Is WCS Still Causing Network Disruption ?

[GhostShip]

Whilst doing my usual monitoring of the network yesterday amid  increasing reports of folks dropping from rooms, I noticed that once again the familiar 1.x.x.x pattern associated with KM's WCS bug, it seemed to go from being present 50% of the time to in one period almost outnumbering ordinary traffic by 20 to one, a level sure to cause random room dropping, cache disruptions and affecting other aspect of the WPN that are more obscure.

The problem that springs to mind is that this activity can fall into three possible scenarios,

1 - KM can control the effect and uses it to cause disruption when he feelks like it.

2 - WCS users are still using out of date Versions with the flaw.

3 - Third party attackers are duplicating the method to cause general network disruption.

To negate points one and two I had asked folks to hold off of using WCS but it seems my request fell on deaf ears, so I now call upon KM to look up which of his users are using the Buggy WCS version and get them to upgrade, only by this action will we be able to ascertain the correct scenario and therefore be able to take the correct remedial action to deal with this problem, please take note folks burying our heads in the sand wont fix this.

 

[..Ñøßߥ..]

I have posted this info on V44 also, my opinion remains, we just need to get folks off WCS asap, that will eliminate any potential issues associated with WCS.

Users should switch to Ouka available here:

http://ouka.dip.jp/archive/ChatServerE_560b_2007_08_18_0000.zip

[rav1960]

i would just like to say that there have been many users saying about falling outa winmx, im not trying to start a fight but u just noticed it yesterday this has been going on for 2 months now.  i just hope we can find what is going on and fix this problem.. good luck guys

[GhostShip]

The problem is well known Rav, the cure however is not in the hands of anyone here, it requires the co-operation of the networks users including KM to draw this issue to a close, the actual transmission of the problem causing fake IP's is extremely hard to track the origin of natively on the network but its not impossible.

If KM can inform us of whether there are any users still on the problem causing WCS releases we can then decide what to do, as his WCS Server was the cause before its only natural we all look in his direction once more and ask him to take a few basic steps for us and help to resolve the problem once and for all.

What I,m basically saying is that KM has it in his power to take his buggy server version out of the equation and enable us to see if there is some sort of outside entity launching attacks on us using his published exploit, for those wondering how KM can do this perhaps you all remember his version update checking and WCS specific peer cache, lets hope he takes this opportunity to aid the community or at least in public be judged on his actions (or lack of them), the ball is in your court KM. 

[..Ñøßߥ..]

With all due respect GS, we saw how long its took for KM to look into fixing his "typo" in the first place. Whilst he "may" assist with resolving or at least nailing down this issue, the best thing for the comminuty to do in the mean time would be to remove WCS from achives and remove links to it and assistance/support for it, and point folks to the other options.

Just a thought.......

[Mizz]

noticed yesterday on PG (running FX hence the PG) that it was getting pretty busy with the wcs ip thing... keeping an eye on it now

[rav1960]

well what else besides telling people to not use wcs and yadda can we do alot of people falling out rooms, and rooms are crashin like crazy

[Mizz]

have noticed over the last week it seems to be impossible for me to stay parked in any room over night....very frustrating....used to be able to park for atleast a week at a time

[James420]

I haven't had this problem since the 1.x.x.x stuff was originally fixed. But it sounds like some kids are doing this stuff deliberately. Also...there is only two servers that are NOT effected by the 1.x.x.x results. That is WCS and Ouka. They both have built in blocking for it, and it shouldn't be too hard to make a patch for FXS that does the same thing. So if you host a room and don't want people dropping from it...get a server that has built in blocking of the 1.x.x.x stuff, and get the newest WCS if you do infact choose it or else you'll just flood the 1.x.x.x stuff even more.

The more servers that block that stuff, the faster we'll be able to rid it from the network. Seems like this is just the new rtf hack to some kids.

[Mizz]

Ouka is not my thing....to much rcms alike for my taste....and as for WCS ?

when HELL FREEZES OVER immediatly springs to mind.....ill dump room before ever going back to WCS

[James420]

Meh, WCS is the most powerful and feature filled winmx chat room server despite WinMXWorld's strong hate for it and anything created by KM. Before their dispute, everyone recognized it as the best. Now it's even better then it was.

I've used WCS for years, never liked any other servers. WCS is simple, and very powerful. With the custom commands, it's easy to change the chat experience to w/e you want with a decent bot. Plus it's very easy on bandwidth and resources.

