The Phantom Flusher stats thread.

[amok]

Its not a trojan. Trojans grow almost exponentially, and this guys rate has been somewhat levelling out (it grows, but slowly, as if he/she has started sneakernetting machines). Hehe, you can't stop a trojan once its launched, so there would be no way to throttle back the block output. Its somebody with access to a very large herd that is either doing this with or without permission from the company that owns the computers. I think d.net should track him/her down just to make sure that the blocks are legit. Afterall, it would lame of us to accept blocks that are illegal so to speak. If they are legit, and the person just wants to remain anonymous, then d.net should allow them to, but they should at least try to find out.

 

[BoberFett]

amok

It could still be a trojan, but I hope not. I was thinking about how I'd do something like this (not that I'd do anything of the sort ) but a trojan could be centrally controlled. In order for the trojan to spread and also for the client to submit cracked blocks, the victim undoubtedly has to be connected to the internet somehow. It's not much of a stretch to figure out how to write the payload to check back in with a central server. It could run a perl script on a remote server which would respond with the e-mail address of the lucky individual to be given blocks. It could also be set up to only check back periodically, maybe a max of once per day. This would allow the author to throttle the blocks. The perl script could have access to a database which would track the number of clients any given e-mail address had assigned to it and bump them up or down as the trojan author saw fit. This setup could also even shut off all production within a few days as all the victims connect to the internet periodically.

This is not an easy thing to set up, but not as difficult as it may sound.

 

[Fandu]

One idea that I haven't seen tabled is that someone is remotly installing the client on machines. Like instead of releasing a trojan into the wild, using known exploits in *NIX and Winblows to install a client. In this manner, you can control how many computers run the client and therefore the block output. Ideas?

 

[BoberFett]

Fandu

Such as installing Back Orifice via a trojan. I'm wondering why we haven't heard anything from D.net on this. It seems as though they're not really concerned about it.

 

[Simulacrum]

I wonder how many people receive blocks from PhF and just don't realize it. Does the PhF always flush a lot, or on some account only flush lightly? Also, is he only flushing to big team members like TA and DPC, or others as well?

I've been participating in RC5 for several years, am not a member of a large team (but am a member of a small team) and haven't seen a single extra blocks. I'v lost some, but never gained any. Since everyone else is doing it, simulacrum@yahoo.com

 

[Wolfie]

I have looked many of times at Dnet and I have not recieved any blocks from the PhF. I wouldn't care if I got some. I will get it if I get it. I will not ask. It's still sounds kinda strange for someone to be getting that kinda key rate.

Just my 2¢
Wolf

 

[Dantoo]

Hmmm. Michael seems to be the odd one out and that may be a clue. The others on TA that received blocks without asking, were in the initial distribution and all well known "Good Ole Boys" around here.

No disrespect meant Michael, are you a good ole boy? Have you posted around here for a good while? If not, the PhF may have chosen you for a reason, friend perhaps?

More generally, Hey Guys!! Is it really a good idea to be lining up for goodies that you don't know the origin of?

Virge, have you actually heard anything back at all from Dnet on the subject or are they that unconcerned? It does seem out of character for them not to respond at all. All they would have to do is jump in and post "No worries, this thing is cool", of course that would take away all the fun we've been having.

 

[Engine]

It's not entirely unheard of for someone to have that kind of rate, though.. even someone on our team. If I remember correctly, dmcowen was getting close to putting out 100k/day at his peak.. and that was on computers running 8 hours a day. If those computers were left on at night, that'd be fairly close to the numbers that the phantom flusher has been putting out.

I don't think we can really rule out the whole trojan thing, though. It'd certainly be possible for someone to run this with a Backorifice/Netbus type of prog. All the person would have to do is replace the ini file on the infected computers.

 

[Michael]

I've been doing RC5 (and SETI) for less than a month. I don't know if I'm a "good old boy", you would have to ask them.

I have posted some help and suggestions plus asked for help on a few threads. My email in my profile's the same as my email for RC5, maybe that's a link.

I thought it was strange that I started receiving blocks. They're nice, though <grin>.

Michael

 

[Mill]

Yes the PhF is a nice man or woman.

 

[Beefcake]

Does the keyrate stay stable at weekends? which would suggest home machines with a trojan, or does it drop which would suggest a company with business machines that get switched off at weekends.

???

 

[PeterN]

How about a herd of Mac G4's?
They have a high RC5 keyrate. IF they can be overclocked, an output of ~300k is possible. You'll need ~250 G4's @ 500 Mhz. I can imaging a large company that deals with graphics have that much!

If so, think of the irony of us overtaking the MAC-team!

 

[DutchJake]

I am not sure, since a dozen people flush to my account, but I scored above average yesterday... (I asked for on sunday)
If it is the Phantom Flusher: Thanx!!
(if not: oh well life goes on)

 

[ItsmeDPC]

Well I've seen the stats for today, you've done over 1,56M WU's.
Beore the PolterCow (Ph F) started flushing you did about 900k-1M WU's a day. This would meen the poltercow does about 500k blocks...

