COPYRIGHT GUIDE FOR PHOTOGRAPHERS
This document is Copyright ASMP (American Society of Media
Photographers, Inc.) 2013. It is distributed electronically by the
online members of ASMP, as a service and a guide to creators, buyers and
users of intellectual property.
Reproduction and distribution of this document for non-commercial use is
encouraged. Reproduction must remain intact, as a complete whole, and
including this notice.
The original distribution (July, 2012) was via CompuServe Information
Service (CIS). To access ASMP members within CompuServe, GO PHOTOFORUM.
COPYRIGHT GUIDE FOR PHOTOGRAPHERS
by Richard Weisgrau & Michael Remer, Esq.
Copyrights can be valuable intangible assets. The Copyright Act of 1976
made clear that photographers are the copyright owners of their images,
except when those images were made as an employee, or when the
photographer has conveyed the copyright to another party in a written
and signed agreement.
In an effort to enhance understanding of copyright, ASMP has developed
this mini-guide on the subject. This pamphlet is not a legal guide to
the subject. Instead it is intended to give you a fundamental
understanding of the subject of copyright and how it applies in your
profession.
COPYRIGHT BASICS
Copyright is a right, granted to you by law, to control the copying,
reproduction, distribution, derivative use, and public display of your
photographs, and to sue for unauthorized use (infringement) of your work.
This right begins at the moment you fix your photographic expression in
a tangible form, that is, when you create the latent image on film.
Copyright ownership, bestowed automatically when you make an image, does
not depend upon registration with the copyright office or placement of a
copyright notice on the image.
Although most images are copyrightable, some are not. To be
copyrightable, images must be original. Originality is essential to
copyright. If you exactly copy a photograph, the copy can not be
copyrighted, since it has no originality. (In fact if the first
photograph is copyrighted, you would need the original photographer's
permission to copy it.)
Making a substantially similar copy of someone else's copyrighted image
without authorization constitutes copyright infringement. It is usually
necessary to show that the alleged infringer had access to the original
work-but the images may be so closely identical that no explanation
other than copying is possible.
Ideas, themes and concepts are not copyrightable, Only the original
expression of those ideas, themes and concepts in some tangible form,
like a photograph, can be copyrighted. You might have an idea for a
great photograph, but you get no copyright until you make the actual
photograph. An art director might have a great concept, but that
concept cannot be copyrighted.
Having an idea or concept does not entitle one to a share of the
copyright of the photograph. The copyright belongs to the one who makes
the tangible expression of the concept or idea.
COPYRIGHT REGISTRATION
Copyrights can be registered with the Copyright Office in Washington,
D.C. Although registration is not required to own the copyright, there
is one instance in which you must have a registration and another when
there is a definite advantage to registration.
When legal action is necessary to remedy a copyright infringement, the
image must be registered before the legal action can be started. This
registration can be made after the infringement occurs. However, unless
you register before the infringement (or within three months after the
first publication even if after infringement, you will not be able to
sue for statutory damages, which are up to $100,000 per infringement
plus your legal fees. When statutory damages are unavailable to the
copyright owner a claim can still be made for actual damages, that is,
the amount of money lost as a result of the infringement plus the amount
of profits realized by the infringer. But actual damages can be
difficult and expensive to prove, and legal fees can be an additional
burden.
A photographer should always seek legal advice from a qualified attorney
before threatening a copyright infringement action.
COPYRIGHT NOTICE
ASMP recommends that all photographs carry a copyright notice, even
though it is no longer required by law. The lack of notice could
provide an infringer with a defense of "innocent infringement". This
defense could seriously limit the recovery of damages in an infringement
claim.
Copyright notice is a way of saying: This is my work - if you want to
use it, come to me. This stance reinforces the asset value to your work
and alerts everyone that you are prepared to protect that value.
Copyright notice consists of the letter c in a circle (C) followed by
the date of first publication and the photographer's name. For example,
(C)1991 (Creator's Name). The word "Copyright" or "Copr." can be
substituted for the (C). Either form is recognized, but use of the (C)
symbol can give additional international protection. The words "All
Rights Reserved" can also give further international protection.
A word of caution is called for on the subject of notice. Some persons
when typing or wordprocessing and some computer programs use a c in
parenthesis [(c)] as a substitute for a (C) . To the best of our
knowledge this form of notice has never been rejected by a court, but
there is no guarantee that a court would uphold a (c) as proper notice.
The law calls for a (C) or the word "Copyright" or "Copr."
LICENSING THE RIGHT TO USE YOUR PHOTOGRAPHS
As the copyright owner, you have to license someone to use your image
before they can legally do so. A license is simply a permission to use
the photograph with certain limitations.
A non-exclusive license does not have to be granted in writing-although
ASMP strongly urges all photographers to grant licenses in written form.
This avoids subsequent disagreements about the terms of the license. In
the absence of a written license, the photographer and client are in an
awkward position. If a dispute over usage arises differing
recollections of rights granted can only be resolved by negotiation or
legal action. Needless to say legal action, a last resort, is certainly
costly and to be avoided if possible. Negotiation, while suitable to
resolve disagreements, is best done before use begins, not after the
fact. Negotiate the license, then confirm the usage rights in a written
copyright license.
Under the copyright law, an "exclusive" grant of rights means a transfer
of all or part of copyright. Avoid these words, unless you intend to
transfer copyright ownership to the client.
If a client insists or you wish to offer exclusive rights consider
limiting the rights as you would limit any other grant of rights. That
is, you should properly grant the exclusive rights for a certain time
period, a certain geographic area, and a certain media, such as
advertising, books, etc. By applying limitations to the exclusive
license you are narrowing the transfer of copyright. By setting a time
period you are assuring the expiration of the transfer.
More information on copyright licensing, and samples of copyright
licenses can be found in the ASMP FORMS booklet, and in the ASMP
Assignment Photography monograph.
The rights which you license should be based upon the outcome of the
negotiations which you have conducted with your client. Generally, you
will grant rights to meet the particular uses for which the client wants
the work. The fee will usually increase as the bundle of rights granted
increases.
TRANSFER OF COPYRIGHT
You can transfer copyright ownership to another party. Copyright, like
any asset, can be bought and sold. The only requirement in the law is
that a transfer of copyright ownership be in writing and signed by the
copyright owner. Photographers should exercise care in signing client
purchase orders. ASMP has seen many examples of purchase orders which
have a copyright transfer included in the terms and conditions. Signing
such a purchase order would result in the loss of your copyright.
There is no law that says you have to transfer copyright to a client.
Remember, even though the client might be the originator of the concept
or idea this does not entitle them to the copyright of the photograph
which you, the photographer, originate.
WORK FOR HIRE
Work for hire is another way the client can become the copyright owner.
The difference between work for hire and a copyright transfer is rather
simple. In the case of a copyright transfer you own the copyright until
you transfer it. In a work for hire situation you never own the
copyright. It is owned by the client from the moment the work is
created, and the client is by law the author of the photograph. The
photographer is denied authorship and is treated as a tool of the
client.
Work for hire exist automatically in the case of an employee taking
photographs for the employer. As provided in the copyright law, no
agreements are required.
An independent contractor ("freelancer") can do a work for hire only in
certain circumstances. First, the work must be commissioned-that is
specifically ordered by someone, and if it is commissioned, it can be a
work for hire only if the photograph comes within one of the nine
specific categories enumerated in the copyright act as qualifying for a
work for hire:
Contribution to a collective work Contribution to a motion picture or
audio-visual work Translation Supplementary work Compilation
Instructional text Test Answer material for a test Atlas
The category most frequently involving photographers is a contribution
to a collective work such as a magazine or other periodical.
WORK FOR HIRE AND COPYRIGHT TRANSFER DIFFERENCES
Although many see work for hire and copyright transfer as the same
thing, they are not.
Under the law, if you transfer the copyright you can get it back after
thirty five years. This "recapture" provision of the law was designed
to allow photographers the eventual control over their body of work.
Also, when negotiating a copyright transfer you have the ownership and
can bargain for the price of the copyright.
In a work for hire situation you never have the copyright. You have no
recapture right at any time. You are simply selling your services for a
fee. That fee should reflect the present and the future value of the
copyright. If you signed a work for hire and later want the copyright
to the work, the only way you can get it is to negotiate with the
copyright owner to transfer it to you.
Finally, a work for hire will apply to all photographs taken on the
assignment, not just to those used by the client. A transfer of
copyright can be customized and apply to all the photographs or some
portion thereof, such as only those used by the client.
FAIR USE
The copyright law allows someone to copy your work without penalty in
certain cases. This is called "fair use". In order to qualify for "fair
use" the photograph would usually have to be copied for educational,
classroom, news reporting or other educational or public interest
purposes. Fair use is always subject to interpretation. There is no
simple rule to apply to determine when an unauthorized use is "fair
use".
Each case has specific facts that must be examined before such a
determination can be made. This is one reason why it is important to
consult with a knowledgeable copyright attorney before jumping to
conclusions about infringement.
COPYRIGHT AND COLLECTIONS
In recent years the trend has been to invoice the client with terms
stating that the grant of rights to use the photograph is not in force
until the invoice is paid in full. It should be understood that under
this provision nonpayment may be both a breach of the client's
contractual obligation and infringement of the copyright. This can
create a legal question about the best way to enforce your rights - a
question best answered by competent legal counsel.
