Powered by Invision Power Board

Welcome Guest ( Log In | Register )

5 Pages < 1 2 3 4 5 > 
Reply to this topicStart new topicStart Poll

Outline · [ Standard ] · Linear+

> Try to detect a fake server, sending bogus search results

Vladimir (SV)
Dec 20 2007, 13:09
+Quote Post





Group: Betatesters
Posts: 1316
Joined: 31-July 05
From: San Salvador, El Salvador



I think there's a way to detect fake files on results. Fake servers does not respect "Max. File Size" either "Extension" (really, thet don't respect anything...)

I had tested diverse things, and found that it will be safe to drop results which extension differs from the expected ones, or which file size differs from the interval selected.

In any case those settings are not obligatory and therefore will not work 100%, but at least I thing it's better than nothing.

One case it could be special useful is when you search for movie types, server returning an "exe" it's likely to be fake.

I think this does not need so much heuristics nor parsing, nor anything more than simple double check if results meets the criteria of the search on client side.

I can post an screenshot of a situation where all fakes results can be identified by a patron, tell me if you like that I post it and to describe more the idea.
User is offlineProfile CardPM
Go to the top of the page
Post #31
muleteer
Dec 20 2007, 15:14
+Quote Post





Group: Betatesters
Posts: 8261
Joined: 29-February 04



What if the user does a global search without specifying any additional parameters except the keywords? unsure.gif I do that sometimes when I'm not sure of the size or extension.

Eg. If I'm searching for a movie and its subtitles. I get the big movie (avi, mkv, mp4, iso, rar, whatever) and the small subtitles (srt, rar zip, sub, idx, whatever).
User is offlineProfile CardPM
Go to the top of the page
Post #32
Aw3
Dec 20 2007, 15:41
+Quote Post





Group: Admins
Posts: 7319
Joined: 8-December 03



What server version and capabilities (in server tooltips) they had?
User is offlineProfile CardPM
Go to the top of the page
Post #33
Vladimir (SV)
Dec 20 2007, 16:30
+Quote Post





Group: Betatesters
Posts: 1316
Joined: 31-July 05
From: San Salvador, El Salvador




QUOTE(muleteer @ Dec 20 2007, 09:14)
What if the user does a global search without specifying any additional parameters except the keywords? unsure.gif I do that sometimes when I'm not sure of the size or extension.

Eg. If I'm searching for a movie and its subtitles. I get the big movie (avi, mkv, mp4, iso, rar, whatever) and the small subtitles (srt, rar zip, sub, idx, whatever).
*



QUOTE(Vladimir (SV) @ Dec 20 2007, 07:09)
In any case those settings are not obligatory and therefore will not work 100%, but at least I thing it's better than nothing.
*



I know it's not perfect, but it could avoid some fake results when the user do specify the parameters.

QUOTE(Aw3 @ Dec 20 2007, 09:41)
What server version and capabilities (in server tooltips) they had?
*


huh.gif I don't understand, do you want that I post the version an capabilities of each server on my list?.

I'm proposing a method to drop the fakes results in some cases, but I think it's not possible to determine the server which produce them without modifications to the code (like logging the servers who throw the fake result)
User is offlineProfile CardPM
Go to the top of the page
Post #34
muleteer
Dec 20 2007, 16:39
+Quote Post





Group: Betatesters
Posts: 8261
Joined: 29-February 04



Basically, if the results returned by a server contains items that do not meet the search criteria, declare that server as a fake and discard all its results. Is that what you are suggesting?
User is offlineProfile CardPM
Go to the top of the page
Post #35
Vladimir (SV)
Dec 20 2007, 17:09
+Quote Post





Group: Betatesters
Posts: 1316
Joined: 31-July 05
From: San Salvador, El Salvador



No, if the results returned by a server contains items that do not meet the search criteria, just log that server as possible fake (to warn user) and discard only the results that do not match the criteria.

Some day I was thinking in the possibility of not simply discard the results, but to open two tabs per search result: usual tab with processed results and the other tab with the results that were received but did not match the criteria.

