Return to Unfiction unforum
 a.r.g.b.b 
FAQ FAQ   Search Search 
 
Welcome!
New users, PLEASE read these forum guidelines. New posters, SEARCH before posting and read these rules before posting your killer new campaign. New players may also wish to peruse the ARG Player Tutorial.

All users must abide by the Terms of Service.
Website Restoration Project
This archiving project is a collaboration between Unfiction and Sean Stacey (SpaceBass), Brian Enigma (BrianEnigma), and Laura E. Hall (lehall) with
the Center for Immersive Arts.
Announcements
This is a static snapshot of the
Unfiction forums, as of
July 23, 2017.
This site is intended as an archive to chronicle the history of Alternate Reality Games.
  

The time now is Fri Nov 15, 2024 8:22 pm
All times are UTC - 4 (DST in action)		 View posts in this forum since last visit
View unanswered posts in this forum
Calendar
 Forum index » Archive » Archive: Ephemeral » ARG: Eldritch Errors
[update?] 5/08 posts on SO about huge bandwidth
Moderators: aliendial, celina63, konamouse, rose, thebruce
View previous topicView next topic
Page 1 of 3 [44 Posts]   Goto page: 1, 2, 3 Next
Author Message
roseModerator
...and then Magic happens


Joined: 26 Nov 2003
Posts: 4117

 		[update?] 5/08 posts on SO about huge bandwidth
from mkaos and themagician
I know not everyone is checking the Sentry Outpost forum. This exchange went on yesterday. I only posted the basic stuff starting from
this post

Mkaos to theMagician

Quote:
And, while you're around, can you do me a favor? I got the hosting bill. It's crazy and you're going to laugh. They're trying to say we went through over 9TB of bandwidth last month. I was just about to call them, but it'd be nice to be confident going in. Can you peek at the logs or whatever you'd peek at to let me know what I need to know? Thanks!


TheMagician
Quote:
And going through 9GB of bandwidth is not a huge issue really. We do that at times.

And careful with your techie speak. GB and TB are completely different.


Mkaos:
Quote:
Yes, I know. NINE TERABYTES. That's what they're trying to say, anyway. Could you poke around and let me know what we're really looking at? Please?


TheMagician:
Quote:
Well this is definitely weird. I have started to look at the server and while the hardware are not extremely tasked, we are definitely going through a lot of network traffic. I have set up a sniffer and will generate logs soon.

Perhaps that will give us an idea of what is going on. I also run a port scan but I couldn't see anything unusual through my bloodshot eyes.

So...yeah....ick! Ideas folks?
_________________

_________________
I love this site for being free, in every sense of the word~Spacebass

Mankind was my business, the common good was my business.~ Dickens

PostPosted: Wed May 09, 2007 9:00 am
 View user's profile Visit poster's website
 Back to top 
danteIL
Unfictologist


Joined: 08 May 2006
Posts: 1990

 		Summarizing
So theMagician and StuR did a little digging in their machines and they discovered some mysterious processes connected to specific ports on their sites (that's my gloss of the tech-speak). They identified the names of the code as screamer.c and boil.c

We discovered that you can use a browser to connect through the same ports and see what was going on:

http://www.sentryoutpost.com:1031/
http://www.ronomi.com:1031/
These seem to kick you back out with the message "Connection terminated."

http://www.sentryoutpost.com:1313/
http://www.ronomi.com:1313/
These seem to start some kind never-ending list of what maybe are connection attempts that look like:
Code:

Auth: 0, best 348
Unauth: 0 (0.00% intrusion)

Auth: 0, best 348
Unauth: 1 (100% intrusion)


Mostly the values are 0s, sometimes 1s and even more rarely I've seen 2s and 3s. Could that be the number of people trying to connect? In any event, it's different across different attempts..