BUYOUTS AND ALL RIGHTS
"Buyout" and "all rights" are confusing terms and are thought by some to
mean a transfer of copyright However, these terms have inconsistent
trade definitions, depending upon personal understanding, and
consequently are not reliable in licensing terminology.
We urge you not to use such terms In licensing clients the rights to
your photographs. It is better to clearly state whether or not the
copyright is being transferred.
An all rights agreement without a transfer of copyright is a permission
to a client to use your image as desired, while the copyright remains
with you. This gives the client the widest range of rights for the time
allowed in the license without a transfer of copyright ownership.
DEFINITIONS FROM THE COPYRIGHT ACT OF 1976
"Audio visual works" are works that consist of a series of related
images which are intrinsically intended to be shown by the use of
machines or devices such as projectors, viewers, or electronic
equipment, together with accompanying sounds, if any, regardless of the
nature of the material objects, such as films or tapes, in which the
works are embodied.
A "collective work" is a work, such as a periodical issue, anthology, or
encyclopedia, in which a number of contributions, constituting separate
and independent works in themselves, are assembled into a collective
whole. A contribution to a collective work can itself be copyrightable.
A "compilation" is a work formed by the collection and assembling of
preexisting materials or of data that are selected, coordinated, or
arranged in such a way that the resulting work as a whole constitutes an
original work of authorship. The term "compilation " includes
collective works.
A "derivative work" is a work based upon one or more preexisting works,
such as a translation, musical arrangement, dramatization,
fictionalization, motion picture version, sound recording, art
reproduction, abridgment, condensation, or any other form in which the
underlying work may be recast, transformed or adapted. A work
consisting of editorial revisions, annotations, elaborations, or other
modifications which, as a whole, represent an original work of
authorship, is a "derivative work."
A "joint work" is a work prepared by two or more authors with the
intention that their contributions be merged into inseparable or
interdependent parts of a unitary whole. Each joint copyright owner can
grant non-exclusive licenses to third parties subject to a duty to
account to the other joint owners for their share and profits.
"Motion pictures" are audiovisual works consisting of a series of
related images which, when shown in succession, impart an impression of
motion, together with ac-companying sounds, if any.
A "transfer of copyright ownership" is an assignment, mortgage,
exclusive license, or any other conveyance, alienation or hypothecation
of a copyright or of any of the exclusive rights comprised in a
copyright, whether or not it is limited in time or place of effect, but
not including a non-exclusive license.
FOR INFORMATION ON REGISTERING YOUR COPYRIGHT
Registration is handled through the Register of Copyrights, Library of
Congress, Washington, DC 20559. Telephone: (202)479-0700. A 24-hour
"hotline" for obtaining registration forms is (202)707-9100.
Photographers are normally registered in class VA (Visual Arts), except
for bulk registration and some contributions to periodicals. The
procedure for filing is quite simple. The form is self-explanatory; it
is filled out and sent to Washington with two copies of the photograph
(except for an unpublished registration, when only one is required)
along with a $20 filing fee. For registration purposes, every
photograph should have a title, which can be a simple descriptive
caption.
Form VA is the basic form for registering all works in the visual arts.
In addition to photographs as such, it should also be used for
registering the following items when they are primarily or exclusively
photographic in nature: books, advertising materials, and most single
contributions to periodicals. When these items consist primarily of
text, they should be registered in class TX.
If first publication occurs in a separately copyrighted work, such as a
magazine, you can still register the copyright in class VA as a
contribution to a collective work, thus securing the advantages of
statutory damages and legal fees in an infringement case as mentioned
above. This procedure is safer than relying upon the registration of
the collective work itself.
PROPER FORMAT FOR DISPLAY OF COPYRIGHT NOTICE
There are three ways to display a copyright notice:
(C) 2013, (Creator's Name)
Copyright 2013, (Creator's Name)
Copr. 2013, (Creator's Name)
Although all three are acceptable it is generally thought that (C) 2013,
(Creator's Name) is the most widely recognized in the international
community.
NOTICE
The Copyright Act is an everchanging document. Every effort has been
made to make this paper as up to date as possible. This document is not
intended to be legal reference material.
20 Great Google Secrets
20 Great Google Secrets
http://www.pcmag.com/article2/0,4149,1306756,00.asp
excl.gif No Active Links, Read the Rules - Edit by Ninja excl.gif
Google is clearly the best general-purpose search engine on the Web (see
www.pcmag.com/searchengines
But most people don't use it to its best advantage. Do you just plug in a keyword or two and hope for the best? That may be the quickest way to search, but with more than 3 billion pages in Google's index, it's still a struggle to pare results to a manageable number.
But Google is an remarkably powerful tool that can ease and enhance your Internet exploration. Google's search options go beyond simple keywords, the Web, and even its own programmers. Let's look at some of Google's lesser-known options.
Syntax Search Tricks
Using a special syntax is a way to tell Google that you want to restrict your searches to certain elements or characteristics of Web pages. Google has a fairly complete list of its syntax elements at
www.google.com/help/operators.html
. Here are some advanced operators that can help narrow down your search results.
Intitle: at the beginning of a query word or phrase (intitle:"Three Blind Mice") restricts your search results to just the titles of Web pages.
Intext: does the opposite of intitle:, searching only the body text, ignoring titles, links, and so forth. Intext: is perfect when what you're searching for might commonly appear in URLs. If you're looking for the term HTML, for example, and you don't want to get results such as
www.mysite.com/index.html
, you can enter intext:html.
Link: lets you see which pages are linking to your Web page or to another page you're interested in. For example, try typing in
link:http://www.pcmag.com
Try using site: (which restricts results to top-level domains) with intitle: to find certain types of pages. For example, get scholarly pages about Mark Twain by searching for intitle:"Mark Twain"site:edu. Experiment with mixing various elements; you'll develop several strategies for finding the stuff you want more effectively. The site: command is very helpful as an alternative to the mediocre search engines built into many sites.
Swiss Army Google
Google has a number of services that can help you accomplish tasks you may never have thought to use Google for. For example, the new calculator feature
(www.google.com/help/features.html#calculator)
lets you do both math and a variety of conversions from the search box. For extra fun, try the query "Answer to life the universe and everything."
Let Google help you figure out whether you've got the right spelling—and the right word—for your search. Enter a misspelled word or phrase into the query box (try "thre blund mise") and Google may suggest a proper spelling. This doesn't always succeed; it works best when the word you're searching for can be found in a dictionary. Once you search for a properly spelled word, look at the results page, which repeats your query. (If you're searching for "three blind mice," underneath the search window will appear a statement such as Searched the web for "three blind mice.") You'll discover that you can click on each word in your search phrase and get a definition from a dictionary.
Suppose you want to contact someone and don't have his phone number handy. Google can help you with that, too. Just enter a name, city, and state. (The city is optional, but you must enter a state.) If a phone number matches the listing, you'll see it at the top of the search results along with a map link to the address. If you'd rather restrict your results, use rphonebook: for residential listings or bphonebook: for business listings. If you'd rather use a search form for business phone listings, try Yellow Search
(www.buzztoolbox.com/google/yellowsearch.shtml).
Extended Googling
Google offers several services that give you a head start in focusing your search. Google Groups
(http://groups.google.com)
indexes literally millions of messages from decades of discussion on Usenet. Google even helps you with your shopping via two tools: Froogle
CODE
(http://froogle.google.com),
which indexes products from online stores, and Google Catalogs
CODE
(http://catalogs.google.com),
which features products from more 6,000 paper catalogs in a searchable index. And this only scratches the surface. You can get a complete list of Google's tools and services at
www.google.com/options/index.html
You're probably used to using Google in your browser. But have you ever thought of using Google outside your browser?
Google Alert
(www.googlealert.com)
monitors your search terms and e-mails you information about new additions to Google's Web index. (Google Alert is not affiliated with Google; it uses Google's Web services API to perform its searches.) If you're more interested in news stories than general Web content, check out the beta version of Google News Alerts
(www.google.com/newsalerts).
This service (which is affiliated with Google) will monitor up to 50 news queries per e-mail address and send you information about news stories that match your query. (Hint: Use the intitle: and source: syntax elements with Google News to limit the number of alerts you get.)
Google on the telephone? Yup. This service is brought to you by the folks at Google Labs
(http://labs.google.com),
a place for experimental Google ideas and features (which may come and go, so what's there at this writing might not be there when you decide to check it out). With Google Voice Search
(http://labs1.google.com/gvs.html),
you dial the Voice Search phone number, speak your keywords, and then click on the indicated link. Every time you say a new search term, the results page will refresh with your new query (you must have JavaScript enabled for this to work). Remember, this service is still in an experimental phase, so don't expect 100 percent success.
In 2002, Google released the Google API (application programming interface), a way for programmers to access Google's search engine results without violating the Google Terms of Service. A lot of people have created useful (and occasionally not-so-useful but interesting) applications not available from Google itself, such as Google Alert. For many applications, you'll need an API key, which is available free from
CODE
www.google.com/apis
. See the figures for two more examples, and visit
www.pcmag.com/solutions
for more.
Thanks to its many different search properties, Google goes far beyond a regular search engine. Give the tricks in this article a try. You'll be amazed at how many different ways Google can improve your Internet searching.
Online Extra: More Google Tips
Here are a few more clever ways to tweak your Google searches.
