phpbb2: IMPORTANT spambot issue and resolutions

[admin (no pm's please)]

For the last 24 hours we have had a sustained attack from over 400 addresses.

This attack was largely from Eastern Europe, but there were suspicious ips from the world over.

Whilst we have banned the IPs the attack did not really stop until we implemented a couple of board admin changes backed up by a code change.

The board change was to remove (very important) the visual confirm on registration and go over to admin activation.

This combined with a code change to prevent the hackers ever seeing the CAPTCHA image on an attempted registration seems to have halted the attack.

I have now added flood protection to the user registration visual confirm system that should further hamper hacking efforts.

What I surmise is that there is an attempt to train a spambot system to beat our so far uncracked CAPTCHA system in order to flood forums with spam.

You can tell if your forum is being attached by looking a "whos online", if there are 100's of guests in "view profile" then please temporarily remove visual confirm, and switch to admin activation.

The new system will dramatically cramp the hackers style, but best to stop them all together.

Please also report it here. Attack logs are being kept as part of the anti-flood system.

I hope the flood system will not activate unless there is really cause.

---

_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[admin (no pm's please)]

I have added for phpbb2 forums the new page, for example on this forum:

http://forum.myfreeforum.org/viewflood.php

This should give information on such attacks.
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[admin (no pm's please)]

The system should also now alert me by email of an attack on a forum.

I have to reserve the right to set such forums to Admin registration without user confirm.

We don't interfere in admin settings on forums more than we absolutely have to, but this qualifies as a case if a forum is actually under attack.
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[admin (no pm's please)]

For the record, an attack now causes an automatic switch in the admin panel to avoid the attack.

We are also isolating clearly rogue ips, and they will in future be fed straight into the firewall.

All this is very easily testable as we are still under attack
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[admin (no pm's please)]

Okay so now the buggers get ip  banned.

Kind of makes it tempting not to stop the attack vector, but to let them come and get banned. But them that lets them do more of what they want  
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[admin (no pm's please)]

On further checking, and rather oddly (but then a lot about this is odd) there was another place I could trap them we a flood control.

That is now in place but has only resulted in another 3 ip bans, so 42 in the firewall currently. This is down from 400 and more which shows the attack is dieing anyway.
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[admin (no pm's please)]

53....
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[admin (no pm's please)]

57....
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[admin (no pm's please)]

70....
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[admin (no pm's please)]

75...

You know I am beginning to think from the latest logs that this is not some clever attempt to break CAPTCHA at all.

That was me putting a spin on it and looking for something "intelligent" going on. In more detail the pattern looks like a spambot registration flood that is so badly coded it fails to get past our basis anti-spambot measures.

I need more logging to confirm that.
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[admin (no pm's please)]

89

but that does seem like it has topped out.

all totally bizarre. I am basically getting email notifications of the attack, and that system applies to all the forums on the system, but it is only the support forum that is being reported as being attacked   Now how dumb is that?
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[Zudane]

Umm.. maybe someone that got a forum closed here is trying revenge by botnet attacks?  I know there are ways to do that, someone got mad before and spammed my forum like that.
_________________


Harsh Reality - Unleash your creativity!

[admin (no pm's please)]

101....
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[admin (no pm's please)]

112...

I did some checking in the early hours of the banned list, just in case legit users were being banned.

Moscow and Kiev featured very heavily! I think I can safely assume that that is not our normal demographic!
_________________

Family Friendly Shareware | | Web Design/Services | Free Forums

[admin (no pm's please)]

110...

Going down, but then that is because some of the earlier bans were not as long, at one point over 400 bans were in place when I was doing it manually.

There are probably about 40 more that will expire soon.

---

_________________

Family Friendly Shareware | | Web Design/Services | Free Forums