WikiLeaks, eMule and Windows 98

[Multibooter]

More speculation about the file insurance.aes256 and its content may be found at http://www.nypost.com/p/news/international/wikileaks_assange_will_release_encrypted_TMdRdOm0JfvW4Z9rjWwLQO

Whether the file actually does contain anything is currently unknown.

Currently there are 195 complete sources, so assuming an avg upload speed of 50kB/s, about 600 copies could be distributed via KAD/the mule per day.

insurance.aes256 has apparently the SHA1 checksum cce54d3a8af370213d23fcbfe8cddc8619a0734c and 1.491.834.576 bytes, in case fakes are planted.

OT Addendum re censorship: The US government has just prohibited government employees from reading privately at home postings at www.wikileaks.ch or related postings at sites like http://www.guardian.co.uk/world/the-us-embassy-cables http://www.nytimes.com/2010/12/05/world/05restrict.html?_r=1&hp

Edited December 5, 2010 by Multibooter

[jds]

One easy way to reset the IP assigned by the US ISP is to change the MAC ID of the router in the router settings.

Please DON'T. At least, not unless you get this MAC address from a NIC that you're scrapping. The last thing we need is conflicting MAC addresses to add to our internet woes.

Joe.

[Multibooter]

Somehow the file does not show up anymore when one searches KAD with the string "wikileaks". The apparent maximum of 300 hits is displayed, but not the file. I have no idea how to increase the number of files displayed for KAD searches.

Apparently the KAD network was flooded with files containing "wikileaks" in the filename. The number of complete sources has decreased to 174 (from 195, the last time I checked), so perhaps they are working on it.

The search string "cablegate" displays the file Ok in the KAD search. When searching with the 2 strings insurance aes256, the real file with the file ID 6EC555319422123FE9C98CE04167960B shows up, plus 3 fakes of also 1.39GB.

When searching the eDonkey network with the string insurance.aes286, many complete sources are now displayed, and 1 fake file seems to have been planted recently. A current list of servers is at http://www.emule-security.net/serverlist/ The "eMule Security" server has currently 49 complete sources, followed by "Emule Server No1" with 30 complete sources.

Edited December 6, 2010 by Multibooter

[Multibooter]

I have suspended my testing for now, it's getting too dangerous. Cyberwar has started, http://www.mastercard.com has been taken out. No idea whether there are implications for Christmas shopping at ebay, the parent of paypal.

The number of complete sources of insurance.aes256 available on the KAD network has increased in the past 36 hours from 174 to 316, with now 7 fakes. The number of complete sources just on the "eMule Security" server has increased from 49 to 85, so the mule is currently distributing maybe 2000 copies per day.

[Multibooter]

Please DON'T. At least, not unless you get this MAC address from a NIC that you're scrapping. The last thing we need is conflicting MAC addresses to add to our internet woes.

I beg to disagree. I never had any MAC address conflicts, and even if I had I would consider my privacy a higher good.

If there is a conflict of MAC addresses, it's maybe an issue in the government computers recording information. Duplicate MAC addresses could be seen by government computers just like 2 persons having been assigned the same social security number, not my problem. Duplicate MAC addresses perhaps making it harder on government computers might be those in the vicinity, displayed in the site survery, etc of the WLAN card.

If I remember right, there was a story about internet traffic going thru the computers of US agencies.

Edited December 8, 2010 by Multibooter

[Multibooter]

I just checked the registry under Win98 and WinXP. I have found some old router MAC IDs in the Win98 registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\DhcpOptions

But I could not find the current router MAC ID in the Win98 registry, probably because I have Disabled WINS resolution, so that "Use DHCP for WINS Resolution" was de-selected/greyed out for the NIC card.

Under WinXP I could not find any router MAC ID in the registry.

[jds]

Please DON'T. At least, not unless you get this MAC address from a NIC that you're scrapping. The last thing we need is conflicting MAC addresses to add to our internet woes.

I beg to disagree. I never had any MAC address conflicts, and even if I had I would consider my privacy a higher good.

If there is a conflict of MAC addresses, it's maybe an issue in the government computers recording information. Duplicate MAC addresses could be seen by government computers just like 2 persons having been assigned the same social security number, not my problem. Duplicate MAC addresses perhaps making it harder on government computers might be those in the vicinity, displayed in the site survery, etc of the WLAN card.

If I remember right, there was a story about internet traffic going thru the computers of US agencies.

Firstly, internet traffic can and does travel via a multitude of routes. If two devices have a conflicting MAC address and their traffic "crosses paths" somewhere (well, certainly at the ISP if they should happen to share this), then undefined errors and bugs will occur that impact on one or both of these devices. This has happened at least once before, to a NIC manufacturer that accidentally re-used some MAC addresses. Don't cause such troubles deliberately, else you really will get "unwanted" attention.

Secondly, don't think that changing your MAC address will in any way prevent you from being tracked down. If the internet data packets can find you, so can whatever agencies may also wish to find you.

I just checked the registry under Win98 and WinXP. I have found some old router MAC IDs in the Win98 registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\DhcpOptions

But I could not find the current router MAC ID in the Win98 registry, probably because I have Disabled WINS resolution, so that "Use DHCP for WINS Resolution" was de-selected/greyed out for the NIC card.

Under WinXP I could not find any router MAC ID in the registry.

To see the MAC address of your router (or any other device on your subnet), open a command shell and type :

ping the_device_address_or_hostname

arp -a

Joe.

[Multibooter]

If two devices have a conflicting MAC address and their traffic "crosses paths" somewhere (well, certainly at the ISP if they should happen to share this), then undefined errors and bugs will occur that impact on one or both of these devices.

Hi Joe, this may not be necessarily of concern to the end user. With a desktop shortcut to the router settings, changing the router MAC just takes a minute, mainly waiting for the router to reset. If a specific MAC number should cause problems, of which I have no concrete experience, it would be no issue to re-enter another one.

Secondly, don't think that changing your MAC address will in any way prevent you from being tracked down. If the internet data packets can find you, so can whatever agencies may also wish to find you.

I have nothing to hide. But there may be a trend towards totalitarian government and having Big Brother constantly look over one's shoulders is not what one could call freedom.

OT: The Low Orbit Ion Cannon v1.0.3 (LOIC), possibly alluded to in http://www.bbc.co.uk/news/technology-11957367 supposedly runs under Win9x. According to the BBC article, it possibly "enrols the machine in a voluntary botnet which then bombards target sites... Security experts warned people to avoid joining the voluntary botnet". There were about 27000 downloads http://sourceforge.net/projects/loic/files/stats/timeline'>http://sourceforge.net/projects/loic/files/stats/timeline from http://sourceforge.net/projects/loic/ in the past week. The author has set it as Public Domain, "I will grant you appropriate rights. I wish to be not a owner, but a maintainer." http://sourceforge.net/projects/loic/develop

Sourceforge is also the home of eMule http://sourceforge.net/projects/emule/

Addendum OT: There was just a new posting by anonymous (could that be the group Anonymous mentioned in the BBC article?) at http://sourceforge.net/projects/loic/develop

Edited December 9, 2010 by Multibooter