http://www.sentryoutpost.com:5217/
http://www.ronomi.com:5217/
This is the most interesting. Connecting here dumps a file onto your computer. This is what the file looks like:
Code:
Yogh Sothoth Y„3ref-al baw„ba: Y„„„ (~QEl„heÈx)!!!! Yogh Sothoth huwa al baw„ba! Y„„„:3„! Yogh Sothoth huwa maft„7 al baw„ba wa 7ameeha. Fal m„dee wal 7„dÈrr wal mustakbal yazubuuna kullahom fee Yogh Sothoth. Huwa ya3lam ~Qayna tajawaza-l-7ukam„~R kula kadeem wax ~Qayna sa YoghXÈ:3a yakhtareekunahuu mujaddaddann. Y„ Azif, ka ~Qannahom yuw„jeehun-al nida~Ra ~Qeelayn„. Huwa ya3rÈf  ~Qayya 7hukula fee-l-~Qardee salaku wa ~Qayna sa tatta~R ~Qakdameehom wa: leem„za l„ yasttattee3u-~Qa7adonn ~Qee3„kat khutuw„teehom. ~QÈnnahom yad3unan„ 3abra Azif wa na7nu nastajeeb. 3abra ~choraZos, huwa mutazemonn bina wa na7nu mannduwuna ~Qeelayhee bee fÈ3lee kitabu-l-ma(u)wt wa k„nuneehee. Huwa yakshof lanaX al majhul wal ta3beeru 3annhu. Huwa yaftea7u-l-b„b leelazeena yakhdumunahu.Yogh Sothoth Y„3ref-al baw„ba: Y„„„ (~QEl„heÈx)!!!! Yogh Sothoth huwa al baw„ba! Y„„„:3„! Yogh Sothoth huwa maft„7 al baw„ba wa 7ameeha. Fal m„dee wal 7„dÈrr wal mustakbal yazubuuna kullahom fee Yogh Sothoth. Huwa ya3lam ~Qayna tajawaza-l-7ukam„~R kula kadeem wax ~Qayna sa YoghXÈ:3a yakhtareekunahuu mujaddaddann. Y„ Azif, ka ~Qannahom yuw„jeehun-al nida~Ra ~Qeelayn„. Huwa ya3rÈf  ~Qayya 7hukula fee-l-~Qardee salaku wa ~Qayna sa tatta~R ~Qakdameehom wa: leem„za l„ yasttattee3u-~Qa7adonn ~Qee3„kat khutuw„teehom. ~QÈnnahom yad3unan„ 3abra Azif wa na7nu nastajeeb. 3abra ~choraZos, huwa mutazemonn bina wa na7nu mannduwuna ~Qeelayhee bee fÈ3lee kitabu-l-ma(u)wt wa k„nuneehee. Huwa yakshof lanaX al majhul wal ta3beeru 3annhu. Huwa yaftea7u-l-b„b leelazeena yakhdumunahu.

[repeated over and over until..]

error: choraz terminate


It's been speculated that this message, which is in a corrupted form of the now-familiar pseudo-Arabic speak, can be partially translated to:
Quote:
Yog-Sothoth knows the gate.
Yog-Sothoth is the gate.
Yog-Sothoth is the key and guardian of the gate.
Past, present, future, all are one in Yog-Sothoth.
He knows where the Old Ones broke through of old, and where They shall break through again.
He knows where They have trod earth's fields, and where They still tread them, and why no one can behold Them as They tread.


From: http://en.wikipedia.org/wiki/Yog-Sothoth

There's got to be more to it than that, though.

PostPosted: Fri May 11, 2007 8:33 pm
 View user's profile
 Back to top 
Rogi Ocnorb
I Have 100 Cats and Smell of Wee


Joined: 01 Sep 2005
Posts: 4266
Location: Where the cheese is free.

 		It's odd that the text repeats in it's entireity, 170 169 times, with no truncation, before the error. That would make me think the same process that is generating the message is also halting itself. I guess that's supported by the "choraz" component of the error message. If the process is a port hunter, it could be set-up to try ports, that way. But why 170 times?

