climateprediction.net home page

The world's largest climate forecasting experiment for the 21st century.

Trojan boinc installation by rogue member


Advanced search
Message boards : Number crunching : Trojan boinc installation by rogue member

Sort
AuthorMessage
Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 26940 - Posted 20 Feb 2007 12:49:00 UTC
Last modified: 20 Feb 2007 13:06:18 UTC

It recently came to the attention of boinc staff that a multi-project cruncher called Wate who occupied a very high position in the boinc and project stats had reached this exalted position by dishonest means.

In early June 2006 he appears to to have released onto the internet a link purporting to provide Windows updates including now for Vista. Some 1500 members of the public worldwide downloaded these 'updates' which in fact consisted of a trojan application that downloaded boinc.exe and attached the person's computer to Wate's account, giving him the subsequent fraudulent credits.

About 90% of the people affected appear to have uninstalled or disabled the unwanted boinc installation, but some compromised computers are still running and crashing climate models. Boinc and project staff have no means of contacting the owners of these computers.

The problem came to light when an affected member of the public noticed the heavy drain on his laptop's battery, looked in Task Manager at the running processes, identified boinc and contacted a group of genuine boinc members in Italy.

Carl deleted Wate's cpdn credits last Friday. An unfortunate side-effect of this was that cpdn credits did not update over the weekend. This problem is now sorted. The managers of most of the other projects Wate was attached to have chosen a different course, altering his registration details.

Wate's method of hijacking computers via a dishonest download is one of the classic methods used by spammers.

Boinc staff, the ClimatePrediction programmers and your moderators stress that boinc and project software was never at fault, nor was there ever any breach of Windows XP or Vista security. The dishonest application was Wate's trojan. Boinc and project software were never infiltrated and remain secure.

How can we prevent our own computer being similarly compromised by frauds and spammers?

*Use legitimate software (it is said that half the illegal copies of Windows sold in China come with a virus pre-installed).

*Download updates for your operating system and other programmes via the tools on your computer, not through links in emails or links on web pages.

*Download new programmes only through links on websites you thoroughly trust, or type the address yourself.

*Keep your AV and firewall up-to-date and scan regularly. Install and use malware cleaners such as Spybot and Adaware.

*Look at Task Manager from time to time to see all the running processes on your computer. Right-click on the digital clock and select it. The processes whose names you don't recognise can be identified through a search engine. If you suspect a rogue application, download HijackThis and post your log there. You will be told what can be safely deleted.

*If your computer behaves unexpectedly, post on the forums.


Here is Wate:

http://www.boincstats.com/stats/boinc_user_graph.php?pr=bo&id=873722

http://climateapps2.oucs.ox.ac.uk/cpdnboinc/show_user.php?userid=188887

http://boinc.berkeley.edu/chart_list.php

http://burp.boinc.dk/forum_user_posts.php?userid=100 - appears to be the same member.

This thread can be used for discussion, reprobation and ridicule.


____________
Cpdn news
5 CPDN READMEs

Profile Saenger
Avatar

Joined: Nov 1 04
Posts: 168
ID: 28078
Credit: 624,848
RAC: 1,078
Message 26947 - Posted 20 Feb 2007 18:31:21 UTC
Last modified: 20 Feb 2007 18:36:59 UTC

Thanks for this treatment of this phisher.
I quoted your post in the fora of the other projects he joined to start a discussion there, I hope you don't mind.

Here are the links to those threads:
Einstein
Rosetta
Simap
µFluids
Predictor
Burp
PrimeGrid
(BOINCstats)

____________
Gruesse vom Saenger


For questions about Boinc look in the BOINC-Wiki

Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 26948 - Posted 20 Feb 2007 19:29:23 UTC
Last modified: 20 Feb 2007 19:34:24 UTC

Thanks for that, Sänger. I put the same post on the boinc_dev forum and said there that members were welcome to copy it to other message boards, but I forgot to say this here.

The opinion on cpdn is that it's best for everybody to know what's happening. I know, for example, that Rytis has scrambled Wate's registration details for PrimeGrid. It may be that Einstein don't deal with him until their database problems are fixed.


____________
Cpdn news
5 CPDN READMEs

Dagorath

Joined: Mar 3 06
Posts: 85
ID: 170894
Credit: 202,314
RAC: 0
Message 26950 - Posted 20 Feb 2007 20:28:56 UTC - in response to Message ID 26948.

Have authorities been contacted?
Will Wate be charged? Prosecuted? Persecuted?
Will he plead insanity and an all consuming lust for credits he just could not control?
Will he plead he is just a philanthropy facilitator harvesting unused CPU cycles out there in the wild and putting them to good use?
Who will be the first to identify and offer counselling for BOINC Credit Whore Syndrome?
My RAC sucks. Can I get a copy of his trojan?


____________

Chrissy
Avatar

Joined: Jan 9 07
Posts: 17
ID: 218256
Credit: 165,916
RAC: 0
Message 26951 - Posted 20 Feb 2007 21:00:12 UTC - in response to Message ID 26950.
Last modified: 20 Feb 2007 21:01:02 UTC

Have authorities been contacted?
Will Wate be charged? Prosecuted? Persecuted?
Will he plead insanity and an all consuming lust for credits he just could not control?
Will he plead he is just a philanthropy facilitator harvesting unused CPU cycles out there in the wild and putting them to good use?
Who will be the first to identify and offer counselling for BOINC Credit Whore Syndrome?
My RAC sucks. Can I get a copy of his trojan?




He He !!! You must be joking:) .. yeah I'd like some more RAC too( for
my Team - The Greenies..but not this way)

Chrissy

"please save us....."

____________



IainsstatspageforTGP

Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 26953 - Posted 20 Feb 2007 21:26:10 UTC
Last modified: 20 Feb 2007 21:27:51 UTC

You're welcome to persecute Wate verbally, virtuously and virtually here. Every time we mention his name, the post should after a few days come up in a Google search. By now he'll know that the game's up and you can be pretty sure he'll be watching. So I'm telling him now that everybody at cpdn thinks he's a tosser. In addition, anyone who risks frying people's laptops, on which cpdn shouldn't be run without precautions, has no understanding of boinc or computers.