Search Within a Timeframe
Daterange: (start date–end date). You can restrict your searches to pages that were indexed within a certain time period. Daterange: searches by when Google indexed a page, not when the page itself was created. This operator can help you ensure that results will have fresh content (by using recent dates), or you can use it to avoid a topic's current-news blizzard and concentrate only on older results. Daterange: is actually more useful if you go elsewhere to take advantage of it, because daterange: requires Julian dates, not standard Gregorian dates. You can find converters on the Web (such as
CODE
http://aa.usno.navy.mil/data/docs/JulianDate.html
excl.gif No Active Links, Read the Rules - Edit by Ninja excl.gif
), but an easier way is to do a Google daterange: search by filling in a form at
www.researchbuzz.com/toolbox/goofresh.shtml or www.faganfinder.com/engines/google.shtml
. If one special syntax element is good, two must be better, right? Sometimes. Though some operators can't be mixed (you can't use the link: operator with anything else) many can be, quickly narrowing your results to a less overwhelming number.
More Google API Applications
Staggernation.com offers three tools based on the Google API. The Google API Web Search by Host (GAWSH) lists the Web hosts of the results for a given query
(www.staggernation.com/gawsh/).
When you click on the triangle next to each host, you get a list of results for that host. The Google API Relation Browsing Outliner (GARBO) is a little more complicated: You enter a URL and choose whether you want pages that related to the URL or linked to the URL
(www.staggernation.com/garbo/).
Click on the triangle next to an URL to get a list of pages linked or related to that particular URL. CapeMail is an e-mail search application that allows you to send an e-mail to
This email address is being protected from spambots. You need JavaScript enabled to view it.
with the text of your query in the subject line and get the first ten results for that query back. Maybe it's not something you'd do every day, but if your cell phone does e-mail and doesn't do Web browsing, this is a very handy address to know.
IRC Warfare Tutorial
The IRC Warfare Tutorial
Written by This email address is being protected from spambots. You need JavaScript enabled to view it.
Version 1.1, 24/9/99
Updated , 7/20/01 by
This email address is being protected from spambots. You need JavaScript enabled to view it.
Converted to HTML by
This email address is being protected from spambots. You need JavaScript enabled to view it.
[Editor Notes]
Please send comments, questions and feedback to
This email address is being protected from spambots. You need JavaScript enabled to view it.
You can always visit us at http://blacksun.box.sk/
[Disclaimer]
We will not help you actualize the things that you will learn here.
The information here is for educational purposes only (for learning how the attacks are done and how to prevent them).
We are not responsible in any way for any damage that might happen to you. This includes software damages and law issues.
[Table Of Contents]
- What is IRC?
- An introduction to the way that IRC works
- Some notes on different IRC networks and their daemon software
- Why IRC wars started?
- What do the others know about me?
- How to spoof / hide your identity on the IRC
- Bans and how to bypass them
- I don't like your nickname... / Getting a user off the IRC
- Can I get caught and will I?
- What are netsplits and how can they help me?
- Channel Takeovers
- How To Completly Ruin A Channel
- Some expansion about RAW sessions
- Faking /ctcp replies
- How to spoof via https proxys
- War Scripts
- Editorial - IRC wars, another perspective
- Some interesting articles by Packet
- Bibliography
[What is IRC?]
IRC stands for "Internet Relay Chat". Jarkko Oikarinen originally wrote it in 1988. Since starting in Finland, it has been used in over 60 countries around the world. It was designed as a replacement for the "talk" program but has become much, much more than that. IRC is a multi-user chat system, where people meet on "channels" (rooms, virtual places, usually with a certain topic of conversation) to talk in-groups, or privately. There is no restriction to the number of people that can participate in a given discussion or the number of channels that can be formed on IRC.
[An introduction to the way IRC works]
All the communications in the world of IRC are done through the server. (This does not includes the DCC (Direct Client Communication) protocol)
When you connect to a server, you send it 2 commands: NICK & USER. These commands are used to identify you on the IRC. Here is the format of the commands:
NICK nickname - Sets your nickname
USER username host server :real name - Set your userid and real name. Host is your host and server is the server you are connecting to.
For example to open a raw IRC session you can telnet to an IRC server on port 6667 or 7000 (the standard ports). Here is an example for telneting my localhost (note: the lines beginning with * have been written by me. The rest are the output I got from the server):
* nick ^TCG^
NOTICE ^TCG^ :*** If you are having problems connecting due to ping timeouts, please type /notice E3AA3478 nospoof now.
PING :E3AA3478
* user ^TCG^ 127.0.0.1 localhost :The Cyber God
:localhost 001 ^TCG^ :Welcome to the DALnet IRC Network ^TCG^!~
This email address is being protected from spambots. You need JavaScript enabled to view it.
:localhost 002 ^TCG^ :Your host is localhost[thegod.actcom.co.il], running version dal4.6.7.DreamForge.win32
:localhost 003 ^TCG^ :This server was created Fri Jul 24 07:48:52 1998
:localhost 004 ^TCG^ localhost dal4.6.7.DreamForge.win32 oiwsghOkcfrRaAb biklmnopstvR
:localhost 005 ^TCG^ NOQUIT TOKEN WATCH=128 SAFELIST :are available on this server
:localhost 251 ^TCG^ :There are 0 users and 0 invisible on 1 servers
:localhost 253 ^TCG^ 4 :unknown connection(s)
:localhost 255 ^TCG^ :I have 0 clients and 0 servers
:localhost 265 ^TCG^ :Current local users: 0 Max: 0
:localhost 266 ^TCG^ :Current global users: 0 Max: 0
:localhost 422 ^TCG^ :MOTD File is missing
:^TCG^ MODE ^TCG^ :+iw
...
ok
As you can see, the second parameter of the USER commands includes my IP. You might be thinking right now that you could enter any IP you want and fake your IP. Well you are wrong. On really older versions of the IRC daemon (Those that were used in Efnet), you WAS able to spoof your IP. But today there are 2 types of antispoof-patches: The one that doesn't care about the IP you entered and connects you using your real IP (which it gets from the socket) and the other one just doesn't allow you to connect to the server until you give your real IP address.
The first method of Anti-Spoofing is most used most in the server version of DALnet and the second is used most by EliteIRCD (which is based on DALnet) and the servers that are based on it.
Now, if it all goes ok then you just opened a raw session to IRC!
All the data transferred to the user (Private Messages/Notices and Channel Events) is transferred from the server. If the user that sent you a message is on a DIFFERENT server than you (but NOT a different network) the message "moves" from the servers until it reaches your server and you. To send someone a message in our raw IRC session type: 'PRIVMSG nick :message' (without the quotes) where nick is the target nickname and message is the message (You must include a : before the message).
When a message moves from server to server it looks like this:
:SenderNick PRIVMSG nick :message
All the IRC commands move from server to server like this. For example when someone uses the NICK command ALL the servers get a notice about it.
[Some notes on different IRC networks and their daemon software]
Different IRC networks have different IRC daemons. It is important to know the futures / limits of the server your network uses. For example, OLD Efnet servers don't know the +b channel mode (ban someone). When trying to start IRC wars you need to know what are the limitations of the server. If it got services, if so does they have a bug that can crash them? Can you obtain Channel Operator in a net-split (we'll get to that)? And so on... During the rest of this tutorial we will discuss different daemon software and bugs, as well as different ways to "get in".
[Why IRC wars started?]
Generally, IRC wars started on the IRC network Efnet. In this IRC network you can't register your nickname so ANYONE can use it. If for example someone logged to this IRC network (By the way, did you know that it is the first IRC network ever (!)) and he saw that his nick is taken. He probably said something like "How Rude?!" or "Mother-F*cker" or anything else. Then he started thinking about ways to get this user off the server. Users started to try many different things on each other and that's pretty much how IRC wars started. Today, users might start IRC wars "just for fun", or for taking over channels they don't like or kicking off users they don't like.
[What do the others know about me?]
OK people! This is actually the first important thing about the IRC wars. Before starting out you need to know what others can find out about you and what can you find out about them.
If you are not connected through a BNC, firewall or a shell (we'll get to this neat stuff later), what I mean, that if you are connected directly to the IRC, using a dial-up for example users can first of all knows your IP. Newbies might say right now, ok... well.... So he knows my IP... who gives a shit anyway?
Well if you said this you are wrong. Let's take a look on my host (resolved IP) for example:
P34.haifa2.actcom.co.il
| | | |_ You can see that my ISP is in Israel, and so am I (unless
| | | I'm dialing to foreign ISPs just to cover my identity, which
| | | is a thing people don't do because of... financial issues).
| | |_ You can see that my ISP (Internet Service Provider) is Actcom
| |_ You can see that I am from Haifa ).
|_My modem number at the ISP's office.
See how many things the host gave you?
1) My ISP
2) My city
3) My country
Now You can also know that if my ISP address is actcom.co.il you can send complains about me to
This email address is being protected from spambots. You need JavaScript enabled to view it.
for example, give them my IP and tell them what I did to you and they will do the rest.
That is what users know about you. Some times you will only see numbers like 19.114.47.1 and not the host. That is because the server failed to resolve your hostname. To resolve it you can download a program called 'nslookup' from somewhere (note: nslookup comes with all Unix systems), give it the IP and it will try to resolve it. Also see the entry 'DNS Servers' in the Newbies Corner.
Now, for those who don't know you can get the IP/host by "whoising" the user.
