Slashdot Mirror
Freenode Network Hijacked, Passwords Compromised?
tmandry writes "The world's largest FOSS IRC network, FreeNode, was hijacked (for lack of a better term) by someone who somehow got a hold of the privileges of Robert Levin, AKA lilo, the head honcho of FreeNode and its parent organization, PDPC. To make matters worse, the passwords of many users may have been compromised by someone posing as NickServ, the service that most clients are configured to send a password to upon connecting, while they reconnected to the servers that hadn't been killed. Of course, if someone was able to nab lilo's password, every user password may have been ripe for the taking. The details are still unknown, but these events raise scary questions about the actual security of FreeNode and other organizations like it."
Not my fake password I use for insecure places all over the internet! What ever will I do!
Ok, seriously, who here uses an important password on Freenode (or any IRC network) for NickServ? I certainly don't. Hell, my Slashdot password is more important than the one I use on IRC and the one I use here isn't even that secure...
I have no sympathy for someone that has an "at risk" password on IRC.
*Don't auto ident during connect
*Don't use multiple passwords
*Change password after someone got ahold of it
*Realise that it's just a goddamn nickname
perpetually dwelling in the -1 pits
I am more that familiar with ircd and security
(having run a server network for better than 5 years).
Rule #1, the admin password is NEVER stored in nickserv.
anyone who does this deserves whatever it is they get!
its better to mod the conf file and do a command rehash
from the cli.
Understanding is much like a 3-edged-sword. in this: there are always 2 sides and the truth.
As an admin on another IRC network, I'm actually quite surprised that the ircd would let someone take the nick nickserv... or at least, if it's permitted to happen, that there isn't some alternate authentication mechanism that guarantees it only goes to a legitimate recipient (i.e. /nickserv or /msg nickserv@services.ircnetwork.net or whatever). Fortunately, my password on there is intentionally weak.
On the other hand, I understand what it's like to have compromised servers on the IRC network. I wish them the best in their efforts to get things working smoothly again. Tracking down the culprits can be exceedingly hard and time intensive, and reloading rooted servers is never fun.
Since when does any administrator have actual access to anyones password? I can see them having the ability to change their password to something else.. but comon. Shouldn't / wouldn't these be encrypted and only accessable remotely?
The largest FOSS IRC network stores all its user passwords in plaintext, not a hash against which incoming passwords can be checked? Its superuser could look at any password they wanted?
It's a good think that firetrap finally collapsed publicly. It should have happened much earlier, before its loss damaged so many people.
--
make install -not war
You may not know how right you are, I've been calling Freenode "Animal Farm" for weeks - Patrick McFarland (a.k.a. Diablo-D3) has been highlighting some of what's wrong with freenode and in doing so has become their "snowball" - he is literally blamed for everything that goes wrong on freenode, including the recent torbot attacks and no doubt this most recent one as well.
I don't understand why there would be any greater implications from this event than any other. All kinds of organizations have been compromised; this is far from news, and just another example of why most security experts recommend a "multi-tiered" password scheme for users. A set of passwords, of varying importance...for the most critical things, a longer and stronger password, another middle-level password to use at other sites of lesser importance (like webmail) and a throwaway password for things that don't matter to you so much. Best of all, use unique passwords for the high-importance site, if you use something like Password Safe for Windows, KeePass for Linux, or Keyring for PalmOS to keep track of them securely.
For your security, this post has been encrypted with ROT-13, twice.
It says "the passwords of many users may have been compromised by someone posing as NickServ".
This doesn't mean that someone found a plaintext list of all the passwords. If you want to find out if there even is one, then download the source code for hyperion and look for yourself.
What it does suggest is that someone /nick'ed to NickServ and consequently could see all the passwords of people joining then they were /msd'ed.
If this had happened to a Microsoft Server the comments would be off the wall about how this PROVES BEYOND DOUBT THAT WINDOWS REALLY SUCKS. (Bold characters intended to fool moderation drones). The hypocrisy on Slashdot is incredible.
Something I hate on Digg is how in each thread of discussion someone feels obliged to explain everything (and how lame stories like "a super set of icons", "learning to program", etc. are posted). And why that?
The cost of joining Digg is null. You join, you digg, you reply. That's how 14 years old are now ruling Digg (while it was originally populated with slashdotters and other tech-oriented websites readers). That's Digg so-called "democracy" (except, in democracy, one is supposed [only supposed] to be mature before voting, that's why there's a minimal age, which unfortunately cannot be implemented on Digg; something great would be "you can choose up to 20 domains of expertise, can change only one every two weeks or month, and you can vote only on stories regarding your level of expertise". Plus some incentive to only have one (1) account).