Like most mail systems, where you have a "spam" folder, that contains the suspicious mail, so you may review them in case of a erroneous behavior of the filtering system.
User is offlineProfile CardPM
Go to the top of the page
Post #36
zegg
Feb 27 2008, 23:31
+Quote Post





Group: Members
Posts: 60
Joined: 18-December 04



hi
my searches produces those crappy results too after a while(in general search)

there should be fake server list file in next emuleplus updated from an online database you are hosting IMO.fakeproducing servers should be added as noticed.an algorithm that is to notice those fake results is not hard imo.pattern that is occuring in every crappy result is that nearly 8-20 new result files appear in one time that generally coming from 1 server those filenames containing many exe results.(at least 1 exe).that server may be instantly submitted as a suspicious crapy server to your forum site (to a file maybe) by the new client.shouldnt be hard to do this...even to make the algorith better, if the client notices such thing, it could search a 1-2 more words in the background without interacting with the user(general search), and look if the new different random words produce pretty same named results with same crappy servers.(from same server until attackers also change their algorithm of handling searches of different range of words((say starting with a-h with crapy server1, h-z wth server2, 0-9 with server 3..or with ascii codes)).anyways dont look if coming from the same server then.rather look that server produced a matching result for a different word too in your algorithm biggrin.gif )

i need to sleep.i hope it is understood.i mean what i try to tell. sleep.gif gnight everyone.life is good is guess.but i am not sure smile.gif