To do a whois on a user in mIrc, BitchX, IRCii, Pirch and some other known IRC clients all you need to do is type /whois nickname
To whois someone in our raw connection (the one I taught you how to establish at the beginning) type 'whois nickname' (without the quotes)
Here is what I get when I whois my self in the raw connection:
whois ^TCG^
:localhost 311 ^TCG^ ^TCG^ ~TCG thegod.actcom.co.il * :The Cyber God
:localhost 312 ^TCG^ ^TCG^ localhost :test server
:localhost 317 ^TCG^ ^TCG^ 9 932030074 :seconds idle, signon time
:localhost 318 ^TCG^ ^TCG^ :End of /WHOIS list.
Ok, before I explain what you got here, here is the format:
Format: :server-name raw-number sender target data.
Server-name is the server that gives you the data.
Raw-number is the ID of the data you got (it is used to determine what data you are getting).
Sender: the senders nickname (you!!).
Target: The target (The nick you are whoising).
Data: The data.
Now here is an explanation on all the 4 lines
In the first one you see the user-name and the host of the user, you also see his real name:
~TCG thegod.actcom.co.il * :The Cyber God
| | |_ The user's real name (you can fake this :))
| |_ The user host or IP
|
|_ The username (set by IdentD, will be explained later,
when followed by a '~' you see that the IdentD is NOT
running and the Ident (username) might be fake).
The second line:
localhost :test server
| |_ Comment about the server (set by the server admin)
|_ The server that user is connected to
Third line:
9 932030074 :seconds idle, signon time
| |_When the user signed in
|_ How many seconds has he been idle
Last line:
:End of /WHOIS list.
|_ Shows you that there is no more data.
Also, when users know your IP they can start almost any Denial of Service (DoS) attack on your host like WinNuke (Arggg... Lame Lame Lame!!!) or a lovely ping flood that will chew up all of your bandwidth, depending on the attacker's bandwidth (for more info and more sophisticated DoS attacks, see the DoS tutorial at blacksun.box.sk).
[How to spoof / hide your identity on the IRC]
After seeing what users can find out about you, it is time to learn how to hide your identity.
There is no easy and lame way to do this. Here are the most knows ways: FireWall, WinGate and a Bouncer aka (As Knows As) BNC.
We will start from the firewall.
The firewall we are talking about is software that runs on some machine and is used to filter incoming packets (packets that arrive to the machine which is running the firewall) and outgoing packets (packets that are sent from the machine which is running the firewall). Some firewalls are not configured very well and allow anyone to connect to them. The hard part is to find a working one that will allow you to use it to connect through it, and once you are connected, using it so users that will whois you or dns you will see the firewall's IP! If, for example, there is a misconfigured FireWall on the host firewall.someone.com, you can use it in mIRC, for example, by starting the mIRC program (I use the newest version 5.6, go download it at www.mirc.co.uk) and:
1. Click on the Files menu, then Options.
2. On the topmost label of the tree where you can see 'Connect', If you see a '+' next to it click it. If you see a '-' go to the next step
3. Click on the sub-item Firewall (duh...)
4. Be sure the 'Use SOCKS firewall' checkbox is marked (has an 'X' in it).
5. In the Hostname field, write the IP / Hostname of the firewall. For example lets use firewall.someone.com
6. Leave the USER ID and PASSWORD empty, and make sure the port in 1080.
7. Click OK.
Now, next time you will type /server ... To connect to the IRC server the connection will be relayed through the firewall, so if someone will whois you he would see something like this:
:localhost 311 ^TCG^ ^TCG^ ~TCG firewall.someone.com * :The Cyber God
:localhost 312 ^TCG^ ^TCG^ localhost :test server
:localhost 317 ^TCG^ ^TCG^ 9 932030074 :seconds idle, signon time
:localhost 318 ^TCG^ ^TCG^ :End of /WHOIS list.
You can see that my host is NO LONGER thegod.actcom.co.il, instead it is now firewall.someone.com!!
Now I am protected. You might be asking right now where to get the firewalls hosts. One idea is go asking your friends. Other is going to Altavista (www.altavista.com) and searching for "firewall AND list" and stuff like that.
Another way of spoofing your IP is a WinGate. WinGate is software for Windows that is used to let several computers that are connected through a local network of some sort to use one computer's Internet access. It also allows you to fake your IP _EXACTLY_ the same way. After installing WinGate, anyone will be able to use it if you don't configure it well (I personally recommend using SyGate instead). To find Wingate addresses you can ask your friends, run a Wingate scanner that will scan whole subnets for Wingates or look for lists on the web.
Note: newer versions of the IRC daemons will automatically check for an open Wingate or a firewall, and if they will detect one they will kill your session and might even K-Line (Ban the host from using the server/network) the host as well.
Now, on to the Bouncer (aka BNC) spoofing.
Bouncer is software that runs on Unix computers. If, for example, there is a BNC on bnc.shell.com on port 1234, you can connect to it by typing: /server bnc.shell.com 1234
After that you should be getting something like this:
-BNC- Please type your password via /quote pass
Crap... You need a password. If you know the password you have no problem. Just type '/qoute pass password' (without the quotes), and replace 'password' is your password.
If you don't know the password you need to ask the guy that gave you the BNC (or you could always hack the server... ;) but this tutorial is about IRC warfare, not hacking servers and getting passwords). You should also ask him if it (the BNC) has vhosts. Vhosts are multiple IPs and hostnames for the same BNC. If it has vhosts, you can set your active host by typing '/quote vip the.host.name.here' (as you should be able to figure by now, it is done without the quotes).
After this you type '/conn server'. For example /conn irc.dal.net will connect you to irc.dal.net with the bouncer's host.
Note: unlike firewalls and badly configured Wingates, the server cannot detect a BNC, so there is no chance you will be banned for using it.
[Bans and how to bypass them]
Channel Operators might ban you after you have done something in their channel that made them angry :( .
To bypass a ban you first need to know the ban type. There are a few ban types:
1. nick!*@* - Bans you by your nickname. All you need to do is change your nick (by typing /nick newnick, or in raw session NICK newnick) and you can reenter the channel.
2. *!user@* - Bans you by your Ident (UserID). If your computer is not running an IdentD daemon (A win9x with mIRC for example) you can easily change your Ident by clicking on the File menu, selecting Options, opening the 'Connect' sub-tree, clicking the IdentD label and changing the User ID. If you are under a Unix / Linux machine that is already running an IdentD daemon, you can't change it because it automatically sets your ident username to your login name. To change this you need to logon to the IRC through a Bouncer because bouncers fake you IdentD.
3. *!*@host - You are banned by your IP / host. All you need to do is to connect through a firewall or a Wingate.
Some times the bans are more complex like ^TCG^!*@*.actcom.co.il.
This ban will prevent anyone named ^TCG^ with host that ends with .actcom.co.il
If you are interested here is the format:
Nick!user@host / IP
| | |_ The IP or hostmask.
| |
| |_ Your username. The IdentD sets this. When running IdentD daemon it
| mostly not faked but when running windows or connection through a
| bouncer it is probably faked.
|
|_The user nickname. If might also contain wildcards like *T*C*G*.
This will prevent anyone with the letters T, C and G (in this order)
to join the channel.
Examples: ^TCG!*@*.actcom.co.il
| | |_________The server
| |_Your Ident user (defined as the wildcard '*', meaning ANYTHING)
|_Your nickname
As you probably know, channels have different modes. For example +o to make a certain person an OP (Operator), +b to ban a person etc'. To set a ban you type: /mode #Channel +b nick!user@host and to remove a ban you type /mode #Channel -b nick!user@host
On a raw session you don't need the '/'.
[I don't like your nickname... / Getting a user off the IRC]
The easiest way to get a user off the IRC is using a program called "Click2" for Windows.
If might not always work and it is considered extremely lame, but it might work sometimes.
After you got this program, do the following:
1. Set the "Packets to:" option box to "Clinet"
2. In the Server textbox fill-in the TARGET server. You can figure it out by doing a /whois or a /dns on the target's nickname.
3. In the Client textbox fill-in the TARGET IP address. You can also figure this by doing a /whois or /dns on him but if he uses any spoofing technique like a BNC or a Wingate it won't harm him even a bit (it may harm the Wingate / Firewall / BNC, though).
4. Be sure that you set it to send 64 packets every 1000ms in the 2 textboxes at the end of the window.
5. The client start port should be 1024 and the stop 1500.
6. Now hit nuke....
This is what you will see if it worked and you were in a channel, and the target in also in this channel:
*** Quits: ^TCG^ (Connection reset by peer)
(Or something likes this)
The target should see something like this:
*** [10053] Software caused connection abort
If it is not working, you won't see anything and he won't either. If he is running some packet-logger that logs ICMP packets he will see your IP but most users do not run these.
Another lame way is to try winnuking the address. I won't explain here how to do it and what winnuke is because it has nothing to do with this tutorial (see R a v e N's DoS tutorial for Winnuke information, as well as information on more sophisticated attacks).
Here is a more complex way.
You will need a flood program like "Floods". (Ask me if you want it)
After running it or any other flooding script that is based on clone loading you connect the clones to the target IRC server. (~6 clones should do the job)
Before we continue, I want to explain you how this works.
Each user on the IRC got something called SendQ and RecvQ. They contain the data the user is sending / receiving.
They also have a maximum value. If this value is achieved, the server will automatically close their connection.
Flood programs and flood scripts load clones (computer-operated IRC "users") and start sending lot of crap to the target nick, causing his RecvQ to fill up and he should get disconnected :).
