Subject: Re: Tracking Players to Home Sites

From: [email-masked]
Date: Wed, 27 Oct 1993 13:31:35 -0700

On Oct 27, 11:57am, [email-masked] wrote:
> Subject: Re: Tracking Players to Home Sites
>
>	Here's my take on the problem, expanding on what Pavel said.
>While it's true that global authentication is a wish-list item for the
>Internet, let's face it, most people connecting to a MOO are not up
>to spoofing Internet addresses.  If you take that as a given, there are
>several things you can do, which vary depending on the situation.

If you catch a spoof you can have them knocked off the net real quick.
>
>	Situation 2) There are several people from the offending site
>connected to the MOO at all times, so you can't isolate the user,
>but you do have access to the foreign site (or can get it).
>This gets trickier.  You must convince the MOO to tell you the foreign
>port number associated with the offending player.  I don't think this is
>in the current server (I haven't dug that deep so I could be wrong),
>which would mean some server hacking.  Then you go to the foreign

Easy (if you know net stuff) hack.

>site and use 'netstat' or the moral equivalent thereof to determine
>which process owns that particular port number.  You've got him.

>	Situation 3) There is only one user from the offending site
>connected to your MOO, but you don't have access to that site.
>In that case, you get to play a statistical waiting game.  Set up
>a shell script to finger the site every half hour, and take an @@who
>listing at the same time.  Correlate who's logged on at the foreign site,
>with the times the offending player is on the MOO.  If the foreign site
>doesn't support 'finger' protocol you're out of luck.

Close.  Everytime their MOO char is unidle, take a look at the site.
The culrpit will drop out much quicker (idle 0 on moo, idle 0 on
site).  If no finger, you have to try many things.  rusers -l,
logining in as user 'w' (not at all common anymore), telneting to 79
on an "authoritative host" and proxy-fingering, using the 'SEND'
command from SMTP to check if a certain user is on (if you have a
list of users, and be careful, this one can get you into trouble).

>	Situation 4) There are always multiple users from the offending
>site connected to your MOO, and you don't have access to that site.
>Technically speaking you're out of luck.  At this point you have to
>prove how good a wizard you really are by using people skills instead
>of technical skills, to either convince the offender not to be anti-social,
>or to convince one of the other players at that site to reveal the
>offender's identity.

Look at above.  There is little chance that they will all idle and
unidle at the same times.  There is also the fact that you can lock
them all out and force the good ones to take care of the bad ones.  Be
sure to warn them, and explain it to all of them when you do it.

>	In fact the longest-running MUD on the Internet reverses these
>priorities, and uses technical means of detection only as a last resort.
>In all the years that MUD's been up, this has only been necessary on
>a very few occasions.  Since the MUD doesn't run with player registration,
>it's really the only practical alternative: if a @toaded player can
>immediately create a new character, @toad loses its force, and knowing
>a player's true identity is no bar to the creation of a new character.
>Long talks and moral suasion have been successful there, where they
>have apparently failed on LambdaMOO.

It's hard to stop a dedicated person.  I have lots of machines I can
login from if I want to.  You might lock out sphinx.nmt.edu to find me
coming on from minos.nmt.edu, so you lock out *.nmt.edu and I come on
from gnu.ai.mit.edu so you lock it out, so I come on from
dockmaster.ncsc.mil, so you lock it out, so I come on from one of
those wonderful terminal servers in sweden that allow incoming telnets
to telnet back out, and you lock out .se, so I come in from tymnet,
and you lock it out.  This kind of thing can continue for a long long
time.  I can always change a local PTR to be localhost (see my note on
spoofing above).

Barring that, I can also just run a process on every machine I have
access to which would connect to your login port, and spam the game
with repeated connection attempts.

I whole-heartedly reccomend convincing the person to be a nice guy.

-- void *(*(*schlake())[])(void *);

---

From: Jay Scott <[email-masked]>
Date: Wed, 27 Oct 1993 13:35:49 -0700

In general there's no way to identify what user at a remote site is
responsible for a given connection, but in practice many remote sites
leak enough information that you can make a reliable guess. If you are
clever and willing to collect information over time, you can probably
find the right user id.

One way is by Russ Smith's program 'fascist'. I haven't seen it, but
I understand that it fingers the remote site to collect idle times and
correlates these with idle times on the mud.

	Frand
	[email-masked]

---

From: [email-masked]
Date: Thu, 28 Oct 1993 01:31:24 -0700

>Uhm, not that I want to defend this bozo or anything, but why exactly is that a
>problem?  I, for one, often used two different sites.  FOr instance, I was
>getting mail through a forwarder from one site that I used as my primary email
>site but I was apt to be logged in through another site.  (As it happened, I
>went through three different other sites for primary access before my mail
>forwarding site croaked.   Made it a lot less hassle changing email sites.)

I don't mind the player using a different account to connect.  But in this
 case, there are two problems: (1) his registered email account is invalid
 and (2) he's connecting from two different sites (according to @@who)
 and I suspect someone from my MOO may have hacked into his account to
 discredit him.  I just want to be sure we're @newting the right person.

--- Dov Sherman
    [email-masked]