Unfortunately the original IP number he registered from was overwritten on the server by the IPs of subsequent contacts, and there will in his case have been hundreds if not thousands of these. Only the most recent IP contact number remains on the server.
____________
Cpdn news
5 CPDN READMEs

Profile Ananas
Forum moderator

Joined: Oct 31 04
Posts: 276
ID: 27928
Credit: 2,132,928
RAC: 10,864
Message 26955 - Posted 20 Feb 2007 21:41:00 UTC - in response to Message ID 26940.
Last modified: 20 Feb 2007 21:43:56 UTC

.... Boinc and project staff have no means of contacting the owners of these computers.


They do have :-)

Make all computers on that account download an application that does nothing but open a message box with a short information and the OK button lead to an information page.

p.s.: please test the scheduler modification well, I do not need such an application ;-)

Profile River~~

Joined: Jun 27 05
Posts: 74
ID: 85254
Credit: 199,198
RAC: 0
Message 26956 - Posted 20 Feb 2007 22:04:17 UTC

... some compromised computers are still running and crashing climate models. Boinc and project staff have no means of contacting the owners of these computers. ...


As I understand it, cpdn can abort a job at a trickle-up.

On its own this would not be much use, as the client would simply download another client. I wonder how easy it would be to have a 'badlist' of banned users so that the scheduler would simply refuse to issue more work to them. This might prove useful in other situations as well.

Just a thought. If anyone feels it is worth passing on, please repost on the BOINC forums.

I also like the earlier suggestion to produce a specialised app that puts out a message to the users, though this could backfire on the lines of shooting the messenger. It might actually be less helpful but less damaging to the project just to make the machines disengage by refusing them work.

River~~
____________

Profile River~~

Joined: Jun 27 05
Posts: 74
ID: 85254
Credit: 199,198
RAC: 0
Message 26957 - Posted 20 Feb 2007 22:11:20 UTC - in response to Message ID 26947.

Thanks for this treatment of this phisher.
I quoted your post in the fora of the other projects he joined to start a discussion there, ...


I have copied it across to LHC and LC.

Although (s)he was not active on those projects, in my view as many people as possible should know. I'd encourage anyone who regulalry posts on other projects not mentioned already to spread the word there.

R~~

Dagorath

Joined: Mar 3 06
Posts: 85
ID: 170894
Credit: 202,314
RAC: 0
Message 26958 - Posted 20 Feb 2007 22:37:50 UTC - in response to Message ID 26951.

Have authorities been contacted?
Will Wate be charged? Prosecuted? Persecuted?
Will he plead insanity and an all consuming lust for credits he just could not control?
Will he plead he is just a philanthropy facilitator harvesting unused CPU cycles out there in the wild and putting them to good use?
Who will be the first to identify and offer counselling for BOINC Credit Whore Syndrome?
My RAC sucks. Can I get a copy of his trojan?




He He !!! You must be joking:) .. yeah I'd like some more RAC too( for
my Team - The Greenies..but not this way)



Of course I'm joking, lol.

I wish CPDN had contacted authorities first before taking any action. They've alerted Wate and now he's more likely to foil any attempts to give him what he deserves. The cops can be very effective when the perpetrator doesn't know he's under suspicion. They may have found a way to draw him into the open and then slap the cuffs on him.

There are likely other people out there who have done same as Wate. Now they are alerted too. Would have been better to round up the lot rather than alert them.



____________

Profile KSMarksPsych
Avatar

Joined: Aug 27 06
Posts: 26
ID: 197041
Credit: 143,690
RAC: 37
Message 26960 - Posted 20 Feb 2007 23:32:02 UTC

I've posted it at NanoHive and QMC and stickied it both places.
____________
Kathryn :o)
The BOINC FAQ Service
The Unofficial BOINC Wiki
The Trac System
More BOINC information than you can shake a stick of RAM at.

Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 26961 - Posted 20 Feb 2007 23:49:11 UTC

The whole business was first in the hands of the people at boinc and they then contacted the project admins via the boinc mailing list. At cpdn the mods knew about this over the weekend, but by Friday Carl already seems to have done something to stop all those computers trickling, as the last trickles were on 16 Feb. But some of the computers could still be crunching.

The only way you could probably determine whether big crunchers are using hijacked machines would be if the servers were set up to save all the IP numbers, rather than each contact IP number overwriting the previous one. It would have to identify anomalous behaviour eg any member with computers in more than one country. So the software would have to include identifying the origin of the IP numbers. Like the banks that can identify anomalous spending patterns.

As to whether continuously crashing workunits for months on end should trigger an email, a boinc message or a pop-up on-screen message....all of these ideas have been suggested before re legitimate but incompetent crunchers.

But if you want to track down an actual computer or an actual person, it's a different ball-game unless the police computer forensics department get involved. When for example one of our mods emailed @web.de which is a legit ISP to give them the IP numbers of spammers registered with them who had posted on our php forum, he got no response whatsoever. I contacted a UK hospital trust which I thought probably had a computer that was hijacked and being used by a spammer. No response even though I gave them my address and phone number. (A few organisations we've contacted have responded.)

The investigation of anything like this is massively time-consuming. I don't think any police force in the world would be even remotely interested in devoting resources to this.

But I wouldn't be surprised if sooner or later, something like what I've outlined in the second paragraph here is implemented in boinc.
____________
Cpdn news
5 CPDN READMEs

Ageless
Avatar

Joined: Aug 5 04
Posts: 222
ID: 69
Credit: 37,375
RAC: 0
Message 26962 - Posted 21 Feb 2007 0:02:05 UTC

You'd need a pretty big database then to store all those IP addresses. Nothing said about people whose IP address changes on a daily/weekly basis as their ISP cycles IP addresses (or they are on plain dial up).

What is the biggest problem the projects out there have? Yup, database problems.
So I don't see it as a viable option and thus without the various IP addresses known, the admins can't send a specific program to the 'hijacked' computers. It'll be sent to all. Not something I want to have popping up. ;-)
____________
Jord.

BOINC FAQ Service

Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 26963 - Posted 21 Feb 2007 0:15:18 UTC
Last modified: 21 Feb 2007 0:18:23 UTC

For Wate there would be a collection of thousands of IP numbers. As you say, avoiding this sort of usually irrelevant collection is why the servers overwrite the number at each contact.

It's also possible to deliberately hide your real IP number.
____________
Cpdn news
5 CPDN READMEs

Profile adhc.com.au
Avatar

Joined: Jan 10 06
Posts: 55
ID: 147874
Credit: 237,942
RAC: 194
Message 26964 - Posted 21 Feb 2007 0:25:09 UTC - in response to Message ID 26940.

This thread can be used for discussion, reprobation and ridicule.


I like this part so much I had to add something. Well done to the CPDN project staff. I hope the other projects can do the same thing and maintain a sense of cross project uniformity.

____________


Click here to join the #1 Aussie Alliance on Climate Prediction

Profile adhc.com.au
Avatar

Joined: Jan 10 06
Posts: 55
ID: 147874
Credit: 237,942
RAC: 194
Message 26965 - Posted 21 Feb 2007 0:35:24 UTC - in response to Message ID 26961.

The only way you could probably determine whether big crunchers are using hijacked machines would be if the servers were set up to save all the IP numbers, rather than each contact IP number overwriting the previous one. It would have to identify anomalous behaviour eg any member with computers in more than one country. So the software would have to include identifying the origin of the IP numbers. Like the banks that can identify anomalous spending patterns.


Using the BOINC members country may be problematic. As an example one of our members resides in China and works all over South East Asia.

It would look horribly suspicious to see an Australian returning results from that demographic. Although this scenario may be easily overcome.

In any case, legitimate users would be much easier to contact.

____________


Click here to join the #1 Aussie Alliance on Climate Prediction

Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 26966 - Posted 21 Feb 2007 0:44:44 UTC

As Jorden says, nothing like this is going to happen any time soon!

This is nice - one of the Italians who investigated the problems of the hapless owner of the hijacked laptop and uncovered the scam has posted here:

http://boinc.berkeley.edu/dev/forum_thread.php?id=1571


____________
Cpdn news
5 CPDN READMEs

Profile Misfit
Avatar

Joined: Aug 27 05
Posts: 35
ID: 94860
Credit: 1,633
RAC: 0
Message 26967 - Posted 21 Feb 2007 3:22:53 UTC - in response to Message ID 26940.

This thread can be used for discussion, reprobation and ridicule.

Do not blame Misfit! ;)
____________

Join BOINC Synergy!
misfit@boincsynergy.com

Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 26969 - Posted 21 Feb 2007 6:06:02 UTC

The day you have not one but 1458 computers attached to cpdn, you will be misused, mistrusted and mistreated for all your past misfeasance, mischief and misdemeanours.

http://climateapps2.oucs.ox.ac.uk/cpdnboinc/hosts_user.php?userid=188887
____________
Cpdn news
5 CPDN READMEs

petrusbroder

Joined: Apr 30 05
Posts: 1
ID: 72768
Credit: 1,445,331
RAC: 733
Message 26970 - Posted 21 Feb 2007 6:17:38 UTC

Why not create an accound for "the unknown crunchers" and put the credits there?
I mean: the WUs are crunched, the science has profited, the right thing to do would be to remove the credits from Wate.
However, someone should have them, so create - in gratefulness and as a small compensation for those who crunched it - that account.

OTOH: there is nothing which prevents him to join again using a different name and different ISP and a different scam. And that is so sad ...
____________

Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 26972 - Posted 21 Feb 2007 7:58:49 UTC
Last modified: 21 Feb 2007 8:01:34 UTC

The workunits have crunched uselessly because none of them have completed even the first decade. So none of this is of the slightest value to the researchers. If you click on the link in my reply to Misfit, then look at the details of the computers' results, you'll see what I mean. There's no way a computer owner who doesn't even know there's a workunit on the computer can get a climate model through 160 years of simulation.

It's been a clossal waste of time and electricity, and I just hope nobody lost their laptop through overheating. Fortunately, a lot of models didn't survive long enough to even warm up a laptop.

Credits per se don't equal scientific data. You can be number 4 in the global stats and be doing nothing of value.

It would be nice if a few of us could go over to the link in my post above Misfit's and thank the Italians there.
____________
Cpdn news
5 CPDN READMEs

Haraldo

Joined: Dec 18 06
Posts: 11
ID: 214384
Credit: 32,969
RAC: 2
Message 26975 - Posted 21 Feb 2007 11:50:54 UTC

I would think that anyone who has sent out a trojan to to amass credits needs
professional help.

Scott Brown

Joined: Aug 26 04
Posts: 19
ID: 1607
Credit: 446,376
RAC: 0
Message 26976 - Posted 21 Feb 2007 14:04:23 UTC - in response to Message ID 26969.

The day you have not one but 1458 computers attached to cpdn, you will be misused, mistrusted and mistreated for all your past misfeasance, mischief and misdemeanours.

http://climateapps2.oucs.ox.ac.uk/cpdnboinc/hosts_user.php?userid=188887


Actually, you forgot to look at all hosts instead of the 1400+ from the last 30 days. Total hosts for this criminal are more than 5300.

On another note, for grant funded projects, I hope that staff are reporting this incident to their Principal Investigators. In many cases, grant funding organizations (especially government agencies) require the reporting of such illegal activities to at least the funding agency if not to the appropriate law enforcement organizations, regardless of whether or not the project itself is at fault or if prosecution will be pursued.

Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 26977 - Posted 21 Feb 2007 14:10:18 UTC

I am quite sure that Carl, Milo and Tolu will be watching this thread. If we don't have a post from one of them to show that they are, one of us will point out to them what you've said.
____________
Cpdn news
5 CPDN READMEs

Dagorath

Joined: Mar 3 06
Posts: 85
ID: 170894
Credit: 202,314
RAC: 0
Message 26978 - Posted 21 Feb 2007 15:25:37 UTC - in response to Message ID 26977.

I am quite sure that Carl, Milo and Tolu will be watching this thread. If we don't have a post from one of them to show that they are, one of us will point out to them what you've said.


Please, if you are at all sincere about the kind of damage that Wate the Wanker and imitators can do then report the matter to the police and let them make the decisions. That's what we pay them for, that's the way it should be done. We cannot assume where it will or will not lead. There may be one little clue CPDN has overlooked that will assist in other cyber crimes Wate might be involved in. Yes, this may only be the tip of the iceberg called Wate the Wanker's cyber crime career. There may be investigative means and methods CPDN has overlooked. I say that in response to earlier indications that CPDN (or at least its moderators) feel reporting this incident to police would be a waste of time.

I also feel that even if the matter is never reported there is some benefit in creating and sustaining the illusion that such matters are reported and prosecuted. It might make others think twice about imitating Wate. CPDN's behavior so far tells imitators there won't be any real punishment so go ahead and give it a shot. Sorry, a million of us good citizens can stand here and scream wanker, tosser and luzer at them all day long but that won't deter them even half as much as the thought they might spend a year in jail. Please, don't adopt the pessimist's attitude on this and point out all the reasons why it might not work and then assume the reasons to be true. We must relentlessly employ every means at our disposal to stop crime. Criminals rely on apathy and fear. Give them no quarter, no advantage. Beat them wickedly and mercilessly any way you can and each and every time you can.


____________

Profile Derek
Avatar

Joined: Apr 21 06
Posts: 3
ID: 391483
Credit: 74,844
RAC: 0
Message 27002 - Posted 22 Feb 2007 19:15:56 UTC
Last modified: 22 Feb 2007 19:17:39 UTC

Hi All,
Scott Brown wrote,-
"On another note, for grant funded projects, I hope that staff are reporting this incident to their Principal Investigators. In many cases, grant funding organizations (especially government agencies) require the reporting of such illegal activities to at least the funding agency if not to the appropriate law enforcement organizations, regardless of whether or not the project itself is at fault or if prosecution will be pursued."
End of quote.

Any answer to this, does there not have to be an answer...
As Dagorath says,
"CPDN's behavior so far tells imitators there won't be any real punishment so go ahead and give it a shot."
He continues,
"earlier indications that CPDN (or at least its moderators) feel reporting this incident to police would be a waste of time."
End of quote.


No, it would not.
I like many here, and those recently from the BBC "creche" as well, do not have that much computer knowledge. Or time to learn enough, quickly enough, to be sure I can not fall for, or be damaged by (my computer that is) "people" like this one.
We would appreciate some action against this "person", if for no other reasons than,
1) To discourage other future "Wates".
2) Reassure us of the project's support and defence of it's crunchers..
(I believe you have stopped many previous attempts, at various types of attack,
but this one "got through", so it is different.)




____________
M/cycle + Highlands = Bliss

click year box to go to Scotland CPDN

Profile Rory
Avatar

Joined: Feb 16 06
Posts: 23
ID: 269055
Credit: 1,322,944
RAC: 2,294
Message 27015 - Posted 23 Feb 2007 1:11:25 UTC

I must of stumbled on to an adult thread, it must be so that no minors have access to obscene language? As I understand myself coming over here there are a few minors transferring to BOINC. Gentlemen, time to hold back the tirade, and use a few **** please.
____________
Rory
Leave a planet to those following!

Profile Milo Thurston
Forum moderator
Project administrator
Project developer

Joined: Mar 2 06
Posts: 68
ID: 170423
Credit: 219,334
RAC: 132
Message 27022 - Posted 23 Feb 2007 11:20:32 UTC - in response to Message ID 26977.

I am quite sure that Carl, Milo and Tolu will be watching this thread. If we don't have a post from one of them to show that they are, one of us will point out to them what you've said.


We've already passed the information up the line, but I am not sure what will happen. If anything does, I will mention it.

Profile Steve Cressman

Joined: Sep 2 04
Posts: 2
ID: 8702
Credit: 14,688
RAC: 0
Message 27044 - Posted 23 Feb 2007 23:16:00 UTC

Wate belongs in and everthing that can be done to put him there should be done. After all a crime has been committed.

Steve
____________

Profile Miko
Avatar

Joined: Oct 16 04
Posts: 3
ID: 25096
Credit: 11,512
RAC: 0
Message 27056 - Posted 24 Feb 2007 12:42:54 UTC

i think the people with an unwanted BOINC on their computer have to call the police to punish Wate by law. (If they live in the same country as Wate!)

There is no damage, maybe a damaged good name, in the BOINC community and the projects.

Another thing is Wate's person as a cruncher...
I don't want to have him in my team, my favorite projects or in the whole community...
But he have just to create a new account and the same person is crunching again!
I see no way to keep him devinitivly out...
How to be fair to the next new teammenber without lots of credits?
...it could be Wate with another name!
I talk mutch more as it is for real, but i wish the person Wate to be marked as unserious!
____________
http://www.altes-beckhaus.com - my home & Job
http://www.crunching-family.at - my team
http://www.altes-beckhaus.com/wiki/ - "my" wiki
http://www.ff-haegerau.at - my "hobby"

Profile Iain Inglis
Forum moderator

Joined: Jan 9 07
Posts: 431
ID: 218132
Credit: 3,635,976
RAC: 3,976
Message 27063 - Posted 24 Feb 2007 22:08:12 UTC

I once sat as a member of a jury on a fraud case in which a man had used a car as a guarantee for a loan: he failed to repay the loan at which point the guarantee was called up - only for the lender to find that the car was leased. The man was charged with theft, the definition of which appeared to be "the use of property not his own as if it had been his own". Since it was a criminal, not civil, offence the decision to prosecute did not need the sponsorship of the damaged party, the Crown Prosecution Service made the decision themselves.

