Rogue User - Trojan installing BOINC illegally!!!

Message boards : Number crunching : Rogue User - Trojan installing BOINC illegally!!!
Message board moderation

To post messages, you must log in.

AuthorMessage
Profile MikeSW17
Volunteer tester

Send message
Joined: 3 Apr 99
Posts: 1603
Credit: 2,700,523
RAC: 0
United Kingdom
Message 521095 - Posted: 21 Feb 2007, 18:36:31 UTC
Last modified: 21 Feb 2007, 18:36:53 UTC

It seems that there is a rogue user, who released a trojan to install BOINC in machines illegally.
Both CPDN and PrimeGrid have identified this user as Wate (See: http://www.primegrid.com/orig/forum_thread.php?id=514#4817 and News: http://www.primegrid.com/ .... also CPDN: http://climateapps2.oucs.ox.ac.uk/cpdnboinc/forum_thread.php?id=5314)

Both those Projects have removed all credit from this user.

Although he doesn't seem to be running SETI, he does figure at No 5 in the Top 100 multi-project users (http://boinc.berkeley.edu/chart_list.php)

Anyone else agree this record should be erased totally?

ID: 521095 · Report as offensive
Richard Haselgrove Project Donor
Volunteer tester

Send message
Joined: 4 Jul 99
Posts: 14650
Credit: 200,643,578
RAC: 874
United Kingdom
Message 521098 - Posted: 21 Feb 2007, 18:44:40 UTC

Might be better to consolidate discussion into the Trojan boinc installation by rogue member thread?
ID: 521098 · Report as offensive
Alinator
Volunteer tester

Send message
Joined: 19 Apr 05
Posts: 4178
Credit: 4,647,982
RAC: 0
United States
Message 521105 - Posted: 21 Feb 2007, 19:03:24 UTC - in response to Message 521098.  

Might be better to consolidate discussion into the Trojan boinc installation by rogue member thread?


Not to mention the fact that according to BoincStats he doesn't even run SAH (at least under the disputed Username), and thus has little bearing other than general interest here. ;-)

Alinator
ID: 521105 · Report as offensive
Profile Saenger
Volunteer tester
Avatar

Send message
Joined: 3 Apr 99
Posts: 2452
Credit: 33,281
RAC: 0
Germany
Message 521128 - Posted: 21 Feb 2007, 20:02:49 UTC
Last modified: 21 Feb 2007, 20:03:45 UTC

C'mon, it's hard to see a thread that's named the same all over most project fora here, he just could not see it.

As far as I read in the other thread, it could be that Seti dealt with him/her before (theat's Wate, not Mike of course), at least that's how I understand some other posts in other fora.
Gruesse vom Saenger

For questions about Boinc look in the BOINC-Wiki
ID: 521128 · Report as offensive
Profile bernt
Avatar

Send message
Joined: 10 Dec 06
Posts: 27
Credit: 131,599
RAC: 0
Sweden
Message 521156 - Posted: 21 Feb 2007, 21:01:30 UTC - in response to Message 521095.  

It seems that there is a rogue user, who released a trojan to install BOINC in machines illegally.
Both CPDN and PrimeGrid have identified this user as Wate (See: http://www.primegrid.com/orig/forum_thread.php?id=514#4817 and News: http://www.primegrid.com/ .... also CPDN: http://climateapps2.oucs.ox.ac.uk/cpdnboinc/forum_thread.php?id=5314)

Both those Projects have removed all credit from this user.

Although he doesn't seem to be running SETI, he does figure at No 5 in the Top 100 multi-project users (http://boinc.berkeley.edu/chart_list.php)

Anyone else agree this record should be erased totally?


Get rid of him!!!!!!
ID: 521156 · Report as offensive
Profile MikeSW17
Volunteer tester

Send message
Joined: 3 Apr 99
Posts: 1603
Credit: 2,700,523
RAC: 0
United Kingdom
Message 521209 - Posted: 21 Feb 2007, 21:59:26 UTC - in response to Message 521105.  
Last modified: 21 Feb 2007, 22:02:49 UTC

Might be better to consolidate discussion into the Trojan boinc installation by rogue member thread?


