actual traffic yet not showing how you can see that traffic is being spoofed from me the reason for this is that it was not me spoofing said traffic.

You can try your best to smeer me KM but i have provided years of honerable service to winmx, i have never, and will never release even half the shit you have done to damage, attack or disrupt this network. Its up to the users to decide, the 1.xxx traffic has been gone for a long time. You return the channel list is attacked, the winmxworld help room is silenced from the network. And the 1.xxx traffic returns.

It could well not be you KM, and the mountain of tools you released freely on the network could be being abused by someone else. but like you are unable to, we are unable to prove where its comimg from. And its much easyer to point a finger at someone that has continued supporting the people you turned your back on and abandoned long ago

As stated its up to the users to decide, and up to now i have recived nothing but support. Tarred with a brush springs to mind.

Joshua203 · « **Reply #11 on:** April 07, 2011, 08:01:41 am »

I've been trying very hard to keep my mouth shut in conversations like this but today I can't help myself...

In a similar thread as this one someone said (Stripes) "the only way to win this game is to not play the game at all" ...this is the only wise message I can see in these discussions.
Why don't you all open up your eyes (both parties), users HAVE NO CHOICE in this, they's are being bullied by BOTH the of you

it's always the same story ...argue ..throw some mud .. someone gets even more angry and then something like this.... tsktsktsk you should all be ashamed

GhostShip · « **Reply #12 on:** April 07, 2011, 08:38:31 am »

I,m disgusted with your attitude Joshua, someone attacks the WPN and we see many posts such as your appear when we step up to take them on, wmw havent attacked the network but you and others know fully well who has and if you choose to do nothing you cant expect us all to do the same things, we are unhappy with it and will publicise any such attacks so users can stay informed or would you rather we said nothing and placed our heads in the sand ?

Whatever your policy is its not wmws and not mine either, when I see abuse I name the villians, blamimg us for the actions of others is a low and underhand blow.

Joshua203 · « **Reply #13 on:** April 07, 2011, 08:45:19 am »

Well I was directing thios at BOTH pasties and if you now know how it feels to be disgusted you maybe can imagine how the the man in the middle feels ...right exactly the same!

You are both doing the damage and keep throwing petrol on the flames .. can't you see that???? GROW UP!!

Lagerlout666 · « **Reply #14 on:** April 07, 2011, 09:44:22 am »

I dont understand how thier is BOTH, Their is only one from what i can see. WinMXworld is not attacking the network, mere the victim of attack itself.

Joshua203 · « **Reply #15 on:** April 07, 2011, 09:57:16 am »

If someone is angry at you and you know he can be dangerous ... what would you do in real life ...try to sus or try to kick him in the shins some more???

I'm amazed you guys don't see it all.. it's pretty clear

Lagerlout666 · « **Reply #16 on:** April 07, 2011, 10:17:18 am »

Have you seen client progres. These weaknesses we can do little about patching a closed source programme. All energies have gone into the project. We csn plug every little hole is a waste of energy when we can have a client. From what I have seen up to now all the major hurdles are broke and whoever ill say is doing the attacks will be buggered when we can easily block any attacks with a client update. Things are progressing well let the glory boys have their 5 minutes of fame. And us have the forever future.

Joshua203 · « **Reply #17 on:** April 07, 2011, 10:20:50 am »

Nice change of topic Tiny, it only tells me you don't want to see what's happening here and why it always gets out of hand

Lagerlout666 · « **Reply #18 on:** April 07, 2011, 10:28:11 am »

I really don't know what you ate trying to say? The fact that chat room has been closed for a few days. Christ I've even spoke to km since then. As it stands at the moment their is a cease fire. Not agreed but I'm sure its just a matter of time before we are fired upon again.

And that room list flooding wasn't being done by winmxworld. I proved it by changing the topic and fake room names where still flooding the old topic. We can't do anything to stop that. Which is why I mentioned the new client. I'm sorry Joshua but I really don't see what your finding to be angry with us when we have been attacked and cloned and already proved this fact.

**edit

And other than blocking km and have the chat list attacked again what do you suggest?

Joshua203 · « **Reply #19 on:** April 07, 2011, 01:27:07 pm »

I ll try it once more and even more simple.... please close your eyes and imagine

you are at the beach and there a guy next to you looking like a big blownup bulldog... he looks at you like he hates your guts and really does n't mind a having a bit of action....

what will you do :
will you walk up to him and say I don't like the way you look or look at me

or

will you try not to make him angry or even think of digging a pit in the sand elsewhere???

The one(s?) doing the attacks are as much to blame ..no need to defend yourself here

It's been somany years of the smae shit over and over again (no way to communicate with bluetak ..no way to communicate with KM ... no way with Sabre ... only since recently a part of the pie team
is n't it time to stop pointing at every one and search the answer in your own attitude???

anyway I am not even angry anymore ..just disappointed .. I thought we were grownups ..I opbviously was mistaking or deluting myself

this was just my two cents .. please don t ask me to explain it again ... buy a good mirror

Greetings,
...Joshua203

PS .. I m amazed that nobody dares to say this exept for one or two maybe three characters .... Cheers to those few

my compliments (you know who you are I'm not naming the names)