software/RELEASES/ircservices/achurch.org/services/lists/ircservices/2003/003841.html

   1 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
   2 <HTML>
   3  <HEAD>
   4    <TITLE> [IRCServices] Major fizzer worm problem
   5    </TITLE>
   6    <LINK REL="Index" HREF="index.html" >
   7    <LINK REL="made" HREF="mailto:ircservices%40ircservices.za.net?Subject=%5BIRCServices%5D%20Major%20fizzer%20worm%20problem&In-Reply-To=19429.12.149.100.21.1052924584.squirrel%40www.xevion.net">
   8    <META NAME="robots" CONTENT="index,nofollow">
   9    <META http-equiv="Content-Type" content="text/html; charset=us-ascii">
  10    <LINK REL="Previous"  HREF="003840.html">
  11    <LINK REL="Next"  HREF="003842.html">
  12  </HEAD>
  13  <BODY BGCOLOR="#ffffff">
  14    <H1>[IRCServices] Major fizzer worm problem</H1>
  15     <B>Ballsy</B>
  16     <A HREF="mailto:ircservices%40ircservices.za.net?Subject=%5BIRCServices%5D%20Major%20fizzer%20worm%20problem&In-Reply-To=19429.12.149.100.21.1052924584.squirrel%40www.xevion.net"
  17        TITLE="[IRCServices] Major fizzer worm problem">ballsy at mystical.net
  18        </A><BR>
  19     <I>Wed May 14 07:50:48 PDT 2003</I>
  20     <P><UL>
  21         <LI>Previous message: <A HREF="003840.html">[IRCServices] Major fizzer worm problem
  22 </A></li>
  23         <LI>Next message: <A HREF="003842.html">[IRCServices] Major fizzer worm problem
  24 </A></li>
  25          <LI> <B>Messages sorted by:</B>
  26               <a href="date.html#3841">[ date ]</a>
  27               <a href="thread.html#3841">[ thread ]</a>
  28               <a href="subject.html#3841">[ subject ]</a>
  29               <a href="author.html#3841">[ author ]</a>
  30          </LI>
  31        </UL>
  32     <HR>
  33 <!--beginarticle-->
  34 <PRE>   We ust bahamut on our network, and while there is apparently a
  35 patch available (mentioned on dalnet-src@ mailing list) here...
  36
  37 <A HREF="http://www.rezosup.org/download/uptodate/serveurs/ircd/patches/patchs_norm/b">http://www.rezosup.org/download/uptodate/serveurs/ircd/patches/patchs_norm/b</A>
  38 ahamut-1.4.34-release.fz3.patch
  39
  40         we opted to go with small Perl bots (1 per server) instead, which
  41 are +oK which /who all connecting users. If they match a given regex, they
  42 get /zlined (not sure what the equivalent command on other IRCds is).
  43 Basically, they're &quot;banned&quot; before they can even register, before the
  44 server
  45 creates a structure for the user, etc.  These should give us the
  46 flexibility to modify the regex should the pattern change without having
  47 to take the server down to apply a patch.  No apparent resource
  48 implications, other than an ircd.conf file which gets pretty large over
  49 time.  Granted, we're a small network...larger networks may see
  50 performance hits...not sure.
  51         Having services deal with these infected clients will become a
  52 nightmare because its S?Line/Akill list will become huge and unmanageable.
  53 Resource issues are inevitable, as well.
  54
  55 David
  56
  57
  58 Quoth Terrance Thornsley on May 14 at 10:03,
  59
  60 &gt;<i> Our IRC net is one of those targeted by the
  61 </I>&gt;<i> fizzer worm and we are getting huge amounts of
  62 </I>&gt;<i> connects.  Is anyone aware of any
  63 </I>&gt;<i> module/fix/patch for services that we may be able
  64 </I>&gt;<i> to use to ban these connects?  We're currently
  65 </I>&gt;<i> using the most recent ver. of ircservices as well
  66 </I>&gt;<i> as Unreal IRCd.
  67 </I>&gt;<i>
  68 </I>&gt;<i> Any help would be greatly appreciated.
  69 </I>&gt;<i>
  70 </I>&gt;<i> Thanks,
  71 </I>&gt;<i>
  72 </I>&gt;<i> Terry
  73 </I>&gt;<i>
  74 </I>&gt;<i>
  75 </I>&gt;<i>
  76 </I>&gt;<i>
  77 </I>&gt;<i> ------------------------------------------------------------------
  78 </I>&gt;<i> To unsubscribe or change your subscription options, visit:
  79 </I>&gt;<i> <A HREF="http://www.ircservices.za.net/mailman/listinfo/ircservices">http://www.ircservices.za.net/mailman/listinfo/ircservices</A>
  80 </I>&gt;<i>
  81 </I>
  82
  83 </PRE>
  84
  85 <!--endarticle-->
  86     <HR>
  87     <P><UL>
  88         <!--threads-->
  89         <LI>Previous message: <A HREF="003840.html">[IRCServices] Major fizzer worm problem
  90 </A></li>
  91         <LI>Next message: <A HREF="003842.html">[IRCServices] Major fizzer worm problem
  92 </A></li>
  93          <LI> <B>Messages sorted by:</B>
  94               <a href="date.html#3841">[ date ]</a>
  95               <a href="thread.html#3841">[ thread ]</a>
  96               <a href="subject.html#3841">[ subject ]</a>
  97               <a href="author.html#3841">[ author ]</a>
  98          </LI>
  99        </UL>
 100
 101 </body></html>