Not to mention the fact that according to BoincStats he doesn't even run SAH (at least under the disputed Username), and thus has little bearing other than general interest here. ;-)

Alinator


Admittedly, I should have looked harder for another thread on the subject - I did look but didn't see it, sorry... bring back the search feature?

As for relevance to SETI, I did note that he didn't crunch for SETI, but IMO
(a) he's bringing BOINC into disrepute, and it's more likely that the developers and managers of BOINC will be made aware of the possible issue through posting here than relying on them browsing other bOINC project sites.
(b) As I pointed out, on this very site, (setiathome.berkeley.edu) is a page crediting the top 100 multi-project and number 5 on that page, clearly should not have the right to be there.

ID: 521209 · Report as offensive
Alinator
Volunteer tester

Send message
Joined: 19 Apr 05
Posts: 4178
Credit: 4,647,982
RAC: 0
United States
Message 521233 - Posted: 21 Feb 2007, 22:31:01 UTC - in response to Message 521209.  
Last modified: 21 Feb 2007, 22:32:04 UTC

Admittedly, I should have looked harder for another thread on the subject - I did look but didn't see it, sorry... bring back the search feature?

As for relevance to SETI, I did note that he didn't crunch for SETI, but IMO
(a) he's bringing BOINC into disrepute, and it's more likely that the developers and managers of BOINC will be made aware of the possible issue through posting here than relying on them browsing other bOINC project sites.
(b) As I pointed out, on this very site, (setiathome.berkeley.edu) is a page crediting the top 100 multi-project and number 5 on that page, clearly should not have the right to be there.


WRT to search, or least put other places than just the Q&A Menu page.

Also, I agree the negative impact is to BOINC overall and the projects specificially where the abuse is occuring, not to mention is just plain wrong, unethical, and probably a felony in some parts of the world. This guy should be stomped on hard if the allegations are proven correct and deliberate, and not only to protect the integrity of the BOINC framework.

However, SAH in and of itself it not involved. I cannot find one reference on the SAH website to the perp other than here in the fora. The common denominator is Berkeley, and boinc.berkeley.edu is not the same entity as setiathomne.berkeley.edu or setiweb.ssl.berkeley.edu. To lump them together is like saying the Physics Dept. is the same thing as the Mathematics Dept. because they both "live" on the Berkeley campus for example.

They may be closely related, collaborators, and comrades, but the are not the same thing.

Alinator
ID: 521233 · Report as offensive
Profile Misfit
Volunteer tester
Avatar

Send message
Joined: 21 Jun 01
Posts: 21804
Credit: 2,815,091
RAC: 0
United States
Message 521372 - Posted: 22 Feb 2007, 3:21:21 UTC

imagine if he was here and was randomly selected to be an automod.
me@rescam.org
ID: 521372 · Report as offensive
Alinator
Volunteer tester

Send message
Joined: 19 Apr 05
Posts: 4178
Credit: 4,647,982
RAC: 0
United States
Message 521380 - Posted: 22 Feb 2007, 3:34:31 UTC
Last modified: 22 Feb 2007, 3:47:24 UTC

LOL.....

You DO like to start trouble even if it is hypothetical, don't you. :-)

OTOH, who's to say he doesn't have an alter ego who IS (or was or could be) an automod??!! ;-)

Alinator
ID: 521380 · Report as offensive
Profile Misfit
Volunteer tester
Avatar

Send message
Joined: 21 Jun 01
Posts: 21804
Credit: 2,815,091
RAC: 0
United States
Message 521404 - Posted: 22 Feb 2007, 4:25:54 UTC - in response to Message 521380.  
Last modified: 22 Feb 2007, 4:26:44 UTC

LOL.....