It seems to me that on this basis Wate might be guilty of a criminal offence: it is evident that he did use property "not his own, as if it were his own"; moreover the rightful owners will have been harmed by his use of their computers, since a computer running a CPDN model uses more power (an additional 30-50 Watts), not to mention the potentially serious consequences of a laptop fire.

If he's a Brit, call in "Yates of the Yard", I say ...

Dagorath

Joined: Mar 3 06
Posts: 85
ID: 170894
Credit: 202,314
RAC: 0
Message 27066 - Posted 24 Feb 2007 23:43:11 UTC - in response to Message ID 27063.
Last modified: 24 Feb 2007 23:45:26 UTC

It seems to me that on this basis Wate might be guilty of a criminal offence: it is evident that he did use property "not his own, as if it were his own"


That argument would stick here in Canada too. And, as in the U.K., there would not need to be a complaint from the victim(s). The Crown Prosecutor can proceed at his/her sole discretion and even without a complaint from the victim. Our law is that way so that crimes can be prosecuted even when the victim has been coerced by the offender into not filing a complaint. I will even go so far as to say I think victims can be charged with contempt of court, in Canada, if they refuse to testify though I doubt the Crown would exercise that right unless the case were extreme.

The question in this matter is not who carries responsibility for initiating proceedings in criminal court. The question is... Should civilians take the matter into their own hands before informing the police? Should civilians assume the police will not be able to pursue the matter due to lack of evidence?

I say matters as grave as the Wate case definitely need to be reported to the police immediately. All civilian parties should refrain from any action that might warn the perpetrator he has been discovered unless there is an immediate threat to someone's life. Indeed, there may have been very few clues to Wate's identity but now that he has been warned there are likely even fewer clues. Now he has probably covered the few tracks he left behind and made any investigation even less likely to succeed.

Another point to consider is that Wate may be involved in other cyber crimes and just 1 single clue gleaned from this offence might correlate with clues he has left in other crimes. That correlation might have led to an arrest. CPDN and the victim have all but destroyed that glimmer of hope. What did CPDN's kneejerk reaction gain? Nothing except the deleting of some cheated credits that were of little importance relative to the damage Wate may be causing to the victims. That action could easily have been postponed and the police contacted first. It really makes me wonder if we are not all just a little too concerned over credits at the expense of ignoring other important concerns.

There is 1 steadfast rule that we can never forget... do not take the law into your own hands, report offences to the police and let them do their job unhindered by our kneejerk reactions and emotional responses. Assume nothing about police powers and abilities, just calmly and quietly report the crime.

If he's a Brit, call in "Yates of the Yard", I say ...


Sadly, due to CPDN's bungling of the affair, there is now little chance that we will ever know who Wate is.


____________

Profile Carl
Forum moderator
Project administrator
Project developer
Avatar

Joined: Aug 5 04
Posts: 906
ID: 1
Credit: 299,864
RAC: 0
Message 27087 - Posted 26 Feb 2007 11:09:47 UTC - in response to Message ID 27066.

Are we supposed to "police the world" when people run unknown software from the Internet? There isn't much we can do other than turn off the account(s) in question. There were 6 other projects involved, do you similarly slam them for not calling Scotland Yard, the CIA, and the FBI?

Dagorath

Joined: Mar 3 06
Posts: 85
ID: 170894
Credit: 202,314
RAC: 0
Message 27091 - Posted 26 Feb 2007 17:09:48 UTC - in response to Message ID 27087.
Last modified: 26 Feb 2007 17:14:59 UTC

Are we supposed to "police the world" when people run unknown software from the Internet?


Suggesting you can "police the world" would be a ridiculous suggestion and that is probably why nobody here has suggested you should attempt to do that.

There isn't much we can do other than turn off the account(s) in question.


Actually, there was one other thing you (or whoever made the decision at CPDN) could have done... you could have picked up the telephone, called the police, filed a statement and consulted with them as to what the best possible course of action would have been. They might have told you there is nothing they can do or they might have told you they will investigate and that you should do nothing that might Wate until further notice. I know how hard it is to have faith in the police. Sometimes they aappear to be the laziest of all civil servants (snivel servants if you prefer) but sometimes they do some amazing work. You could have given them a chance. It would have cost you very little and may have led to an arrest. It was a gamble but you had nothing to lose and everything to gain.

Indeed there was little chance that an investigation would produce any result but it was not your place to assume there was absolutely zero chance. That decision should have been left up to the police because they, not you, are the experts in that field. It is them, not you, who should decide if they have time and manpower to investigate. Clearly, CPDN made assumptions they should not have made.

There were 6 other projects involved, do you similarly slam them for not calling Scotland Yard, the CIA, and the FBI?


A call to local constables would have sufficed. It would have relieved you of any further responsibility as the constables would have been responsible for contacting the Yard, CIA or FBI had they deemed it necessary. The moral of the syory is... know where you responsibility begins and where it ends. Act within those bounds and you will rarely be scolded.

Regarding other projects, since CPDN had already alerted Wate, I see no reason to fault other projects. By the time other projects were aware, CPDN had already destroyed any chance of an investigation succeeding. Certainly, the victim is also at fault for not informing the police first but at least he did not alert Wate. CPDN alerted Wate, CPDN killed any chance of an investigation succeeding. After what CPDN did, what the other projects did was inconsequential, the damage had already been done. Therefore I see no reason to slam other projects. I would however, address my remarks to the victim. I hope s/he is listening.

This is not the end of the world. There was no loss of life, nobody lost a job or any staggering amounts of money. Computers slowed down, some CPUs may have fried, there was risk of lappys catching fire but we have no indication any did. In the grand scheme the damage appears to relatively minor.

