New P2P on the block: Perfect Dark

[Doughnuts]

You're not connected. I'd assume it's a problem with the port forwarding. It doesn't give any detailed error when the port is not open.

Tip for when you do get it working: Don't search for roman text like "Kaiji", because you won't pull up many results. Use the Japanese title.

[jfs]

If your problem is only that outside hosts can't connect to you (eg. missing port forwarding) you'd get a message saying "open port not confirmed", not a general "is offline" message.
I don't know what you need to do to get online, I didn't need to do anything special to go online apart from add a few nodes.

[Emess]

After you added the nodes and created your sign, did you actually select/activate your sign? That's the only thing I can think of that'd stop it from getting online :3

E~

[4get]

Originally Posted by Emess

After you added the nodes and created your sign, did you actually select/activate your sign? That's the only thing I can think of that'd stop it from getting online :3

"Sign" setup is completely optional, only needed for signing uploaded messages/files when you want to.

You can go online and post/upload anonymously without selecting the default sign or even without creating any signs at all.

Originally Posted by quina

[..]

- I already forward and open the port (if it is the port error the error message would be different anyway I think) {
- Already adding the nodes from several sites
- Already create username
- I turned off my anti-virus and also firewall just to be sure.

Doesn't seems like its uploading / downloading anything - it just said offline. From what I heard my unity suppose to be 2G before I can start download. But since my download is not going anywhere my unity is still sitting at 0 for the past 1/2 hour now.

Is there any magic "GO ONLINE" button I have to click? I can't seems to see any.

PD does the magic automatically It starts connection attempts right from the moment it gets both incoming port setup and some nodes.

sekai: 0 + 0 + 10 (0), 0 / 34

This line from your screenshot means PD knows 10 node addresses, failed to connect to any and there were 34 unsuccessful connection attempts.

By the way, rather strange that you've got only 10 nodes from those "several sites". Try again with this list http://p2p-db.net/dark.txt (~70 nodes), just to be sure.

If it would fail in the same manner - it means something is blocking outgoing connections.

[D404]

http://forensic.netagent.co.jp/pd_chosa.html

Someone linked me to this earlier. Make of it what you will. (Note: I have literally done no research!)

[zhurai-tsuki]

question: how is this, in terms of running it in linux (...in wine)?

are there any problems with it or no? just wondering.

[martino]

Only problem that I found here is that right-clicking on some entries sometimes doesn't work, as in no menu shows up. Minimizing the window puts it into the notification area (under KDE), not sure how it behaves on Win now though. That's about it though. Runs really well imo.

[Starks]

As a Linux user, I share martino's sentiments about running PD in Wine.

The only caveat is that you need to set up the ja_JP locale to see Japanese text.

Follow step 1 of this guide and then run the PD executable from the terminal with:

LANG=ja_JP.UTF-8 wine /path/to/pd/perfect\ dark.exe

[Emess]

@zhurai-tsuki, It runs fine in WINE, just set up your locale correctly.

@martino, I've noticed that too, it happens (to me) when the tooltip comes up and PD doesn't change focus properly. I usually right click in the file column, and that works every time. It's the column where it has "new" "downloading" and whatever else.

E~

[Waryas]

Originally Posted by D404

http://forensic.netagent.co.jp/pd_chosa.html

Someone linked me to this earlier. Make of it what you will. (Note: I have literally done no research!)

Yes it has been cracked.

[D404]

Originally Posted by Waryas

Yes it has been cracked.

Yeah that's what I thought, but I found it curious that most in this thread ignored it.

[martino]

Originally Posted by Emess

@martino, I've noticed that too, it happens (to me) when the tooltip comes up and PD doesn't change focus properly. I usually right click in the file column, and that works every time. It's the column where it has "new" "downloading" and whatever else.

E~

Yeah, even just clicking on another entry and then going back to the original helps. Well, it's not worth complaining about.

Originally Posted by D404

Yeah that's what I thought, but I found it curious that most in this thread ignored it.

