[RC5] RE: Do not forget about the cheaters :)

Floppus Floppus at Chello.nl
Thu Jan 8 14:19:13 EST 2004


I have been searching for evidence of cheating a lot a while ago.
I found al lot of (vary) suspicious outputs, but no solid evidence.

Comparison of members that have fairly large outputs of whom I know it's
crunched with normal clients with members of whom I don't know that and have
a similar output has learned the following:

Normal:
- some larger members have a stable output, and are publicly known to have
control over a large organization (like the #1 member, that controls
netcourier.com).
- some larger members have periods in which they slowly gain output, which
stabilizes, until the next period of growth. This is what i've seen
especially with the so called "subteams", where a lot of people flush as one
member. The advantage of these members, is that their personal statistics
would show irregular behaviour of subteam members. These periods of growth
can be explained because once in a while some people within the subteam get
a certain drive to promote running a DC client to their members and to
others.

Irregular:
- some larger members show very rapid growth. They start with a few hundred
WU's a day for a short while, and then boost into the 10K's. When they grow
after that it's not exceptionally if their daily output jumps with 5K a
time.Strangely enough, some of these memers choose a name that implies that
they are a subteam, while there can't be found any personal stats, no
website, and not even anything about their progress on the teampage or
forum.
- some larger members have participated for a long time, with rather stable
output, and then all of a sudden started to show behaviour as mentioned in
the previous example.

Another thing that bites me, is that irregular behviour of participants seem
to occur a lot within the same teams. What's even more stange, the team I
looked at in particular doesnt even have an active community, with at least
mention of their members and where these members can be found.

Example of a participant (subteam) of whom I am very certain no cheating is
going on:

Dnet page:
http://stats.distributed.net/participant/psummary.php?project_id=8&id=403148
forum: http://forum.dsmarty.com
google search on team name:
http://www.google.nl/search?q=teambvd&ie=UTF-8&oe=UTF-8&hl=nl&lr=
Main proxy: http://rc5.teambvd.com/byhost.html

#1 subteam member proxy: http://floppus.teambvd.com/stats/byhost.html
#2 subteam member proxy: http://hitman.teambvd.com/uwstats/byhost.html
#3 subteam member proxy: http://hitman.teambvd.com/ccstats/byhost.html

after that, some of the smaller members run proxies, but nothing
spectacular.
The same goes for every major participant (subteam) of DPC. The internal
competition within DPC has been there for a long time, and ensures that
people watch over eachother.
I am prepared to go and run around naked in Amsterdam if there would be ANY
major DPC member using hacked clients.

I am not going to publicly show my entire findings of some of the
participants and teams who I find to have irregular outputs,
but you can easily try and search for information like what I've shown here
for participants you suspect, and lets face it:
some are very obviously cheating. Looking at my research, I'd even say the
hacked client might be distributed teamwide, even to people not even knowing
they'd be cheating.

I know very well that Distributed.net has done and still does a lot of
research related to 100% safe DC, and that starting to protect clients might
invite hackers to begin a programmers/hackers battle, but as it is now,
people are starting to move away from distributed.net projects. That
especially sucks since that would leave me without my hobby representing DPC
in dnet projects ;)

I really hope a way will present itself to get satisfactory protection soon.

with regards,

Floppus
(Floris Dansen)
DPC representative for Distributed.net projects

----- Original Message ----- 
From: <groovyr at comcast.net>
To: <rc5 at lists.distributed.net>
Sent: Thursday, January 08, 2004 2:08 PM
Subject: [RC5] RE: Do not forget about the cheaters :)


> >Indeed, but there is an anti-cheating system in place which should allow,
by
> >means of some very simple statistics (merely looking at the data, or if
you
> >want to be scientific, apply the chi-square test), to detect these
cheaters
> >and invalidate their accounts.
>
>
> Yes but it is failing and failed when a few on the German team were
cheating
> back in September and is failing now for the polish team which has obvious
> cheating going on.   I even went to their forum and some team members
> questioned other team members on HOW THE HELL are they doing so many
> blocks and the replies were everything from wink wink to "offline machines
> doing a huge dump and it will be back to normal tomorrow" then of course
> the next day comes and STILL mega blocks being submitted.   It is so bad
you
> have polish team members lying to other team members.
>
>
> >
> >Unfortunately the system is far from fool-proof. Certain shortucts are
> >possible which allow short-circuiting the work done by more than half
(I'd
> >say ~70% of work can be evaded without allowing detection even by the
> >chi-square test).
>
> yup
>
>
> >
> >But cheaters don't even need to be that sophisticated: AFAIK, there's no
> >automated system to check for cheats, so unless some very blatant
cheating is
> >going on, it won't be noticed.
>
> well we noticed it because it is blatant on the polish team.  1/3 the
members
> of the dutch team doing double to triple the blocks daily is nonsense.
> We tracked some of the polish members and they went from a few hundred
units
> day to 30K a day in 1 huge jump.    Not just 1 member but within 2 weeks a
half dozen
> team members jumped like that. My guess it the hacked client was passed
around to
> a few buddies.
>
> 30K units would take like 300  3GHz P4's to crank that out a day AND doing
nothing else.
>
>
>
> >It needn't be that way. Some Stanford researchers published a paper at
the RSA
> >Conference 2001 (which, by the way, was already noticed by the guy who
> >released the hacked client back then). It's available at
> >
> >http://crypto.stanford.edu/~pgolle/papers/distr.pdf
> >
> >for anyone who cares about the gory details. For those who don't, in
short,
> >it's possible to detect cheaters with very high probability and minimal
> >overhead. And it's easy to implement too, particularly considering the
system
> >that is currently in place.
> >
>
> very interesting stuff but if each client marked the blocks at the client
level
> then any client doing 2000+ a day would be checked.  no CPU time
> used at all until then and you would know exactly were to narrow the
search
> and thus could actually do some blocks for real to make sure they are
> bogus blocks.
>
> Besides you need this to find a cheater on a sub team since you can not
> penalize the whole sub team.   Each client should me identifiable.
>
>
>
> _______________________________________________
> rc5 mailing list
> rc5 at lists.distributed.net
> http://lists.distributed.net/mailman/listinfo/rc5
>



More information about the rc5 mailing list