"AmazonAWS" attack on ShareEX network (July 10, 2009)

guy

(;Θ_Θ)ゝ”
Feb 11, 2007
2,079
43
I posted this message on another Share thread but realized it would be better to keep the info/discussion in its own thread, so apologies for the duplicate.

Share users are reporting attacks on the Share network originating from AmazonAWS (and other) servers. The Share network is reportedly being flooded with fake packets, causing transfers to be slowed down or stopped, and possibly also corrupting users' cache. Apparently it's a big enough issue that there is quite a bit of discussion going on at 2ch the past couple days.

The current solution is to install the UEN Disconnector plugin for Share, which will identify rogue nodes and dump their host/ip information into a txt file. Then to use PeerGuardian2 to load that list and block/sever those connections. Unfortunately for Vista x64 users, there is a driver signature limitation that prevents PG2 from loading; there's a "F8-on-boot" workaround to disable signed driver enforcement, but it's a royal pain.

As I have other stuff on my plate (and currently nothing in my Share queue), I haven't looked into the issue any deeper. Developments are being tracked over at atwiki, and discussion threads on 2ch can be found in the ネット関係→Download category. Related files, links to ongoing discussions, and references are also at atwiki.
Code:
http://www13.atwiki.jp/amazonaws/

If someone has time to decode the Japanese, I'm sure a translation would be appreciated. In the mean time, it might be helpful to ask if any regular Share users have experienced connection problems in the past 2-3 days.
 

guy

(;Θ_Θ)ゝ”
Feb 11, 2007
2,079
43
A screenshot of UEN Disconnector in action.

View attachment 179502

Known bad nodes include:
  • *.amazonaws.com
  • *marunouchi.tokyo.ocn.ne.jp
  • *.nas945.p-tokyo.nttpc.ne.jp

As can be seen in the screenshot.
 

elgringo14

Survived to Japan
Super Moderator
Apr 28, 2008
9,092
341
Thanks for the infos guy.

I had severe trouble with Share in the last days, first I got the "time disconnection error", then the program was keeping on crashing, after like 30 mn of operation.
Then I decided to clean my nodes database (not updated since I started using it, e.g. one and a half year ago !), uploaded a fresh list (from there) and all problems solved magically.

It's still suspicious because I get a lot of connections, more than usual (labeled Verification especially), maybe it's checking nodes because I have a small database now. But the program is running properly since two days.

And I don't use any of the plugins you recommanded. Do the spam nodes are related to JAV more than hentai for instance ?
I don't have any cluster words dedicated to JAV.
 

guy

(;Θ_Θ)ゝ”
Feb 11, 2007
2,079
43
I don't know if certain clusters are more or less affected than others. It will be helpful to know if anyone is having any particular trouble with certain types of files/clusters.
 

KGhidorah

Member
Feb 13, 2007
109
0
I've been running share the last few days grabbing a few moecco ISO's and trying to get some of Shihono Ryo's earlier works in ISO also.

I hadn't noticed any specific problems but I've installed the plugin and PG2 and its getting hits, im just using DVDISO IV and U-15 clusters