here is the servers i have in my server list
ed2k://|server|38.107.161.45|4661|/
ed2k://|server|38.107.161.46|4661|/
ed2k://|server|38.107.161.47|4661|/
ed2k://|server|38.107.161.48|4661|/
ed2k://|server|38.107.161.49|4661|/
ed2k://|server|38.107.161.50|4661|/
ed2k://|server|38.107.161.51|4661|/
ed2k://|server|38.107.161.53|4661|/
ed2k://|server|38.107.161.54|4661|/
ed2k://|server|38.107.161.55|4661|/
ed2k://|server|38.107.161.56|4661|/
ed2k://|server|38.107.161.57|4661|/
ed2k://|server|38.107.161.58|4661|/
ed2k://|server|38.107.161.59|4661|/
ed2k://|server|38.107.161.60|4661|/
ed2k://|server|38.107.161.61|4661|/
ed2k://|server|38.107.161.62|4661|/
ed2k://|server|38.107.161.63|4661|/
ed2k://|server|38.107.164.3|4661|/
ed2k://|server|38.107.164.4|4661|/
ed2k://|server|38.107.164.5|4661|/
ed2k://|server|38.107.164.6|4661|/
ed2k://|server|38.107.164.7|4661|/
ed2k://|server|38.107.164.8|4661|/
ed2k://|server|38.107.164.9|4661|/
ed2k://|server|38.107.164.10|4661|/
ed2k://|server|38.107.164.11|4661|/
ed2k://|server|38.107.164.12|4661|/
ed2k://|server|38.107.164.13|4661|/
ed2k://|server|38.107.164.14|4661|/
ed2k://|server|38.107.164.15|4661|/
ed2k://|server|38.107.164.16|4661|/
ed2k://|server|38.107.164.17|4661|/
ed2k://|server|38.107.164.18|4661|/
ed2k://|server|38.107.164.19|4661|/
ed2k://|server|38.107.164.20|4661|/
ed2k://|server|38.107.164.21|4661|/
ed2k://|server|38.107.164.22|4661|/
ed2k://|server|38.107.164.23|4661|/
ed2k://|server|58.218.179.157|8080|/
ed2k://|server|58.218.202.170|8080|/
ed2k://|server|61.129.115.56|4500|/
ed2k://|server|61.129.115.227|4500|/
ed2k://|server|62.26.18.194|5444|/
ed2k://|server|62.38.5.168|4000|/
ed2k://|server|62.90.55.13|4000|/
ed2k://|server|62.90.55.17|4000|/
ed2k://|server|62.90.55.67|4000|/
ed2k://|server|62.121.97.56|4567|/
ed2k://|server|64.27.4.231|30116|/
ed2k://|server|64.34.164.93|5433|/
ed2k://|server|64.34.166.107|3867|/
ed2k://|server|64.34.166.225|8321|/
ed2k://|server|64.34.168.33|8763|/
ed2k://|server|64.34.168.34|6580|/
ed2k://|server|64.34.177.106|5936|/
ed2k://|server|64.34.178.57|8590|/
ed2k://|server|64.34.180.200|9473|/
ed2k://|server|64.34.193.81|8579|/
ed2k://|server|65.111.173.41|4200|/
ed2k://|server|66.90.73.253|8899|/
ed2k://|server|66.135.32.97|5660|/
ed2k://|server|66.135.34.198|8270|/
ed2k://|server|66.135.59.149|4775|/
ed2k://|server|67.159.5.180|4242|/
ed2k://|server|72.172.89.117|4661|/
ed2k://|server|72.172.89.118|4661|/
ed2k://|server|72.172.89.120|4661|/
ed2k://|server|72.172.89.121|4661|/
ed2k://|server|72.172.89.122|4661|/
ed2k://|server|72.172.89.125|4661|/
ed2k://|server|72.172.89.126|4661|/
ed2k://|server|72.172.89.127|4661|/
ed2k://|server|72.172.89.128|4661|/
ed2k://|server|72.172.89.129|4661|/
ed2k://|server|72.172.89.130|4661|/
ed2k://|server|72.172.89.131|4661|/
ed2k://|server|72.172.89.132|4661|/
ed2k://|server|72.172.89.135|4661|/
ed2k://|server|72.172.89.136|4661|/
ed2k://|server|72.172.89.137|4661|/
ed2k://|server|72.172.89.138|4661|/
ed2k://|server|72.172.89.143|4661|/
ed2k://|server|72.172.89.144|4661|/
ed2k://|server|72.172.89.149|4661|/
ed2k://|server|72.172.89.157|4661|/
ed2k://|server|74.50.101.2|4242|/
ed2k://|server|77.247.178.244|4242|/
ed2k://|server|78.54.19.37|4665|/
ed2k://|server|80.252.110.146|4661|/
ed2k://|server|80.252.110.147|4661|/
ed2k://|server|82.80.4.242|4232|/
ed2k://|server|82.80.4.244|4232|/
ed2k://|server|83.149.104.122|4242|/
ed2k://|server|83.149.116.131|4232|/
ed2k://|server|85.17.6.36|8899|/
ed2k://|server|85.17.6.37|8899|/
ed2k://|server|85.17.6.40|8899|/
ed2k://|server|85.17.6.41|8899|/
ed2k://|server|85.17.35.53|4321|/
ed2k://|server|85.17.40.41|5125|/
ed2k://|server|85.17.52.63|5125|/
ed2k://|server|85.17.52.92|5000|/
ed2k://|server|85.17.52.124|5000|/
ed2k://|server|85.17.145.2|8899|/
ed2k://|server|85.17.154.36|8899|/
ed2k://|server|85.17.168.92|4321|/
ed2k://|server|85.17.168.131|4321|/
ed2k://|server|85.17.172.34|4321|/
ed2k://|server|85.17.184.1|4321|/
ed2k://|server|85.17.208.77|8899|/
ed2k://|server|85.17.226.211|1847|/
ed2k://|server|85.17.235.193|7354|/
ed2k://|server|85.17.235.194|7354|/
ed2k://|server|85.17.235.195|7354|/
ed2k://|server|85.17.235.196|7354|/
ed2k://|server|85.128.56.84|4567|/
ed2k://|server|87.118.120.181|4500|/
ed2k://|server|88.191.22.205|8000|/
ed2k://|server|89.31.134.126|14832|/
ed2k://|server|89.215.21.175|5000|/
ed2k://|server|89.248.162.206|6543|/
ed2k://|server|89.248.174.10|4323|/
ed2k://|server|91.121.92.50|9898|/
ed2k://|server|91.121.109.215|4661|/
ed2k://|server|92.48.193.14|5000|/
ed2k://|server|193.138.204.213|6232|/
ed2k://|server|193.138.205.25|5000|/
ed2k://|server|193.138.221.210|4242|/
ed2k://|server|193.138.221.213|4242|/
ed2k://|server|193.138.221.214|4242|/
ed2k://|server|193.138.230.251|4242|/
ed2k://|server|193.138.231.210|4242|/
ed2k://|server|195.114.98.154|4661|/
ed2k://|server|195.189.226.203|4661|/
ed2k://|server|202.205.109.5|4661|/
ed2k://|server|208.53.131.7|4444|/
ed2k://|server|208.53.138.131|5555|/
ed2k://|server|208.53.147.27|7366|/
ed2k://|server|208.71.90.162|4444|/
ed2k://|server|212.150.248.18|4000|/
ed2k://|server|212.150.248.19|4000|/
ed2k://|server|212.179.18.132|4232|/
ed2k://|server|212.179.18.136|4232|/
ed2k://|server|212.179.18.142|4232|/
ed2k://|server|212.179.18.144|4232|/
ed2k://|server|212.179.133.218|4232|/
ed2k://|server|212.179.133.219|4232|/
ed2k://|server|213.8.162.36|4232|/
ed2k://|server|213.186.44.181|4661|/
ed2k://|server|217.97.199.75|4000|/
ed2k://|server|218.87.20.106|8888|/
ed2k://|server|222.35.72.231|4661|/
ed2k://|server|222.73.207.86|8080|/
User is offlineProfile CardPM
Go to the top of the page
Post #37
muleteer
Feb 27 2008, 23:50
+Quote Post





