hax0r on teh IRC

[cyberkiller]

Heya everyone!! there is a hacker on IRC trying to break a pass or so electrofreak thinks. yea.... duffman he is operating thru ur computer. yea.... =(

[Ait'al]

So who is it. Im stil lost. lol

are you refering to a bot of his?

[cyberkiller]

we think its a hackers bot running off of Duffmans machine thru a trojan tryng to break a password.. mainly hamma's

[EineBeBoP]

* Eine|BFV huggles his friend, Electrofreak
<Electrofreak|EVE> aital, before playtests yeah
*** O33296288 ([email protected]) has joined channel #ps-universe
<Electrofreak|EVE> there was 500 ppl in there last time
<Cyberkiller> http://www.planetside-universe.com/f...ad.php?t=24670
*** Signoff: O33296288 (Quit: Bye!)
<Electrofreak|EVE> and when servers go down
* Eine|BFV huggles his friend, Electrofreak, again
<Electrofreak|EVE> thanks eine
<Eine|BFV> np
<Cyberkiller> i need a huggle =(
<Electrofreak|EVE> U R 4 TR00 FR13n|)
*** O91852013 ([email protected]) has joined channel #ps-universe
<Cyberkiller> Hello, do you mind telling us WTF you are doing trying to hack this little ol' irc server??? we have your information and well yea. piss of ya bloody wanker.
*** Signoff: O91852013 (Quit: O91852013)
<Electrofreak|EVE> lol
<Electrofreak|EVE> i was gonna write a script
<Electrofreak|EVE> then i realized it would be too spamtastic
<Cyberkiller> its nto a script
<Cyberkiller> lol
<Electrofreak|EVE> ah
<Electrofreak|EVE> well i saved logs of all the shit
<Cyberkiller> i dotn have the slightest idea how to write scripts
<Cyberkiller> how do i save a log?
<Aital> read the help it explains teh commands
<Aital> 8)
<Eine|BFV> magic for teh win
*** O36696366 ([email protected]) has joined channel #ps-universe
*** Signoff: O36696366 (Quit: O36696366)
<Electrofreak|EVE> you save everything in your buffer by right clickin channel name, and clickin save as
*** Signoff: CDL-Incompetent (Connection reset by peer)
<Eine|BFV> | /\/ |) 33 |)
<Electrofreak|EVE> and it saves everything in your channel
*** O15765210 ([email protected]) has joined channel #ps-universe
*** Signoff: O15765210 (Quit: O15765210)
<Electrofreak|EVE> im getting sick of you
<Electrofreak|EVE> ah damn missed
<Cyberkiller> ok
<Aital> saves everything as in teh conversation?
<Cyberkiller> r33t
<Cyberkiller> got it
<Electrofreak|EVE> it saves everything in the IRC chat
<Electrofreak|EVE> as far as you can scroll uo
<Aital> its a log?
<Electrofreak|EVE> at a certain point it stops recording chat
<Electrofreak|EVE> yeah it logs it
<Aital> yea i know
<Electrofreak|EVE> you want to log if its going to be longer than that
*** O95979322 ([email protected]) has joined channel #ps-universe
*** Signoff: O95979322 (Quit: O95979322)
<Cyberkiller> gawd im gettin heavy traffic on the ZA
*** O50962407 ([email protected]) has joined channel #ps-universe
<Cyberkiller> Hello, do you mind telling us WTF you are doing trying to hack this little ol' irc server??? we have your information and well yea. piss of ya bloody wanker.
*** Signoff: O50962407 (Quit: O50962407)
<Cyberkiller> what i dotn get is
<Cyberkiller> he is giving away what he is doing
<Aital> maybe he doesnt know what he doing
*** O23913212 ([email protected]) has joined channel #ps-universe
*** Signoff: O23913212 (Quit: O23913212)
*** CDL-Incompetent ([email protected]) has joined channel #ps-universe
<Aital> its not a new spider is it?
<Cyberkiller> a new wha?
<Aital> thing keeping track of rooms
<Aital> nm
<Cyberkiller> oh
<Cyberkiller> no
<Cyberkiller> its too fast for a spider
*** O47455502 ([email protected]) has joined channel #ps-universe
<Aital> maybe its hamma playing peakaboo
*** Signoff: O47455502 (Quit: O47455502)
<Cyberkiller> know what woul dbe funny? if this all had somethign to do with www.ilovebees.com
<Aital> on crack
<Cyberkiller> In 2 days this medium will metastasize.
*** O41059133 ([email protected]) has joined channel #ps-universe
<Cyberkiller> phase 2 in 2 days
*** Signoff: O41059133 (Quit: O41059133)
<Cyberkiller> Electro where r u?
<Aital> what the fuck is that cyber?
<Cyberkiller> in the new halo 2 trailer at the end www.xboxcom changes to www.ilvoebees.com for a second and ges back
*** O75863769 ([email protected]) has joined channel #ps-universe
*** Signoff: O75863769 (Quit: O75863769)
<Cyberkiller> everyone is thinking its leading up to an early release of halo 2
<Cyberkiller> but noone knoes
<Cyberkiller> knows*
<Aital> i still have my free thingy from my vid card 8)
<Cyberkiller> phase 2 is in 2 days
<Cyberkiller> for?



See him joining/quitting? thats it.

[Baneblade]

[Ait'al]

anyone got a hack to force someone to stay in an irc?

