IRCHelper.co.uk
Please note: This information is *not* guaranteed 100% correct - please email me any errors.

Chex IRC Home
Up
Hacking AustNet

Virtual World Documentation - 2/april/1998

Our IRC servers use virtual world to provide some protection to users who want it against host mask being visible to other users.  If you have this on (which is the default when you log on to server) others will not be able to see your exact hostname.  This can provide some protection against nuking and other banes of IRC life.  Virtual world protection is NOT foolproof - please see the here for more details.

To turn virtual world off, do   /msg nick -x

To turn virtual world on, do   /msg nick +x

Brief explanation: It uses a hash to create a different but unique host for each hostname. This is used to 'cover' up real hostnames from being used as a source of nuking and other attacks. The domain name remains intact. This is not a secure method, since the host can be recovered with brute force (just like your passwd file can be recovered with brute force). This idea is genuinely based on Austnet and Microsoft, with a final one hopefully to be based more on Microsoft. It is not complicated and shouldn't be prone to errors, but the "idea" is likely to have problems.

What it does: It uses ElfHash() to create the unique host, there is a slight possibility of a collision, but that possibility is hopefully 1 in 2^32. There are other hashing algorithms to choose from, but ElfHash is by far the best. DESHash uses your generic off-the-shelf password hashing algorithm, and it requires the crypt library. It uses crypt(). It doesn't work as of this moment. :)

What it needs to know: nothing really, except your hostname.

What options to compile in: Run Config, and make sure you've answered YES to virtual host/alter hostnames.

A simple bypass: /dcc the person and you will get the 'real' hostname. (this also finds out real ip from wingate spoofing users, and can receive an ip for dns spoofing, although the /whois-when-opered should be sufficient). There are even more amazingly simple techniques that can be used. email me any information on other simple techniques to drai2@geocities.com (faster reply, if it still exists by the time you read this).

Problems: possible dcc problems with mIRC and other clients which 'gets' an IP from a /whois or userhost or something similar off the irc server. No fix for this except not to make Virtual World a default mode. (change it in s_user.c)



Dr/icebsd aka David R. S. <drai@hotmail.com>
Updated by Capt Jul 1999