Nobody is calling for anybody's resignation. I see no need for disciplinary action or even official written reprimands. The scolding in this forum is sufficient. I appreciate how, in the heat of the moment, CPDN could make the mistakes they made. I cannot guarantee I would have done any better. My only wish is that CPDN will re-consider the events and their actions and resolve to do better next time, if there is a next time. That's all I want.

Let's allow the matter to die. Or let's continue discussing it if you feel a dicussion could be of some benefit. I guarantee it will be of no benefit to CPDN if CPDN chooses to continue and adhere to the indefensible position it could not have handled the situation better.


____________

Ken Vogt
Avatar

Joined: Aug 19 05
Posts: 8
ID: 93405
Credit: 265,943
RAC: 0
Message 27460 - Posted 23 Mar 2007 12:51:45 UTC
Last modified: 23 Mar 2007 12:55:08 UTC

Amazingly, alone among projects, predictor at home is still accepting results from Wate, with a RAC of over 1000.

Indeed, Dotsch posted at BOINCstats, that the admin there has refused to close the account, and has in fact locked threads suggesting that he should delete Wate. Including the thread containing the repost of mo.v's original notice.

This is the admin's post referred to by Dotsch:

This thread is closed. Please do not create a new one.

Since this thread was first created I have deleted two other threads incorrectly accusing volunteers of cheating.

If someone has installed the boinc client on machines that they do not have permission to that is wrong. I have no way of knowing if this has or hasn't happened. Just because "some guy" posted something on the internet is not good enough reason to take any action against anyone.

dlb


____________
David Lee Braun
Predictor@Home
Manager of Computational Facilities
for Dr Charles L. Brooks, III
Department of Molecular Biology, TPC6
The Scripps Research Institute
La Jolla, CA 92037
(858) 784-7427
dbraun@scripps.edu


I find this incredible, to say the least. It is true that the reposters of mo.v's authoritative and excellent exposition (and expose) of Wate's perfidy did not credit her as the author, but anyone reading that post, including the copy posted at predictor, could clearly see that it was not from "some guy." Let alone if they had read any of the linked material at any of the projects.

As Dorsch mentioned, there is a thread, as yet unlocked, responding to the admin's decision not to ban this despicable person. Hopefully, Mo or someone from here can inform the folks at P@H that this is a serious matter, handled responsibly in the first instance by the BOINC devs and CPDN staff, and thenceforth by every other project except his.
____________
Ken

Profile MikeMarsUK
Forum moderator
Avatar

Joined: Jan 13 06
Posts: 1356
ID: 149116
Credit: 2,495,923
RAC: 1,967
Message 27463 - Posted 23 Mar 2007 14:51:09 UTC


If someone has access to the boinc_projects mailing list, this would be where a note should be posted (rather than on the predictor forums), since the other project adminstrators will be able to lend support.
____________

I'm a volunteer and my views are my own.
News, Announcements and README posts

Profile [b@h] tomcat

Joined: Nov 28 05
Posts: 16
ID: 120941
Credit: 1,239,673
RAC: 266
Message 27469 - Posted 23 Mar 2007 22:39:06 UTC - in response to Message ID 27463.
Last modified: 23 Mar 2007 22:39:44 UTC

to post at the boards of predictor isn't possible because all threads about this topic are closed and cleared short time after created
furthermore all people posting to this or even reposting link to the closed thread are banned so that they can't post
(like many other people and me:

You may not post or rate messages until Jan 19, 2038
)

Now they blocked whole ip ranges to prevent people from complaining


____________

Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 27472 - Posted 24 Mar 2007 1:13:03 UTC
Last modified: 24 Mar 2007 1:42:53 UTC

I have an email about the Predictor problem from Jorden who's much more in contact with the admins and mods of other boinc projects and also the boinc people in Berkeley than most of us here.

The only thing I would now correct in my original announcement about the W*** problem is what the two Italian members of the Boinc Italy team who posted on the boinc_dev forum have now told us. They said the Italian guy with the trojan who went to them for help thinks the trojan was probably downloaded in a file from a peer-to-peer site. (Maybe music, maybe a film clip?)

The Predictor people have had plenty of time to investigate the situation re W***. The Italian team members have come out and explained what happened, the announcement has been kindly reposted everywhere without AFAIK anyone refuting any statement, the boinc guys in Berkeley appear everywhere under their real names and have their email addresses openly available, Rom Walton's blog page contains a link to a German online press article about W*** which shows that the boinc people take the problem seriously, and the project admins who've taken action aren't exactly incommunicado. My own contact details are easily available to Predictor and everybody else through my sig.

I notice that David Lee Braun's Predictor email address is contained in Ken's post up above, so when I've looked at all the links I'll write to him, probably some time on Saturday. As I may be the person he refers to as 'some guy', I'll be including my real name Maureen Vilar, address, phone number and links to this thread and the one on the boinc_dev forum which are probably the most informative.
____________
Cpdn news
5 CPDN READMEs

Profile Cori
Avatar

Joined: Feb 1 05
Posts: 4
ID: 50720
Credit: 81,766
RAC: 27
Message 27477 - Posted 24 Mar 2007 11:31:09 UTC - in response to Message ID 27472.

... so when I've looked at all the links I'll write to him, probably some time on Saturday. As I may be the person he refers to as 'some guy', I'll be including my real name Maureen Vilar, address, phone number and links to this thread and the one on the boinc_dev forum which are probably the most informative.

Thanks a lot for helping. :-)

Btw: I'm one of those users who were banned at Predictor when asking about the "W***" issue and later on when asking there why censorship was happening. ;-)
____________
Greetings from Cori

Profile Kokomiko
Avatar

Joined: Jun 29 06
Posts: 4
ID: 191612
Credit: 1,518,308
RAC: 1,649
Message 27478 - Posted 24 Mar 2007 11:42:57 UTC

Good morning.

