5 ms·

Reminds me of a bug from the early 00s in a bunch of router firmware, where the router would crash/reboot on receiving a malformed "DCC SEND" message, so people

Reminds me of a bug from the early 00s in a bunch of router firmware, where the router would crash/reboot on receiving a malformed "DCC SEND" message, so people would spam "DCC SEND ANYLONGSTRINGHAHAPWNED" in large IRC channels and watch as half the participants dropped.

ltr_ 2y ago
oh the memories, the CTCP ping with the string "+++ATH0" string on the message, or the `/skin "/con/con"` command on Quake2 online games, and the ";cat /etc/passwd" on old Unix's finger services, fun simpler times, what a mess.
- 1oooqooq 2y ago
  why you think that's gone? treating data as privileged input was never out of fashion. last one in memory: google pixels modem accepting AT for custom firmware things from the outside. recommendation was "disable 4G and 3G until update" (which was the first one they delayed)
kalaksi 2y ago
Similarly, at one time posting "startkeylogger" in IRC would also kill some people's connection because of an antivirus mistaking it for traffic from/for a trojan
- cqqxo4zV46cp 2y ago
  Yep. Then you combined both in the one message for ultimate effectiveness. :)
anothermoron 2y ago
In early 2000 I was playing a stand alone mod for Unreal Tournament 99 called Tactical Ops. UT99 provided an IRC client right in the game and people used it to coordinate matches, when somebody from nato-ladder (North American Tactical Ops Ladder) discovered that spamming a specific character to a player in private message (or even in public channel where the player was) caused the game to crash with nothing to show in the logs. They used it intelligently during tournament, not overusing it, just making a particular player drop at the right moment and probably abused it for sometime before it became publicly known. I don't remember if this was an issue also present in UT99 or just TO.
- thephyber 2y ago
  Tactical Ops. Was that the game with … ? - Steven Seagull - Sylvester Stallion
  - anothermoron 2y ago
    [dead]
tomhallett 2y ago
Is that what AOL Instant Messenger “Punters” used to do?
- cdchn 2y ago
  Very similar, I remember this is how AOHell did some of its tricks.
- nativeit 2y ago
  I remember before AOL’s standalone Instant Messenger became popular, mid-1990s, we could go into AOL chat rooms (and Yahoo’s) and throw inline HTML tags into the chat box, and they’d affect everything below them until we either sent a closing tag, or enough posts came through to finally push it off the top of the screen. It’s kind of wild how long it took them to implement even very basic protections.
- StimDeck 2y ago
  There were some punters that would need a single IM, although I don’t know the exact method, I am pretty sure it was malformed rich text or html. I think most punters sent large amounts of data in many consecutive IMs and hid the local modals so they didn’t punt themselves.
oooyay 2y ago
Idk about a router being susceptible to this but this was a long time bug in mIRC.
- gliptic 2y ago
  mIRC having a security hole with DCC SEND is exactly why some routers decided to filter it. EDIT: Perhaps I'm misremembering this. It seems it might have been due to some bugged port remapping code in the routers.
  - oooyay 2y ago
    Nah, I think you're right. Another poster found an issue with Netgear routers doing stateful packet inspection that ALSO failed. So, it sounds like mIRC had a bug, routers tried to apply some protection and also failed.
    - phire 2y ago
      DCC doesn't work through NAT, as it creates a fresh connection to a random port. That's the entire contents of the DCC send message, the ip/port of the sender and the filename. I'm pretty sure these Netgear routers were trying to create an automatic port forwarding rule so the DCC connection would work through NAT without any configuration.
- pierrec 2y ago
  Everything I can find points to an issue on some Netgear routers. At least some people say that disabling a specific router feature (stateful packet inspection firewall) would fix it, which seems like damning evidence. Presumably the router didn't actually crash, it just triggered the firewall. Interesting bit of archeological security. The fun part is that nothing has improved.
  - oooyay 2y ago
    That's amazing. Thanks for digging that up. Entirely emblematic of early aughts and 90s tech.
Scoundreller 2y ago
A lot of antivirus would do similar things, because they monitor IRC connections and go haywire if they see a message that suggests you’re on a command and control botnet running over IRC
deleted 2y ago
[deleted]

ltr_ 2y ago

oh the memories, the CTCP ping with the string "+++ATH0" string on the message, or the `/skin "/con/con"` command on Quake2 online games, and the ";cat /etc/passwd" on old Unix's finger services, fun simpler times, what a mess.