EDIT: Occultus is correct. It's 169 times. I see why it works out from a looping perspective, but still don't see how it works as part of an attack vector methodology. The total text with the initial line is 130,819 bytes or 130,637 bytes without it. One more iteration of the message would make the lengths 131,592 and 131,410, respectively. So it could be a limit of 131,072 (128k) for the variable in play.
_________________
I'm telling you now, so you can't say, "Oh, I didn't know...Nobody told me!"


PostPosted: Sun May 13, 2007 1:28 am
Last edited by Rogi Ocnorb on Sun May 13, 2007 7:52 am; edited 1 time in total
 View user's profile AIM Address Yahoo Messenger MSN Messenger
 Back to top 
Occultus
Boot

Joined: 27 Apr 2007
Posts: 37

 		13 * 13 = 169
Maybe the 170th triggers an out of bounds error.

PostPosted: Sun May 13, 2007 6:33 am
 View user's profile
 Back to top 
danteIL
Unfictologist


Joined: 08 May 2006
Posts: 1990
Occultus wrote:
13 * 13 = 169
Maybe the 170th triggers an out of bounds error.


I don't know if this is what you meant or if you were just pointing out the math alone, but there's also 13+13 --> Port 1313

Btw, nice job figuring out that 1313 was monitoring the connections on 5217.

I'm ignorant about these things, but is it possible we'd need a password for 1031?

PostPosted: Sun May 13, 2007 9:24 am
 View user's profile
 Back to top 
tipsila
Unfettered


Joined: 10 Apr 2006
Posts: 545
Location: In the back of your mind

 		Just a thought on the number 13 -- the CL messages have been in batches of 13 - except for the initial post. So far there have been 9 groups of 13. So should we expect 4 more rounds of 13 posts?

PostPosted: Sun May 13, 2007 9:48 am
 View user's profile AIM Address Yahoo Messenger MSN Messenger
 Back to top 
Occultus
Boot

Joined: 27 Apr 2007
Posts: 37

 		Copied here for anyone that doesn't read the SentryOutpost forums:

---

Ok - progress report:

Port: 5217

From connection you get about 2 seconds to send:

Xé:3a

The number on door 1217 from this dream:

If you type that in before it disconnects you then you are in.

The auth count on port 1313 goes up by 1.

Then over a period of about 2 minutes (no matter what I tried typing in the mean time - including nothing) the service tries to connect to your PC via telnet. On the 10th connection attempt it sends the same text before and crashes out with the same error.

Until I sent:

Yogh Sothoth

If you send that within the 2 minute window then the connection attempts stop and you get about 20 minutes connected before the session closes.

During the time I was connected (tried it a couple of times to make sure, and connected two sessions in and verified that the auth count went to 2) I tried everything I could think of to get a reaction:

Full text that 5217 spits out
some unix commands
some dos commands
1217, 1313, 1031
and various other things, including a conversation and running commentary with the listener Smile

Nothing.

I also tried connecting to 1031 at the same time to see if it opened up to my IP while connected on 5217 - nothing.

I'll have another go later, there's probably a 3rd level of the login process to find yet.

PostPosted: Mon May 14, 2007 10:59 am
 View user's profile
 Back to top 
roseModerator
...and then Magic happens


Joined: 26 Nov 2003
Posts: 4117

 		Looks like some kind of experiment in opening ports and connections is going on...not that i understand it at all:

Occulus wrote:
.
Quote:
and the good news is that with 6 stable connections open I can now connect to 1031.

Port 1031 replies with another prompt:

Offset>


and then Occulus wrote:


Quote:
I'll try and give some step by step instructions:

Open a connection to 1313 and leave it running.

Open a connection in a new window to 5217 and send Xé:3a

Repeat 5 times in new windows - before the first one disconnects after all the telnet attempts.

You should now have:

Quote:
>
Xé:3a
Trying IP REMOVED ...
telnet: connect to address IP REMOVED Connection refused
> Xé:3a

showing in each window.

That works for me every time now and those 6 sit there for about 20 minutes before they disconnect (probably an idle timeout).

Then open another connection in a new window, to 1031.

That gives me the Offset> prompt.



Quote:
We need to figure out how to get the data back without PuTTY (or other telnet app) converting/discarding half the special characters.

