Skip to content

join flood from user at similar host triggers eggdrop botnet attacking itself #1932

Description

@dchmelik

I use eggdrop/netbots botnets on original (no services) IRC networks and found a serious bug: if a nickname join floods (even due to netsplits) from a similar host as one of the eggdrops themselves (like eggdrop user1@subdomain1.example.com, join flooder user2@subdomain1.example.com) then it can trigger an eggdrop botnet attacking itself (despite each setup user attributes +abfloN, bot attributes +ghp or +gs, and properly connected): they may ban *!*@subdomain1.example.com, then banning and kicking (for 'abusing desync') other botnet members... and it's often the case individual bots will each ban & unban (or vice versa) this in quick succession. My botnet didn't have +bitch nor +revenge* but something triggered a botnet war. Recently I saw three or four botnets in a channel (two or three newer/smaller, not completely configured) have a war because of such a flood (the wraith fork might have the bug also) and two or maybe all botnets had most/all this happen (at least two botnets attacked themselves, not only banning hostmasks, but specifically kicking members of their own botnets). I don't know who ran them, but apparently the join flooder was part of a botnet and got kicked, and automatically invited back in, and reopped, triggering more botnet war. I didn't see in time how it started but have logs.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions