[Noisebridge-discuss] Anyone know any tricks on removing a Freenode k-line?

[Brian Johnson]

In case anyone was wondering, the ban was removed and here's the response I
got:

It looks likely that someone on your network visited a malicious URL
> designed to disrupt freenode by using your web browser to send spam
> messages to various channels on our network.
>
> I've removed the kline on your IP address, so hopefully you should be
> able to reconnect; to avoid this happening in future, you (or your
> colleagues) should avoid visiting untrusted URLs, particularly with a
> browser which has javascript enabled; if you regularly visit untrusted
> third party websites on the internet, we'd suggest using something like
> noscript to minimise the risk to you of things like this happening.
>
> The URL in question contains some malicious javascript which generates a
> POST request to freenode containing some IRC commands which cause you to
> connect to the network and start flooding messages containing a link to
> the javascript content in question as part of the message. Due to the
> semi-self-propagating nature of this attack and the disruption being
> caused, we're having to remove clients behaving this way from the network
> to prevent further disruption.
>
> The URL tends to to end in /iframe.html (although we've seen it cropping
> up in an obfuscated form via tinyurl.com and bit.ly) and is being fairly
> actively distributed on sites such as slashdot in message comments, so if
> you're a heavy user of freenode it's probably worth being a little extra
> careful on sites like slashdot for the time being!
>

On Sat, Jan 23, 2010 at 1:39 AM, Brian Johnson <noisebridge at dogtoe.com>wrote:

> I received a query as was about to talk about it in #noisebridge. So I
> pasted that message verbatim and was soon banned from Freenode. It turns out
> that, even though their policy doesn't explicitly state it, but Freenode
> does content filter.
>
> I've already e-mailed kline at freenode.net but because it's the weekend it
> "may take a couple days," also due to the fact that "[freenode] is under
> attack!' it may take even longer.
>
> If anyone knows any pointers, or anyone with some ircop power, please let
> me know as I would be much appreciative.
>
> - Brian
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.noisebridge.net/pipermail/noisebridge-discuss/attachments/20100123/41c2ea2b/attachment-0003.html>