You DO like to start trouble even if it is hypothetical, don't you. :-)

OTOH, who's to say he doesn't have an alter ego who IS (or was or could be) an automod??!! ;-)

Alinator

I checked the posting rules beforehand and made sure it didn't say, "Moderators (especially Misfit) may not start hypothetical trouble."

Of course if I really wanted to start a rumor I could say it could be someone with lots of credits and a really short NamEZ.
me@rescam.org
ID: 521404 · Report as offensive
Profile ML1
Volunteer moderator
Volunteer tester

Send message
Joined: 25 Nov 01
Posts: 20265
Credit: 7,508,002
RAC: 20
United Kingdom
Message 521655 - Posted: 22 Feb 2007, 18:25:22 UTC - in response to Message 521372.  

imagine if he was here and was randomly selected to be an automod.

What!?

You automatically get imposed upon to moderate the forums after a gazillion random posts and 75% life utilization on the forums?!

Phew!

Gracious wishes of happyness in all moderation,

Cheers,
Martin

See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)
ID: 521655 · Report as offensive
Profile Misfit
Volunteer tester
Avatar

Send message
Joined: 21 Jun 01
Posts: 21804
Credit: 2,815,091
RAC: 0
United States
Message 521952 - Posted: 23 Feb 2007, 2:30:17 UTC - in response to Message 521655.  

imagine if he was here and was randomly selected to be an automod.

What!?

You automatically get imposed upon to moderate the forums after a gazillion random posts and 75% life utilization on the forums?!

Phew!

Gracious wishes of happyness in all moderation,

Cheers,
Martin

Am I to conclude you've been on vacation since November? :)
I was told it's because they think I'm Milla Jovovich. I could be...
me@rescam.org
ID: 521952 · Report as offensive
Profile littlegreenmanfrommars
Volunteer tester
Avatar

Send message
Joined: 28 Jan 06
Posts: 1410
Credit: 934,158
RAC: 0
Australia
Message 523030 - Posted: 25 Feb 2007, 6:07:45 UTC

IF there is a trojan-using "rogue user", I wonder if he might be responsible for the sudden appearance of the third placed user in this page:Sign-on date=28th Jan 2006]
I can't find a record for that user in the SETI profiles database, but the name suddenly zoomed up the board literally a couple of months ago, seemingly from nowhere! He/she must have a lot of machines to rack up that sort of performance, and they must have come on board VERY quickly!
Of course, it's perfectly possible there's nothing amiss, just a lucky character whose boss has allowed him/her to install BOINC on a couple of dozen computers.
If he/she's legit, then good luck! :)
However, if this is the result of a trojan, installing BOINC without the knowledge or agreement of PC owners, perhaps it's time S@h had a chat with an antivirus company, advising them of this situation? Can you imagine the backlash as thousands of aggrieved people find they have been "roped in" to number crunch for S@h? The damage could be disastrous!

ID: 523030 · Report as offensive
Alinator
Volunteer tester

Send message
Joined: 19 Apr 05
Posts: 4178
Credit: 4,647,982
RAC: 0
United States
Message 523233 - Posted: 25 Feb 2007, 16:51:31 UTC - in response to Message 523030.  

IF there is a trojan-using "rogue user", I wonder if he might be responsible for the sudden appearance of the third placed user in this page:Sign-on date=28th Jan 2006]
I can't find a record for that user in the SETI profiles database, but the name suddenly zoomed up the board literally a couple of months ago, seemingly from nowhere! He/she must have a lot of machines to rack up that sort of performance, and they must have come on board VERY quickly!
Of course, it's perfectly possible there's nothing amiss, just a lucky character whose boss has allowed him/her to install BOINC on a couple of dozen computers.
If he/she's legit, then good luck! :)
However, if this is the result of a trojan, installing BOINC without the knowledge or agreement of PC owners, perhaps it's time S@h had a chat with an antivirus company, advising them of this situation? Can you imagine the backlash as thousands of aggrieved people find they have been "roped in" to number crunch for S@h? The damage could be disastrous!


