ircII source installed account backdoor

In October 1994, CERT warned that some copies of the ircII 2.2.9 UNIX client source contained a Trojan horse. The corrupt source had been available from many FTP sites as early as May, although CERT did not have a specific first date. Because ircII could be compiled and installed without special privileges, the compromised boundary was not only a central administrator's package tree; any user might have built the poisoned client locally. The delivery was ordinary source distribution: users fetched an IRC client from FTP sites, compiled it, and ran it under their own accounts. The malicious change rode inside that source tree; the trusted action was the build.

The backdoor gave remote intruders access to accounts running the IRC client, and CERT said exploitation was already active. CERT also named the escalation: if IRC was run from a system account such as root or bin, the Trojan horse let intruders reach that system account. The advisory suggested searching binaries for the strings JUPE or GROK, but warned that backdoor words could be changed and urged sites to install ircII 2.6 instead. IRCHelp's catalog carries a much later retrospective line about the same incident, that some hacked copies of ircII 2.2.9 gave anyone Unix and IRC access, but it names the CERT advisory as the source of that entry, so it restates CERT rather than corroborating it independently.

A contemporary Bugtraq exchange supplies distribution-specific context missing from the CERT summary. ircII maintainer Matthew Green said the standard 2.2.9 did not contain the access bug, but that copies on various FTP sites had CTCP GROK and CTCP JUPE backdoors. A second participant reported downloading a JUPE-bearing copy from ftp.funet.fi within the preceding month, located the change in source/ctcp.c, and described it as a three- or four-line command handler that let a remote IRC client execute commands. This confirms that byte-identical-looking version labels did not identify whether a particular copy was poisoned: the compromise was in distribution, not the official version's intended source.

The scope was awkward because the distribution path was informal by modern standards: CERT could say the bad source had appeared on many FTP sites, but not exactly when each copy changed hands. Administrators therefore had to find every locally built ircII binary, assume string checks were incomplete, and replace the client from a known-good release.