#Friends-of-irc Channel Classes

Text Flooding Class

***************************

This page should not be taken as legal or medical counsel , but only as recommendation from a collection of sources.

***************************

TEXT FLOODS

One type of harassment that can take place on IRC is referred to as TEXT FLOODING. This basically takes the form of text being sent in large volumes and at speed into the channel. The purpose of this kind of flooding is to disrupt your channel conversation and annoy you.

Although annoying, text flooding on IRC can NOT break your IRC connection.

***************************

1) MANUAL TEXT FLOODING

Dedo dedo la la la Dedo dedo la la la Dedo dedo la la la

khjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkh

jkhjkhjkhjkhjkh jkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjk

hjkhjkhjkhjkhjk

hjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhj

khjkhjkhjkhjkhj khjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkh jkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjk hjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhj khjkhjkhjkhjkhjkhjkhjkhjkhjkhjkhj

***************************

Below is a sample of the kind of file that can be played to the channel in an automated text flood:

/k/+jfZ7mVX4GFI0FaEITgPIyo+XmS+z/ue7/z388yF0brgdmxjrf8J/JoR7+4v/NFr5Ke3N0zT0Mfnv 7RhtHdI9aO9xWmw1dl1nW9sFbsXPyQ3hthZ19X4v4s3vrM3ZiXKVq6zB29TaPvGlx+vZz94O569dYcp+ cGOt94nGzp7csPBnTxFmov3fbLnMI6hO8nbf/XjNHT24m9U7BiaRn4uSk29vYbxbFvvOnzS+JTsCF12B m+n2J9DGkPlRl8XRaZE0an3VXCNPbvBpZRa3402VUPox7S3P3QRZwz26m4UM862WTcfHBL1qWJ/E1/0L o3eNm6AIYcmVpdk41G/jB1sO45+MFRcJMNh7/76aOEGehRKvOAVe5hCM9Ij/RBHX4mfcUY/+Beqt6hBA x6yTHeI02j/9V9sEzovhyJO8N4UJ3q3x0M6CFKdPQUIsmNoEZUhtqKZxuIM9yLo+LTDwfjbjYZP9vaxw elD9pMoG6/yC6PsXQoNHPASQ42PAnz33MTroiVeMoBCzZMkTnTBU+NuCCSCGNuWzoNygrTfQlfHKwDUB Brcwkc7+yYOhl+I+XiTEt67CorJS3in8feAV6jOeJzGYarGpPLo4yyLfoQQ47ob3N7ASCCCIkWRBKUbA dgaWw9iEiMt+ueXfBen09mkKF6SD5LvangELwI4Kz/iiMNN3liizVwpMABqx3OUl1R/N/tZ3Jvc0eNEh d46Fw19ybhDSgtzXhD5g6fDL6G64Nh4PJaj9Vgqhx8U/O3UjAG5ae6qBpalO0ktOWVtP5w9eDgNKv9g9 dU7ynGzAJsNJVIFUXKgA74StK383v49

***************************

2) TEXT FLOODING AUTOMATED BY SCRIPTS

e) Automated Text flood to channel, /notice or /msg Text floods like the well known Tsunami are a familiar part of flood scripts:

TsUnAmIr_____._._._._.-._.-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-._._._._._____lTsUnAmIr^G TsUnAmIr_____._._._._.-._.-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-._._._._._____lTsUnAmIr^G TsUnAmIr_____._._._._.-._.-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-._._._._._____lTsUnAmIr^G TsUnAmIr_____._._._._.-._.-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-._._._._._____lTsUnAmIr^G TsUnAmIr_____._._._._.-._.-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._.-~`~-._ .-~`~-._.-._._._._._____lTsUnAmIr^G

***************************

3) SERVER MESSAGE FLOODS (with or without scripts)

f) Nickflood (nickchange)

Every time a user changes their nick, a message is sent to your client by the IRC server informing you of the change. It follows that if this is done continuously then your client will be flooded with nick change notices.