Joining Slashdot is free, but there's a cost when you join: you're eaten alive by grammar and spelling nazis if you don't post correctly, you're eaten alive by an "expert" if you say something technically wrong, you receive negative mod points and get ignored, etc. That's why there are so many accounts and so few posters. And that's how Slashdot has been able to remain readable. I was no newbie when I first start reading Slashdot, but not being a newbie I already knew that you have to understand the subculture and the community first before participating (the same goes for IRC). So I actually registered and became myself a slashdotter years later. Most Diggers are newbies. That's why Digg is good for fresh news and lame for comments, while Slashdot is good for comments (but lame for fresh news). Because we're smarter-than-thou elitists.
The money goes 100% to Lilo. *All* of their servers and hardware are donated. I believe they may pay for their web server, but even then, that's $99/month max?
:)
This is what annoys me most about Lilo's "donation" pledges - he has set up a non-profit organisation with himself as the only paid employee, and receives thousands in donations yearly which all go to him. Oh, and "supplies", which of course are used by the only employee of the organisation. Yet he doesn't make this clear, at all. I believe most people genuinely think they are donating to the network, not the guy who sits there all day running it.
Lets also not forget his latest project, for us to all pay off his debt and buy him a new trailer to live in. Seriously, I'm not joking.
Freenode really, really needs new leadership, fast. Something not controlled by one person, or even if it is, someone competent would be a nice change
It's not "just a goddamn nickname". It's how people on IRC identify you as you. If someone impersonates you successfully and talks to the right people, or uses some bot in your channel, all kinds of damage could be done. Suppose they convince someone to manipulate an account that you hold somewhere, because after all, they know "you". This is why nickserv exists.
I have one question.
Why are you a jackass?
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
...the insecure places are more than the secure ones. Come to think of it, if someone got my password for the insecure places, he could do almost anything posing as me :P
Send email from the afterlife! Write your e-will at Dead Man's Switch.
And it is the type of people like YOU that piss me off. "All hackers write viruses break stuff omgwtf." Chill out. I have found many security flaws, and reported them to the proper authorities. (Fashion Bug...ie, Charming Enterprises) Making it public like this is wrong, but it should have been done on a 1 to 1 basis. People DO listen when things like this may be compromised...
Or what? You'll attack FreeNode further?
Wow. Big deal. A chat service populated by geeks mostly working on open source projects, some of which I bet you use. It ain't big, it ain't clever, and about the most serious effect it'll have will be to annoy some people who will use some other method to communicate for a while. At least until either FreeNode recovers or we all migrate somewhere else.
Seriously. Of all the amazing things you could have done with your tick tick ticking time on this earth you choose to spend it kicking over sandcastles. Big waste. When the rest of us are 80 we'll look back on what we have achieved with life, the things we built, and we'll be proud. When you're 80 you'll look back on your life and think, man, that was so short! Why did I chuck my youth down the drain when I could have been getting shit done?
In that case you are a hacker in the original sense of the word - a competent professional who Gets Things Done.
The OP was complaining about "hackers" in the ZOMG HOLLYWOOD!! sense of the word, usually people who want the thrill of Beating The Man without actually having to do anything dangerous, like getting off their seats.
Damn straight. I will always "test security" and "reporting" when I find a flaw. And to the kids who enjoy destroying / defacing...I hope you are caught. =)
No, it's idiots from Hollywood stealing our word and our name for nothing but an attempt to squash yet another penny from Joe Sixpack and soccer moms.
Bill's henchmen waging a rabid campaign against us don't help, too.
And remember: being a hacker doesn't mean you exploit security holes (for good or ill). It means that you employ a certain approach to programming/doing sysadmin tasks/solving physics problems/etc.
Just because a majority of the mindless part of the society fails to understand a word, the word doesn't change its meaning.
The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Have you ever been 15? Everything is a game. Especially everything on the computer. 0wning this guy's chat server feels about the same as making a slam dunk right over a bigger defender's head, then joking about his mother. Just a game.
At that age, kids have never had responsability, and so are unable to feel empathy for those who they are harming.