So after you launched the program, you start flooding. I can't tell you exactly how because there are lot of programs and I can't explain you how every one works, but I can help you via my e-mail:
This email address is being protected from spambots. You need JavaScript enabled to view it.
There are also more advanced programs that support clone loading through firewalls and Wingates. When a user loses his connection to the IRC because of such an attack, everyone on every channel he was present on will see the following:
*** Quits: ^TCG^ (Excess Flood)
Another way of disconnecting a user from the IRC is exploiting a bug in his OS. You need to determine his OS and start this attack on him. There are lots of different types of attacks. To learn about them, read R a v e N's DoS tutorial.
[Can I get caught and will I?]
First of all, it depends on what you are going to do or already did.
When you are going to take over a channel for example, if you are doing it without hiding your identity first (See previous chapter) you can get caught but nothing will probably happen to you. You might receive a DoS attack that can terminate your IRC session or lag you like hell. If you are using a bouncer for example, you won't get caught for this. But if you "click" someone and he logs the packets he can e-mail your ISP with your IP and they might kill your account.
If you are killing someone with a netsplit (See next chapter) you won't get caught and nothing will happens to you since you haven't done anything illegal.
Also, it is good to know as much as possible about your target. If you see some one that is named 'Ass^Hole' for example, you have no good reason to go packet him or flood him. He might have access to an OC3 or a DS-3 line (Extremely fast connections to the Internet) and he might also detect your attacks and start flooding you in return. Trust me, you don't want this to happen. One day my T3 line got ping flooded from an OC3 line and it stopped working for about 30 minutes. Just for your information, OC3 can transfer up to 255Mbit and a T3 can transfer up to 9Mbit (I think). If such a line will flood your computer you don't stand a chance.
[What are netsplits and how can they help me?]
Large IRC networks consist of various servers. A NetSplit occurs when a link between one of the servers and the others gets broken because of lag or other reasons. All users that were connected to this channel will be separated from the others as long as the netsplit occurs.
Therefore, lots of channels become empty, and get closed. When you will join a channel that became empty, or you left only 1 user in the channel and you will cycle it, there is a chance that you will obtain the channel operator status (OP, @).
On a NetJoin (When the server relink to the entire network again) you might still have the channel operator status. On new servers, you won't get the operator status when the network is in a spilt mode, but if you could find an old server or network you just might get lucky. Breaking a connection between 2 servers by yourself is very difficult. You need to pick 2 servers that are already lagged and start ping-flooding the target server from a fast connection.
Once a netjoin occurs, it is recommended to have a war script (we'll get to those) that will DeOP everyone on the channel so other OPs won't be able to DeOP you.
NetSplits can also let you disconnect a user from the IRC. Let's say you want to disconnect a user named 'Lamer'. When a netsplit occurs, there are two different possibilities:
1) The target user ('Lamer', in our case) was on the server that did the netsplit and has left the IRC network, but will return once a netjoin occurs (shouldn't take a lot of time).
2) The user is still on the network and has nothing to do with the netsplit.
If number 1 occurs then all you need to do is connect to the network using his nickname and wait for the netjoin. When the servers will re-link they will see that there are 2 users with the same nickname. Such thing cannot possibly happen, so one user must be killed. The user that was NOT on the network, (which means he was on the splitted server) will probably get killed. If option 2 occurs then all you can do is to put a clone (open another IRC sesssion), connect to the splitted server and change your nick to his nick. When the servers will rejoin there is a small chance that he will get killed, so cross your fingers. :)
Now, for the 1,000,000$ question: how do I detect a netsplit? You can detect a netsplit if the user(s) quit message is "Server1 Server2". For example:
Lamar has quit IRC (irc.magic.com irc.freei.net)
| |_Server2
|_Server1
This message tells you that there is a split between irc.magic.com and irc.freei.net
The second server (Server2) is the server that left the net.
[Channel Takeovers]
Channel takeovers are used to take a channel from a user, and prevent him from reentering the channel or gaining operator status in the channel. The first thing you need to do is to get ops. Here are 4 ways to get ops:
1. Via a NetSplit. (might take a lot of time)
2. Asking one of the ops to let you be an op (Who knows? You might get lucky).
3. Running a bot on your computer or on a shell account and telling the other ops that it is online 24 hours a day, and ask them to op it. They might do it, then tell the bot to op you.
4. You can always lure the other ops into giving you op by telling them that you will advertise their channel and bring them users and you might earn the ops status.
You can do nothing without the OP status. Here is what you do after you got an op and you want to close they're channels:
1. First, mass de-op all the users so they won't kick or ban you. There are a lot of scripts out there that will do this for you.
2. Then place a ban on *!*@*
3. Mass-Kick the channel (also with a script)
4. After this set the following modes: +smilk 1 1 (you type /mode #Channel +smilk 1 1)
5. You took over the channel! :)
There is a problem with this, when you will leave the channel he will get empty and then closed. The only solution for this is placing a 24/7 (24 hours a day, 7 days a week) bot in the channel. If channel services are available on this network (Like in DALnet), you can register the channel if no one else have done this already.
If you took over a registered channel, you will have a problem keeping it because Channel Services can give the channel back to its legal owner with no problem.
[How to completely ruin a channel]
Here are some possible ways to completely ruin a channel:
1) Turning the channel into an invite-only channel, so only people who were invited (to invite people, type /invite nick) can join.
2) Making the channel password-protected.
3) Making sure that you are the only OP in the channel and then turning the channel into moderated mode and then mass-devoicing everyone. In moderated mode, only voiced users (people with a little + in the beginning of their nick. To voice people, do /mode #channel +v nick or -v to devoice) can talk. That way, users will be able to see who is on the channel (note: you can see who's on a channel without joining it by typing /names #channel), but they won't be able to chat, and they will have to listen to you... :)
[Some expansion about RAW sessions]
Too lazy to read RFC ?
Well, this is the "SUMMARY" of rfc1459 (IRC Protocol). Hopefully after reading this you'll have better understanding of how the protocol work (hey... don't just use it... try to understand how it work). Yeah... this is also how some people spoof their IP by telneting from some restricted shell account with no IRC client access.
[Connecting to the IRC daemon]
Telnet/netcat (yep... we're gonna use a raw socket) to the IRC port (6667/6668..etc) of the IRC server.
eg <:> telnet irc.dal.net 6667
Send your nick & username to be recognized after u got connected using the user command in this form "user ".
eg <:> user nobody localhost localhost :I'm nobody nick nobody
-------------------------[!! NOTE !!]-------------------------
At any time if your receive anything like this
ping :1234567 <-- The sequence number change all the time
or
ping :192.0.0.1 <-- Some IP address
You must send back the number with a pong
eg <:> pong :1234567
or
pong :192.0.0.1
If you don't pong back, you'll be disconnected with a ping timeout error.
---------------------[!! END OF NOTE !!]-------------------
[Exploring some basic commands]
Ok, after the nick & user commands you can start chatting now. Type join #channel (Without the /) to join #channel.
(Yea... most commands you use in your BitchX or mIRC client can also be
used here too...just don't include the /
eg: part #channel
quit :I'm out
etc... )
To send your message to a channel, use the privmsg command.
eg <:> privmsg #channel : Hi guys...Sup? (Dont forget the ":" if you are going to send more then one word)
This will send "Hi guys...Sup?" to #channel
To send a private message to a user:
eg <:> privmsg nickname : HI ya
This will send "HI ya" to nickname.
To set a mode on a channel you simply type mode #channel mode.
For example, MODE #Channel +b 192.114.*.* will ban everyone that they're IP begin with 192.114.
[Fun stuff to do]
If you get something like this ":nick!user@ip-address PRIVMSG your-nick :_VERSION_"
this means that nick is trying ctcp/version you. This command is used to find out your version.
Send the version back using the NOTICE command... it could be anything you want.
eg : NOTICE nick :_VERSION Telnet version 0.1 :) _
This will send "Telnet version 0.1 :)" as the version reply.
Now many of you guys chat and have various people always doing{Client for Client Protocol} CTCP replies, ie. VERSION, TIME, FINGER, PING replies on you. These replies can get you in a lot of trouble, mainly its a way for people to gather information about you then start up an attack. Now it is time to change the replies your mirc will give in a way to cause the other end to be fooled. Well this topic has been covered by many writers and warscript developers, but many don't know about changing the replies to their advantage, well look no further, here we go!
One of the most devistating attacks can come from a VERSION reply.
To do a ctcp version reply on a user, all you have to do is type:
"/ctcp <nick> VERSION " This will return the nick's irc client. Now you may ask why is that important? Well lets say your using mirc 5.7x which suffers from heap overflow of 217 bytes, and 5.8 heap overflow of 226 bytes by knowing your version an attacher already knows which operating system your using and a version, so they can hack you without a trojan and you won't know it happened.
Lets kill the version reply to either give a fake reply or no reply at all so they can sit there waiting, lol.
Okay you will need a hex editor for this, I recomment Hiew, get it here!
-make a backup of your mirc32.exe.
-install hiew, load it up, once you have clicked mirc32.exe now you will see some garbage, click F7 that should popup the search box, type in VERSION you should be able to find the reply something like mIRC32 v5.8 K.Mardam-Bey. Now just delete the reply. If you have trouble doing it with Hiew then get another hex editor, there are many around but its the best. So save and exit. Now you can chose to have no Version reply to make your attacker suffer from waiting when there isn't going to be a reply or you can fake your reply to trick him.
