[VB] ban evasion detection

[Noodlez]

this method will detect if some one is trying to evade a ban (by switching username + cdkey) since squelch uses IP address, the only way around htis would be to use a proxy + new ip + new username

Code Select Expand

Private Sub Binary_Join(usrName As String, ByVal usrFlags As Long, usrText As String, Ping As Long)
Dim f as ParsedFlags
      If usrFlags = BNFLAGS_SQUELCH Then
      f = ParseFlags(Database.GetFlags(usrName))
            If f.Banned = True then
                  Send "/ban " & usrname & " Ban evasion detected!"
            End if
      End if
End Sub


[RhiNo]

thanx that should help me a bit

[Mesiah / haiseM]

Actually a true ingenious way, is to use the Atomic Bomb, and masswhisper these bots, so while there mass rejoining and spamming, if theyre receiving whispers, they too will flood. I'd just add filtering, "if this many names show up, start blocking the rest" something along those lines...

[Skywing]

Sending mass messages to any well-written bot won't cause it to flood.

[Noodlez]

um, how would recieving alot of whispers make you flood?

[Arta]

Ditto...

[Mesiah / haiseM]

I don't know, ask Darkminion, it worked on him once.

And if a program is busy adding text to a window, how will it have time to spam and rejoin as fast as it does?

How do u think the floodbots, flood bots?

They go so fast, it freezes other programs (supposed to anyways)

So why not give them a taste of their own medicine?

[warz]

Because it all boils down to nothing, but wasting your time.

[JaMi]

umm i thought the floodbot "flooded ops" by getting itself shitlisted.... joins the channel, mass rejoins, therefore making ops try to ban it 8 times instead of once, sooner or later the delay fux up and it floods off, ive never seen it "freeze" a bot up other then stygian

[Arta]

A well coded bot Shouldn't feeze as a result of rejoinspam. It's more likely to have been something wierd with your system.

[JaMI]

erm, why would you have either one of those bots as ops? i mean there both great bots and all... just not for ops, put protect on with a full channel and youll flood chew off  :-/ Ive never really used EC so i cant say it wouldnt handle it... but wasn't it designed as more of a chat bot then ops bot?

[Zakath]

That's correct, it originally was purely a chat bot.

I wonder...my bot has yet to run into a flood bot. I have no idea whether anything will go wrong...

If I need an opbot, I use EternalBot, though I don't believe it's publicly available at the moment.

[WinSocks]

ummm FloodBot doesn't have a Chat Interface, it only tells you when it connects/disconnects and the stats of the bot, it ignores all chat features so that it won't allocate the spam messages into a RTB chat field.... so spamming won't do squat to the floodbots.

[Spht]

I don't see why people are always looking for "bot that bans flood bots." It is merely required that the client send the ban immediately without delayed flood protection at an empty queue and empty last-message recovery. What makes the real difference is your latency speed to Battle.net - assuming you have a broader connection than the attacker, it should be very possible to fight the battle. Otherwise, if calculated that the client could not send out the ban in time, it should just ignore the rejoin.

The best remedy would be a system that ZeroBot uses known as SVProtect (Short Visit Protection). This determines if the bot should actually attempt to ban the attacker (based on time between rejoins) if necessary (for autoban or channel protection). Otherwise, it will simply ignore them instead of sending out ban attempt that would not reach Battle.net in time anyway.

Zakath: EternalBot was not designed to fight off zero-latency short visit rejoins if they're due to be banned on join. My newer client, however, uses a system similar to SVProtect.

[Noodlez]

way to bump a 2 month old topic... btw smart guy, squelch is based on ip. so unless they change their ip they remain squelched and therefore banned