I was an ornry teenager once, too. I recall sending ATH0 pings, sending OOB packets, mounting unprotected file shares, and feeling a thrill every time I one-upped these older, smarter people. The internet was just a Nintendo game to me.
This kid, like the others, is no more of a jackass than any other kid his age. He will just grow out of it with time, like everyone else.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
Having responsibility and being able to feel empathy are two orthogonal things (their are plenty people with lots of responsibility and little or no empathy). And the ability to feel empathy (and to act upon it to a certain degree) comes a lot earlier than the age 15 for most people.
What kind of silly overgeneralization is this? At 15, there were quite a few kids my age who weren't such assholes, and there were also some others who were. The latter were by far a minority in my case, although of course bullies always manage to get some following among the less strong-willed. I would at least never describe this sort of behaviour as "normal".
Probably, but not necessarily. Some people remain assholes all their life.
Want a high quality FOSS RTS game? Try Warzone 2100!
I mod down anyone who says "I will be modded down for this", regardless of the rest of their comment
I agree. But, some parts of the language are always in flux: "LOL" becomes "roflmfao" or "zomg rofl", "elite hacker" becomes "leet hax0r" becomes "31337 h4x0rz", "Own" -> "0wn" -> "p0wn3d", "crap" -> "gay" -> "ghey", the list goes on. You know this stuff is always going to be in flux, because it's mostly people from the younger generation who use language alone to make them sound cool.
In general, I acknowledge that both "convoluted cogitations" and "r0x0r your b0x0rs" are as correct as the English I'm using.
But, there are a few evoutions (bastardizations) of English that bother me a lot. One is misuse of apostrophies. It's not that hard -- "it's" means "it is". If you can replace "it's" with "it is", use an apostrophie. If you can replace "its" with "your" and have the sentence still make sense, don't use an apostrophie.
Another is the misuse of the word "hacker". Most of the time, when language evolves, the original meaning is not lost -- for instance, it's ok to use "shredder" to refer to a snowboarder, because most people won't be confused when you talk about the "shredder" that sits over a trash can and destroys documents. The problem is that while people haven't forgotten that "to hack" can also mean "to chop", people who know about the Hollywood Hacker will have completely forgotten about the MIT hacker and the Perl hacker. And we don't really have a better word for either of those.
Really. Replacing the MIT hacker with the word "prankster" is akin to replacing the Perl hacker with the word "coder". It doesn't do justice -- hackers are fundamentally different than most "programmers" or "coders". Hackers are neither software engineers nor codemonkies, though they may act as one for work.
I don't think nearly as much is lost when you replace "hacked in" with "broke in", or "hacker" with "cracker".
I don't often evangelize, as much as I love Mac/Linux. I realize that even if I'm 100% right and Windows is utter crap, nothing I say beyond explaining what Linux is (to those who don't know what an OS is) will make them switch. But the Hollywood Hacker is something I take personal offense at. I frequently call myself a hacker and clarify the term shortly after -- "What you call a 'hacker' is really a 'cracker'. The word 'hacker' has to do with a specific kind of clever programmer, and how the same cleverness can apply to other things."
Its as much a true mistake of language as the first word of this sentence.
Don't thank God, thank a doctor!
Words mean whatever people say they mean. It's the very definition of 'tautology'.
This is simply false. Words have an important historical usage context which is not discarded simply because one generation makes the mistake of listening to one badly educated entertainer. I'm not sure where this myth comes from, exactly, but I know not one single linguist who falls short of disgust for the legion of armchair quarterbacks professing this supposed deep understanding of the nature of the lexicon without ever having taken a linguistics class.
Grandparent is, in fact, correct. Words do not change simply because 1/4 of the population is a bunch of douchebags who don't know how to crack a book. When you're 50 and you watch these mistakes melt away in favor of the next generation's crop of errors, and begin to realize that these "changes" are impermanent, because they're merely errors, perhaps you'll begin to understand.
Linguistics is a science with a statistical and mathematical underpinning. Please do not further comment on its nature until you have at least a passing familiarity therewith, thank you.
StoneCypher is Full of BS
I bet there are non 15 years old people who can bring down Freenode to its knees in 5 minutes of time. I bet they hate lilo too.
Thing is they WON'T do such a thing since Freenode is home of many open source projects including stuff Slashdot runs on.
It is more like locking down a ER department for fun.
What the hell is a "news" page for on http://www.freenode.net/ if you're not going to put, "WARNING: Do not identify with a password on IRC right now!!" on the page. The last news posted is from early May!