Looking for Links/Staf/Chatters

LabRat · none Joined: 04 Nov 2010 Posts: 3

WickedIRC Network is a new server looking for links/staff & chatters

i can be contact via our server irc.wickedirc.net or via PM on here for more details

cheers

LabRat · none Joined: 04 Nov 2010 Posts: 3

we are using Unreal3.2.8.1 and Anope

katsklaw · Posted: Nov 05, 2010 10:41am Post subject:

How many real, non-ulined, non-robot type clients do you have? and would you be willing to merge?

Bertrum · Eleet Joined: 30 Mar 2008 Posts: 573 Location: Venus

LabRat perhaps give us some more information, what extended services do you use, bopm denora, how many opers, how many servers, do you use shells, vps or dedis, will you accept shells or vps. It will definitely help you find a suitable link if you give more information.

Levi` · none Joined: 26 Dec 2006 Posts: 43

I recently visited this network, and sat for quite some time without any real interaction. Striking my curiousity, i started CTCP Versioning random people. 90% of the users did not post a reply, and 9% replied with eggdrop. Out of 45 people, i managed to get ONE mIRC version reply. The nicks are quite funky too, all very long.. 15+ chars. Seems the administrator is trying to make the network look larger then it is to gather merges/links. That is unfortunate, i am now turning away.

D3M0N · Posted: Nov 10, 2010 6:26am Post subject:

Not being rude:

Current Local Users: 7 Max: 9
Current Global Users: 574 Max: 575

When I type /list only about 100 of those actually show up in rooms - so wheres the other 475 users??

Jobe · Posted: Nov 10, 2010 8:02am Post subject:

It gets better then that D3MON, of the 500 users, only 5 appear on non-ulined servers:
* irc.wickedirc.net (3) 1
* `-iNsAnE.wickedirc.net (2) 4
* End of /MAP

So either this networks ulines are WRONG (ONLY services and stats should be ulined, possible janus links too but NO OTHER server. Or the network has a seriously large number of fake users.

Trixar_za · Posted: Nov 11, 2010 6:29pm Post subject:

Both Janus's Linker bot and normal link functions would show up in /map by default. This could have probably been hidden though, but it might require some serious effort.

Here's my stats as I join:
/luser:
There are 575 users and 8 invisible on 4 servers
16 :operator(s) online
72 :channels formed
I have 4 clients and 3 servers
Current Local Users: 4 Max: 9
Current Global Users: 583 Max: 586

/map:
[01:54:48] »» irc.wickedirc.net (4) 1
[01:54:48] »» `-iNsAnE.wickedirc.net (2) 4

BotServ Bots:
{BotServ} 30 bots available.

Biggest Channel:
#DarkSide 56

So I joined the biggest channel and randomly whois'd people, check out this whois:
[TheBeastie] (LoL@WickedIRC-Network-R00L99MD.zone5.WonderLand.sydney.au): ¡!¡!.Just4Fun.¡!¡!
[TheBeastie] is a registered nick
[TheBeastie] services.wickedirc.net :WickedIRC Network Services
[TheBeastie] idle 60:07:32, signon: Sun Oct 31 07:42:11
[TheBeastie] End of WHOIS list.

Note the server - now I'm really interested... After whoising a few users in the channel I noticed a lot of 'users' come from services.wickedirc.net with an impossibly long away time, yet they don't show up as BotServ
Bots. I whois one of the Botserv bots and confirm they're also connecting from services.wickedirc.net

Then I note the follow:
/module:
*** netadmins (Kill & ban protection for netadmins) [3RD]
*** hideserver (Hide servers from /map & /links) [3RD]
*** cloak (Official cloaking module (md5))
*** commands (Wrapper library for m_ commands)
*** m_uline (Command /uline) [3RD]

Note m_uline and hideserver. They can dynamically create and hide ulined servers... This is getting even MORE interesting.

So class, what have we learned? We have learned that they can hide servers they want and set them as uline whenever they want. We have learned that a large majority of their users in the channels come from services.*, but don't show up as botserv bots. They either modfied janus massively to allow this, which I doubt because the 'users' have been silent so long - Janus would be relaying like crazy if these users were real. ZNC zombies would show up as real users in /map and so would a botnet.

So what does this leave us? A custom Anope module that allows him to create and control pseudo users on the fly - which isn't that hard to begin with, if you know how and you use os_raw.

That said, I have a message for LabRat. Drop the pseudo users. They're just chasing users, potential links and opers away rather than drawing them in. Rather use that module writing talent of yours to write up some cool games and fun bots for the users. That will get you users in no time Wink

katsklaw · Posted: Nov 11, 2010 8:46pm Post subject:

bots that dont show up to users are simply set as private bots in botserv, it's a very basic task to perfom.