I noticed that some of those data blocks appear to overlap, so we should be able to stitch them together in sequence if we can grab it all without corrupting it.

When I got disconnected from 1031 and reconnected, I got different blocks for the numbers I tried previously - but I spotted data that was a repeat of blocks I'd got from the earlier attempt. So hopefully the data is constant.

I also noticed that for example when I just input 40 it gave an error - I input 40 again and it gave a data block - 3rd time error - 4th time same data block as before and so on. So I'm not 100% sure how the offsetting works, but it does seem to be providing a fairly consistent window onto the data.

Hopefully we can grab enough blocks to start doing a big jigsaw puzzle - and then start thinking about what to do with it once we've got it

Just an update of what Occulus has posted there to save him the trouble of doing it twice.

Good work Occulus.
_________________
I love this site for being free, in every sense of the word~Spacebass

Mankind was my business, the common good was my business.~ Dickens

PostPosted: Mon May 14, 2007 4:00 pm
 View user's profile Visit poster's website
 Back to top 
danteIL
Unfictologist


Joined: 08 May 2006
Posts: 1990
Occultus wrote:
You should now have:

Quote:
>
Xé:3a
Trying IP REMOVED Smile ...
telnet: connect to address IP REMOVED Smile : Connection refused
> Xé:3a

showing in each window.

That works for me every time now and those 6 sit there for about 20 minutes before they disconnect (probably an idle timeout).


Okay I've gotten this to work, but I still have these questions:

1) You don't need 6 connections to 5217, do you? It seems to work with only 3.

2) When you say "those 6 sit there" what do you mean? Does nothing happen? Because for me, I get repeated attempts to connect, and after about 6 attempts, the whole thing disconnects with the gibberish

3) I've never gotten anywhere near 20 minutes. Even with those 6 connection attempts, the max time is maybe 2-3 minutes -- long enough for me to open 1031 and try some things there, but that's about it.

Just trying to figure out what's going on...

EDIT: those questions were directed at Occultus Smile

PostPosted: Mon May 14, 2007 4:05 pm
Last edited by danteIL on Mon May 14, 2007 4:13 pm; edited 1 time in total
 View user's profile
 Back to top 
roseModerator
...and then Magic happens


Joined: 26 Nov 2003
Posts: 4117

 		I don't understand it all so I was just copying and pasting the text -which isn't helpful.

The whole thread on Sentry Outpost is about the bandwidth but the last few pages are the most relevant. I would start from the end and work back.

It does say somewhere that 3 connections work.

EDIT: Fixed URL. --Phaedra
_________________
I love this site for being free, in every sense of the word~Spacebass

Mankind was my business, the common good was my business.~ Dickens

PostPosted: Mon May 14, 2007 4:10 pm
 View user's profile Visit poster's website
 Back to top 
Rogi Ocnorb
I Have 100 Cats and Smell of Wee


Joined: 01 Sep 2005
Posts: 4266
Location: Where the cheese is free.

 		I'm seeing no rise to 100% on 1313 till I have six windows open, but, just as DanteIL points out, the timeout is about 2 minutes and they all start closing in the order opened.
_________________
I'm telling you now, so you can't say, "Oh, I didn't know...Nobody told me!"


PostPosted: Mon May 14, 2007 4:15 pm
 View user's profile AIM Address Yahoo Messenger MSN Messenger
 Back to top 
roseModerator
...and then Magic happens


Joined: 26 Nov 2003
Posts: 4117

 		Also, I didn't see this posted here anywhere. This post came before the Occulus posts above

Varin wrote:

Quote:
For those of you who are a little slow like me...

