by Joseph Lo aka Jolo, last updated Aug 6, 2002
On EFnet, every channel has a timestamp or TS, which is the date and time that the channel was most recently created. Think of it as the channel birthday. The TS is very important to your channel's security. When servers split and rejoin, they use the channel TS on both sides of the split to resolve any conflicting channel modes, including who was originally an op.
Consider the common scenario where server X splits due to some networking problems. Server X temporarily becomes a separate IRC network of its own. If nobody on your channel happened to be on server X before the split, then your channel will no longer exist there. From the point of view of server X, everybody on your channel just /quit all at once. Anybody on server X can then just /join your channel and recreate it from scratch, thus getting channel ops. (Most EFnet servers should prevent this now, but glitches are always possible.) When server X rejoins the rest of the network, whichever side with the older TS is considered the original one, and the modes are synchronized back to the way they were. In our example, the servers would fix things on the newer channel by removing ops from any new ops and undoing any other mode changes set on server X. Everything then goes on normally.
If somebody in your channel was on server X during the split, your channel stays open. When the two sides rejoin, the two TS's are the same, so there is no problem. This is a good reason to spread your ops around on as many different servers as possible.
Many years ago, before the current TS protocol was implemented, most channels had a TS of 0 (zero), which was the default value. (Zero is the beginning of time essentially, which for IRC servers running UNIX operating systems, is defined to be 00:00:00 GMT, January 1, 1970.) If a split channel rejoins and both sides have TS of 0, both sides are just as authoritative, so in the above example, no ops would be deoped. It was thus fairly easy for somebody to take over a channel by "riding a split". Fortunately this ended with the implementation of TS, until now.
Twice in March 2001, crackers ("hackers") were able to link a bogus EFnet server into the network. They manipulated the TS on that server and reset it back to 0. The older TS always wins, and there is nothing older than the beginning of time itself. So when the hacked server was linked in, many channels had their TS reset from their legitimate creation dates all the way back to 0. This made them vulnerable to takeovers using the aforementioned split-riding technique.
On most clients, you can check your TS with the command /mode #channelname, which should show your channel's current modes and when it was created. The result may be shown on your status screen, console window, etc. For example:
/mode #irchelp *** Mode for channel #irchelp is "+tnl 25" *** #irchelp - created Sat Mar 24 03:56:59 2001
If the year is 1969 or 1970, then TS has been set back to 0 (it may be slightly different due to time zones). AFAIK older versions of mIRC does not show the TS if it is 0, so if you see your channel's modes but no date, you have a problem. When in doubt, ask somebody not using mIRC to check for you.
The only way to fix this is to "cycle" your channel: clear everybody out and recreate it from scratch. The TS will then be set to the current time and you'll be safe. The danger of course is that whoever gets back in first is the new owner of the channel, so you need to maximize the chances that it's one of your ops. Here's the recommended way to do this.
If you're not sure you can handle it, seek help with #irchelp. Be sure the person you talk to is an op (@ by their nick) before trusting them.
Who knows. We are always only as safe as our weakest link. Just be vigilant and keep an eye out on your channel TS, and reset it if necessary. If you are experienced with IRC bots or scripting, it is a good idea to have some automated means of checking all ops to make sure they belong to your authorized ops list. It takes considerable IRC experience and resources to maintain a channel, so good luck. If you don't feel up to the task, there's always DALnet. :-)