SCPDiscord

Summary:

a bot has been mirroring the #site19 chat to a SCP fan Discord server

SCPDiscord

salvagebar 06 Nov 2017 02:21

Saturday evening of November 4th, some discussion began in #site17 about the user SCPDiscord

+ Show

[Sat 04 21:31:35] <+Sophos> First sighting of SCPDiscord
[Sat 04 21:31:39] <+Sophos> Never says a single word
[Sat 04 21:31:42] <+Sophos> Only quits and joins
[Sat 04 21:31:44] <%MrAnakinSpecter> Uhh, okay?
[Sat 04 21:31:51] <%MrAnakinSpecter> What's your point? :|
[Sat 04 21:31:52] <GreenWolf> it's also running off an AWS server
[Sat 04 21:32:03] <GreenWolf> which… well, nobody is going to run an irc client off of that
[Sat 04 21:32:07] <+Sophos> Sounds like somebody's logging bot.
[Sat 04 21:32:12] <GreenWolf> ^
[Sat 04 21:32:20] <@ProcyonLotor> Okay.
[Sat 04 21:32:31] <GreenWolf> given the name, I think it's a logging bot that's feeding channel logs to a discord server
[Sat 04 21:32:32] <%MrAnakinSpecter> I know literally nothing about computer things so I will defer to someone smarter than me.
[Sat 04 21:32:32] <@ProcyonLotor> They did not get any auth as far as I am aware.
[Sat 04 21:32:36] <s6th> probably relays irc chat to a discord yeah
[Sat 04 21:32:42] <@ProcyonLotor> This looks pretty damning.
[Sat 04 21:32:49] <GreenWolf> if it's /not/ a bot, then they can appeal in here, no harm done
[Sat 04 21:32:58] <taylor_itkin> I'd like to ask what the point of that would be, though
[Sat 04 21:33:09] <taylor_itkin> spying? for what? Just to troll? It seems harmless to be a troll
[Sat 04 21:33:38] <&Dexanote> yeah, ban it.
[Sat 04 21:34:44] <GreenWolf> it also doesn't respond to CTCP, which means it's not a standard client
[Sat 04 21:35:03] <SpookyBee> I feel like I've seen them speak before
[Sat 04 21:35:03] <+Sophos> I thought that too
[Sat 04 21:35:10] <+Sophos> but IIRC we block ctcps in 19
[Sat 04 21:35:21] <+Sophos> because of that spam issue a while back
[Sat 04 21:35:22] <GreenWolf> Sophos: how? also, didn't do it in 19
[Sat 04 21:35:27] <%MrAnakinSpecter> Operators will handle this, speculation accomplishes nothing.
[Sat 04 21:35:36] <%MrAnakinSpecter> If you want to discuss this, do it in 19.
[Sat 04 21:35:47] <GreenWolf> MrAnakinSpecter: coony literally told us to bring the discussion here /from/ 19
[Sat 04 21:35:57] <%MrAnakinSpecter> nevermind me can't read
[Sat 04 21:36:07] <+Sophos> Oh it blocks ctcps from users to the channel, nvm. You're right, it doesn't respond to ctcps.
[Sat 04 21:36:36] <+Sophos> Lot of people with dip0.t-ipconnect.de hostmasks, so no obvious suspect.
[Sat 04 21:36:49] <SpookyBee> I'm legit curious who it is that was using SCPDiscord >_>
[Sat 04 21:37:01] * NineVolt is now known as GamingVolt
[Sat 04 21:37:06] <SpookyBee> Like I'm 90% sure I've seen them speak before but they don't have a .seen
[Sat 04 21:37:16] <@ProcyonLotor> I am willing to consider it an honest mistake and not give the operator any more than a "don't do it again"
[Sat 04 21:37:16] <%MrAnakinSpecter> Likely we will never know unless they appeal.
[Sat 04 21:37:20] <+Sophos> My logs say they never spoke in 19 ever.
[Sat 04 21:37:24] <GreenWolf> well, if it's a bot, it's not very well programmed either, since there's no identifying flags in /WHOIS or CTCP to tell who owns it
[Sat 04 21:37:29] <SpookyBee> Sophos: yea that's why I'm confused.
[Sat 04 21:37:32] <GreenWolf> which is, like, bot etiquette 101
[Sat 04 21:37:38] <taylor_itkin> My question still remains, personally
[Sat 04 21:37:44] <s6th> Google returns:
[Sat 04 21:37:44] <s6th> http://05command.wikidot.com/forum/t-3202847/plu
[Sat 04 21:37:45] <taylor_itkin> what would be the point of having them log from here to discord
[Sat 04 21:37:45] * ProcyonLotor sets mode: +b *!*@synIRC-ACC8950D.eu-west-1.compute.amazonaws.com

Sophos noted that there was a conversation earlier that morning (and linked to a pastebin with the relevant lines, a discussion between Tuomey and Lily) where it was determined the username was suspect, but not against the rules, as there didn't seem to be roleplaying or an attempt to portray SCPDiscord as an official voice.

