Re: MSN buddy spam and Everybuddy slowdown

On Tue, 7 Jan 2003 11:05:39 +0000 Meredydd Luff <[email protected]>
wrote:

Hi Meredydd,

> and/or putting up huge numbers of "XXX has added you to their buddy
> list" notifications. This seems to be a widespread denial-of-service
> attack and/or virus directed at MSN Messenger users. I'm not sure how I
> should respond to this attack, but I would like to put a defence
> mechanism into CVS as soon as possible. If anyone can think of an angle
> of attack, please grab me on AIM or Yahoo - I'm offline on MSN until
> this can be cleared up.

I got such a thing this week-end, with a giant username.
eb_msn_authorize_user was called until I killed the proc (seems to be what
you describe).

I added an llist of usernames waiting to be accepted and refused and
simply return from eb_msn_authorize_user without any action if a request
arrives from a user with another request pending.

I thought this may be caused by the buffer limitations and added 
  if (strlen(friendlyname) > 254 || strlen (username) > 254) {
	  eb_debug(DBG_MOD, "refusing contact %s\n",username);
	  msn_add_to_list(mainconn, "BL", username);
	  return 0;
  }
at the beginning of eb_msn_authorize_user().

I'm not sure it's the correct fix since it has not reproduced since but it
may be useful.
Cheers,

-- 
Colin
panic("Oh boy, that early out of memory?");
    2.2.19 linux/arch/mips/mm/init.c