Query Results on Language other then English Search Terms

[thucydides]

Hi,

I have been searching using Languages other than English (Arabic, Swahili, etc) for content on Phex. Somehow , the same Nodes are returning the same fake results for instance if I search for هيفاء or any other keyword I get back results with the search term plus appended terms (like pornstar, keygen, zip , etc.). It also appears to me that the same Nodes are responding to these queries.

Is this a concerted effort to distribute malware by falsely responding to keyword searches? Does anyone else research Search Terms in Language other then English?

Thanks

Thucydides

[arne_bab]

Sadly what you see is simply the result of spammers trying to push fake files into Gnutella.

At times I search in german and I see similar spam.

Normally I just ignore the files and ban the spamming hosts.

So, yes: This is a concentrated effort to harm Gnutella. There are companies who get paid for spamming Gnutella.

Sadly we don't yet have a perfect working solution against that (though there were some very interesting ideas in the past - they weren't implemented yet, though).

[thucydides]

Hi Arne_bab,

Thanks for the reply, Where were those very interesting ideas discussed? I cant help but wonder how they are injecting these false files/results onto the network. Do you know of anyone who has taken the time to analyze the obviously false search results. I wonder if the files are just binary junk, or if they are specific pieces of malware.

Thanks,

Thucydides

[arne_bab]

Hi thucydides,

That's several questions

1) The idea which looked most promising to me can be found at Credence: Thwarting P2P Pollution - sadly LimeWire didn't integrate it, and they didn't reply on my questions, so I don't know their reasons.

2) Injecting these false results is quite easy: Just reply falsely to messages. Gnutella is an open standard, so everyone can write a Gnutella client by following the specifications (GDF - LimeWire), and they can just reply dishonestly. A client sees "someone wants X" and can answer with matching files, but it can also lie.

3) As far as I know the files range from just plain invalid results (which can't be downloaded) over porn spam to virusses. Just download one and run your virusscanner over it (but be careful not to execute it).

Happy sharing!