OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 4th quarter (Oct-Dec) 1998: Re: Internet Wide DOS Attack using IRC

Re: Internet Wide DOS Attack using IRC

Diane Bruce (dbDB.NET)
Fri, 2 Oct 1998 20:11:38 -0700 

Samuel Cossette says:
>
> I have done my own investigation about it;
>
> First it's not Back Orifice, it's another fuck*** trojan, spread by a DCC
...
> With 500 "clones" they can easily split an irc server with the command
> MOTD :irc.server.net (.do raw command).

  Funny you should mention this one. I coded up the anti-flood code
for ircd-hybrid-5.3p2. This is exactly why 5.3p2 is out.
It slows down MOTD requests plus some other requests...
Its been sucessful in preventing this attack from working.

-Dianora ircd-hybrid coder/EFnet admin
(for the curious, ftp.blackened.com/pub/irc/hybrid/ircd-hybrid-5.3p2.tar.gz)

--
Diane Bruce, http://www.db.net/~db  http://www.db.net email dbdb.net
"Yeah, but it's a great picture of a toaster oven." lathrop at primenet dot com