This the participant you're talking about?

X3

If so, I don't see anything too unusual here. Bringing one late model "Big Boy" online full time could easily account for the numbers he's posting currently.

As far as the long hiatus they took, that isn't all that unusual either.

As far as the bad PR from this kind abuse goes, the real disaster is that people continue to stupidly click on CAYS links in email, porn and/or warez sites links, and not regularly check their boxes for AV/OS/Application security updates, tighten browser settings etc.

I suggest that if someone finds that BOINC is running on their machine and they didn't put it there, this is definitely the lesser of two evils. The alternatives could be far worse, since they by definition did something thoughtlessly.

The only question which remains is just what else is the weaponized version BOINC doing besides abusing the credit system? ;-)

A possible scenario where BOINC could be installed clandestinely but not illegally would be to tack it on as a condition of use for some other application, much like adware is on some demo and "free" applications and the click through EULA's we mostly all agree to when updating Windows. In this case, you can't say the perp didn't have permission since courts here in the US and many other jurisdictions have upheld software EULA's for the most part and the GPL which BOINC is released under allows anyone to redistribute it. In an era of routine 50 MB downloads from Microsoft, who's going to notice the puny 8 or so BOINC would tack on to something?

Don't get me wrong here, I'm of the opinion anyone who would try something like this is lower than whale turds on the bottom ocean, but that doesn't always make it illegal.

Due to personal computers being powerful general purpose tools and not toasters or any other household appliance, it pretty much back to the old saying, "It's impossible to make anything idiot proof, because idiots are so ingenious"!

Alinator
ID: 523233 · Report as offensive
1mp0£173
Volunteer tester

Send message
Joined: 3 Apr 99
Posts: 8423
Credit: 356,897
RAC: 0
United States
Message 523366 - Posted: 25 Feb 2007, 21:32:15 UTC - in response to Message 521655.  

imagine if he was here and was randomly selected to be an automod.

What!?

You automatically get imposed upon to moderate the forums after a gazillion random posts and 75% life utilization on the forums?!

Phew!

Gracious wishes of happyness in all moderation,

Cheers,
Martin

The "smart" automods all went back to being regular forum members.
ID: 523366 · Report as offensive
Profile Misfit
Volunteer tester
Avatar

Send message
Joined: 21 Jun 01
Posts: 21804
Credit: 2,815,091
RAC: 0
United States
Message 523413 - Posted: 25 Feb 2007, 23:51:07 UTC - in response to Message 523366.  

The "smart" automods all went back to being regular forum members.

tsk tsk tsk
me@rescam.org
ID: 523413 · Report as offensive
Profile littlegreenmanfrommars
Volunteer tester
Avatar

Send message
Joined: 28 Jan 06
Posts: 1410
Credit: 934,158
RAC: 0
Australia
Message 523425 - Posted: 26 Feb 2007, 0:34:19 UTC - in response to Message 523233.  

IF there is a trojan-using "rogue user", I wonder if he might be responsible for the sudden appearance of the third placed user in this page:Sign-on date=28th Jan 2006]
I can't find a record for that user in the SETI profiles database, but the name suddenly zoomed up the board literally a couple of months ago, seemingly from nowhere! He/she must have a lot of machines to rack up that sort of performance, and they must have come on board VERY quickly!
Of course, it's perfectly possible there's nothing amiss, just a lucky character whose boss has allowed him/her to install BOINC on a couple of dozen computers.
If he/she's legit, then good luck! :)
However, if this is the result of a trojan, installing BOINC without the knowledge or agreement of PC owners, perhaps it's time S@h had a chat with an antivirus company, advising them of this situation? Can you imagine the backlash as thousands of aggrieved people find they have been "roped in" to number crunch for S@h? The damage could be disastrous!


This the participant you're talking about?