Group: Betatesters
Posts: 8261
Joined: 29-February 04



Ouch! Suggest you select them all and delete them, then update from http://www.peerates.net/servers.php

http://emuleplus.info/forum/index.php?show...indpost&p=83687
User is offlineProfile CardPM
Go to the top of the page
Post #38
zegg
Feb 28 2008, 00:20
+Quote Post





Group: Members
Posts: 60
Joined: 18-December 04



the default autoupdate server list at startup also contains a bogus server which screws the search list in lates client1.2c...i have been trying serverlists and this list doesnot contain a crappy server that produces those fake results.

here is the clean server list i made from mostly biggest servers.

ed2k://|server|66.90.73.253|8899|/
ed2k://|server|193.138.221.214|4242|/
ed2k://|server|38.107.161.55|4661|/
ed2k://|server|38.107.164.23|4661|/
ed2k://|server|193.138.221.213|4242|/
ed2k://|server|67.159.5.180|4242|/
ed2k://|server|74.50.101.2|4242|/
ed2k://|server|38.107.161.59|4661|/
ed2k://|server|38.107.161.54|4661|/
ed2k://|server|38.107.164.3|4661|/
ed2k://|server|38.107.161.45|4661|/
ed2k://|server|38.107.164.4|4661|/
ed2k://|server|38.107.161.61|4661|/
ed2k://|server|195.189.226.203|4661|/
ed2k://|server|38.107.164.22|4661|/
ed2k://|server|77.247.178.244|4242|/
ed2k://|server|83.149.104.122|4242|/
ed2k://|server|38.107.164.14|4661|/
ed2k://|server|38.107.164.15|4661|/
ed2k://|server|38.107.164.13|4661|/
ed2k://|server|193.138.230.251|4242|/
ed2k://|server|38.107.161.57|4661|/
ed2k://|server|38.107.164.6|4661|/
ed2k://|server|38.107.161.58|4661|/
ed2k://|server|64.34.193.81|8579|/
ed2k://|server|85.17.52.92|5000|/
ed2k://|server|38.107.161.47|4661|/
ed2k://|server|193.138.205.25|5000|/
ed2k://|server|85.17.52.124|5000|/
ed2k://|server|38.107.164.9|4661|/
ed2k://|server|64.34.177.106|5936|/
ed2k://|server|38.107.161.60|4661|/
ed2k://|server|38.107.164.19|4661|/
ed2k://|server|38.107.164.11|4661|/
ed2k://|server|80.252.110.146|4661|/
ed2k://|server|80.252.110.147|4661|/
ed2k://|server|38.107.161.47|4661|/
ed2k://|server|38.107.164.8|4661|/
ed2k://|server|85.17.52.92|5000|/
ed2k://|server|92.48.193.14|5000|/

if you want to use it, make sure you disable updateserverlist(client/server/atstart) from configration and after you removed all servers from your list,just copy all +paste them to direct download section in search tab.makesure you add them static and reorganize prioritization making more files/usr containing ones to hi, while tohers to lower pri..
User is offlineProfile CardPM
Go to the top of the page
Post #39
Lastwebpage
Feb 28 2008, 17:06
+Quote Post