1oooqooq 2y ago
why you think that's gone? treating data as privileged input was never out of fashion. last one in memory: google pixels modem accepting AT for custom firmware things from the outside. recommendation was "disable 4G and 3G until update" (which was the first one they delayed)

kalaksi 2y ago

Similarly, at one time posting "startkeylogger" in IRC would also kill some people's connection because of an antivirus mistaking it for traffic from/for a trojan

cqqxo4zV46cp 2y ago
Yep. Then you combined both in the one message for ultimate effectiveness. :)

anothermoron 2y ago

In early 2000 I was playing a stand alone mod for Unreal Tournament 99 called Tactical Ops. UT99 provided an IRC client right in the game and people used it to coordinate matches, when somebody from nato-ladder (North American Tactical Ops Ladder) discovered that spamming a specific character to a player in private message (or even in public channel where the player was) caused the game to crash with nothing to show in the logs. They used it intelligently during tournament, not overusing it, just making a particular player drop at the right moment and probably abused it for sometime before it became publicly known. I don't remember if this was an issue also present in UT99 or just TO.

thephyber 2y ago
Tactical Ops. Was that the game with … ? - Steven Seagull - Sylvester Stallion
- anothermoron 2y ago
  [dead]

tomhallett 2y ago

Is that what AOL Instant Messenger “Punters” used to do?

cdchn 2y ago
Very similar, I remember this is how AOHell did some of its tricks.
nativeit 2y ago
I remember before AOL’s standalone Instant Messenger became popular, mid-1990s, we could go into AOL chat rooms (and Yahoo’s) and throw inline HTML tags into the chat box, and they’d affect everything below them until we either sent a closing tag, or enough posts came through to finally push it off the top of the screen. It’s kind of wild how long it took them to implement even very basic protections.
StimDeck 2y ago
There were some punters that would need a single IM, although I don’t know the exact method, I am pretty sure it was malformed rich text or html. I think most punters sent large amounts of data in many consecutive IMs and hid the local modals so they didn’t punt themselves.

oooyay 2y ago

Idk about a router being susceptible to this but this was a long time bug in mIRC.

gliptic 2y ago
mIRC having a security hole with DCC SEND is exactly why some routers decided to filter it. EDIT: Perhaps I'm misremembering this. It seems it might have been due to some bugged port remapping code in the routers.
- oooyay 2y ago
  Nah, I think you're right. Another poster found an issue with Netgear routers doing stateful packet inspection that ALSO failed. So, it sounds like mIRC had a bug, routers tried to apply some protection and also failed.
  - phire 2y ago
    DCC doesn't work through NAT, as it creates a fresh connection to a random port. That's the entire contents of the DCC send message, the ip/port of the sender and the filename. I'm pretty sure these Netgear routers were trying to create an automatic port forwarding rule so the DCC connection would work through NAT without any configuration.
pierrec 2y ago
Everything I can find points to an issue on some Netgear routers. At least some people say that disabling a specific router feature (stateful packet inspection firewall) would fix it, which seems like damning evidence. Presumably the router didn't actually crash, it just triggered the firewall. Interesting bit of archeological security. The fun part is that nothing has improved.
- oooyay 2y ago
  That's amazing. Thanks for digging that up. Entirely emblematic of early aughts and 90s tech.

Scoundreller 2y ago

A lot of antivirus would do similar things, because they monitor IRC connections and go haywire if they see a message that suggests you’re on a command and control botnet running over IRC

deleted 2y ago

[deleted]