It'd be nice to know what the writing says in the first place, and not just the graph(s), roughly anyway.

[neothe0ne]

Originally Posted by D404

most in this thread ignored it.

I gave up on pd and went to share. "That" only ensured that pd no longer has any advantages over share so no point not using the superior client and network.

(and before someone complains about that statement, I never look for transport streams)

[fireshark]

Have a translation -- my Japanese isn't that good, sorry:

Perfect Dark Investigation Service



NetAgent has created a Perfect Dark investigation system with the ability to find information on nodes and files on the Perfect Dark network. As of May 2009, our propieatry crawler has collected information on over 35000 files on the Perfect Dark network.



Analysis of Node Count Trends on the Perfect Dark Network



NetAgent analyzed Perfect Dark node behavior during Golden Week (4/26/2009 to 5/6/2009) with our new propietary crawler system, and created the following graph to facilitate understanding of the underlying trends.



Reference document: Node count investigation graph



Graph: Golden Week 2009 Perfect Dark Node Count



NetAgent’s Perfect Dark Investigation



What is Perfect Dark?

Perfect Dark is part of the family of P2P file sharing software represented by Winny. Domestically, there are approximately 35,000 users on any given day. Recently, there have been more books and magazines in bookstores. It is prudent to say that Perfect Dark has had a leading role in this development.

Perfect Dark contains a high degree of anonymity. Because of the decentralized nature of Winny and Share, etc. P2P networks, not only has it been difficult to analyze the entirety of these systems, but existing methods of investigation had to be abandoned as well. In these systems, data transmission efficiency and completion are sacrificed in the name of greater user anonymity. Furthermore, the communications themselves are RSA, AES etc. encrypted to prevent easy acquisition of the communicated data. Because the revealing of the information and mechanisms of Winny and Share have since led to a large number of files being “exported” into the Perfect Dark network, it should be carefully monitored.



Information Exchange

In the Winny and Share systems, the IP addresses of the holders of a file by key can be found with three pieces of information -- nodes, keys (file information), and file transmission, allowing one to find the current holders of a file. Because Perfect Dark keys do not contain the node information of the holder, a simple crawler cannot be used to ascertain the holders of a file. Because of this, NetAgent created a “Information Holder State” network to record a leaked file’s sharing status.



Information Obtainable from Investigation

· Perfect Dark node: IP address, port number, keywords, client version

· File information: Filename, filesize, cache conversion date, rating

Perfect Dark Crawler Display (Click to enlarge)

The crawler does not know the contents of uploaded files. But, the crawler is obtain the IP address of the uploader.



* For estimated time and cost, please contact NetAgent.

[fict_ticious]

Well, fiddlesticks.
Thanks for the translation.

[globus999]

Originally Posted by fict_ticious

Well, fiddlesticks.
Thanks for the translation.

-Perfect Dark node: IP address, port number, keywords, client version-

So, the crawler can ID:

The IP address of a node.
The Port of a node.
Keywords ? Which keywords? the search keywords?
The client-version of the node.


-File information: Filename, filesize, cache conversion date, rating-

Filename in the network or in the client?
Filesize in the network or in the client?
Cache conversion date in the client?
Rating in the network?


I dunno, call me stupid, but one way of understanding this is that the crawler can see who is in the network and what is this person searching for, but it cannot see what did the node download or is sharing. It can only see which files are "in the network". Is this interpretation correct or am I completely off the mark?

[fireshark]

A file has keywords, more like tags, associated with it. see all the words after the filename

Filename, size: they're the same.
Yes, where else can you convert from cache?
Yes, your rating contributes to the network's rating. It's next to the filename when you search.

Their crawler screenshot would seem to indicate otherwise (to my crappy translation):

[globus999]

Originally Posted by fireshark

A file has keywords, more like tags, associated with it. see all the words after the filename

Filename, size: they're the same.
Yes, where else can you convert from cache?
Yes, your rating contributes to the network's rating. It's next to the filename when you search.