You can see what they're talking about by putting a colon and the port number at the end of the url...

http://www.sentryoutpost.com:5217/

http://www.sentryoutpost.com:1313/

http://www.sentryoutpost.com:1031/



Dante posted:
Quote:
Yogh Sothoth Y„3ref-al baw„ba: Y„„„ (~QEl„heÈx)!!!! Yogh Sothoth huwa al baw„ba! Y„„„:3„! Yogh Sothoth huwa maft„7 al baw„ba wa 7ameeha. Fal m„dee wal 7„dÈrr wal mustakbal yazubuuna kullahom fee Yogh Sothoth. Huwa ya3lam ~Qayna tajawaza-l-7ukam„~R kula kadeem wax ~Qayna sa YoghXÈ:3a yakhtareekunahuu mujaddaddann. Y„ Azif, ka ~Qannahom yuw„jeehun-al nida~Ra ~Qeelayn„. Huwa ya3rÈf ~Qayya 7hukula fee-l-~Qardee salaku wa ~Qayna sa tatta~R ~Qakdameehom wa: leem„za l„ yasttattee3u-~Qa7adonn ~Qee3„kat khutuw„teehom. ~QÈnnahom yad3unan„ 3abra Azif wa na7nu nastajeeb. 3abra ~choraZos, huwa mutazemonn bina wa na7nu mannduwuna ~Qeelayhee bee fÈ3lee kitabu-l-ma(u)wt wa k„nuneehee. Huwa yakshof lanaX al majhul wal ta3beeru 3annhu. Huwa yaftea7u-l-b„b leelazeena yakhdumunahu.



Bluekindo posted it as:


Quote:
I think that the gobbldygook that Dante quotes on pg. 6 is phoentic Urdu. I think it's an incantation...specifically this one:


Quote:
Yog-Sothoth knows the gate. Yog-Sothoth is the gate. Yog-Sothoth is the key and guardian of the gate. Past, present, future, all are one in Yog-Sothoth. He knows where the Old Ones broke through of old, and where They shall break through again. He knows where They have trod earth's fields, and where They still tread them, and why no one can behold Them as They tread.



_________________
I love this site for being free, in every sense of the word~Spacebass

Mankind was my business, the common good was my business.~ Dickens

PostPosted: Mon May 14, 2007 4:18 pm
 View user's profile Visit poster's website
 Back to top 
roseModerator
...and then Magic happens


Joined: 26 Nov 2003
Posts: 4117

 		Sorry, I can't answer your questions. I may have missed something that I copied. In the meantime you might post on SO or look through that thread for an answer.
_________________
I love this site for being free, in every sense of the word~Spacebass

Mankind was my business, the common good was my business.~ Dickens

PostPosted: Mon May 14, 2007 4:20 pm
 View user's profile Visit poster's website
 Back to top 
danteIL
Unfictologist


Joined: 08 May 2006
Posts: 1990
rose wrote:
Also, I didn't see this posted here anywhere. This post came before the Occulus posts above


I almost never give trout, but I summarized this stuff in the second post on this thread, above.

PostPosted: Mon May 14, 2007 4:23 pm
 View user's profile
 Back to top 
Occultus
Boot

Joined: 27 Apr 2007
Posts: 37
Rogi Ocnorb wrote:
I'm seeing no rise to 100% on 1313 till I have six windows open, but, just as DanteIL points out, the timeout is about 2 minutes and they all start closing in the order opened.


I'm not sure why that's happening for you.

Every time I go through those steps the 5217 ports don't close - the window stays exactly as I showed it, one telnet connection attempt then it just sits at the prompt until it times out 20 minutes later.

If I open just one connection it fails after about 2 minutes like you said, but as soon as I open more than one it seems to kill the timer and the connections stay up.

HPHack said it was working for him too - so I don't know why it works for some people and not everyone.

I know 6 windows is probably a bit of overkill, but that's how I first got it to work, so I kept doing it Smile


While the connections are up are you getting access to 1031 and seeing the Offset> prompt? Or is that not working either?

PostPosted: Mon May 14, 2007 6:04 pm
 View user's profile
 Back to top 
Display posts from previous:   Sort by:   
Page 1 of 3 [44 Posts]   Goto page: 1, 2, 3 Next
View previous topicView next topic
 Forum index » Archive » Archive: Ephemeral » ARG: Eldritch Errors
Jump to:  


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
You cannot post calendar events in this forum



Powered by phpBB © 2001, 2005 phpBB Group