I have not used the Name Wate in my postings on P@H, I've only pilloried the censorship of postings. But I have written a mail to his boss with links to all the threads with the thinking about the censorship on the scripps research institute. Also I've forwarded all systemmails from the forum to my mailaddress with the censored post, included the information why and that I'm censored. The statement line contained only: "None"

Here is one of the mails:

Predictor@Home notification:

This email is sent to inform you that one of your threads in the forum has been affected by moderation in Predictor@Home:
Thread: What the hell is here going on?
Link: /forum_thread.php?id=2545

The moderator gave this explanation to why your thread was moderated:
None Given

For further information and assistance with Predictor@Home go to
____________

Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 27479 - Posted 24 Mar 2007 11:42:58 UTC
Last modified: 24 Mar 2007 12:00:57 UTC

Everybody including refugees is more than welcome to post and discuss here, and also on the cpdn php forum (link in my sig) where you don't even need to be a cpdn or boinc project cruncher to register. If you register there, please keep the same username so we recognise each other.

After looking at W's Predictor page again

http://predictor.scripps.edu/show_user.php?userid=75192

Although W had belonged to 3 boinc projects (uFluids, Einstein and BURP) earlier and apparently legitimately, he attached to cpdn, Rosetta, Predictor and SIMAP all on the same day, 1 June 2006. I'd guess that all the new project attachments were in preparation for the release of the trojan, probably a day later.

One of the cpdn mods has suggested that if Predictor and the Scripps Institute have such faith in W***, they are welcome to run all their research projects using his computers........
____________
Cpdn news
5 CPDN READMEs

Profile Cori
Avatar

Joined: Feb 1 05
Posts: 4
ID: 50720
Credit: 81,766
RAC: 27
Message 27480 - Posted 24 Mar 2007 12:48:19 UTC - in response to Message ID 27479.

...One of the cpdn mods has suggested that if Predictor and the Scripps Institute have such faith in W***, they are welcome to run all their research projects using his computers........

*LOL* Would be a perfect solution... they deserve each other [sarcasm mode!! ;-)] and no mesage boards would be needed anymore as well.
____________
Greetings from Cori

Richard Haselgrove

Joined: Jan 1 07
Posts: 115
ID: 216408
Credit: 2,905,763
RAC: 3,897
Message 27481 - Posted 24 Mar 2007 14:03:25 UTC - in response to Message ID 27479.

Although W had belonged to 3 boinc projects (uFluids, Einstein and BURP) earlier and apparently legitimately, he attached to cpdn, Rosetta, Predictor and SIMAP all on the same day, 1 June 2006.....

Proofreader's note: the uFluids join date {29 Aug 2006} is later than his busy sign-up day.

Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 27482 - Posted 24 Mar 2007 14:40:04 UTC

Oops, thanks for pointing that out.
____________
Cpdn news
5 CPDN READMEs

Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 27484 - Posted 24 Mar 2007 17:46:11 UTC

My email to Mr Braun sent and very politely acknowledged by him.
____________
Cpdn news
5 CPDN READMEs

Profile Cori
Avatar

Joined: Feb 1 05
Posts: 4
ID: 50720
Credit: 81,766
RAC: 27
Message 27488 - Posted 24 Mar 2007 21:34:06 UTC - in response to Message ID 27484.

My email to Mr Braun sent and very politely acknowledged by him.

Thank you again. :-)
____________
Greetings from Cori

Profile Rory
Avatar

Joined: Feb 16 06
Posts: 23
ID: 269055
Credit: 1,322,944
RAC: 2,294
Message 27491 - Posted 25 Mar 2007 1:15:57 UTC

I have never seen such anger, free speech is a right to all, and if for no good reason withheld, the anger is clear.

Censorship is the last resort ( if comments are within the law of the land and decency, no arguments can stand against the poster, only the admin.), if used in haste it only compounds the problems for all, namely the fool that tried it, to calm a situation.

It is clear from all the links and having read a bit of the forum mentioned as to get an idea, simple just don't crunch for it and delete it from your portfolio (before doing so, read on a bit).

Post any were you can get a clear and uncensored opinion out, to reasonable crunchers, and then if all else fails, a full bodied campaign against joining the forum! Just one point if the project is good for all in your opinion continue to crunch for the betterment of all, if not in you're opinion, as above leave it and never darken your time with them again.
____________
Rory
Leave a planet to those following!

Profile MikeMarsUK
Forum moderator
Avatar

Joined: Jan 13 06
Posts: 1356
ID: 149116
Credit: 2,495,923
RAC: 1,967
Message 27495 - Posted 25 Mar 2007 9:57:45 UTC

Mr. Braun has responded:

http://predictor.scripps.edu/forum_thread.php?id=2546&nowrap=true#13868

"David Lee Braun" wrote:
Message 13868 - Posted 25 Mar 2007 0:16:22 UTC

I've locked this thread to keep this message at the top.

The Trojan issue: I have never said anywhere that I was not going to do anything about the Trojan user. What I said was that I was not going to do anything just because there was a post on the web. I don't visit any other projects forums and I don't know anybody at the other projects. There is a mailing list for projects that as far as I know all projects are subscribed to. There has been no mention of this until last night there. I believe it is inappropriate to post the name of a suspected cheater on the forums and this has brought out all sorts of childish behavior and accusations. If I had noticed something suspicious I would have either mailed the BOINC folks directly or sent mail asking other projects to check to see if the problem exists on there sites. If I posted something in the forums I would have not given a user name and just a description of the issue so that users are aware. After the thread appeared in our forums two other threads were created accusing people of cheating. I deleted those threads because the accusations were just plain wrong and I locked the Trojan thread asking the users not to create a new one.

