5 WU's hijacked by a team

[Evil_E]

Hi Folding@Home,



I have just noticed that 5 of my WU's have been credited to a Team that I never assigned to receive my finished WU's, so they have been hijacked without my knowledge somehow (I'm not sure how this happened, but I so know that this happened without my permission).

Is there a way to contact someone from the Folding@Home staff so that I can investigate this issue (and also get my WU's awarded to the team that I have set up to receive all my finished units) ?


Thank you.

[Neil-B]

Are you using a passkey? ... Usernames are not unique so rather than someone hijacking your WUs it may just be that there is someone else folding with the same username ... If both of you are not using passkeys then the data will be mingled together and it will be hard track donations ... If either or both of you are using passkeys then this is not an issue ... Some stats views don't separate out usernames linked with different passkeys

[Evil_E]

Hi Neil-B,

Thanks for your reply and for trying to help me out with this issue.
Yes, I am using a passkey with my user account. I do have F@H running on more than 1 machine, but they are both using the same account and are set up to donate the completed units to the same team.

[Neil-B]

which stats view is showing you the hijacked WUs? ... and are you searching the stats by passkey or username?

[Joe_H]

There are 4 different users with the name Evil_E and 4 different teams showing up in the database. Two have not been active within the last couple months, another was last active about a month ago and show 5 WUs.

So most likely those are WUs that you did not process. As mentioned, usernames are not unique. On the official stats site when looking up you can specify both username and team, and that will only show results for that combination.

[Evil_E]

I check my personal stats by clicking on the username link that is located in the advanced control app, under the status tab (there's an "Identity" box there that has both my username and also team ID that I'm crunching for), this username link pops up my stats :
https://stats.foldingathome.org/donor/Evil_E
The 5 of my (?) WU's listed under "Agate Software" (dd 18 May 2020, 05:25:55 -> what time zone would that be : mine, the collection server, ... ???) are incorrect : they either were hijacked somehow (not sure how this happened if this is indeed the case, but I can confirm that my machines were crunching numbers at the time of these WU's being "awarded" to this rogue team) or (if this is from another user) ended up in my stats for some unknown reason.

BTW : if you click on the "Evil_E" entry on the Agate Software stats page then you end up on this URL :
https://stats.foldingathome.org/donor/67365712
which happens to be identical to my stats, so I'm guessing that the WU's are assigned according to the user ID (67365712) and not the username ? (is that correct ?)
If this is the case then someone has inserted 5 WU's into my profile linked to my ID (which I find unlikely to happen) or someone has hijacked 5 of my WU's and awarded them to this rogue Agate Software team.

Either way, something went wrong, that is obvious, and I would like to find out what and why so that this issue can be corrected and rectified.(because if this can happen to me then it is likely that other users are also affected)

[Neil-B]

If you look at the cpus app https://apps.foldingathome.org/cpu you will see that there are lines there that have a different cupid to the ones your kit is using .. this reinforces the likelihood that someone for a short time used the same username as yourself

[Joe_H]

The client keeps the last 16 logs, if you could show a particular WU was folded, uploaded, and not credited to you, that would support your case. But these 5 WUs were folded by someone else and using different machines and IP addresses. There is NO hijack possible like this under the F@h software.

[Evil_E]

@Joe_H okay, so how do you explain that these 5 WU's ended up linked to my username with my numeric user ID and not some other "Evil_E" user account with a totally different numeric ID ?
Someone would have had to have access to my username, user ID (and possibly even my passkey) to be able to do that, yes ???


Let's not forget that usernames + passkeys are sent to users via email. I don't know if you know this, but emails are the online equivalent of sending a postcard to someone : if you are able to get your hands on a postcard making its way from sender to recipient then you can read the message. Emails (usually) travel through multiple relay servers before they end up in the recipient's mailbox, so it is possible that someone was able to intercept it and copy my username and passkey and use it for their purposes.
So I would say that your statement about hijacks not being possible under the F@H software is not entirely correct.


Joe can you perhaps tell me what I need to look for in the log files in terms of figuring out if these 5 WU's were folded, uploaded and not credited to me ? I know where the log files are saved (I created copies of them just in case they get overwritten by newer ones), I just need to know what to look for in all that text...

[Neil-B]

The prcg for each WU is in a line with :project: in it ... check to see that you have matching prcg to the ones in the cpus app for each of the lines at the time listed for each one GB I am expecting you not to find matches for at least one line which will be the one with older dates

[Joe_H]

The other person using the Evil_E username was not using a passkey. The previous two users of that userename also were not using a passkey. There is only one user Evil_E and using a passkey, and that is you and those WUs were credited to you.

As for your information about email, I have been using it since the 1970's and have a good idea what can be done and what is not likely to have been done. But the entire argument falls apart in your case because they did not have your passkey. But then what I said was that the type of hijack you were describing was not possible, you mentioned nothing about someone els using your passkey until later. Someone intercepting your passkey email while not impossible is very unlikely.

As for how they got linked, and that is your description, as explained usernames are not unique. My description and that of the project is that the records presented are only connected by a common username. However username and team are unique, username and passkey are unique. Four different records exist under that basis even. When you look up just by username those will be four separate item on the display of point and WUs processed.

So anyone can use the same username, and so far three others have. Two of those were long enough ago that the date of last WU processed is not recorded, that information was added to the database many years ago. One other started folding for a brief period in May and stopped. You currently are the only one active. None of this requires any access to your email, computers or network.

Years ago it was suggested that the F@h project do actual registration of usernames. But by that time there were many duplicate usernames, and they never ended up adopting a username registry. The username check that does exist will sometimes work to properly indicate a name has not been used already, but does not keep anyone else from using the same name in the future.

The use of an username in the form to get a passkey does not register it. All that happens is that a specific username requesting a passkey to be sent to a specific email address will result in the same passkey being sent each time. Change either the username or the email address and a different passkey will be sent out.

[rwh202]

@Joe_H okay, so how do you explain that these 5 WU's ended up linked to my username with my numeric user ID and not some other "Evil_E" user account with a totally different numeric ID ?
Someone would have had to have access to my username, user ID (and possibly even my passkey) to be able to do that, yes ???

It's as Joe_H has explained. Just happened that someone choose and entered the same name. Nothing more.

They don't need your 'user ID' - that's just the database equivalent of your username, nor have they used your passkey.

As way of example, look out for some work units turning up on team 224497...