Lets trick the attacker:
Load up you mirc, then goto the tools menu, then click " Remote ". There you should see a box,
now simply write this mini script,
|
ctcp 1:VERSION:{ |
So now we have faked our ctcp reply it should look like this, if we faked it to have no reply
/ctcp Mikkkeee VERSION
-> [Mikkkeee] VERSION
-
[Mikkkeee VERSION]
-
Well now the attacker will keep waiting and waiting.
Lets fake some more,
Another ctcp reply that can be of usage is /ctcp <nick> PING
This reply of your ping will tell the attacker the speed of your connection and if your lagging, wink wink he might want to do a dos attack and boot you, so lets fake the reply to our advantage.
Same as above write this mini script in our tools, then "remote"
|
ctcp 1:PING:{ |
Usually I have mine set to 1 sec , but you can make it funny like 690263165 sec, which would leave the attacker fooled/confused.
Another reply that can cause you a bit of harm is /ctcp <nick > TIME which will send the other user, your local time/date. This is very bad cause if your busy trying to bounce your ip over wingates and proxys and now your ip is somewhere in Asia, and someone does ctcp TIME then they will know your true location in the world, which can hurt your spoofing tricks.
So lets fake it to our advantage!
|
ctcp 1:TIME:{ |
your new time can be something like, Tue Jun 12 22:23:17 1989 be creative!
Another ctcp reply that can be used to gather some info on you is /ctcp <nick> FINGER
its not a big deal but it simply replies what you have told it to reply, so just fake everything.
hope that helps!
[How to spoof via https proxys]
Now this idea is very creative, and I just found a little program that you can use to do it. It is called ThroughTheFire 0.9 which is able to spoof your ip via https proxys. It is a new innovation in spoofing, lol !You can also use this program to spoof telnet and i guess ftp sufing. Well all you have to do now is find working https proxy lists. To do so just type in ww.altavista.com
+"Https proxy" and you should get some results, maybe not working results. Read the
Search Engines Ripped Apart tutorial to see other methods on using search engines.
[War Scripts]
War scripts are usually scripts for IRC clients that contain features like Mass DEOP / Kick, channel takeover options, nukers, flooders, clones and sometimes bots. Some scripts even contain some nice and funny features that don't necessarily have something to do with IRC Warfare.
In this section I will briefly cover some of the more known war scripts and their features.
7th Sphere Script (c) 1996-1997 7th Sphere Enterprises
This email address is being protected from spambots. You need JavaScript enabled to view it.
- http://www.7thSphere.com
Pros: Easy setup, Nice protections, Automatically runs the Click nuker and fills-in all the needed values.
Cons: Protections are not customizable enough. Channel Takeover doesn't mass kick / ban the channel.
TRiBE (t7) By kefz(tribe)
Pros: Excellent protections, Excellent socket flood clones and firewall flood clones. The best I have ever seen! Comes with a great set of utilities. Can automatically run click with all the options pre-configured. Excellent set of scripts / clients / bots exploits / backdoors.
Cons: None! Go get this script now!
Peace and Protection 4.0
Pros: Get it and see for your self, simply a work of art!
Cons: Too many good tools, lol
Wang Script 3.5 pro
Pros: Wang Clone, Trojan scan, Password protection, nickname find, ctcp masking, email checking/sending, clone scanner, anti takeover, info finder, takeover, fake dcc's, telnet, wartools addons.
Cons: NONE!
[Editorial - IRC wars, another perspective]
Note: Most of this is taken from an article that was written by Ntd (
This email address is being protected from spambots. You need JavaScript enabled to view it.
). I feel that this article has the best perspective about the IRC wars.
Note 2: If you are a newbie and you think IRC wars are a great form of hacking, and doing complex attacks you might want to skip this chapter and read it another time.
IRC WAR? A LOAD OF SILLY NUKES
Right, first things first, nukes - or properly, Denial of Service (DoS) attacks - are technically nothing to do with IRC war. They operate directly from the attacker to the victim's IP, and IRC comes into it only inasmuch as it gives the attacker a ready source of IP addresses to attack, and perhaps a "motive" for doing it (e.g, "they banned me!"). But, attackers could just as easily collect IPs from services such as ICQ (which, incidentally, has to be one of the most idiotically insecure protocols ever invented, yet many people who bemoan IRC attack happily run ICQ, and probably don't even check the option to hide their IP which is useless anyway because there are lot of patches that will always show you the IP even if the user chose to hide it).
IRC WAR DOESN'T HELP IMPROVE SECURITY
Surely the stupidest argument against IRC war, is that unlike other forms of hacking, it does not help anybody because it doesn't contribute to increased security. There is a mass of evidence showing quite clearly that this is not the case. Why did Microsoft release a winsock that was not vulnerable to the port 139 OOB nuke? Because that nuke became so widely abused. Why do current versions of mIRC have an option to only enable the identd server during connection? Because mIRC 5.3 had an ident exploit with which mIRC could be crashed. Why, in fact, have flood attacks become so obsolete? Because ircds now contain anti-flood code written directly in response to flood abuse. Of course these attacks are irritating and disruptive at the time, but in the long term they have undoubtedly led to more secure code in operating systems, clients and irc daemons.
IRC WAR IS NOT REAL HACKING
Again, this stems from a misunderstanding of what IRC war is. Essentially there are two types: TCP/IP attacks (ICMP nuke, smurf, fraggle, ping of death) and ircd based attacks (nick collisions, lag collisions, serverops, hacking o:lines, bogus bans). While the first category are almost exclusively "lame cracking" (that is, the user needs only to download a program and can then use it without any actual knowledge), the second category is more ambiguous. I know one person who finds many exploits by working with the ircd code (which is of course almost always free for download) - and finding bugs by working with the source is as "real" as hacking can get. Within a few days of their implementation he found ways of bypassing the ircnet ircd patches designed to protect against open socks servers and deliberate nick collisions. He even found a method by which a normal client could completely crash a server remotely. And what did he do with this knowledge...?
DOS ATTACKS
Yes, they are illegal, and yes they are disruptive. Furthermore, many DoS attacks affect many more people than those targeted, the most obvious example being the smurf attack. I am one of a group of friends who run a few of the biggest channels on ircnet, and these channels are regularly attacked by war groups intent on taking them. I make no exaggeration when I say that several times a week, if not everyday, members of the original channel opers complain that they are being smurfed by members of groups attempting to take the channel. These smurf attacks are capable of taking down entire ISPs and that IRC warriors recklessly use these attacks against single users just to take an irc channel is utterly inexcusable in my opinion.
MOTIVATION
While there are some IRC warriors / hackers like the individual I described above, it is sadly true that there are many more who are acting from more dubious motives. To the people who resort to floods, nukes and such tools just because they are banned from channels, I say: you need to get out more. What, then is my basic point? My conclusion is that IRC abuse and hacking is like any other branch of hacking - it ranges from the incredibly basic and lame to the actually quite skilled and beneficial. At the one end are the classic 13 year old hax0r wannabes with their CLICK.EXE, and I am in no way suggesting these people's behaviour should be excused or tolerated. However, I urge you all to be aware that at the other end of the scale exist talented, knowledgeable hackers discovering and revealing bugs in clients, OSes and ircds by a variety of methods and in doing so making IRC more secure for all of us.
[Some intresting articles by Packet]
=[Ping Flooding]=
1. =What is a ping?=
A ping is a small file (often 32 bytes) that is sent to another computer online,
in which the other computer replys. Basicly it is saying "hello" to another
computer. With this is also shows how long it took for the ping to get there
and back.
2. =So why is this usefull to me?=
Well it can and it can not be usefull. If you are going to play a game like
quake/quake2 on a server, the faster the ping gets there and back the better.
Also, if you are on a fast connection you can nock people of there ISP
temperarily. This is called ping flooding, and can work very well. The best
thing to flood with is a T1 or better. Even if you don't have more than a
28.8 you can lag or kill someone. Here is an example of how ping works
C:\ping 24.131.12.124
this would send a few 32byte packets to that host. Now, this won't do much
by itself...but there are more features to pinging that make it very usefull.
this is the command I often use
C:\ping -l 2800 -t -w 2000 24.131.12.124
(good for 28.8 users)
-l is the size of the packet to send, generaly you want to keep trying higher
numbers till you find the very most there connection can take....soon they
will be to lagged to do much, or get killed. -w is how long it waits till it
decides to time out.... -t keeps pinging the IP untill you hit CTRL+Break
there are some other cool switches like -n wich echo floods them, and -v
witch specifys the Terms Of Service
=[Net Splits]=
1. =[What is a NetSplit]=
The large irc servers work, is they link together to provide less lag and a
local server to many people. They link together so that people can talk and
do what ever and not have to be on the same server. What a netsplit is, is
when one server is lagged enough it breaks off from the rest of the servers
then becoming its own stand alone server untill it merges again.
2. =[Why Does this matter?]=
Well it can and it can't matter....It is possible to take over a channel
through netsplits. So it can matter if you want to protect yourself from
this, or do it yourself.
3. =[How do I protect myself?]=
The only way is to have netsplit protection. Alot of people do not like this
script, and I do not recomend using it unless you think someone is trying to
take your channel. When servers merge it trys to restore the settings as it
was before the split. So if you were a channel operator the server would OP
you, reset the modes etc etc. When someone takes a channel by a netsplit they
get opped by the server, so the script deops anyone who is opped by the server.