Thank you kindly. So, it's not so bad after all in terms of the info they can extract.

The crawler can tell if you are connected to the network. So far, who cares.

The crawler can tell which files are in the network and their keywords. So far, nobody cares either.

The crawler cannot tell wich keyword you are searching for: good.

The crawler cannot tell which file you have partially stored in the "Unity": good.

The crawler cannot tell which file you are downloading/sharing: good.

The crawler will have a hard time finding out when was the file decoded: In order to do so, it would have to connect with the client and query it. Since there are between 30.000 and 40.000 clients, this takes time. If you download, decrypt and then erase the records of the operation fast enough, the crawler won't have a clue about what did you download or not. I suspect the connect-query-disconnect operation over 30.000+ clients takes a long time. Good.

Bottom line, if by some sort of miracle the developer provides an auto-decrypt-record-erasure function we are OK. Meantime, one can do it manually. A bit of a pain in the neck, but nothing terrible.


Bottom line is this. The ONLY link between what's in the network and you is the info about when was the file decoded. And this link is week and has a simple fix (if the developer wants to do so).

Or am I missing something?

[fireshark]

Did you even look at thek crawler screenshot?

Unity = downloading. Anything you download is unity, it just so happens that after you download it to unity it's converted into file (download). Therefore, cache conversion date = download completion date.

The crawler cannot tell which file you are downloading/sharing: good.

Look at the screenshot. Each row has a filename and a hostname that is downloading the filename.

The crawler will have a hard time finding out when was the file decoded: In order to do so, it would have to connect with the client and query it. Since there are between 30.000 and 40.000 clients, this takes time.

This is a one-client operation. It already knows who you are (screenshot). Bingo, cache conversion date.

Bottom line is this. The ONLY link between what's in the network and you is the info about when was the file decoded. And this link is week and has a simple fix (if the developer
wants to do so).

Information Obtainable from Investigation

· Perfect Dark node: IP address, port number, keywords, client version

· File information: Filename, filesize, cache conversion date, rating

[globus999]

Originally Posted by fireshark

Did you even look at thek crawler screenshot?

Unity = downloading. Anything you download is unity, it just so happens that after you download it to unity it's converted into file (download). Therefore, cache conversion date = download completion date.


Look at the screenshot. Each row has a filename and a hostname that is downloading the filename.


This is a one-client operation. It already knows who you are (screenshot). Bingo, cache conversion date.

Not realy. The Unity is the cache. Perfect Dark is designed so that every single client caches random files. Just because something is in your Unity it means nothing since you have absolutely no control over what it is being downloaded, with the exception of the files you selected. PD is designed in this fashion in order to provide "plausible deniability" among other things.

Perform this experiment. Start a brand new install of PD. Don't search anything. Don't download anything. Just connect and let it be. You will see that the Unity begins to fill-out by itself.

However, the point is that by looking at the Unity there is no way to know if the file is one that you selected or Perfect Dark downloaded and cached automatically. The ONLY way to know that is if you decrypt the file. However, Perfect Dark allows for the erasure of the info regarding downloaded files and decrypted files. This info is NOT stored in Unity but in a separate database. You *CAN* erase this info selectively from the Download screen -as far as I understand it-.

Of course, PD won't delete the encrypted file from Unity, but, once you deleted the reference to download/decryption, there is no way to know if you did or did not download it. In other words, the file is "in the network". Therefore, and to my point, if there would be a way to either NOT record the fact that you downloaded a file or decrypted a file, there is no way to know if it is "YOUR" file or "PD's". Therefore, not a big deal. Bottom line, removing this info, the crawler is actually providing very little info other than knowing that you are on the network and finding which files are also on the net. So what? This is roughly the same info you can get by just installing the client and doing a search. From a legal standpoint, in this scenario for example, there is no way to prove that you downloaded a file versus that PD did it automatically.