View Issue Details

IDProjectCategoryView StatusLast Update
0003326unrealircdpublic2007-05-11 07:42
Reportervonitsanet Assigned To 
PrioritynormalSeverityfeatureReproducibilityN/A
Status closedResolutionwont fix 
Product Version3.3-alpha0 
Summary0003326: A way to decrypt a cloaked host
Descriptioni have users who reporting me some users.
But when i use /whowas the history for the nickname is gone so i can not see the real ip.
I want a command maybe from the shell ./unreal uncloak <hidden host> to see the real hostname.
3rd party modules

Activities

Stealth

2007-05-10 10:56

reporter   ~0014076

The cloak is made up from the cloak keys and a hash function, and in theory cannot be reversed without the keys and a little bit of brute forcing.

A hash function is a one-way algorithm, which is a non reversible way to convert text into a string. For example, if you have the IP 64.160.78.3, and a key of 542. My hash function could be "first + second + third + fourth + key". It would look like:

64.160.78.3 -> 64 + 160 + 78 + 3 + 542 -> 847

If you take the answer, even if you had the key (502), you could still break the remaining number (847 - 542) into many IP combinations that equal 305. There would be almost no way to tell which IP originally gave you the result 305 without having the original IP

aquanight

2007-05-10 18:14

reporter   ~0014079

If you have a sane client that logs server notices (eg mirc doesn't by default, even if you turn on logging - you have to do it manually to the status window iirc), and you were on when the user was and you had +s +cF, you can try to find the nick!user@*.isp in your log. You may well end up finding multiple IPs.

But apart from this, unreal's cloaking algorithm is not reversible. Otherwise it would not be as secure as it is. If you had the keys, and about 300 centuries to spare, it could be done by brute forcing.

WolfSage

2007-05-11 05:46

reporter   ~0014085

Psst. Sts? Can we close this? =)

stskeeps

2007-05-11 07:42

reporter   ~0014087

Cloaking algorithm is one way.

Issue History

Date Modified Username Field Change
2007-05-10 05:22 vonitsanet New Issue
2007-05-10 10:56 Stealth Note Added: 0014076
2007-05-10 18:14 aquanight Note Added: 0014079
2007-05-11 05:46 WolfSage Note Added: 0014085
2007-05-11 07:42 stskeeps Status new => closed
2007-05-11 07:42 stskeeps Note Added: 0014087
2007-05-11 07:42 stskeeps Resolution open => wont fix