[ Outline ] · Standard · Linear+ Try to detect a fake server, sending bogus search results

[AraldoL]

since some days I noticed on nearly every search I get one single fake search result (obviously a dangerous executable) with a very high number of sources so it's always on first position on the search results. The filename is always built of my search term and "_ShareAccelerator.exe", i.e. if I do a global search on "schafkopf" (a german cards game, there are several freeware versions floating around) I get "schafkopf_Shareaccelerator.exe" with about 6500 full sources. There must be at least one bogus server that builds this filename from my search term.

Of course I use a big and weekly updated ipfilter.dat! And I use a self compiled version of current CVS with an self made addition to prevent adding any servers which are located in the United States according to ip2country. So I have no US servers in my list.

To investigate which server it is I tried to find the location in source where the server results are added to the list. I wanted to write a debug line with the server's ip to the debug log to find out which server it is as a first step.

Can someone point me to the proper file and function in source where both server ip and filename from global search results are available?

Araldo

[AraldoL]

Something new on the subject:

1. Dropping those bogus search results does work. I added the red code lines to SearchList.cpp function CSearchList::AddToList at line ~675:

CODE

                        delete pAddedFile;
                        return false;
                  }
            }
      }

      CString strServerFilename = pAddedFile->GetFileName();
      uint32 dwServerFullsources = pAddedFile->GetIntTagValue(FT_COMPLETE_SOURCES);
      if ((dwServerFullsources > 4000) && (strServerFilename.MakeLower().Find(".exe") > 0))
      {
            AddLogLine(false, RGB_LOG_ERROR_TXT _T("Bogus Server sends %u full sources for suspicious file %s - dropped!"),
               dwServerFullsources,strServerFilename);
            delete pAddedFile;
            return false;
      }

      CSearchFile            *pSearchFile;

      for (POSITION pos = list.GetHeadPosition(); pos != NULL; )

To allow logging I had to change SearchList.h as well at line 87:

CODE

class CSearchList : public CLoggable
{

As you see it's only dropped if it's an EXE file and server reports more than 4000 complete(!) sources. Now the file name changes, it's not only shareaccelerator any more. But it's always an EXE file with about 6500 full sources.

2. Detecting the server responsible for this results: Sorry, I wasn't able to find out the proper connection between server IPs and result packets, resulting in wrongly accusing a BigBang server. Perhaps someone can add it to the detection above to filter such a server.

Araldo

This post has been edited by AraldoL: Jan 7 2007, 18:30

[Fuxie - DK]

As you see it's only dropped if it's an EXE file and server reports more than 4000 complete(!) sources. Now the file name changes, it's not only shareaccelerator any more. But it's always an EXE file with about 6500 full sources.

Try doing a search for "exe" in the name-field and "4000" in availability-field..

I get two results:
eMule0.47c-Installer.exe <-- 12870 results...
ud.sarkilari_Web_Hottest_Videos_PersonalPlayer.exe <-- 4457 results...

So by excluding all exe-files simply because they have more than 4000 sources seems a bit dangerous for me...

[AraldoL]

Try doing a search for "exe" in the name-field and "4000" in availability-field..

I get two results:
eMule0.47c-Installer.exe  <-- 12870 results...
ud.sarkilari_Web_Hottest_Videos_PersonalPlayer.exe  <-- 4457 results...

So by excluding all exe-files simply because they have more than 4000 sources seems a bit dangerous for me...

The search packet is only dropped if you get more than 4000 full sources from a single(!) server. So perhaps the first example is dropped from one or two biggest servers that really have 4000 complete sources connected. But even then your global search gets lots of additional results from servers with less than 4000 full sources which are not(!) dropped. It's unlikely that there are more than 4000 sources on a big server and none on the smaller ones. If one packet is dropped you would get 8000 instead of 12000 total sources, still enough I think. If such a download is started the remaining sources are found by source exchange.

Btw, the second example sounds exactly like those fake results! (currently I'm getting xxx_shareaccelerator.exe, xxx_web_hottest_videos_personalplayer.exe, xxx_direct_torrent_search_bar.exe, ...), you could download and launch it and tell me what it does

Araldo