Microsoft RickRolls Wi-Fi Network Leechers

An anonymous reader writes "Microsoft has revealed that it RickRolled users that were killing its TechEd conference Wi-Fi network last year by torrenting large files. Network administrators at the event quickly built a list of all of the top torrent trackers around and got the nod to add them all to the local DNS resolver and point them at a local Web server containing some Rick Roll scripts. According to the admin: 'It killed me that I didn't see anyone getting done by this first hand, but there were hundreds of impressions in the server logs containing the Rick Roll scripts so I did get a fair amount of satisfaction at least. It was the most evil of evil Rick Roll scripts too — worse than any that anyone has used to get me in the past.' Fun and games aside, it looks like the leechers will force quotas and traffic shaping for the first time in the event's history."

Comments

It could have been worse...

[Mattskimo]

At least it wasn't Soulja Boy.

Evil

[DeBaas]

Rick Rolling, told you Microsoft is evil ;-)

Re:Evil

[The Mighty Buzzard]

Network admins are evil by default, Microsoft or not. Most of them aren't nearly as creatively hilarious as this though.

Re:Evil

[sycorob]

Am I the only one that's terrified to click on any links here?

ObRoll

[wiredlogic]

Just to get things rolling. Here is the tasteful mashup with Nirvana.

Can you spell DoS?

[nuckfuts]

From TFA:

So we scheduled this script to run each minute to generate a list of offending MAC addresses.

We reasoned that if you had a lot of mappings, and that a large proportion of those mappings were to a lot of distinct remote hosts, and largely not idle, that you are probably a Torrenter. OTOH, if you had, say, 20 connections open to a single host or a low number of hosts then this is probably quite fine.

These scripts output a list of bad MACs, that we then just dropped into a block list in the core switches.

And there you have it. The culprits fingered and booted off the network. Of course, they then just changed their MAC addresses, in which case they were then re-identified as soon as their utilisation crept up, and the new MAC was banned.

This approach will work fine until one of the culprits decides to spoof the MAC address of your DNS servers (or whoever else they want to f*ck with) and gets them "booted off the network".

Been Slashdotted

[one cup of coffee]

It looks like the news link has been Slashdotted, Here's a mirror to the link

ic news story Microsoft

TBF with a big bucket

[jamesh]

I solved this problem at the local library's public access wireless with a linux router and a token bucket filter with a big bucket. Each IP address gets a 10MByte bucket that fills up at 256kbits/second. The bucket is big enough that they'll never know they are limited for normal browsing, but a torrent sucks it try really fast and drops down to a slow enough speed that it's not really worthwhile. And even if they do stick with it at least they aren't burning through tens of gigabytes per day. It beats any other filter i've ever tried.

I still fondly remember the howls of dismay from the leechers when I turned it... they just couldn't understand why their downloads start at 20mbits/second but slow down to a crawl almost straight away :)

Re:TBF with a big bucket

[David M. Andersen]

It's actually pretty easy in linux. http://lartc.org/howto/lartc.qdisc.classless.html#AEN691 In fact, http://lartc.org/ has loads of good stuff.

Re:Lame

[c6gunner]

Rick Rolling is so last year....

gee ...

"Microsoft has revealed that it RickRolled users that were killing its TechEd conference WiFi network last year ....

Look on the bright side - at least you didn't make a total ass of yourself by saying:

What did you expect? This is Microsoft we're talking about here. They're always behind by a full year or five when it comes to internet memes.

TBF with a big bucket-Howls of pain.

[Anonymous Coward]

"I still fondly remember the howls of dismay from the leechers when I turned it... they just couldn't understand why their downloads start at 20mbits/second but slow down to a crawl almost straight away :)"

You wouldn't happen to have an audio copy by any chance?

Re:How do Rick Roll scripts work?

[natehoy]

No. As I understand it, those who are rickrolled basically get a customized DNS response that points all page requests to a local server with one web page and a blind redirect to that web page. That single web page has an embedded rickroll video.

Somewhat similar to how airports on a pay-for connection, or hotel connections work. Try to go to any website, and you get redirected to a login or purchase page.

Presumably any other connections not on port 80 (torrent, FTP, etc) are dropped.

So if you're surfing the web while torrenting, you'll get the rickroll video on the next page you load after you are detected, and you'll find that all of your torrents suddenly stop connecting.

Re:it doesn't make sense to me

[WCguru42]

and if you believe otherwise, you very much are a good definition of what is wrong with this world, in terms of a stunning display of greed backed up with force, overwhelming the common good

What if I want to pretend that I believe this in the hopes that the RIAA will send it's dogs after Microsoft's (and maybe Google's) wolves and never come back. I feel fairly confident that Microsoft and Google have lawyers that would tear the RIAA apart in a real battle. There's a reason the RIAA hasn't taken strong tactics against them (specifically Google via YouTube) in the past.