Author Topic: WCS Fix for problem with malformed WPN traffic (Read 10843 times)

Bearded Blunder · « **on:** April 09, 2011, 11:23:27 am »

Have released a minor update to the most recent stable official WCS release (1.8.3) which becomes 1.8.3.1

Both Windows and Linux flavours available for download from here:

http://wcs.mxstuff.org/?download

I have been running this myself since compiling it and i is working as expected.

Please report any issues (I'm not expecting any owing to the nature & simplicity of the fix) at mxstuff on the forum, as I rarely look at this site these days

I can't take credit for this fix.

Many thanks to KM for his patience talking me through the needed small edits both for the fix itself, and the assistance with compiling it on a slightly different compiler version.

Max™ · « **Reply #1 on:** April 09, 2011, 12:48:56 pm »

pardon me for sounding skeptical but,
KM helps you with a fix to prevent attacks he makes?
thats like a pickpocket offering you your wallet he just stole from you so he can steal it again.

sharing sarah · « **Reply #2 on:** April 09, 2011, 02:10:06 pm »

I wouldn't trust KM for anything. He caused all this, he is either doing it himself or the information he released allowed it to happen.
And now wants to look like the savior? Get real.
I don't recommend anyone download this so called fix, as you don't know what else is inside it and the scr code hasn't been checked out.

Now bearded when will that be available for us to see?

nylly444 · « **Reply #3 on:** April 09, 2011, 03:01:48 pm »

sarah, the reason for suggesting posting fixed programs in the technical section was for giving people a chance to check them out.

I'm quite sure that if is says the issue is fixed then it is - as for if anyone wants to trust this programs that's up to themselves isn't it?

there's no way I'm *ever* gonna trust KM anymore with anything, but at least by posting here the technical minded people are aware of it and might check it out.

Might I suggest to open up a new thread about people's credibility and stuff elsewhere on the forum and let's stick to the simple reporting of fixes in here please?

sharing sarah · « **Reply #4 on:** April 09, 2011, 03:41:36 pm »

I would think this is a better option: https://forum.winmx4u.com/viewtopic.php?f=3&t=38

Rooms I host stayed connected the whole time.

Bearded Blunder · « **Reply #5 on:** April 09, 2011, 05:14:41 pm »

You are of course all entitled to your own views with regard to personalities, & while no coder, on this occasion I actually understood what was done to the source, even if I wouldn't have known where to look to make the changes unaided, don't suppose many of you have a much higher opinion of me than you do of KM (guilt by association), but I can certainly attest that nothing even potentially harmful was done, merely the increase in capacity of some internally used variables & reformatting a couple of lines to do the exact same thing as they did before.. the latter being to work around changes in LCC.

KM is fully aware how certain users react to him & his code, which is why this approach seemed better than him simply supplying me with compiled binaries, which would certainly have been much quicker.

Weather you prefer WCS or RSWCS is a matter of personal choice, in the same way as some prefer using IE, or Firefox, or Opera. There have in the past been allegations made regarding RSWCS also, which may have been complete bunkum, I can't speak to that as I'm happy with "The devil I know", as are others...

WCS 1.8.3 has been around a long time, if it contained "nasties" they would have come to light a long time ago, nor would I be using it myself.

Other chatservers are available, if you prefer them by all means use them, I'm not forcing anyone, merely offering a fixed version for those who wish to start or continue using WCS.

At least I made the effort, with help, to produce this fix, I could easily have thrown my hands in the air & simply migrated to something else stranding WCS users... Or even left as a few chat hosts may have done as a result of this trouble, things like this get tiresome.

As to "Will I release the revised source?" as I've been asked elswhere, it's still KM's work, so please ask him, I don't feel at liberty to make the decision for him...

I have reasonable grounds to be personally satisfied this attack was not KM's doing, & being on friendly terms with him, puts me in a better position to determine that than some who merely sit to one side speculating. He has his own suspicions, which I tend to agree are likely, but I am NOT prepared to name names, as I have no hard evidence to back up any allegation.

nylly444 · « **Reply #6 on:** April 09, 2011, 05:23:44 pm »

I think merlin is right - it's up to the users to make their own choice.

I do think that we owe it to the users to make them aware of their possible choices however which is why I asked merlin to put it here after talking in the room.

Richy didn't want to post himself which is why I did it fro him after him mentioning he had fixed rswcs as well.

Again, this was put here in the tech section after talking to another supervisor so the technical minded people can check out these solutions.

If and when we're satisfied that these solutions are what they propose to be we can decide what to do next.
I do realise that people are being edgy fro a solution but especially now is not a time to rush things IMO...

Lagerlout666 · « **Reply #7 on:** April 10, 2011, 07:41:28 pm »

As much as we have had problems in the past the level of abuse winmx is taking at the moment from who ever it is. I'm sure they will be found at some point. I'd like to say thank you for not curtailing and. Leaving folks out on a whim. That goes to richy too.

