SPAM................! KILL IT...!Please...

C

caroby

Guest
Please admin guys............. KILL all users who ..........Ok, sorry not "P.C." ......

Disable users whom SPAM here on BR Central..... It's starting to get problematic..!:mad:

Just plane annoying.:(


Thanks from user caroby,

cale
 
Cale,
Best thing you can do is pm one of the moderators with the user name and thread in question.
Sometimes these just get overlooked but when they find them they usually delete them.

I didnt know we were suppose to be pc on this board......blahhhhh hehe
Vern
 
Jackie,
do you have authority to do an IP ban?

Or, I guess that applies to any admin here.

If so, you can use two sites to get the needed info and ban an entire IP range. That way, even folks on systems with dynamic IPs will have to change networks in order to come back. Usually this sort of stuff comes from overseas. Reason being, here you can be prosecuted for it so there's less fun in being an ahole here than other places. I admin a few small sites and from time to time I get spammers too. For the most part, it's rare now cause I've basically eliminated RU, PL, and various newer parts of the EU by doing huge ip bans on those subnets. It doesn't take very many entries and you can cover a LOT of real estate.

http://whatismyipaddress.com/ip-lookup does pretty good geolocation.

http://www.dnsstuff.com/ (ip information) will tell you what the parent network is, and how big it is. (by looking at the subnet mask listed).

A SN Mask of 255.255.0.0 means the first two numbers mean something (identify the internet provider), and all the addresses of the last two numbers are all in this Ip Pool (same provider). Therefore, if a spammer is at 123.234.56.78 and you see his SN mask is 255.255.0.0, then banning 123.234.*.* will mean he needs to change internet providers or simply move out of the area (country) to try again! Use up all the available internet providers in your area and guess what, it sucks to be them. All the fun is done... If the network is big, say something like Verizon or Crapcast in the US, they will sometimes have Ip pools that move deep into that third number. Banning those overseas can mean huge areas, even entire countries. Now yer talking 16M+ addresses. I would not ban large pools domestically. I doubt you'll see that stuff from the US anyway. For that, banning a small pool is fine. I could give a recommendation on that if you ever find this stuff coming from this continent.

You will find virtually all this bs comes from old eastern block countries cause there's very few laws for this on the books there, if any. So, if you think about it, virtually all members here are from the USA, GB, AU, some occasional ones from South America and the EU, and that's about it. US Military abroad will probably show up as local traffic anyway, so, I seriously doubt you'll ever do away with a "real" member if you nix a few foreign ip pools.

If the stuff is coming from overseas, and you really don't care if folks in that country are banned here, you can simply ban big blocks of IPs. I usually start with the first two octets associated with the ip and ban that whole range. Thats 65k addresses, pow. goodbye. If you're worried about who you "might" be locking out, I'd say it's a safe bet you ain't gonna miss em!
 
Cale,
Best thing you can do is pm one of the moderators with the user name and thread in question.
Sometimes these just get overlooked but when they find them they usually delete them.

I didnt know we were suppose to be pc on this board......blahhhhh hehe
Vern


Correct.... Will do.

4Mesh................ GOOD info... Have some IT background..?... Lotta foreign SPAMers out there!!!..........THAT'S FOR SURE..!
Good God, the intrusion rate for U.S. corporate networks has gone WAY -UP the last 3 years... Like 150%... Growing and it's not just the Chi-Com's............. Cyber War boys.... Getting VERY intense FAST..!

cale
 
4mesh,

Banning by IP addresses would probably work for the foreign countries. Most of these types of spam lately are coming from Asia and Indonesia; but, some of them(the less bold) are coming from California! At least, most of them are harmless, merely annoying. Just don't click on the links provided if you suspect something. I delete them when I see them.

Wilbur is reluctant to ban by IP because in the past it has affected legit users.

Jim
 
Last edited by a moderator:
Caroby,

Sorry, this'll be a long story....

Truth is, spammers as a rule are so mundane, I really don't know what the point is in doing this stuff. If they're here in the states, I'd say its probably a script-kiddie who's some lame wannabe and thinks it kewl to be a general pita. CA's loaded with em... Probably a good majority work for MS and Symantec...

With an application like VBulliten, security is difficult because anyone who owns the software, and even anyone who's tested it, has the source code. So, they can set up a test system and spend time attempting to exploit holes in it. It's also possible that back-doors are written in, though I wouldn't say that with VBulliten. And see, the code is so big, you simply don't have time to look through it all to see if there's a hole in it. A person couldn't read all the stuff in a year, much less understand it. There's sites out there that make note of all the holes in software that's available open source. Virtually everything has holes that can be exploited IFF it is set up on a server that's configured loosely. Even if they are not, you can have issues.

