Logging in using root
reddit / irc

----------------------------------------------------------------------
DarkSith_Lord · 2018-05-31 11:08

Generally on all websites, I can find that don't use IRC with root
logged in. Why is that? Also, I accidentally logged in to the freenode
using root, any problem with that?

----------------------------------------------------------------------
ne7split · 2018-05-31 11:22

[You shouldn't really run anything as root, unless it requires
administrative access to the machine.](https://askubuntu.com/a/16179)

A reason you shouldn't log in to IRC as root is that you could receive
a file over DCC which, if executed, could cause damage to the system.

----------------------------------------------------------------------
DarkSith_Lord · 2018-05-31 11:27

But that then totally depends on me, whether I run it or not !

----------------------------------------------------------------------
derfy2 · 2018-05-31 11:28

Or an exploit in your client.

----------------------------------------------------------------------
DarkSith_Lord · 2018-05-31 11:33

Now that sounds scary, I already logged in using root, how do I check
if my system is still safe?

----------------------------------------------------------------------
[deleted] · 2018-05-31 12:57

[removed]

----------------------------------------------------------------------
webvictim · 2018-06-01 00:08

If your client doesn’t say that anyone has tried to send you a file,
you’re probably fine.

Seriously though, don’t IRC as root. Making another account and using
that is not hard and you never know when the next exploit might be
used.

----------------------------------------------------------------------
KindOne · 2018-06-01 01:01

Example: Someone finds a bug in your client or one of your scripts
that can allow them execute commands.

https://weechat.org/doc/security/


mIRC Example:

https://web.archive.org/web/20130126001721/http://hawkee.com/snippet/8
225/

>[20:46:34] <KindOne> Lets see.. how can we exploit this quote script.

>[20:48:10] <KindOne> !searchquotes
<redacted_mirc_code_to_give_me_ops>

>[20:48:11] <@MeanOne> Searching through quotes for
<redacted_mirc_code_to_give_me_ops>...

>[20:48:12] MeanOne sets mode: +o KindOne

>[20:48:17] <@KindOne> muhahahaha

>[20:53:20] <@KindOne> !searchquotes
<redacted_mirc_code_to_give_me_ops>

>[20:53:21] <@MeanOne> Searching through quotes for
<redacted_mirc_code_to_give_me_ops>...

>[20:53:23] MeanOne sets mode: +o KindOne

>[21:00:06] <@KindOne> !searchquotes
<redacted_mirc_code_to_make_bot_quit>

>[21:00:07] <@MeanOne> Searching through quotes for
<redacted_mirc_code_to_make_bot_quit>...

>[21:00:09] * @MeanOne (KindOne@999.999.999.999) Quit (Quit: /!return
1)

https://forums.mirc.com/ubbthreads.php/topics/248012/Quote_system_-
almost-_fully_wo

I'm not giving you the code to execute it, but I'm sure you get the
idea.

The script got removed when I finally reported it to the site admin
like two years later (I forgot).