[Sat 04 21:42:54] <+Sophos> Guess somebody allowed it: https://pastebin.com/qkMzaPry

After some digging, minmin and I found an SCP fan Discord server, with channels that mirrored the text in our channels #site19 and #site17. Here are the lines in 19 until the moment that Procy banned the bot:

+ Show

[Sat 04 21:34:07] <mlister> .lc
[Sat 04 21:34:08] <%jarvis> mlister: Scp-3245: Television Slaves (written 44 minutes ago by NuclearWaffle) - http://www.scp-wiki.net/scp-3245
[Sat 04 21:34:08] <%jarvis> mlister: 'The Dark Web' (DKE79/O2RG5/4JLW6) (written 3 hours ago by DrChandra) - http://www.scp-wiki.net/the-dark-web-dke79-o2rg5-4jlw6
[Sat 04 21:34:08] <%jarvis> mlister: SCP-3084: Leave a message (written 5 hours ago by Golubian) - http://www.scp-wiki.net/scp-3084
[Sat 04 21:34:37] <Levi> Dr_Leonard: http://mashable.com/2017/10/27/saudi-arabia-womens-rights-sophia/#E3bcTe11_sqB
[Sat 04 21:34:47] <Dr_Leonard> Oh yeah that thing
[Sat 04 21:34:50] * ProcyonLotor sets mode: +b *!*@synIRC-ACC8950D.eu-west-1.compute.amazonaws.com
[Sat 04 21:35:08] <DrBleep> O_O
[Sat 04 21:35:11] <SpookyBee> .seen SCPDiscord
[Sat 04 21:35:12] <%jarvis> spookybee: User not found.
[Sat 04 21:35:16] * SCPDiscord was kicked by ProcyonLotor (Bots are not allowed in this channel without prior permission. )

And here is a screencap of the Discord channel, ending at the same place, showing that the bot was posting IRC lines to Discord:

+ show block

Notice that the lines end at the same moment the bot was kicked.

Last edited on 06 Nov 2017 07:03 by Zyn Show more

The Return of SCPDiscord

salvagebar 06 Nov 2017 02:33

SCPDiscord rejoined #site 19 on the evening of Sunday, November 5th (around the same time, 9:00 PM Eastern US). After determining that the bot was again posting lines from #site19 to the Discord, I re-kickbanned.

+ Show

[Sun 05 20:44:23] * SCPDiscord (~moc.swanozama.etupmoc.1-tsew-ue.8BB5588C-CRInys|rocsiDPCS#moc.swanozama.etupmoc.1-tsew-ue.8BB5588C-CRInys|rocsiDPCS) has joined #site19
…
[Sun 05 20:49:33] <BlackWing> just shows as text to me.
[Sun 05 20:49:34] <Aquafratres> JackIke: I think I would find some way to make the last sentence in particular a little less on the nose but I think it's pretty solid overall
[Sun 05 20:50:11] <Modern_Erasmus> BlackWing: season 2 is wayyyy better than season 1
[Sun 05 20:50:16] <Modern_Erasmus> And I enjoyed s1 a lot already
[Sun 05 20:50:18] * SCPDiscord was kicked by salvagebar (salvagebar)

Again, here's a screencap of the same channel on the Discord, showing the lines being mirrored up until the moment the bot was kicked from the channel:

+ show block

Last edited on 06 Nov 2017 07:03 by Zyn Show more

Re: SCPDiscord

DrMagnus 06 Nov 2017 17:08

This should go without saying, but I didn't create a little brother for Helen. No clue who this is, or where it comes from.

Re: SCPDiscord

ChaoSera 08 Nov 2017 07:41

Just noting for the record that the bot seems to attempt to rejoin roughly every 24 hours. The time isn't the same every time so it's probably not automated, which suggests someone is doing it manually. It gets kb'd every time by jarvis so there's not really any need for action but I thought it should be pointed out.

Re: SCPDiscord

subtletea 11 Nov 2017 04:37

With Procy and ARD's permission, a nameban was put in place to cut down on spam from the bot joining and being kicked by Jarvis. I banned in 17 and ARD banned in 19.

Re: SCPDiscord

DrMagnus 19 Dec 2017 20:51

I contacted the owner of SCPDiscord's repo, Bluscream.

I asked them to remove the configuration to attempt to join our channels, and he claims he did. The page has been removed from the GitHub repo, at very minimum.

You can view a log of our conversation here.

I'm not actually sure if we have a rule against mirroring our forum content to a discord channel, but I assumed yes.

If this user decides to continue, I have the configuration details for the IRC portion stored, if additional action is required.