[Dharkbayne]

Originally Posted by Ait'al

anyone got a hack to force someone to stay in an irc?

Now I knew you were stupid, but that's just...

[Electrofreak]

Basically heres what happened. A random number nick started joining and leaving every several seconds on IRC. I pulled up an Info on him one time when he came in and saw that he was joining a channel #duff along with #ps-universe every time he joined. So I went into #duff and waited for him. Sure enough, he popped in and this happened:

"* Now talking in #duff
* O32348345 has joined #duff
<O32348345> Optix_Pro_v1.32_Server_Online:_{Ip_address:_[192-168-0-100]}{Computer_Name:_MATT}{Current_User_Name:_Matty}{I dentification_name:_Joe_Bloggs_Returns}{Installed_ Trojan_Port:_3410}{Installed_Trojan_Password:_NONE }{Windows_Version:_Windows_XP_5.1_2600_Service_Pac k_1}{Webcam:_No}
<Electrofreak|EVE> hello
* O32348345 has quit IRC (Quit: Bye!)
* O88796770 has joined #duff
<O88796770> Optix_Pro_v1.32_Server_Online:_{Ip_address:_[192-168-0-100]}{Computer_Name:_MATT}{Current_User_Name:_Matty}{I dentification_name:_Joe_Bloggs_Returns}{Installed_ Trojan_Port:_3410}{Installed_Trojan_Password:_NONE }{Windows_Version:_Windows_XP_5.1_2600_Service_Pac k_1}{Webcam:_No}
* O88796770 has quit IRC (Quit: O88796770)
* O70343840 has joined #duff
<O70343840> Optix_Pro_v1.32_Server_Online:_{Ip_address:_[192-168-0-100]}{Computer_Name:_MATT}{Current_User_Name:_Matty}{I dentification_name:_Joe_Bloggs_Returns}{Installed_ Trojan_Port:_3410}{Installed_Trojan_Password:_NONE }{Windows_Version:_Windows_XP_5.1_2600_Service_Pac k_1}{Webcam:_No}
* O70343840 has quit IRC (Quit: O70343840)
* ChanServ sets mode: +ntr
* O56298705 has joined #duff
<O56298705> Optix_Pro_v1.32_Server_Online:_{Ip_address:_[192-168-0-100]}{Computer_Name:_MATT}{Current_User_Name:_Matty}{I dentification_name:_Joe_Bloggs_Returns}{Installed_ Trojan_Port:_3410}{Installed_Trojan_Password:_NONE }{Windows_Version:_Windows_XP_5.1_2600_Service_Pac k_1}{Webcam:_No}
* Electrofreak|EVE sets mode: +b *!*@psu-1056B821.client.comcast.net
* O56298705 has quit IRC (Quit: O56298705)"

As you can see, I'd registered the server and banned him. He no longer can join #duff.

However, he continues to join and leave, and no ops are around. We think that he may have created a private channel, so we are unable to see where he is to stop him.

After a bit of checking people's info, I noticed that DUffman had the EXACT same address as the person joining. So we now know whoevers doing it is going through duffman at least. I wouldn't be quick to accuse Duff, its quite likely that someone put a trojan on his comp and is working through it to avoid detection. Also, if we ban duff, he can just infect someone else and continue.

Lastly, as we talked about this in IRC, CyberKiller reported that his Norton had just intercepted a virus, but was unable to access it. After running an online virus scan a trojan virus was detected and quarentined on his computer. Whether it was the one that just dropped onto his comp, we dont know. He then put up his zone alarm and started getting heavy traffic on it, so someone might have been trying to infect him.

Also, the regularity of the joining and leaving and random nick each time seems to me that this is a bot that attempts to crack passwords. As far as I know, IRC limits the number of times you can enter a password, so that would explain why he is quitting and rejoining with a new nick every few seconds.

Anyhow NONE of the ops are awake and whoever it is is probably working through duffman, so I guess the only thing right now is to ban duff and put a quick stop to this until things can get worked out. Since CK was hit, everyone kinda have your firewalls up and crap while ur in IRC, could an mIRC exploit of some kind or something.

edit- Lartnev just came in and banned *!*@psu-1056B821.client.comcast.net (duffman's address) so hopefully this nick joining will stop. I'm just worried that if it IS a hacker, its going to just find someone else to work through.

[Mag]

The hackers you really need to worry about are the ones you don't see. This guy is obviously novice.

[Electrofreak]

Originally Posted by Mag

The hackers you really need to worry about are the ones you don't see. This guy is obviously novice.

yep if he had been smart he woulda used a hidden channel in the first place.
Not to mention, hes incredibly lucky he managed to join/leave that long without getting a ban. We need more late-night ops

[Ivan]

Originally Posted by Electrofreak

yep if he had been smart he woulda used a hidden channel in the first place.
Not to mention, hes incredibly lucky he managed to join/leave that long without getting a ban. We need more late-night ops

I would of been on but I was away all since thurs.

[Electrofreak]

Yay! Ivan's back, PSU IRC is SAVED!

[Ivan]

Saved? I'd rather think Doomed!

[AztecWarrior]

Originally Posted by Ivan

I would of been on but I was away all since thurs.

BS. You're a bot.

[Ivan]

Originally Posted by AztecWarrior

BS. You're a bot lover.

Fixed.