If you do use this script, make sure people can op themselves automaticly by
sending you a message. ...
4. =[How do I take a channel through this?]=
First you need a link looker, (which comes with this script). What a link
looker does is search for servers that are about to or have broken off. When
you find a server that has broken off, you need to quickly join that server
and go into the channel you want to take over. If no one else is on that server
you will be a channel operator. But this is not all you have to do, because
when the servers merge again it will deop you. You need to run the Dysnch script
which will fill the channel with bans and diffrent modes. Hopefully it will
screw up the already screwed channel enough that when the merge happens it
thinks you were a channel operator and you keep your OPS. Then you need to
quickly run the takeover script so that none of the netsplit protection (if
there are any) scripts deop you.
=[Advanced Nuking]=
Nuking is fun for the whole family, but sometimes it's not just "wham bam thank you ma'am". On
occasion, it requires you to be a little creative to successfully nuke someone. hopefully
we will give you some ideas on how to become a pheared nuker.
** Open ports:
In order to become a successful nuker, you must learn to find as much information about your
target as possible. One of the most important elements to nuking is finding the right ports
to nuke. the default IRC server ports are 6660-6669, with 6667 being the most commonly used.
One thing you may discover throughout your nuking 'career' is that most servers offer different
ports that are open for IRCing. The easiest way to find out the open ports is to check the
Message Of the Day, for 90% of all IRC servers will list their open ports in the motd. To get
the message of the day simply type '/motd irc.server.net'. This will display the motd and allow
you to find the open ports (usually). Now you can nuke these ports, increasing your chances of
success.
** Their Connection:
Another thing you may want to do is find out whether your target is on a shell account, or a
dial-up account. Under normal circumstances, dial-up users are easier to nuke then shell accounts
for reasons we won't go into right now. To find out which they are using, simply take the last
part of their IP and try to visit to the ISP's homepage. Again, there are many servers that
will describe their services on their web-page. Usually, if their ip is two or three legible
words only interupted by a period, then it is a shell. For instance,
"
This email address is being protected from spambots. You need JavaScript enabled to view it.
" would most likely be a shell account, while
"
This email address is being protected from spambots. You need JavaScript enabled to view it.
" is usually a dial-up.
** Nuking Shell Users:
If you're using windows, you should download a program that will allow you to finger a server.
Cyberkit is a good program, for it has Ping, Finger, Traceroute, etc.
get it at http://www.ping.be/cyberkit/cyber.zip, or go find one of your own. there are hundreds
to choose from. (no we're not being endorsed by cyberkit, it's just a kickass proggie)
Most shell account users will login from a dial-up account, and if finger is running on their
shell, it should display the dial-up IP address. Finger the server and once you know this, use
your nuker to disconnect them from their shell by replacing the IRC server with their shell
account address, and use the IP you found through finger as the client. Use ports 22 24 as the
server ports, in place of 6660 6669. Port 23 is the default telnet port, so nuking from 22 to 24
will effictivly disconnect them from their shell account. this usually causes your target to
quit irc with "Where did my controling terminal go?" quit message. it's pretty funny when it
works.
[Bibliography]
My personal experience.
IRCing with telnet - Understanding IRC protocol, by ech0 Security - HTTP: http://ech0.cjb.net.
Request for Comments (RFC): #1459, May 1993, By J. Oikarinen and D. Reed
Black Sun Research Facility (blacksun.box.sk).
IRC War, Another Perspective - by Ntd
Some articles by some guy named Packet.
The IRC Warfare Tutorial / Written by
This email address is being protected from spambots. You need JavaScript enabled to view it.
| Updated , 7/20/01 by
This email address is being protected from spambots. You need JavaScript enabled to view it.
My ICQ#: 7864557
EOF
All About Movie Tags (what Is A Dvdrip, Cam Etc.)
Original Sources
CAM -
A cam is a theater rip usually done with a digital video camera. A mini tripod is sometimes used, but a lot of the time this wont be possible, so the camera make shake. Also seating placement isn't always idle, and it might be filmed from an angle. If cropped properly, this is hard to tell unless there's text on the screen, but a lot of times these are left with triangular borders on the top and bottom of the screen. Sound is taken from the onboard microphone of the camera, and especially in comedies, laughter can often be heard during the film. Due to these factors picture and sound quality are usually quite poor, but sometimes we're lucky, and the theater will be fairly empty and a fairly clear signal will be heard.
TELESYNC (TS) - A telesync is the same spec as a CAM except it uses an external audio source (most likely an audio jack in the chair for hard of hearing people). A direct audio source does not ensure a good quality audio source, as a lot of background noise can interfere. A lot of the times a telesync is filmed in an empty cinema or from the projection booth with a professional camera, giving a better picture quality. Quality ranges drastically, check the sample before downloading the full release. A high percentage of Telesyncs are CAMs that have been mislabeled.
TELECINE (TC) -
A telecine machine copies the film digitally from the reels. Sound and picture should be very good, but due to the equipment involved and cost telecines are fairly uncommon. Generally the film will be in correct aspect ratio, although 4:3 telecines have existed. A great example is the JURASSIC PARK 3 TC done last year. TC should not be confused with TimeCode , which is a visible counter on screen throughout the film.
SCREENER (SCR) -
A pre VHS tape, sent to rental stores, and various other places for promotional use. A screener is supplied on a VHS tape, and is usually in a 4:3 (full screen) a/r, although letterboxed screeners are sometimes found. The main draw back is a "ticker" (a message that scrolls past at the bottom of the screen, with the copyright and anti-copy telephone number). Also, if the tape contains any serial numbers, or any other markings that could lead to the source of the tape, these will have to be blocked, usually with a black mark over the section. This is sometimes only for a few seconds, but unfortunately on some copies this will last for the entire film, and some can be quite big. Depending on the equipment used, screener quality can range from excellent if done from a MASTER copy, to very poor if done on an old VHS recorder thru poor capture equipment on a copied tape. Most screeners are transferred to VCD, but a few attempts at SVCD have occurred, some looking better than others.
DVD-SCREENER (DVDscr) -Same premise as a screener, but transferred off a DVD. Usually letterbox , but without the extras that a DVD retail would contain. The ticker is not usually in the black bars, and will disrupt the viewing. If the ripper has any skill, a DVDscr should be very good. Usually transferred to SVCD or DivX/XviD.
DVDRip - A copy of the final released DVD. If possible this is released PRE retail (for example, Star Wars episode 2) again, should be excellent quality. DVDrips are released in SVCD and DivX/XviD.
VHSRip -Transferred off a retail VHS, mainly skating/sports videos and XXX releases.
TVRip -TV episode that is either from Network (capped using digital cable/satellite boxes are preferable) or PRE-AIR from satellite feeds sending the program around to networks a few days earlier (do not contain "dogs" but sometimes have flickers etc) Some programs such as WWF Raw Is War contain extra parts, and the "dark matches" and camera/commentary tests are included on the rips. PDTV is capped from a digital TV PCI card, generally giving the best results, and groups tend to release in SVCD for these. VCD/SVCD/DivX/XviD rips are all supported by the TV scene.
WORKPRINT (WP) -A workprint is a copy of the film that has not been finished. It can be missing scenes, music, and quality can range from excellent to very poor. Some WPs are very different from the final print (Men In Black is missing all the aliens, and has actors in their places) and others can contain extra scenes (Jay and Silent Bob) . WPs can be nice additions to the collection once a good quality final has been obtained.
DivX Re-Enc -A DivX re-enc is a film that has been taken from its original VCD source, and re-encoded into a small DivX file. Most commonly found on file sharers, these are usually labeled something like Film.Name.Group(1of2) etc. Common groups are SMR and TND. These aren't really worth downloading, unless you're that unsure about a film u only want a 200mb copy of it. Generally avoid.
Watermarks -
A lot of films come from Asian Silvers/PDVD (see below) and these are tagged by the people responsible. Usually with a letter/initials or a little logo, generally in one of the corners. Most famous are the "Z" "A" and "Globe" watermarks.
Asian Silvers / PDVD -
These are films put out by eastern bootleggers, and these are usually bought by some groups to put out as their own. Silvers are very cheap and easily available in a lot of countries, and its easy to put out a release, which is why there are so many in the scene at the moment, mainly from smaller groups who don't last more than a few releases. PDVDs are the same thing pressed onto a DVD. They have removable subtitles, and the quality is usually better than the silvers. These are ripped like a normal DVD, but usually released as VCD.
Formats
VCD -
VCD is an mpeg1 based format, with a constant bitrate of 1150kbit at a resolution of 352x240 (NTCS). VCDs are generally used for lower quality transfers (CAM/TS/TC/Screener(VHS)/TVrip(analogue) in order to make smaller file sizes, and fit as much on a single disc as possible. Both VCDs and SVCDs are timed in minutes, rather than MB, so when looking at an mpeg, it may appear larger than the disc capacity, and in reality u can fit 74min on a CDR74.
SVCD -
SVCD is an mpeg2 based (same as DVD) which allows variable bit-rates of up to 2500kbits at a resolution of 480x480 (NTSC) which is then decompressed into a 4:3 aspect ratio when played back. Due to the variable bit-rate, the length you can fit on a single CDR is not fixed, but generally between 35-60 Mins are the most common. To get a better SVCD encode using variable bit-rates, it is important to use multiple "passes". this takes a lot longer, but the results are far clearer.
