IRC takeover
Encyclopedia
An IRC channel takeover is an acquisition of IRC channel operator status by someone other than the channel's owner. It has largely been eliminated due to the increased use of services
on IRC networks.
; this is called riding the split. After such mass disconnections, a channel may be left without users, allowing the first rejoining user to recreate the channel and gain operator status. When the servers merge, any pre-existing operators retain their status, allowing the new user to kick out the original operators and take over the channel.
A simple prevention mechanism involves timestamp
ing (abbreviated to TS), or checking the creation dates of the channels being merged. This was first implemented by Undernet
(ircu
) and is now common in many IRC servers. If both channels were created at the same time, all user statuses are retained when the two are combined; if one is newer than the other, special statuses are removed from those in the newer channel.
Additionally, a newer protection involving timestamping is used when a server splits away from the main network (when it no longer detects that IRC services
are available), it disallows anyone creating a channel to be given operator privileges.
User timestamping is often used to detect these kinds of attacks in a fashion similar to channel timestamping, with the user who selected that nickname later being kicked from the server. Another protection method, called nickhold, disallows the use of recently split nicknames. This causes fewer kicks, but causes more inconvenience to users. For this reason, timestamping is generally more common. Some servers, such as ircd-ratbox, do both. IRC services
and bot
s can also protect against such attacks by requiring that a password be supplied to use a certain nick. Users who do not provide a password are killed after a certain amount of time.
the computers of channel operators, compromising channel bot shell account
s, having someone add you to a channel service's userlist, or obtaining services passwords through social engineering.
ping responses from broadcast addresses at multiple hosts sharing an Internet address, and forging the ping packet's return address to match a target machine's address, a single malformed packet sent to the "smurf amplifier" will be echoed to the target machine. This has been used to take over IRC servers.
IRC services
Internet Relay Chat services is a name for a set of features implemented on many modern Internet Relay Chat networks. Services are automated bots with special status which are generally used to provide users with access with certain privileges and protection...
on IRC networks.
Riding the split
The most common variety of channel takeover uses disconnections caused by a netsplitNetsplit
In computer networking, specifically Internet Relay Chat , netsplit is the disconnection of a given node from the previously established network or between two nodes. As an IRC network is an undirected acyclic graph, a split between any two nodes splits the entire network into two pieces.Consider...
; this is called riding the split. After such mass disconnections, a channel may be left without users, allowing the first rejoining user to recreate the channel and gain operator status. When the servers merge, any pre-existing operators retain their status, allowing the new user to kick out the original operators and take over the channel.
A simple prevention mechanism involves timestamp
Timestamp
A timestamp is a sequence of characters, denoting the date or time at which a certain event occurred. A timestamp is the time at which an event is recorded by a computer, not the time of the event itself...
ing (abbreviated to TS), or checking the creation dates of the channels being merged. This was first implemented by Undernet
Undernet
The Undernet is the fourth-largest publicly-monitored Internet Relay Chat network circa 2011, with about 12 client servers serving 60,000 users in 11,000 channels at any given time....
(ircu
Ircu
ircu is the name of the IRC daemon software written for and used on the Undernet IRC network.ircu is one of the few servers that is based on the irc2.7 codebase of the original IRCd....
) and is now common in many IRC servers. If both channels were created at the same time, all user statuses are retained when the two are combined; if one is newer than the other, special statuses are removed from those in the newer channel.
Additionally, a newer protection involving timestamping is used when a server splits away from the main network (when it no longer detects that IRC services
IRC services
Internet Relay Chat services is a name for a set of features implemented on many modern Internet Relay Chat networks. Services are automated bots with special status which are generally used to provide users with access with certain privileges and protection...
are available), it disallows anyone creating a channel to be given operator privileges.
Nick collision
Another popular form of channel takeover abuses nickname collision protection, which keeps two users from having the same nickname at once. A user on one side of a netsplit takes the nickname of a target on the other side of the split; when the servers reconnect, the nicks collide and both users are killed from the server. The attacker then reconnects or switches nicks in a second client while the target reconnects, and proceeds to jupe (or block) the target's nickname for a period of time.User timestamping is often used to detect these kinds of attacks in a fashion similar to channel timestamping, with the user who selected that nickname later being kicked from the server. Another protection method, called nickhold, disallows the use of recently split nicknames. This causes fewer kicks, but causes more inconvenience to users. For this reason, timestamping is generally more common. Some servers, such as ircd-ratbox, do both. IRC services
IRC services
Internet Relay Chat services is a name for a set of features implemented on many modern Internet Relay Chat networks. Services are automated bots with special status which are generally used to provide users with access with certain privileges and protection...
and bot
IRC bot
thumb|409px|right|An IRC bot performing a simple task.An IRC bot is a set of scripts or an independent program that connects to Internet Relay Chat as a client, and so appears to other IRC users as another user...
s can also protect against such attacks by requiring that a password be supplied to use a certain nick. Users who do not provide a password are killed after a certain amount of time.
Other methods
Other methods can be used to take over a channel, though they are unrelated to flaws in IRC itself; for example, crackingHacker (computer security)
In computer security and everyday language, a hacker is someone who breaks into computers and computer networks. Hackers may be motivated by a multitude of reasons, including profit, protest, or because of the challenge...
the computers of channel operators, compromising channel bot shell account
Shell account
A shell account is a user account on a remote server which gives access to a shell via a command-line interface protocol such as telnet or ssh....
s, having someone add you to a channel service's userlist, or obtaining services passwords through social engineering.
Smurfing
According to Hypermedia Seduction for Terrorist Recruiting (2007), exploiting ICMPInternet Control Message Protocol
The Internet Control Message Protocol is one of the core protocols of the Internet Protocol Suite. It is chiefly used by the operating systems of networked computers to send error messages indicating, for example, that a requested service is not available or that a host or router could not be...
ping responses from broadcast addresses at multiple hosts sharing an Internet address, and forging the ping packet's return address to match a target machine's address, a single malformed packet sent to the "smurf amplifier" will be echoed to the target machine. This has been used to take over IRC servers.