Random nicks

UKhappychat · none Joined: 08 Mar 2008 Posts: 28

Hi, we've started getting random nick's coming on our servers just sitting in rooms... examples..

T_IFH42154563
A_204JOFJ3

Anyone know what it could be ?

Future · none Joined: 20 Mar 2008 Posts: 27

not sure, but maybe you should try to contact them. Query them if they don't reply assume it's a bot and shouldn't be there. /kill it Razz

greg27 · Lurker Joined: 07 Oct 2006 Posts: 117 Location: Australia

never seen anything like that before - did you ctcp version them? no reply = badly coded bot, anything else could either be fake or give some insight Smile

UKhappychat · none Joined: 08 Mar 2008 Posts: 28

Yep, i did a whois and it kept bringing up random ip's on each nick.. i've kicked/banned about 19 my servers today :S

katsklaw · Guru Joined: 28 Jun 2004 Posts: 1022

greg27 · Lurker Joined: 07 Oct 2006 Posts: 117 Location: Australia

but the vast majority of clients will respond to a ctcp version, and no version + those nicknames most likely = something malicious.

katsklaw · Guru Joined: 28 Jun 2004 Posts: 1022

The nicks alone are more malicious looking and random than any/no CTCP reply. Considering that a malicious bot can return what appears to be a valid CTCP reply just as easily as an innocent user can return a real reply. It's not possible to use any collected statistics as to what percentage of the returned replies a correct. The vast majority of clients can and many do ignore CTCP. A lot of the now aging mIRC scripts do it for various reasons .. including my own. In fact for most of the last 12 years, ctcp cloaking/hiding has been a feature in a lot of mIRC scripts alone and many users expect a script to do it. I'm talking numbers of downloads in the hundreds of thousands over the years, not just 100 or 200. Thats not counting the abilities of other clients. Since SearchIRC reports the IRC population between 700k and 1m users, you could be talking about a rather notable percentage.

CTCP version replies are so easily faked by nearly any client including mIRC that it's just not reliable anymore, much like the usefulness of identd. You should search google on "how to hide version reply on irc" (without the quotes) sometime. It's not a phenomenon just on IRC either and I'd be willing to bet that there are as many if not more clients that ignore or modify their CTCP version than there are malicious bots that answer truthfully. CTCP cloaking is and always has been an additional measure of anonymity, just like using a secure proxy or a bouncer like BNC, which has also been used by hundreds of thousands of users. Let's also toss in the fact that there is such a thing as a CTCP flood and many clients have little or no flood protection so the only solution for that is to ignore all of it.

This same thing happens when users like myself who use their nick as their ident and GCOS, couple that with the fact that I ignore CTCP I get banned for networks that think that just beacuse my GCOS matches my nick I'm a malicious bot. Which is equally as absurd as thinking that a CTCP reply is an indication of client authenticity.

What networks should REALLY do is their damned job and scan the network with their eyes and not some script that can't possibly tell if a nick is random or not. Hiring staff that has some real experience on large networks doesn't hurt either.

It's the younger generation of IRC Admins that have made it so people think that no reply = malicious bot. This same generation is what made it so IRCops expect to be able to be ban proof, can op themselves in any channel for any reason and have God like powers on IRC and make it seem perfectly ok and needed. I've been an admin for most of my 12 years on IRC and I've been an admin on a 140,000 user network I've killed tens of thousands of clones every week, dealt with flooders and the same kind of malicious users as you see today and I can tell you for a fact that such "toys" are not needed when you have the proper experience you should have as an Admin and not some yahoo user than has been on IRC for just a few months and thinks that they can be a NetAdmin. But that a whole different story.

greg27 · Lurker Joined: 07 Oct 2006 Posts: 117 Location: Australia

katsklaw, relax, all i meant was that if a bot is badly coded by some lazy idiot it is unlikely to reply to ctcp versions - i didn't mean that any user with no version response should automatically be labeled malicious.

Jobe · Posted: Mar 23, 2008 8:36am Post subject:

UKhappychat · none Joined: 08 Mar 2008 Posts: 28

Well i have proxy scans on and it still is getting passed.

katsklaw · Guru Joined: 28 Jun 2004 Posts: 1022

Future · none Joined: 20 Mar 2008 Posts: 27

Ok it's someone who has downloaded a .exe and opened it, with it being full of virus's and so they are infected...the botnet owner has made it so it joins your network, same happened with me.