IRC-Junkie.org – IRC News

All about Internet Relay Chat

Mibbit has been compromised

On August 14 a cracker group claiming to be “hackers” named HTP broke into Mibbit, the popular web chat client for IRC. According to their temporarily “rescue” blog the break-in only affected their IRC network, their primary blog and their Wiki. NickServ passwords in clear text were released later the same day by the HTP, as well as personal information regarding several staff members. Both their IRC O-line passwords as well as their NickServ passwords, home addresses and phone numbers were published to the public via a range of file hosting services, and Pastebin.

Something perhaps even more concerning is that the group has revealed not only channel logs, but logs of private messages. It appears like Mibbit has been logging what people have said in PM to each other over their network. According to official statements, this was only a test. Some people have heard that Mibbit has been logging all messages going through their systems. Mibbit has never logged anything, unless a user wants to enable logging. The leaked message logs were captured by a staff member, and not by Mibbit’s system, according to official statements. While this is fully legal, the level of ethicality has been questioned.

The web IRC client that can be used to connect to almost any other network, which is what made them famous, has not been affected. It is operating normally.

All NickServ passwords were stored in plain text, and that raised a concern for those who are interested and engaged in enforcing security. According to staff member pottsi password hashing was not done because that would “means sendpass and getpass would not work”. Another staff member, Joshua, claimed that password hashing was not done because it was too much work to convert all passwords. This has however proven to be incorrect, at least if they used a plain copy of Anope. In Anope’s module database, there is a module called enc_switchover. It’s fairly easy to migrate from one encryption method, or none, to another, using that module. In addition to that, the Anope module ns_resetpass will allow users to reset their passwords despite encryption taking place.

Many people, especially IRC administrators, are now questioning Mibbit’s reliability and some are considering to block access from the web service, just like one of the largest networks, freenode, did a couple of years ago. This is mainly due to the question whether they log messages there too, which would go against many networks’ policies.

The Mibbit team is now working very hard to bring all services back up again. At the time of writing, ChanServ and NickServ on their network is down and staff members are forced to use /samode if they need to get op. They advice everyone who had a NickServ account registered in April or earlier, this year, to change password.

  Copyright secured by Digiprove

Mibbit webchat updates

Mibbit, the popular webchat client for IRC, once again made a few updates to their service.

In the announcement they write that, due their tremendous growth, have “expanded from having a single backend for Widgets, to having 4 backend servers” which “also gives us failover, and an easy way to update backends without having to kick everyone off”.

Since all backends use the same IP, IRC networks that use Mibbit for their webchat don’t have to change anything.

The new features that were introduced with this update is WebSocket support, a feature currently only available in Google Chrome:

WebSocket is a system that allows a bidirectional tcp connection between browser and server. Mibbit can use this in place of Comet, in order to cut bandwidth and provide a faster experience for users. WebSocket is currently supported in latest Chrome dev channel. If you haven’t tried it yet, Chrome is an awesome webbrowser, especially for webapps like Mibbit.

Also, a lag-meter has been built in which “shows the current lag between your browser and the mibbit server” and even though this doesn’t measure the lag from mibbit to the IRC network they “plan to implement some lag features for IRC later on.” The lag is “logged on the Mibbit server in order for us to improve the user experience” and “if we find that lag from browsers in the UK is high, we may setup a UK backend”.

Closing the announcement they write

Once again, thanks for your understanding when we do have to restart a backend, we’re nearing a time now where we can do complete rolling updates and not have to kick anyone off.

It’s a real privilege to work on something that is used by so many people, and we really do appreciate your use of Mibbit. If you have any thoughts, ideas or gripes, please do feel free to catch me on irc.mibbit.net.

Happy holidays Mibbitians! :D

Happy holidays from here too =)