I haven't seen any rooms running WCS having any problems, I run my room with it and have for a while. I haven't had these problems I've seen elsewhere, which mainly were using FXS to host the room.

[Mizz]

Meh, WCS is the most powerful and feature filled winmx chat room server despite WinMXWorld's strong hate for it and anything created by KM. Before their dispute, everyone recognized it as the best. Now it's even better then it was.

I've used WCS for years, never liked any other servers. WCS is simple, and very powerful. With the custom commands, it's easy to change the chat experience to w/e you want with a decent bot. Plus it's very easy on bandwidth and resources.

I haven't seen any rooms running WCS having any problems, I run my room with it and have for a while. I haven't had these problems I've seen elsewhere, which mainly were using FXS to host the room.

funny how people's trust changes when u use that very good and powerfull program to abuse and attack the network tho....

where once there was trust...now there is distrust....he can make as many programs as he likes, u can defend him all u like, u can shift the problem by saying..this is winmxworlds strong hate....does not change the fact that KM felt the need to bug his WCS and use it to attack the network....trust is gone and will never come back....maybe he has fixed the problem...maybe this version of WCS is great....i still dont trust it its that simple !  im not going to sit and wait and find out my trust, and the trust of many others with me, gets abused again...


once biten james.....twice shy !

[Lagerlout666]

Well i have to be honest, after running wcs myself i still can find no fault with this new edition, an i like many other are just not willing to use oukar, no matter how much it is pushed at us. I have for along time always used WCS. I have used many other servers including FXs to eagles light chat server but i always come back to wcs and groan at the metis configs i have to change all over again lol. Now i duno what was goin on in KM's head when he left it to flood the network for weeks but maybe the fault was harder to cure than you all know, but then it may just have been a evil act, that im affraid we will never know but as james has pointed out, thier are only 2 servers currently able to block the 1.XXX traffic an no looking of someone designing a patch for FX's to block that crap an the owner well out of excistance. So maybe for the stability of your users an yourself till something better comes along oukar and WCS are a good choice. An like i say i run PG continusly and many other packet monitoring tools and ive yet to see one single thing bad that this new WCS does, If anything ive noticed Oukar mess the packets up more and decided to drop a few primarys from its connection list, something great for trying to keep you room name in the list when you host a busy room lol.

[GhostShip]

Tiny and James seem to be living in cloud cuckoo land on this one, not only is it not easy to undertake this flooding but KM admitted himself he was behind the original "attacks", blaming "Kids" for this highly technical attack is "original", this is either KM, his WCS version or the Cartel, there are no other contestants.

Can I suggest we stick to technically provable facts and stop playing "I like/I hate KM" politics.


Tiny in reply to your post PG does not intercept packets and read the internal contents so can you explain how you would see anything if it was sending out these packets ?

Also what tools did you use to see Ouka dropping primaries ? Others would be interested in these tools I,m sure.
whilst you may be ignorant of how hard it was for KM to fix his error I am not and I can state catagorically he was attacking the network, his primary aim was to make the peer caches seem useless as he was running around stating such things at the time, whilst causing the problem behind the scenes.

James you make a claim we hate KM, nothing is further from the truth, he should apologise to all users for his attacks and help fix the damage he has caused, only then can minds be changed.
If my friend does something morally wrong is it not my duty to first ask him privately then in public to resolve the matter if it was affecting the entire network, no one should be allowed to do this and I made a promise to folks that I would always put mx first in everything, in this case KM was clearly in the wrong and it was necessary to expose his actions when it started affecting innocent users and he had privately refused to cease his "attacks".

There is no hate here just a an honest sense of wanting matters resolved for the benefit of ALL WPN users not just those who use WCS.

[Lagerlout666]

You know what im sick of this place, you fire up xnet stat, wireshark anything you want, and watch oukar mess up the primarys losing upto 3 at a time within a split second of each other, you cant tell me that isnt a bug of some sort. I never once mentioned PG was able to do any of these things, but it is still a tool to see what traffic the tools you own are trying to connect to, and i can see the packets, the site i have provided and the information you have posted allow along with a simple copy paste from the sourcecode website allows me to dump the information to a txt file with the greatest or ease, infact a child could do it. You are not the only one who is learning all this quicks, many of us are learning faster than you realise. An the new WCS has no issues with the 1.xxx. if you have evidence that it does then show me as i cant find it and this sentance certainly isnt a I LOVE KM campaign. Again it seems we are feuding quicks, its a damn shame you can no longer hold back and talk with the so called users of winmx without claiming they are cuckoo.