Secondly, 60 hrs isn't that long. I have a friend who has been idle on DALnet for 7 weeks now while she is touring the country with her husband.

mostly useless facts aside, I too agree, fake net. Lets whine until it's delisted.

D3M0N · Posted: Nov 11, 2010 8:52pm Post subject:

Ok, I did a MASS CTCP Version reply on the main channel and got 37 replies back, 33 of which were eggdrops, I dont know much about eggdrops but i have tested this stunt on my server and have found out whats going on.

OperServ has a module in which you can "change/hide" different parts of a whois. Example:

D3M0N is D3M0N@my.test.vhost * D3M0N
D3M0N is using modes +Sqo
D3M0N is connecting from *@TheJanusChat
D3M0N using testing.TheJanusChat.com JanusChat test whois
D3M0N is a Network Service
D3M0N End of /WHOIS list.

Compared to my ORIGINAL whois:

D3M0N is D3M0N@A51F693C.B5D5DB47.1E833932.IP * CEO & Founder of Krazy-Host.Com, INC
D3M0N is using modes +iowghaAsxN +kcfFjveGnNqSso
D3M0N is connecting from *@188.165.69.165 188.165.69.165
D3M0N on #services @#LogChan +#chatzone +#oasis_playground #Main @#Janus #gabe +#ladygaga ~#linkChat #infowars
D3M0N using irc.TheJanusChat.Com TheJanusChat - Powered 100% by Janus!
D3M0N is a Network Administrator
D3M0N is available for help.
D3M0N is - TheJanusChat Owner
D3M0N has been idle 15mins 33secs, signed on Fri Nov 05 06:58:04
D3M0N End of /WHOIS list.

I could be REALLY wrong on this one but its easily done on my server with the simple ""os_chgswhois"" module.

Krat0s · none Joined: 30 Sep 2010 Posts: 43

Once again we prove to why janus shouldnt be used... it makes fake users to alter lusers... Searchirc shouldnt index these networks because its unfair to the rest

katsklaw · Posted: Nov 11, 2010 10:18pm Post subject:

Trixar_za · Posted: Nov 12, 2010 5:26am Post subject:

::sigh:: There are other ways of cheating. Creating pseudo-users via a server or service, ZNC zombies, Botnets, multiple eggdrops and mirc socket bots. Hell, you could even modify the code of the IRCd and add user count stats. Blaming Janus everytime you see a swelling in users just proves your ignorance of it. It follows certain rules and believe it or not, but it users actively talk. I have also found that the definition of unfair for most IRCops means "It's unfair because *I* can't do it".

That said, I find what D3m0n figured out interesting. Why would their version reply return Eggdrop? Eggdrops would show as real users on the net they're connecting from. I don't think they're using the os_chgwhois module though, because if I could change whoises, I wouldn't show the connecting server as services. Still it's interesting how they're spoofing the CTCP Version response, but forgot the connecting server hey Wink

katsklaw · Posted: Nov 12, 2010 9:01am Post subject:

What makes you think they are spoofing versions anyway? Why can't the 33 users that replied as an eggdrop actually be eggdrop bots?

Personally I didn't seen any eggdrops, but that's because I only versioned those connecting from services.* and all of those I versioned came back as Anope bots, set private or otherwise.

Modified ircd? custom Janus? I think we are reaching a bit far with so little information in hand. Those ideas seem a bit complex considering what we are seeing can easily be done with unmodified Anope and unmodified eggdrop. Why must the solution always be complex?

Another point is if this person was capable of modifying an ircd and/or Janus in such a way, why would they be making the users seem to be Anope Bots or eggdrop bots? That just doesn't make sense to go through so much trouble to spoof something that can already happen in vanilla software that they are already using.

I can reproduce this exact same thing with nothing more than Anope.

Trixar_za · Posted: Nov 12, 2010 1:30pm Post subject:

Like you said a customised IRCd and Janus would require too much skill and effort to get right. Mind you, it's probably not that hard to modify the luser code if we tried. Still it would require a recompile to work.

That said, your point about we being able to do it with an unmodified Anope is sound. It's probably the easiest, especially if you make a quick while loop mIRC script to generate the stuff for you from files.

As for eggdrops... well, here's the thing. You can only connect 1 eggdrop at a time per process. Each would need 1 conf file for it and 1 process. I doubt most shell host would allow you to run 30 or more processes JUST for eggdrops. The alternative (and it can be done with TCL), is that you could write multiple sockets, but then again, it would show up as a real user on the connect server. The socket eggdrops would also have no version reply unless coded to do so.

So this makes me think that our friend has a 1 or 2 eggdrops running, while creating mass private botserv bots to help fill up his servers. I'm yet to go back and try /whois 0 o to see what would happen Razz

(Probably a flood of bots in my /who screen Wink

)