X3

If so, I don't see anything too unusual here. Bringing one late model "Big Boy" online full time could easily account for the numbers he's posting currently.

As far as the long hiatus they took, that isn't all that unusual either.

As far as the bad PR from this kind abuse goes, the real disaster is that people continue to stupidly click on CAYS links in email, porn and/or warez sites links, and not regularly check their boxes for AV/OS/Application security updates, tighten browser settings etc.

I suggest that if someone finds that BOINC is running on their machine and they didn't put it there, this is definitely the lesser of two evils. The alternatives could be far worse, since they by definition did something thoughtlessly.

The only question which remains is just what else is the weaponized version BOINC doing besides abusing the credit system? ;-)

A possible scenario where BOINC could be installed clandestinely but not illegally would be to tack it on as a condition of use for some other application, much like adware is on some demo and "free" applications and the click through EULA's we mostly all agree to when updating Windows. In this case, you can't say the perp didn't have permission since courts here in the US and many other jurisdictions have upheld software EULA's for the most part and the GPL which BOINC is released under allows anyone to redistribute it. In an era of routine 50 MB downloads from Microsoft, who's going to notice the puny 8 or so BOINC would tack on to something?

Don't get me wrong here, I'm of the opinion anyone who would try something like this is lower than whale turds on the bottom ocean, but that doesn't always make it illegal.

Due to personal computers being powerful general purpose tools and not toasters or any other household appliance, it pretty much back to the old saying, "It's impossible to make anything idiot proof, because idiots are so ingenious"!

Alinator


HI mate,

I can't, and won't disagree with any of what you've said. It pretty much sums up my own thoughts, including the amazing recent results of the cruncher in question. I'd be the last to point the finger without solid proof, which I certainly don't have. As I stated in my last post, he/she may just be lucky enough to have a boss with a large network, and is making good use of it.

I'm not here to compete with others over credit, so any envy I feel is at the thought of all those computers! *slaver, drool*

Your point about "idiots" and the way people blindly click links, etc, is one I have tried to make several times to those around me. My present email address went 6 months without a single SPAM. Then I started getting 5 times as much SPAM as real mail. I have MailWasher Pro, but the whole thing is still a nuisance. I follow all the procedures and still get rubbish in my Inbox, because some brainless **** out there is being careless. *ho hum*



ID: 523425 · Report as offensive
1mp0£173
Volunteer tester

Send message
Joined: 3 Apr 99
Posts: 8423
Credit: 356,897
RAC: 0
United States
Message 523949 - Posted: 27 Feb 2007, 4:27:04 UTC - in response to Message 523413.  

The "smart" automods all went back to being regular forum members.

tsk tsk tsk

Your signature would be funnier if the cow was going "MOD." :-)
ID: 523949 · Report as offensive
Profile Misfit
Volunteer tester
Avatar

Send message
Joined: 21 Jun 01
Posts: 21804
Credit: 2,815,091
RAC: 0
United States
Message 523971 - Posted: 27 Feb 2007, 5:22:35 UTC - in response to Message 523949.  

The "smart" automods all went back to being regular forum members.

tsk tsk tsk

Your signature would be funnier if the cow was going "MOD." :-)

I learn something new every day.
me@rescam.org
ID: 523971 · Report as offensive
Pepo
Volunteer tester
Avatar

Send message
Joined: 5 Aug 99
Posts: 308
Credit: 418,019
RAC: 0
Slovakia
Message 524161 - Posted: 27 Feb 2007, 15:40:43 UTC - in response to Message 523971.  

Your signature would be funnier if the cow was going "MOD." :-)

I learn something new every day.

I think you've got it.

Peter
ID: 524161 · Report as offensive

Message boards : Number crunching : Rogue User - Trojan installing BOINC illegally!!!


 
©2024 University of California
 
SETI@home and Astropulse are funded by grants from the National Science Foundation, NASA, and donations from SETI@home volunteers. AstroPulse is funded in part by the NSF through grant AST-0307956.