Rogue 'talk' (ntalk) client ?

24 views
Skip to first unread message

Doug Sewell

unread,
Aug 31, 1994, 3:04:11 PM8/31/94
to
Every so often I (and others that happen to be on the same IRC channel
as I am) get bombed by a rogue talk session - I get the 'talk requested
from' text, followed by a screen full of capital E's then apparently some
ansi characters that leave text blinking on my screen.

It's as if someone built a talk-protocol client specifically designed to
annoy people.

(Even funnier - but this might be an AIX quirk - is that it seems to break
through 'mesg n' on my machine - even though normal talk requests are denied
properly.

I've taken some measures to track where this comes from. I'm considering
replacing the AIX talkd with a hacked one (from the ntalk sources) to
do more tracking.

(I'm reluctantly cross-posting this between alt.irc and comp.security.unix)

--
Doug Sewell (do...@cc.ysu.edu) Left alle... what ?! http://cc.ysu.edu/1/doug

de-moc-ra-cy (di mok' ra see) n. Three wolves and a sheep voting on what's
for dinner -- Bill Gunshannon, bi...@cs.uofs.edu

KevinTX

unread,
Aug 31, 1994, 6:11:09 PM8/31/94
to
Doug Sewell (do...@cc.ysu.edu) wrote:
: It's as if someone built a talk-protocol client specifically designed to
: annoy people.

This is an old, old flaw in most talk daemons that allows control
characters to be passed in the talk request information. Get a better
talkd that filters out the control characters or turn off talk requests.
Any "mesg n" should stop them (they are no different from normal talks).

kevin
--
kev...@paranoia.com || "Ask me no questions, I'll tell you no lies."
(System Administrator) || *Pretty Good Privacy key available by Finger*
Warez want to be Free! || <a href="http://www.paranoia.com/">My Server!</a>

Eric C. Chien

unread,
Aug 31, 1994, 9:38:36 PM8/31/94
to
In article <342k7c$3...@news.ysu.edu>, Doug Sewell <do...@cc.ysu.edu> wrote:
>as I am) get bombed by a rogue talk session - I get the 'talk requested
>from' text, followed by a screen full of capital E's then apparently some
>ansi characters that leave text blinking on my screen.

This is commonly known as a flash on IRC.

>It's as if someone built a talk-protocol client specifically designed to
>annoy people.

That is exactly it. It is merely C code that mimics talkd and
sends a ANNOUNCE talk packet. The talk packet that is sent defines the
username that requests a talk as escape code sequences that turn on
graphics mode and thus causes your screen to *mess up*.

>(Even funnier - but this might be an AIX quirk - is that it seems to break
>through 'mesg n' on my machine - even though normal talk requests are denied
>properly.

I am using AIX, and my mesg n works properly. I would contact
your system administration about this problem. Flash.c was available
before it became known to IRCers and could be a general nuisance to your
system.


>
>I've taken some measures to track where this comes from. I'm considering

Good luck. Look at the talkd source. Look at the functions
that generate ANNOUCE(ments). This is the basic code the flash program
uses. By my memory the most I think you could probably track (if anything)
is the hostname of the flasher. Using netstat might help. I would still
let your system administor know that mesg n does not work properly.

I posted a script specific to IRC that will merely clear/clean your screen
if this happens. It might be useful to you, it might not.
I believe it was Subject Header under AntiFlash.
Also, to anyone who did decide to use it, I have noticed on some machines
that an extra ^L needs to be added after the one already in the code.
Otherwise you can manually do it yourself...

...Fingers

wic...@vnet.net

unread,
Sep 1, 1994, 4:48:55 AM9/1/94
to
Eric C. Chien (ecc...@hurricane.seas.ucla.edu) wrote:

: In article <342k7c$3...@news.ysu.edu>, Doug Sewell <do...@cc.ysu.edu> wrote:
: >as I am) get bombed by a rogue talk session - I get the 'talk requested
: >from' text, followed by a screen full of capital E's then apparently some
: >ansi characters that leave text blinking on my screen.
:
: This is commonly known as a flash on IRC.

It seems like the more recent version of flash doesn't just
throw garbage up on your screen, but if you've got Zmodem
auto-download turned on, it activates your Zmodem transfer
protocol to start receiving. If you're having this problem,
just turn off Zmodem AutoDownload on whatever terminal program
you're using. Going and re-selecting your terminal emulation
inside your term program should reset all the garbage variety
flashes.

wiccan

Eric C. Chien

unread,
Sep 1, 1994, 10:18:47 PM9/1/94
to
In article <3444hn$d...@ralph.vnet.net>,

wic...@vnet.net <wic...@vnet.net> wrote:
>Eric C. Chien (ecc...@hurricane.seas.ucla.edu) wrote:
>: In article <342k7c$3...@news.ysu.edu>, Doug Sewell <do...@cc.ysu.edu> wrote:
>: >as I am) get bombed by a rogue talk session - I get the 'talk requested
>: >from' text, followed by a screen full of capital E's then apparently some
>: >ansi characters that leave text blinking on my screen.
>:
>: This is commonly known as a flash on IRC.
>
> It seems like the more recent version of flash doesn't just
> throw garbage up on your screen, but if you've got Zmodem
> auto-download turned on, it activates your Zmodem transfer
> protocol to start receiving. If you're having this problem,
> just turn off Zmodem AutoDownload on whatever terminal program

Likewise, if mesg n is working properly, you will not have this
problem. The fact that Zmodem AutoDownload is activated is merely due
to the escape/graphics/whachamacallit text/sequence that is sent. This sequece
can be edited to whatever you wish (if you have the source code). I would
advise turning off Zmodem AutoDownload in general because any of these types
of flashes (the escape sequence) can also be put into a channel key and
cause you "grief" while on IRC w/o the abuser/luser having to use talkd.

...Fingers

Reply all
Reply to author
Forward
0 new messages