[..Ñøßߥ..]

I am aware personally of some of the things KM has been up to over the years, however, knowing something and proving it to people here, are two very different issues and unfortunatly, i like many do not have the technical ability to peice together the case. Then after KM screwed up, the very people who would usually support him were able to prove he was attacking the network. KM, whilst knowingly causing the issue, tried to suggest it was the peer caches. Then after claiming it was a "typo" he took weeks to fix it. Now, someone care to tell me how long a typo takes to fix? 1minute? 5minutes? 10minutes? or weeks?

So he got caught out on this one, and so eventually he was forced into repairing it, or was he. Tiny, James and others have always looked to KM as probably the most advanced user in terms of Winmx know how in the community, what makes them think they are now able to spot any of KM's further little attacks? Whilst it is wrong to assume KM is behind this, it is also prudent to take some steps to ensure those guilty of similar crimes in the past dont have such a platform to repeat such attacks, having learned from last time how to close the loopholes that saw them caught.

In this case, a sensible community response would be to continue to recommend users remove WCS, and switch to software who's author does not have at least 1 attack on the community to his name.

You can choose to swear by WCS if you wish, but im sure in the past you have been happy to recommend WCS only to find out KM was abusing your trust then, once bitten............

[Lagerlout666]

I can understand the once bitten part of it all nobby, But to turn down what appears to be a viable choice other than oukar to me seems like madness. I duno if his typo was him showing off or trying to cover what may have been a major flaw that took awhile to fix, this we will never know as what where once KM's close friends all apear now to be fueding and with that we probably will never find out. But anyway now it looks like i support the damage that possibly WCS has done and appears to be still doing and that is not what im trying to put accross and it blew very quickly out of proportion. My point was that oukar and wcs are the only chat servers able to withstand this 1.xxx explosion, an are in my eyes the only two i would recommend but personally i prefer wcs as it appears to me to be far more ridgid. Dropping clusters of primarys to me in a chat server is no good for your listing of your room and ive seen oukar doing that with my bare eyes. But like it has always been this arguement of which server is best will never be solved, as it is a personal choice.

[..Ñøßߥ..]

I have no axe to grind with chat servers, i see no battle, i care little which folks choose to use, PROVIDING they are not affecting others by their choice.

oukar and wcs are the only chat servers able to withstand this 1.xxx explosion, an are in my eyes the only two i would recommend but personally i prefer wcs as it appears to me to be far more ridgid. Dropping clusters of primarys to me in a chat server is no good for your listing of your room and ive seen oukar doing that with my bare eyes.

Both block, but only 1 has been used as a tool to attack the network. I would rather use Ouka with a potential bug (although none of the rooms i know use it seem to have had a problem) than WSC that "may" cause ongoing issues for others.

With WCS a potenital attack tool and FX not blocking any such traffic there is only 1 real option, Ouka, i would suggest Tiny if you have found a potential issue, do the community a favour,  grab some screen shots and data and get it off to Ouka asap so he can fix the issue? Im sure GS knows how to contact him.

Just a thought. I am not trying to oppose you, or be confrontational, i am just very aware KM got caught out once, with WCS, i strongly suspect he has gotten away with other attacks in the past, it would just seem common sense to minimise network exposure to his "software" thats all.........

I really think if we ALL got behind this, we could pratically remove WCS and any risks it comes with, i think more than anything the big issue for hosts is, they are used to WCS and do not wanna spend time on reconfiguring their bots.

[GhostShip]

Tiny I may be wrong in my attitude of calling yourself and James a cuckoo but it just seems plain to me that if your WCS is sending out a packet with a payload that contains node information all the tools you mention are unable to show it, sure you,ll see something, but not what it is as its encrypted.

There is no feud here with KM, whats at issue is trust, you either trust what I,m saying or you dont, I have the tools to see the damage and the knowledge to know what packet is affected and causing the disruption, you do not to my knowledge therefore unless you can show me how you can see what Ouka is receiving or WCS is sending inside the affected packet  I cant see how you reached your conclusions is all.

My apologies to you both in perhaps jumping the gun a little in this but it seems for months I tell ppl what the problems symptoms are and whats at stake and all I hear is "well I cant see anything", is that suprising if you dont know what your looking for ?

[$i£ve®$haÐów]

hi all
well i would just like to add that my mx is reconnecting all the time latley. and ppl falling out of my room about 10 at a time. so there must be some thing going on .
     
            GóÐÐ맧