Re: Internet Wide DOS Attack using IRC

[db () DB NET (Diane Bruce)]

Samuel Cossette says:
> I have done my own investigation about it;
>
> First it's not Back Orifice, it's another fuck*** trojan, spread by a DCC
...
> With 500 "clones" they can easily split an irc server with the command
> MOTD :irc.server.net (.do raw command).

  Funny you should mention this one. I coded up the anti-flood code
for ircd-hybrid-5.3p2. This is exactly why 5.3p2 is out.
It slows down MOTD requests plus some other requests...
Its been sucessful in preventing this attack from working.

-Dianora ircd-hybrid coder/EFnet admin
(for the curious, ftp.blackened.com/pub/irc/hybrid/ircd-hybrid-5.3p2.tar.gz)

--
Diane Bruce, http://www.db.net/~db  http://www.db.net email db () db net
"Yeah, but it's a great picture of a toaster oven." lathrop at primenet dot com