Many IRC flood scripts have built in high speed nickchange flooding options. While some services (like nickserv) protect against rapid nickchanges by slowing it down or even by disconnecting the flooder, many networks do not.

g) Cycle flood (/part and /join)

Every time a user joins or leaves your channel, a message is sent to your client by the IRC server informing you of this activity. Cycle flooding is when a user continuously parts (leaves) and joins your channel with the purpose of flooding your client with part and join notices.

Many IRC flood scripts have built in high-speed cycleflooding options.

h) Invite request flood

Every time you are invited to join another channel you receive a message to your client asking you to join. Not surprisingly this feature of IRC has also been exploited to annoy users online. With or without the aid if a script, a harasser can send you multiple /invite requests to a non existent channel.

i) DCC request flood

Every time another user wishes to DCC you, you receive a message to your client asking you if you will accept the DCC. This feature of IRC can also be exploited to annoy users online. With or without the aid if a script, a harrasser can send you a never-ending stream of DCC requests.

***************************

4) AVOIDING IRC SERVER DEFENSES

Most IRC servers have a built in protection to prevent text flooding - after about 512 bytes of continuous input within a given time from one user they disconnect that user. Clever harassers however can easily avoid this. Slow flooding can be done with the Playfile command in your Windows client mIRC, (or Playtext in the Mac Client IRCle), instructs your IRC client to play any selected textfile slowly to the channel - this is done slowly enough so that the sender is not disconnected by the IRC server.

The other way a harasser can safely flood your channel without themselves being kicked off by the server is by using multiple clones to flood the channel in relay.

A clone is a multiple connection from the same source. You can make clones either by using an IRC client that will permit multiple connections (IRCle for example permits 10 at once), or by running several identical IRC programs on your computer and making a connection to the same network with each program. An IRC /whois on each clone (/whois ) will reveal the same hostname (connection node+domain name) after the @ symbol, indicating that the user has more than one connection to the network from their computer.

If a user makes a multiple connection to a network of 5 clones, using 5 different servers on the network to do it (to avoid detection from IRCops), then they can mount a very fast and powerful flood attack on another user. Because the clones take it in turns, no one clone is flooding continuously - they are operating in relay - and through different servers - so they are better protected from being kicked off the network by the server. Even if one clone, or several clones are kicked offline, the abuser is still there as long as one connection remains.

IRC attack scripts exist that automate the whole process of clone making and multiple relay text flooding - these are easily available from underground websites and are easy to operate.

***************************

5) DEFENSE AND RESPONSE AGAINST TEXT FLOODING

Text flooding although annoying is easily neutralized by using one of the ignore commands on IRC

i) /ignore nick 3

The use of /ignore nick 3 instead of just /ignore nick means that the ignore command has the ability to follow nick changes. A normal /ignore will only be effective until the flooder changes nicks. /ignore 3 in fact places an /ignore on the hostmask of the flooder rather than the nick.

ii) /silence hostmask

Text flooding is not going to break your IRC connection, but you may prefer to /silence since people who text flood will also probably be CTCP flooding, and CTCP flooding CAN break your connection.

Preferred /silence masks are either:

U@H (User@ Host): /silence *!*user@*.host

or

Hostname: /silence *!*@hostname

iii) kick/ban

The appropriate response to text flooding from Chanops depends on whether the flood is a high speed scripted flood (premeditated) or a slow flood being done manually (more often done without premeditation).

For a slow, low volume flood Ops should follow a 3 strikes policy:

For a high speed high volume flood Ops should kick/ban immediately. If flooding of the Op continues in /msg or /notice, then use /ignore 3, /silence *!*user@*.host or /silence *!*@hostmask

Notice that all warnings should be given in /notice or /msg and never in the public channel. This is to avoid humiliating the flooder, which will only escalate the situation.

***************************

Cyberangels are a wonderful orginization on the web that can help anytime you find yourself in trouble , many thank to them for much of the informatin I will be presenting in these classes.

***************************

Friends-of-irc's Class Directory:

"http://www.oocities.org/friendsofirc/class.html"