[Asmo]

"I am writing to this list because I no longer know where to turn" admin Anthony from Ablenet started his email to the full-disclosure list. "Over the course of the past 2 to three weeks I have watched my services on the Internet become systematically blocked and redirected by no less than 3 major isps in their efforts to stop botnets from connecting to IRC."

What happened was that three major ISPs (TimeWarner/AOL, Verizon and Cox) had set the DNS of the servers from Ablenet to resolve to their alternative IRCd instead of the actual IP, resulting in the users being redirected to the ISPs IRCd. Once connected to this IRCd they were being directed into a channel, where they would be presented by a list of commands intended to remove zombie software. For many years IRC was a popular place for dronerunners to control and command their dronenet from.

"Because we were hit by 3 major ISPs at the same time," Anthony starts explaining to IRC-Junkie in a reaction, "... for a period of approximately one month, we have seemingly lost approximately 75% of our user base, who were either directly affected or peripherally affected and followed their communities to an unaffected network.

The action did not remained restricted to this relatively small network however, also 5 servers from EFnet were caught. One of them is irc.vel.net, with Exstatica as its admin. He explained how he discovered his server was involved as well. "Yesterday July 22nd, The admin-body discovered that a handful of EFNet servers have been "juped". Not only have they taken the irc record, but they've also hijacked the SOA and NS records too."

Anthony tried to contact the ISPs in question but got either no reply at all, or a standard message that resources were too limited to reply. Also Exstatica tried to contact the ISPs; "Yes I've tried, I've contacted the abuse team at cox, they've requested logs, which I provided in the first email, and then gave me a canned response that I need to check my computer for viruses."

Anthony stressed the character of his network was far from being a rogue one that hosted drone networks. "Our network has always been one that relied on their communities, under the premise that people come to irc to share ideas, meet new people and to gather in their own communities. We were never big on the notions of unnatural expansion, inflated, false communities or hierarchies. We're tough on botnets and non-conducive to file sharing... We have (had?) literary communities, fan communities, hobbyists, gamers, etc; pretty much running the gamut of personalities."

Both Anthony and Exstatica have considered legal actions. But as there is no monetary loss and it involves only a violation of the RFC specifications such an action will most likely not be very fruitful.

For Anthony and Exstatica there is one reason left to fight back however, stand for Net neutrality. Anthony: "I also hope that our representatives do something, regarding Net Neutrality, to prevent the monopolization of the Internet. This could in some ways be compared to racketeering or a corporate equivalent of China's restriction on the Internet. I firmly believe this to be a constitutional violation to our right of free speech and if we do not act now, when do we act? When will it be too late?"

Reviewing the move from the ISPs, how many drones could have been caught is unknown, it can not be that much as most of the zombie software has since moved from IRC to use P2P and HTTP. Also the text commands can either be given in a private message, channel message or topic. Prefixes range from . to , to & and can be virtually anything, including the word of the command itself, remove, uninstall, etc.

Admins advice users to use alternative DNS servers if they experience these problems when connecting to their IRC network. Since the media attention on this issue started yesterday several DNS records have been restored, of course without an explanation why they have been hijacked in the first place.

Over the past few years this has happened a few times before, but never ona scale as this move, and not involving networks as large as EFnet's.

IRC-Junkie was unable to contact any ISPs named in this article.
_________________
Asmo

webmaster www.IRC-Junkie.org

[katsklaw]

wow! .. now THAT is a good piece of news! thnks Asmo!

[El Rico]

Woah, thats... evil.
Today they hijack DNS entries to clean infected PCs and tomorrow they hijack their competitors entires to re-direct the traffic to their site?
Ok, this might be a bit exaggerated but you get the idea, this is totally the wrong road to follow.

[Asmo]

Very scary move indeed. The whole online world is upside down when Google enters China, but apparently companies in the USA can determine themself as well what their customers can do on the Internet...
_________________
Asmo

webmaster www.IRC-Junkie.org

[katsklaw]

[Asmo]

[bc]

[katsklaw]

[Asmo]

Hmm, when it happened a long time ago, other issues might be involved as well, such as it simply being easier to pull something like that off.

The Internet has far bigger economic importance these days then even as far as 5 years back. ISPs having the power to redirect traffic for any reason or no reason at all without having to explain is a dangerous thing. Its also impossible IMO to at the same time point a finger at for example China if you allow the same thing to happen in your own country.

And this is all beside the issue whether it was a worthwhile action to begin with...

Very strange indeed =D
_________________
Asmo

webmaster www.IRC-Junkie.org

[El Rico]

I found a ZDNet article regarding this matter and I think their point with the Computer Misuse Act is rather interesting.

[Asmo]

[El Rico]

Well, the article states that it was a move by TimeWarner ISPs and some of those are active in the UK as well (not to mention that there are other countries with similar laws where they're active, Germany for example).

And it was more the point of being sued for trying to remove a malicious software that was probably installed by an unlawful act in the first place that made be wonder.
But it is an intrusion into the customers PC without his consent, even if it is with good intentions, so that law should apply.
Unfortunately judges over here in Germany are quite unpredictable when it comes to Internet related cases, so they might even get away with stunts likes this over here.

[Asmo]

Ah I see your point. Removing trojans/virusses/zombiesoftware etc indeed can cause such problems in some countries due to law. Thats viewing it from a different angle legally wise.

I think in the end they can't really have taken THAT many drones at all. I'm sure the amount of users that were innocent and tried to connect to their irc network was substantially more.
_________________
Asmo

webmaster www.IRC-Junkie.org

[phrozen77]

[nenolod]