MS Security Essentials reporting false positives in the Bitcoin blockchain

Re:MS Security Essentials reporting false positives in the B... by bobbles on Friday May 16, 2014 @12:40AM (#7753773)

I seem to remember just having some text copy+pasted into IRC channels used to send peoples anti virus software into meltdown.. but this was sometime like 2000-2001

[ Parent | on HN ]

Re:MS Security Essentials reporting false positives in the B... by duskwuff on Friday May 16, 2014 @01:23AM (#7753893)

For a while, some security suites would freak out and terminate an IRC connection if they saw the text "start keylogger" show up. You could get people to drop by saying it in a channel, for instance.

[ Parent | on HN ]

Re:MS Security Essentials reporting false positives in the B... by TazeTSchnitzel on Friday May 16, 2014 @07:05AM (#7754860)

http://bash.org/?13213

Like this?

[ Parent | on HN ]

Re:MS Security Essentials reporting false positives in the B... by duskwuff on Friday May 16, 2014 @11:19AM (#7755930)

Worse, actually. As I recall, it'd block access to the responsible IRC server until you rebooted the machine. But yes, kind of like that.

[ Parent | on HN ]

Re:MS Security Essentials reporting false positives in the B... by ygra on Friday May 16, 2014 @04:18AM (#7754373)

Or, more sneakily, by embedding it in your hostmask.

[ Parent | on HN ]

Re:MS Security Essentials reporting false positives in the B... by JimDabell on Friday May 16, 2014 @04:01AM (#7754306)

If I remember correctly, it used to be the case that if you could get the string +++ATH0 transmitted to somebody in the clear, you could hang up their dialup connection because it was a control code for Hayes modems that ended up being standardised on. Badly written firmware in modems meant that this was often interpreted even when it wasn't transmitted in a control code context.

[ Parent | on HN ]

Re:MS Security Essentials reporting false positives in the B... by spacemanmatt on Friday May 16, 2014 @05:10AM (#7754536)

BitCom, a trashy DOS based terminal program, would lower the signal on the DTR pin, which would hang up the modem instantly, when it saw the text, "NO CARRIER" on a line by itself. Obviously, that line got dropped in forums and chat rooms as the "word of the day for BitCom users" on a regular basis.

[ Parent | on HN ]

Re:MS Security Essentials reporting false positives in the B... by thristian on Friday May 16, 2014 @07:26AM (#7754915)

Actually, it wasn't "badly written firmware". Hayes modems actually looked for "+++", then a second or so of no traffic, before they would switch into command-mode, and that delay was patented. So "Hayes-compatible" modems would implement the system without the delay, and as a result were vulnerable to remote DoS.

[ Parent | on HN ]

Re:MS Security Essentials reporting false positives in the B... by hosay123 on Friday May 16, 2014 @08:20AM (#7755056)

To extend this a little further, various brands of modems (at least Rockwell) supported it but came with it disabled by default. You could enable it before dialling up by setting an S register

[ Parent | on HN ]

Re:MS Security Essentials reporting false positives in the B... by beagle3 on Friday May 16, 2014 @04:35AM (#7754429)

There wasn't really a "control code context" - it was (2 second silence)+++(1 second silence) to switch to command mode, and then ATH to disconnect.

Bad firmwares would also accept same from remote side, although supposedly it should only have come from the local side.

[ Parent | on HN ]

Re:MS Security Essentials reporting false positives in the B... by anonymfus on Friday May 16, 2014 @10:04AM (#7755538)

This reminds me how the string %English% transferred via SMS crashed some old Siemens phones and GSM modules because of error in detection of embedded images.

And how recently string سمَـَّوُوُحخ ̷̴̐خ ̷̴̐خ ̷̴̐خ امارتيخ ̷̴̐خ could crash some versions of iOS and OS X.

[ Parent | on HN ]

Re:MS Security Essentials reporting false positives in the B... by simcop2387 on Friday May 16, 2014 @01:44AM (#7753942)

DCC SEND LOLLERCOPTER

There were a few others, but that's the one i remember. the part after DCC SEND doesn't matter as long as it was longer than 8 characters i think it was.

[ Parent | on HN ]

Re:MS Security Essentials reporting false positives in the B... by frik on Friday May 16, 2014 @02:55AM (#7754095)

It was a bug in Linksys, Netgear routers that rebooted the device.

bug report e.g. http://colloquy.info/project/ticket/531

[ Parent | on HN ]

Re:MS Security Essentials reporting false positives in the B... by mschuster91 on Friday May 16, 2014 @04:49AM (#7754476)

DCC SEND startkeylogger or such combined both exploits. Ah, I had quite a fun with that a couple of years back.

IIRC it still bites a couple of people on Freenode, but the most networks have auto-kick bots in place for these scriptkiddies.

[ Parent | on HN ]

Re:MS Security Essentials reporting false positives in the B... by thelsdj on Friday May 16, 2014 @03:59AM (#7754302)

I had a modem that would disconnect if someone typed: ATH0++ in IRC.

[ Parent | on HN ]