500k is about 1064 P3-550's 24/7!
My thoughts are going more and more towards a (very &quot;intelligent&quot trojan.

If been doing some calculations. The Ph F. started on (about) the 6th, taking a &quot;victems&quot; on an irregular basis. Sometimes 2 a day sometimes none.
As there are now (I believe) 21 or 22 &quot;victems&quot;, the Ph F is flushing about 483k/506k each day. Today is the 27th. So he has taken a victem each day. Increasing the flushes with about 23k of blocks each day. (Which is about 49 P3-550's!)
I think a growthrate of 23k-a-day is very large, maybe not as large as with a _regular_ trojan, but still... I know just 2 or 3 people with access to such computing power. (One works at AMD as an IT-specilist, the other is his boss and the other one has about 1200P3-700's to take care of.)

Only &quot;bad&quot; thing is, that now the Ph F/Poltercow is flushing, their is no rivalry. You guys get to much blocks for usa to keep up to. We simply can't assimilate this fast. And well ehm it isn't nice for you guys either because the internal rivalry in the team is going haywire. Ask viztech, his race is over and done with...

But hey wth, we'll just have to go assimilate and try to get you guys back!

(Update: It used to be: &quot;A million a day keeps the DPC's at bay.&quot;It seems about 700k should do the job right now )
(Update 2: We must assimilate.... Resist the poltercow..... Go and get more power... power...)

 

[bkehoe]

I've been following this thread, and I would be considering a smart trojan too which gets its email address every day from a central server.

I don't beleive anyone at Sysopt has got any strange blocks. The only 'strange' thing was MTP getting 800 blocks on the proxy when he thought he was cracking for Scotts birthday present of blocks, but maybe he wasn't.

Since he seems to give to anyone else that asks, DPC/Anandtech, does he donate to Sysopt? If so, then bkehoe@esatclear.ie

Brendan

 

[MrCyber]

I wonder if there is already any news from d.net on this matter ?

 

[CrazyHarry]

I was thinking...
does he read this forum?

and what does he thinks when he is reading it?
is he laughing at us or for us?
make me laugh too: e.bell@chello.nl

Will he ever answer our questions?

 

[MDingo]

PhF, how about some blocks for marends@bigfoot.com

 

[Dijkhuis]

I could use some help too.

B.Dijkman@sepa.tudelft.nl

 

[bonehead]

Let's see if he reads this forum. I do approx. 1500 blocks a day how bout so more PhF. shenders@starpower.net.

 

[MrCyber]

Ok.. well then.. PhF.. help me into the 100k please

frankwin@frankwin.com

 

[skiff]

My best guess is that the PhF has control over an enormous herd of computers, which are all being reinstalled by a Ghost copy. The PhF included the RC5 client in the image, and is gradually spreading the image over the network. Not too many at a time, as that causes the network to overload.

If this is true, I have three questions:
1) Why doesn't he use his own E-mail?
I might be able to answer that: He/She could be affraid that cracking too many blocks would lead to disqualification, like happened to the Rabbit (although he used a trojan).

2) How does he change the E-mail address so often. I have about 20 computers running, but I wouldn't know how to change then, let alone such a massive herd.
Speculative answer: could quite easily be done with a logon script. Someone logs onto a computer, the script retrieves a new ini file, and there it goes again. Using more than one E-mail address can be accomplished by putting another ini file on every server (I presume such a herd does run on several servers, and for every server the clients only look on that specific server)

3) Why doesn't d.net track him/her down. That could quite easily be done. As the blocks must come from somewhere. If they come from one IP, or a small amount of IP's, than that server could be traced. I presume such a large herd does have a fixed connection to the internet, with a fixed IP address. If, however, the blocks come from about anywhere, it might be the work from a smartly programmed trojan. But than again, the trojan would not be smart enough. If the trojan flushed on a perproxy, and the perproxy flushes to d.net, then you seem to have the same situation as using a large company's herd.
Speculative answer to question 3: d.net has tracked him down, asked for his intentions, and the PhF politely asked not to publicise his information. another possibility is that d.net is still working on it.

Anyway, lots of speculation, and I might be totally wrong in the end.

If the PhF needs another E-mail address to fill up some nodes: skiff@xs4all.nl. That might also be able to close in on team AT again.

Herman
www.waterkoeling.nl
Dutch Power Cow member.

 

[Mill]

Yes, since I am just starting out.

evanhyde@home.com

 

[Michael]

Now I'm up to 5,000 blocks from PhF.

Michael

 

[downhiller80]

OK today I got 29,500 gratis!!! I love this guy\gal.

I'm also amazed that he doesn't want the stats for himself since he'd wipe the board with all of these blocks.

Anyone notice the Tortoise hasn't turned anything in for a few days?

Seb