I really don't think that this is any of your business, but that night I sent mail to the user in question asking for a response. Last night a lady, who I do not know sent me mail from claiming to be from CDPN. The return address was a hotmail account. I believe this person was who she said she was, but it did remind me of the weekly mail I get from ebay asking me to update the account I've never created. This illustrates the point that seems to be universally missed here. The web can give credibility to ANYBODY. A post and discussion on the projects mailing list by project administrators would give credibility to this issue. A forum post has no credibility. If you disagree with this you should look at some of the thing you say in the forums. I read them all.

I will not delete someones account just because an angry mob instructs me to.

Freedom of Speech issue: I think that schools have really failed here. Freedom of speech does not mean that you can say anything anywhere you want. It means that I can criticize the government, which I do often, and there is nothing that they can do about it. It does not mean that you can walk into my house to express your opinion, you can't use my phone, computer, wireless, or the P@H server without permission. That permission can be revoked at any time. If you invite me to your home and discover that I like to talk about the KKK, which most people might find offensive, you can ask me to leave. If I refuse to leave you can call the police and have me arrested. There is no freedom of speech issue here. When you are on someone's property and you are ask to leave you have to leave.

I did not think the Trojan thread was appropriate and it appeared to be spawning other similar discussions. I locked the thread. If the user community had any respect at all that would have been the end of it. You would have been free to take the discussion to one of the many other forums. There is no freedom of speech issue here.

Several users decided that they were going to ignore my request and reopened the thread. Again, it's not your server. It's mine. Just as a property manager or security guard can ask you to leave a shopping mall I can ask you to leave our server. I used the boinc 'banish' function which suspends the users ability to create threads for a week or so. Had these users just gone elsewhere that would have been the end of it. Instead they created new accounts and more threads, which I started blocking and deleting. At this point their behavior, does not matter if you agree with my deleting the posts or not, is criminal. The banish message states that you are not able to post until such and such date. This is like returning to the shopping mall after a guard has told you to leave. You have no right to return. One user boasted that he could change his ip address after I blocked it. His posts made it clear that he understood that he had been banished and was doing everything he could to get around it. This is criminal behavior. A number of you have stated that we are endorsing criminal behavior by not deleting the trojan users account. Then you behave like this. I think most adults would have simply left. An adult may have disagreed, and contacted my by email..which is at the bottom of all my posts along with my address and phone number. Thats not what the people here did.

If I go to your home and you ask me to leave I'm gone. I have no idea what you are thinking. Looking at this thread it looks as if the average P@H forum user is a 12 year old. One lady ask me in a post to delete her account, so I did. Then she sent me mail calling me an asshole and declared war. Our freinds who repeatedly created new accounts sent me mail explaining that they were going to create threads everywhere, which they did. Look at what people have written in this thread. Who are you people? What is wrong with you?

I was unsatisfied with my mechanic. I stopped going to him. I didn't harass him. I didn't threaten him. I didn't like the work he did so I found someone else. I didn't put a billboard up outside his shop calling him names. There are some sick people here.

This all started because I know how people act in the forums and I wanted to put out a fire before it got out of hand. I've been with predictor for a while now and I know how people can be in the forums but I had no idea that people have this much free time and so little maturity.

I got a mail from a team captain in Germany threatening to boycott the site if we continue to endorse criminal activity. It's ironic that one of his people is on the list of people who created multiple accounts to get around being banished. If this is how your people act then don't threaten, I demand that you disconnect for predictor.

The bottom line is this. If you do not like P@H go somewhere else. Please. There are a large number of projects to choose from and if you look hard enough I'm sure that you will find one you like.

And finally: To respond to all the personal attacks I see this mess as a reflection on the character of the eight or so users who's tantrum started all this. You were told you couldn't do something so you through a fit.

dlb

____________
David Lee Braun
Predictor@Home
Manager of Computational Facilities
for Dr Charles L. Brooks, III
Department of Molecular Biology, TPC6
The Scripps Research Institute
La Jolla, CA 92037
(858) 784-7427
dbraun@scripps.edu



____________

I'm a volunteer and my views are my own.
News, Announcements and README posts

Ageless
Avatar

Joined: Aug 5 04
Posts: 222
ID: 69
Credit: 37,375
RAC: 0
Message 27501 - Posted 25 Mar 2007 12:30:20 UTC

Wate's account has been blocked on PAH. All David has for a problem now is how to easily zero the credits without breaking the database. I've asked him to email Carl on that, as he knows what not to do. ;-)
____________
Jord.

BOINC FAQ Service

Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 27513 - Posted 26 Mar 2007 1:25:27 UTC
Last modified: 26 Mar 2007 1:54:17 UTC

Ageless/Jorden's post above shows that David Braun at Predictor now knows about W*** and is taking steps to put the situation right. I have received emails from Mr Braun and can confirm that this is the case. He is reluctant to zero W***'s credits by going into the database, which I can understand. The Predictor forum now needs time to get back to normal.

If you have been banned from PAH, please be patient in the hope that a satisfactory solution can be found.

I have reluctantly deleted two posts, by George Rothfuss and Misfit, sending them emails to explain my decision.

This thread is for discussion of W*** and the trojan. It should not be used for unreasoned criticism of a fellow boinc project or of that project's administrator while steps are being taken there to put things right. I would accept that reasoned discussion of the steps being taken is legitimate. Such discussion would, however, really be more appropriate on the Predictor forum where Mr Braun will read it. So if you can post on Predictor, that is where you should post about Predictor.

Many threads on this topic on other forums have been removed or locked. Please post positively, in spite of the difficult circumstances, to enable us to keep this thread open.
____________
Cpdn news
5 CPDN READMEs

Profile mo.v
Forum moderator
Avatar

Joined: Sep 29 04
Posts: 1587
ID: 21936
Credit: 1,139,729
RAC: 1,779
Message 27550 - Posted 27 Mar 2007 14:29:39 UTC

I have moved a post by Dagorath to the thread about Predictor in the Cafe. Dagorath has been informed of my reasons by email.
____________
Cpdn news
5 CPDN READMEs

Message boards : Number crunching : Trojan boinc installation by rogue member




Copyright © 2002-2009 climateprediction.net