Rogue 'talk' (ntalk) client ?
Doug Sewell
as I am) get bombed by a rogue talk session - I get the 'talk requested
from' text, followed by a screen full of capital E's then apparently some
ansi characters that leave text blinking on my screen.
It's as if someone built a talk-protocol client specifically designed to
annoy people.
(Even funnier - but this might be an AIX quirk - is that it seems to break
through 'mesg n' on my machine - even though normal talk requests are denied
properly.
I've taken some measures to track where this comes from. I'm considering
replacing the AIX talkd with a hacked one (from the ntalk sources) to
do more tracking.
(I'm reluctantly cross-posting this between alt.irc and comp.security.unix)
--
Doug Sewell (do...@cc.ysu.edu) Left alle... what ?! http://cc.ysu.edu/1/doug
de-moc-ra-cy (di mok' ra see) n. Three wolves and a sheep voting on what's
for dinner -- Bill Gunshannon, bi...@cs.uofs.edu
KevinTX
: It's as if someone built a talk-protocol client specifically designed to
: annoy people.
This is an old, old flaw in most talk daemons that allows control
characters to be passed in the talk request information. Get a better
talkd that filters out the control characters or turn off talk requests.
Any "mesg n" should stop them (they are no different from normal talks).
kevin
--
kev...@paranoia.com || "Ask me no questions, I'll tell you no lies."
(System Administrator) || *Pretty Good Privacy key available by Finger*
Warez want to be Free! || <a href="http://www.paranoia.com/">My Server!</a>
Eric C. Chien
>as I am) get bombed by a rogue talk session - I get the 'talk requested
>from' text, followed by a screen full of capital E's then apparently some
>ansi characters that leave text blinking on my screen.
>It's as if someone built a talk-protocol client specifically designed to
>annoy people.
That is exactly it. It is merely C code that mimics talkd and
sends a ANNOUNCE talk packet. The talk packet that is sent defines the
username that requests a talk as escape code sequences that turn on
graphics mode and thus causes your screen to *mess up*.
>(Even funnier - but this might be an AIX quirk - is that it seems to break
>through 'mesg n' on my machine - even though normal talk requests are denied
>properly.
I am using AIX, and my mesg n works properly. I would contact
your system administration about this problem. Flash.c was available
before it became known to IRCers and could be a general nuisance to your
system.
>
>I've taken some measures to track where this comes from. I'm considering
Good luck. Look at the talkd source. Look at the functions
that generate ANNOUCE(ments). This is the basic code the flash program
uses. By my memory the most I think you could probably track (if anything)
is the hostname of the flasher. Using netstat might help. I would still
let your system administor know that mesg n does not work properly.
I posted a script specific to IRC that will merely clear/clean your screen
if this happens. It might be useful to you, it might not.
I believe it was Subject Header under AntiFlash.
Also, to anyone who did decide to use it, I have noticed on some machines
that an extra ^L needs to be added after the one already in the code.
Otherwise you can manually do it yourself...
...Fingers
wic...@vnet.net
: In article <342k7c$3...@news.ysu.edu>, Doug Sewell <do...@cc.ysu.edu> wrote:
: >as I am) get bombed by a rogue talk session - I get the 'talk requested
: >from' text, followed by a screen full of capital E's then apparently some
: >ansi characters that leave text blinking on my screen.
:
: This is commonly known as a flash on IRC.
It seems like the more recent version of flash doesn't just
throw garbage up on your screen, but if you've got Zmodem
auto-download turned on, it activates your Zmodem transfer
protocol to start receiving. If you're having this problem,
just turn off Zmodem AutoDownload on whatever terminal program
you're using. Going and re-selecting your terminal emulation
inside your term program should reset all the garbage variety
flashes.
wiccan
Eric C. Chien
wic...@vnet.net <wic...@vnet.net> wrote:
>Eric C. Chien (ecc...@hurricane.seas.ucla.edu) wrote:
>: In article <342k7c$3...@news.ysu.edu>, Doug Sewell <do...@cc.ysu.edu> wrote:
>: >as I am) get bombed by a rogue talk session - I get the 'talk requested
>: >from' text, followed by a screen full of capital E's then apparently some
>: >ansi characters that leave text blinking on my screen.
>:
>: This is commonly known as a flash on IRC.
>
> It seems like the more recent version of flash doesn't just
> throw garbage up on your screen, but if you've got Zmodem
> auto-download turned on, it activates your Zmodem transfer
> protocol to start receiving. If you're having this problem,
> just turn off Zmodem AutoDownload on whatever terminal program
Likewise, if mesg n is working properly, you will not have this
problem. The fact that Zmodem AutoDownload is activated is merely due
to the escape/graphics/whachamacallit text/sequence that is sent. This sequece
can be edited to whatever you wish (if you have the source code). I would
advise turning off Zmodem AutoDownload in general because any of these types
of flashes (the escape sequence) can also be put into a channel key and
cause you "grief" while on IRC w/o the abuser/luser having to use talkd.
...Fingers