I have a hosting account on GoDaddy for my personal stuff. Back years ago for the PA 1000 Yard Club, I also ran a virtual dedicated server for a few years. Then GoDaddy added features on the shared hosting that did what I needed the VDS for so I dropped that, but I still have a test system at my house and will always. GoDaddy themselves offer various programs for use on their systems that are open source (free). One, a program called CopperMine Photo Gallery I used years back. This software is installable onto your account right from their hosting account control center. They supply it.

It is MALICIOUS....

At one point, GD contacts me and says there's a security breech on MY hosting account, and they've shut down the DNS to it. After calling they say it's coming from a folder within the Coppermine software that THEY provided (but somehow it's still my fault???). It was both sending email, and modifying files on my hosting account so that every page that got loaded caused a cross site scripting violation. (CSS Violation, not to be confused with Cascaded Style Sheets CSS).

So, I had to completely delete the Coppermine crap, and go clean up Alllll sorts of files that had stuff appended to them. There were HTML IFrames appended to the end of all the PHP files various places. So I cleaned it up. And without Coppermine on the system anymore, the holes were plugged. (I don't write bs with holes...). After I was done, I did some investigating into this because I could pretty clearly see that IFffff they had been really nasty, they coulda caused a boatload more problems than what they did. If that had been me and I was the one actually trying to be nasty, there is quite literally no limit to how bad it could have been. These people didn't want to do that stuff. They also made ZERO effort to cover their tracks. As if they wanted it to be easy to fix. Once it's possible to modify a file, you have absolute control over all the files in the hosting account. You also have the ability to see login info for database servers, and just go raise hell if you don't mind going to jail should you happen to piss of the wrong person. (Like the one IBM guy did years back). IBM sorta made an example with him that you really don't wanna f with their stuff.

For somebody who's just making posts and adding links, there's no damage being done so that you simply have to deal with yourself. If this is coming from CA or anywhere in the USA, well, you can still ban blocks of ips, just don't do huge blocks. If it's Verizon, well, they switch IPs pretty often so you'd have to hit a bigger range. But for all the US Cable companies, you can just do 256 addresses at a time. It's unlikely they can change addresses much more than that and who cares if 256 IPs are gone? You could also do an sql statement like SELECT ALL FROM USERS WHERE LASTIP LIKE "123.234" and see if any real member on the system will be affected, and who. Nobody important? uhhK, Bye!

All told though, these posts are really no big deal by comparison to the crap Wilbur was dealing with a while back. And even those, they were not trying to be nasty, they just wanted to be a pita. If they'd have wanted to get serious, they couda got serious.

As an aside, just fyi, nobody "Breaks" into anything. What happens is, somebody leaves the doors open, and then lies to cover their incompetent ass. Management generally isn't smart enough to know this so they buy it and perpetuate the lie. Take SQL Injection Attacks in PHP for instance. Using PHP, it is virtually impossible to do an SQL injection attack because ZEND (makes PHP), years ago did away with the possibility of multiple SQL statements in the same function call. It simply won't do it. So, you have to go out of your way to make it possible by other means. Now, look around the internet and you'll still see boatload of people who say this is a huge problem, it's all bs. The problems are elsewhere and they're put there by the folks who supply the stuff. For what reason, I do not know. I know that my own systems that I wrote entirely, have zero holes in em. And I mean, zero.

I.T. background... well, a little :)
 
What Wilbur should do is make a few modifications in the php.ini file on the root of the web server and disallow a whole host of things. On my account, I have statements to disallow various stuff that has no purpose to me. Fact is, 95% of PHP isn't needed for a website. One biggie is to do a set allow_url_fopen = Off so folks can't modify files on the server. This should be done by your web host by default, and it eludes me why reputable hosts allow that crap, but they do. I'm sure there's a reason, it's just not a good one.

Here's a page that tells of some tricks for the website owner to stop about 95% of hack attacks. A little googling will yield some other tricks, and running a phpinfo(); on your server and examining the output will tell you all sorts of stuff that you should disable.

Some good reading:
http://www.infosecprojects.net/compromised-webserver.html

While that won't fix these guys posting, it'll stop most of the hack issues there's been.
 
Back
Top