XVCD/XSVCD -
These are basically VCD/SVCD that don't obey the "rules". They are both capable of much higher resolutions and bit-rates, but it all depends on the player to whether the disc can be played. X(S)VCD are total non-standards, and are usually for home-ripping by people who don't intend to release them.
KVCD Thanks for lardo4life for the info
KVCD is a modification to the standard MPEG-1 and MPEG-2 GOP structure and Quantization Matrix. It enables you to create over 120 minutes of near DVD quality video, depending on your material, on a single 80 minute CD-R/CD-RW. We have published these specifications as KVCDx3, our official resolution, which produce 528x480 (NTSC) and 528x576 (PAL) MPEG-1 variable bit rate video, from 64Kbps to 3,000Kbps. Using a resolution of 352x240 (NTSC) or 352x288 (PAL), it's possible to encode video up to ~360 minutes of near VCD quality on a single 80 minute CD-R. The mpeg files created will play back in most modern standalone DVD players. You must burn the KVCD MPEG files as non-standard VCD or non-standard SVCD (depends on your player) with Nero or VCDEasy.
DivX / XviD -
DivX is a format designed for multimedia platforms. It uses two codecs, one low motion, one high motion. most older films were encoded in low motion only, and they have problems with high motion too. A method known as SBC (Smart Bit-rate Control) was developed which switches codecs at the encoding stage, making a much better print. The format is Ana orphic and the bit-rate/resolution are interchangeable. Due to the higher processing power required, and the different codecs for playback, its unlikely we'll see a DVD player capable of play DivX for quite a while, if at all. There have been players in development which are supposedly capable, but nothing has ever arisen. The majority of PROPER DivX rips (not Re-Encs) are taken from DVDs, and generally up to 2hours in good quality is possible per disc. Various codecs exist, most popular being the original Divx3.11a and the new XviD codecs.
CVD -
CVD is a combination of VCD and SVCD formats, and is generally supported by a majority of DVD players. It supports MPEG2 bit-rates of SVCD, but uses a resolution of 352x480(ntsc) as the horizontal resolution is generally less important. Currently no groups release in CVD.
DVD-R -
Is the recordable DVD solution that seems to be the most popular (out of DVD-RAM, DVD-R and DVD+R). it holds 4.7gb of data per side, and double sided discs are available, so discs can hold nearly 10gb in some circumstances. SVCD mpeg2 images must be converted before they can be burnt to DVD-R and played successfully. DVD>DVDR copies are possible, but sometimes extras/languages have to be removed to stick within the available 4.7gb.
MiniDVD -
MiniDVD/cDVD is the same format as DVD but on a standard CDR/CDRW. Because of the high resolution/bit-rates, its only possible to fit about 18-21 mins of footage per disc, and the format is only compatible with a few players.
Misc Info
Regional Coding -
This was designed to stop people buying American DVDs and watching them earlier in other countries, or for older films where world distribution is handled by different companies. A lot of players can either be hacked with a chip, or via a remote to disable this.
RCE -
RCE (Regional Coding Enhancement) was designed to overcome "Multiregion" players, but it had a lot of faults and was overcome. Very few titles are RCE encoded now, and it was very unpopular.
Macrovision -
Macrovision is the copy protection employed on most commercial DVDs. Its a system that will display lines and darken the images of copies that are made by sending the VHS signals it can't understand. Certain DVD players (for example the Dansai 852 from Tescos) have a secret menu where you can disable the macrovision, or a "video stabaliser" costs about 30UKP from Maplin (www.maplin.co.uk)
NTSC/PAL -
NTSC and PAL are the two main standards used across the world. NTSC has a higher frame rate than pal (29fps compared to 25fps) but PAL has an increased resolution, and gives off a generally sharper picture. Playing NTSC discs on PAL systems seems a lot easier than vice-versa, which is good news for the Brits An RGB enabled scart lead will play an NTSC picture in full colour on most modern tv sets, but to record this to a VHS tape, you will need to convert it to PAL50 (not PAL60 as the majority of DVD players do.) This is either achieved by an expensive converter box (in the regions of £200+) an onboard converter (such as the Dansai 852 / certain Daewoos / Samsung 709 ) or using a World Standards VCR which can record in any format.
News Sites -
There are generally 2 news sites for film release for p2p and they are:
nforce - VCD Help
Code:
http://www.vcdhelp.com/
Code:
http://www.nforce.nl.
About Release Files
RARset -
The movies are all supplied in RAR form, whether its v2 (rar>.rxx) or v3 (part01.rar > partxx.rar) form.
BIN/CUE -
VCD and SVCD films will extract to give a BIN/CUE. Load the .CUE into notepad and make sure the first line contains only a filename, and no path information. Then load the cue into Nero/CDRWin etc and this will burn the VCD/SVCD correctly. TV rips are released as MPEG. DivX files are just the plain DivX - .AVI
NFO -
An NFO file is supplied with each movie to promote the group, and give general iNFOrmation about the release, such as format, source, size, and any notes that may be of use. They are also used to recruit members and acquire hardware for the group.
SFV -
Also supplied for each disc is an SFV file. These are mainly used on site level to check each file has been uploaded correctly, but are also handy for people downloading to check they have all the files, and the CRC is correct. A program such as pdSFV or hkSFV is required to use these files.
Usenet Information
Access -
To get onto newsgroups, you will need a news server. Most ISPs supply one, but this is usually of poor retention (the amount of time the files are on server for) and poor completition (the amount of files that make it there). For the best service, a premium news server should be paid for, and these will often have bandwidth restrictions in place.
Software -
You will need a newsreader to access the files in the binary newsgroups. There are many different readers, and its usually down to personal opinion which is best. Xnews / Forte Agent / BNR 1 / BNR 2 are amongst the popular choices. Outlook has the ability to read newsgroups, but its recommended to not use that.
Format -
Usenet posts are often the same as those listed on VCDQUALiTY (i.e., untouched group releases) but you have to check the filenames and the description to make sure you get what you think you are getting. Generally releases should come down in .RAR sets. Posts will usually take more than one day to be uploaded, and can be spread out as far as a week.
PAR files -
As well as the .rxx files, you will also see files listed as .pxx/.par . These are PARITY files. Parity files are common in usenet posts, as a lot of times, there will be at least one or two damaged files on some servers. A parity file can be used to replace ANY ONE file that is missing from the rar set. The more PAR files you have, the more files you can replace. You will need a program called SMARTPAR for this.
Scene Tags
PROPER -
Due to scene rules, whoever releases the first Telesync has won that race (for example). But if the quality of that release is fairly poor, if another group has another telesync (or the same source in higher quality) then the tag PROPER is added to the folder to avoid being duped. PROPER is the most subjective tag in the scene, and a lot of people will generally argue whether the PROPER is better than the original release. A lot of groups release PROPERS just out of desperation due to losing the race. A reason for the PROPER should always be included in the NFO.
SUBBED -
In the case of a VCD, if a release is subbed, it usually means it has hard encoded subtitles burnt throughout the movie. These are generally in malaysian/chinese/thai etc, and sometimes there are two different languages, which can take up quite a large amount of the screen. SVCD supports switch able subtitles, so some DVDRips are released with switch able subs. This will be mentioned in the NFO file if included.
UNSUBBED -
When a film has had a subbed release in the past, an Unsubbed release may be released
LIMITED -
A limited movie means it has had a limited theater run, generally opening in less than 250 theaters, generally smaller films (such as art house films) are released as limited.
INTERNAL -
An internal release is done for several reasons. Classic DVD groups do a lot of .INTERNAL. releases, as they wont be dupe'd on it. Also lower quality theater rips are done INTERNAL so not to lower the reputation of the group, or due to the amount of rips done already. An INTERNAL release is available as normal on the groups affiliate sites, but they can't be traded to other sites without request from the site ops. Some INTERNAL releases still trickle down to IRC/Newsgroups, it usually depends on the title and the popularity. Earlier in the year people referred to Centropy going "internal". This meant the group were only releasing the movies to their members and site ops. This is in a different context to the usual definition.
STV -
Straight To Video. Was never released in theaters, and therefore a lot of sites do not allow these.
OTHER TAGS -
*WS* for widescreen (letterbox)
*FS* for Fullscreen.
RECODE -
A recode is a previously released version, usually filtered through TMPGenc to remove subtitles, fix color etc. Whilst they can look better, its not looked upon highly as groups are expected to obtain their own sources.
REPACK -
If a group releases a bad rip, they will release a Repack which will fix the problems.
NUKED -
A film can be nuked for various reasons. Individual sites will nuke for breaking their rules (such as "No Telesyncs") but if the film has something extremely wrong with it (no soundtrack for 20mins, CD2 is incorrect film/game etc) then a global nuke will occur, and people trading it across sites will lose their credits. Nuked films can still reach other sources such as p2p/usenet, but its a good idea to check why it was nuked first in case. If a group realise there is something wrong, they can request a nuke.
NUKE REASONS :: this is a list of common reasons a film can be nuked for (generally DVDRip)
** BAD A/R ** :: bad aspect ratio, ie people appear too fat/thin
** BAD IVTC ** :: bad inverse telecine. process of converting framerates was incorrect.
** INTERLACED ** :: black lines on movement as the field order is incorrect.
DUPE -
Dupe is quite simply, if something exists already, then theres no reason for it to exist again without proper reason.