We all need to muck in together at the moment and stand strong till the new client arrives, I can't say my thanks is owed to km as all this is because he let the cat out the bag but it is good to see folks talking again making solutions reminds me of how it used to be.

reef · « **Reply #8 on:** April 10, 2011, 10:06:14 pm »

To be perfectly honest as a host who uses wcs i've noticed these attacks for 5 or 6 months at least. The attack has been very random in length of time, anywhere from 2 hours to 12 and then 24 hours. WCS wouldnt connect and when it did finally connect it suffered from high bandwidth usage. So if this isn't KM (which i dont think it is) its somebody whos known this exploit long before KM shared the document files. Not jumpin on the KM bandwagon or anything like that, i'm just saying this attack has been present for quite some time, and only yesterday panic set in and fixes were made.

sharing sarah · « **Reply #9 on:** April 10, 2011, 11:47:42 pm »

Well I'll not debate with you in this thread as it's not for that. I use the WCS version I mentioned and as to why I wont change, how ever there has been none of this 1 series of attacks until recently. And as to who it is? The network has seen 3 diff types of attack in the last 24 hours and so it's a pretty sure bet its a developer who already knows of such attacks, or obtained the information from.........
All I have to say

wonderer · « **Reply #10 on:** April 12, 2011, 06:37:03 am »

All I can say whoever it is, it's a sick person.
I'm not saying all, but many are using WinMx as a social network, mainly to chat with friends in their small, or may be bigger chatrooms. For them this can be the only contact with the outside world.
Disturbing this network of chatrooms is like flattening the wheels of a wheelchair. Simply said, cutting off people from the outside world.
I wish, and I know it is bad to do so, I wish the couser of these problems to be disabled and cut off from the social contacts like he/she is cutting off people now.

White Stripes · « **Reply #11 on:** April 12, 2011, 08:23:41 am »

i think it would be a good idea if ppl started passing around IM/email contact info to their winmx friends rather than relying solely on the wpn....

MinersLantern · « **Reply #12 on:** April 13, 2011, 03:22:09 am »

As a user of 1.88 (yes there is such a thing) I have discovered that if I simply lie and prefix the room name with [ES] or [RCMS] or [FXS] or whatever (including nothing at all suggesting the real winmx) other than [WCS] the room magically shows up again in the listings. Someone is targeting WCS rooms. I have no problem getting FXS rooms to show. Most of them are FXS that show, has been for several days. Now who would be interested in masking WCS rooms? Oh I can only imagine... Me thinks Michelle is upset that people are using 'his' software to host rooms without becoming a billionaire. WCS still works just fine when ya lie about what your using as the server. Makes me think hes simply targeting room names to screw with and it isnt a problem with the WCS protocol and hes using software to look for the exact name [WCS] to target attacks to. Mess up the spelling just slightly, and the room shows anyway.

White Stripes · « **Reply #13 on:** April 13, 2011, 04:16:13 am »

@Miners;

has this been attempted in reverse? masking ES as WCS for instance and have it fail?

Lagerlout666 · « **Reply #14 on:** April 13, 2011, 08:04:19 am »

The problem is being caused by a buffer overun problem. Someone is sending out fake packets at a rediculous size, the fact changing WCS shouldnt come into it as looking at the code WCS returns that info anyway as part of a header, you just dont see it(possibly away KM could see how many rooms where using WCS we would have to ask him) and it adds it to the topic at your choice. the only way to aleviate such attack as far as im concerned was to rewrite a few lines of code. I dunno where 1.8.8 comes from, or what its code looks like. Maybe they changed something and semi alleviated the problem. As the versions posted they would appear to have been fixed completely. (ill put in brackets from this bug!!! lol)

sharing sarah · « **Reply #15 on:** April 16, 2011, 01:00:01 am »

Well I wonder what the problem is here if this server has been fixed? I just took this screen shot today.

Look at the UPLOAD:

White Stripes · « **Reply #16 on:** April 16, 2011, 01:08:02 am »

um.... what screenshot? .. did the forum break or did the upload not upload?

silicon_toad2000 · « **Reply #17 on:** April 16, 2011, 06:05:33 am »

thanks for that sarah.

I can see an attachment to sarah's message stripes.
Can you not see it?

Max™ · « **Reply #18 on:** April 16, 2011, 07:24:01 am »

yep i seen the screenshot, its the same on wcs 1.8.8 and rswcs 1.9.5.4,
its due to a large amount of packets sent to the server, it replies with twice the normal packets, hence the large upload,
this also increases bandwidth and if im not wrong, slows your speed when downloading on winmx.

MinersLantern · « **Reply #19 on:** April 16, 2011, 08:16:08 am »

1.8.8 came from a girl/lady, I dont know. Female. lol
She set out and corrected many bugs in the original WCS. She literally died over a year ago and then any further development of WCS of course ended at that point.
The original little bugs were corrected with few additions of new 'features'. Unfortunately, it is still prone to the data overflow problem, in theory. Ive found that even FXS is doing the same thing now. I can lie and change my WCS to indicate anything under the sun. I can actually use the real FXS and it gets flooded with ips that dont connect as well. WinMX is being just as crappy at loading a roomlist. I havent tried ES yet.