Group: Members
Posts: 133
Joined: 13-June 05



Sorry,
but I don't see the point why eMule should support any list or dedection of fake servers, can someone explain me the reason for it?

There are some good list with NOT fake servers like:
http://peerates.net and http://www.gruk.org/
Is this not enough?

Yes, I know, when I would enable the both options to automatic get new servers,
I would get a lot of fake serves too, but why should someone enable this options?

Peter

User is offlineProfile CardPM
Go to the top of the page
Post #40
muleteer
Feb 28 2008, 18:44
+Quote Post





Group: Betatesters
Posts: 8261
Joined: 29-February 04



Its a personal choice - zegg doesn't seem to mind them. Problem is, fake servers are capable of doing much more that just giving you garbage results. Some could even be data miners for the anti-piracy agencies. Don't forget that you reveal your entire list of shared files to the server you are connected to, plus whatever you are downloading is revealed to every server in the list.
User is offlineProfile CardPM
Go to the top of the page
Post #41
Lastwebpage
Feb 29 2008, 14:52
+Quote Post





Group: Members
Posts: 133
Joined: 13-June 05



last one should be catched from the IPFilter.dat, or not?
User is offlineProfile CardPM
Go to the top of the page
Post #42
muleteer
Feb 29 2008, 16:30
+Quote Post





Group: Betatesters
Posts: 8261
Joined: 29-February 04



QUOTE(Lastwebpage @ Feb 29 2008, 20:22)
last one should be catched from the IPFilter.dat, or not?
*


True, but ipfilters are not always up to date - a fake server has to be detected and reported to the ipfilter compilers, who will then independently verify the report. Only then does that server get put in. The really bad servers just keep changing their IP addresses - even if they change IPs once every two weeks, the ipfilter will never get them. sad.gif
User is offlineProfile CardPM
Go to the top of the page
Post #43
Lastwebpage
Mar 1 2008, 07:27
+Quote Post





Group: Members
Posts: 133
Joined: 13-June 05



QUOTE
ed2k://|server|66.90.73.253|8899|/
ed2k://|server|193.138.221.214|4242|/
...
True, but ipfilters are not always up to date


This would assume that this fakeserver list get an update each day. wink.gif
User is offlineProfile CardPM
Go to the top of the page
Post #44
muleteer
Mar 1 2008, 07:57
+Quote Post





Group: Betatesters
Posts: 8261
Joined: 29-February 04



QUOTE(zegg @ Feb 28 2008, 05:50)
the default autoupdate server list at startup also contains a bogus server which screws the search list in latest client1.2c
*


That is exactly what I have been trying to tell you. A lot of good servers bit the dust after eMule Plus v1.2c was released. We know it, you know it, everyone with any sense knows it, but until we release v1.2d you have to make the changes manually.

1. Select all the static servers and remove from static list. (otherwise they won't get deleted in the next step).
2. Select all the servers and delete them.
3. Click the button 'Update server.met from URL', paste the link http://www.peerates.net/servers.php the box and click 'update'.

And yes, disable 'autoupdate server list at startup', and also other vehicles for getting fake servers, eg. 'Update server list on server connection' and Update server list when client connects'. If you like, you can also disable 'remove dead server after n retries', or your server list will get smaller and smaller over time as dropped servers have no way of coming back.

Latwebpage: you've lost me. tongue.gif Please give the 'for dummies' version of whatever point you were trying to make. rolleyes.gif laugh.gif
User is offlineProfile CardPM
Go to the top of the page
Post #45

5 Pages < 1 2 3 4 5 >
Reply to this topicTopic OptionsStart new topic
 

Lo-Fi Version Time is now: 20th May 2013 - 21:51