Reporting spam

imipak · Post by **imipak** » Fri Mar 02, 2007 9:13 am

...the boards are being spam-flooded with a link that tries to install a Windows executable. Which is odd, as I'd expect 99% of everyone here to use Macs or Linux.

In either case, I hereby petition the GalCops to classify the originating offender as a Fugitive, but would still like to know if the trojan is being used to add more spam to the boards through compromised accounts (browser defect) or if it's a server glitch that is being exploited.

(This is important. If it's the former, then as soon as those individuals clean their systems and change their passwords, things'll be fine. If it's a system problem, and that's why we're seeing so many different "users" posting, then everyone should treat their password as compromised and change it as soon as the problem is fixed.)

Uncle Reno · Post by **Uncle Reno** » Fri Mar 02, 2007 9:21 am

Magus Zeal · Post by **Magus Zeal** » Fri Mar 02, 2007 9:21 am

Unfortunatly, Killer Wolf, the only one who has the power to install that sort of stuff is not available right now. He'd have to be contacted personally then step in to do this.

I plan on taking the spammer's tools away. These spammers are from zombies, and all I have to do is send some sanctions to the ISPs of the zombies and there goes their service. Then I can (try) to complain to the hosting company of the "websites" and see if I can get them shut down -- but they're located in the Ukraine, which might mean my complaints would get laughed at.

Uncle Reno · Post by **Uncle Reno** » Fri Mar 02, 2007 9:25 am

Uncle Reno · Post by **Uncle Reno** » Fri Mar 02, 2007 9:30 am

*

https://bb.oolite.space/profile.php?mode ... ile&u=1609
posted
https://bb.oolite.space/viewtopic.php?p= ... ght=#31646

Uncle Reno · Post by **Uncle Reno** » Fri Mar 02, 2007 9:43 am

I'm now making a run for it down the towers escape tunnel.....

Killer Wolf · Post by **Killer Wolf** » Fri Mar 02, 2007 10:09 am

Magus Zeal wrote:
Unfortunatly, Killer Wolf, the only one who has the power to install that sort of stuff is not available right now. He'd have to be contacted personally then step in to do this.

I plan on taking the spammer's tools away. These spammers are from zombies, and all I have to do is send some sanctions to the ISPs of the zombies and there goes their service. Then I can (try) to complain to the hosting company of the "websites" and see if I can get them shut down -- but they're located in the Ukraine, which might mean my complaints would get laughed at.

ah, ok. i thought mebbes a few of the admin types who delete the posts would be able to alter settings etc.
the board on my side (by boardstogo) introduced the security word thing for posts, where you have to type in a random code generated by the board, had a search on php but i couldn't see any MODs like this, sadly :-(

anyways, cheers in advance for anything you manage to do to cut down this rubbish :-)

TGHC · Post by **TGHC** » Fri Mar 02, 2007 10:45 am

What are the spammers trying to achieve, is it to get your personal details or something?

Uncle Reno · Post by **Uncle Reno** » Fri Mar 02, 2007 1:44 pm

Yet another bot that has posted lots of spam
https://bb.oolite.space/profile.php?mode ... ile&u=1612

Killer Wolf · Post by **Killer Wolf** » Fri Mar 02, 2007 1:58 pm

christ wept, they're working overtime today >:-( every time i come back there's like a dozen more posts.
scum.

Captain Hesperus · Post by **Captain Hesperus** » Fri Mar 02, 2007 2:52 pm

https://bb.oolite.space/profile.php? ... ile&u=1613
For what it's worth. He'll probably be back two minutes after he's deleted.
:sigh:

<P.S.> here's his crap.
https://bb.oolite.space/viewtopic.ph ... ght=#31710

Captain Hesperus
"Despondancy is a crack sniper with a loaded rifle and ammo to spare in a high tower that, unbeknownst to him, has had all the uppermost windows bricked up to prevent pigeons getting in."

JensAyton · Post by **JensAyton** » Fri Mar 02, 2007 3:34 pm

Killer Wolf wrote:
had a bit more trawl of php, maybe a mod/admin could scope these out??

TIPS
Set activation to 'user' or 'admin'

Already got that.

Killer Wolf wrote:
Enable visual confirmation

Already got that.

Killer Wolf wrote:
Disable guest posting

Already got that.

Killer Wolf wrote:
MODS

Looking into those.

JensAyton · Post by **JensAyton** » Fri Mar 02, 2007 3:48 pm

imipak wrote:
...the boards are being spam-flooded with a link that tries to install a Windows executable. Which is odd, as I'd expect 99% of everyone here to use Macs or Linux.

In either case, I hereby petition the GalCops to classify the originating offender as a Fugitive, but would still like to know if the trojan is being used to add more spam to the boards through compromised accounts (browser defect) or if it's a server glitch that is being exploited.

Neither. The bots are registering new accounts and using those. The only defences stock phpBB has are e-mail confirmation (not a problem with so many free e-mail hosts) and a weak CAPTCHA.

As for the Windows executable, there’s no oddness. The botnets don’t care what the board is about, they just look for phpBBs.

Captain Hesperus · Post by **Captain Hesperus** » Fri Mar 02, 2007 5:16 pm

*

https://bb.oolite.space/profile.php?mode ... ile&u=1604
<ka-chik> BOOOOOOOOMM!!
Not on my watch!

Capt'n H

reills · Post by **reills** » Fri Mar 02, 2007 5:31 pm

*

He's making fun of me! Darn Spambot!

https://bb.oolite.space/viewtopic.php?t=3196

https://bb.oolite.space/profile.php?mode ... ile&u=1605

Oolite Bulletins

Reporting spam

On the miniscule possibility nobody has noticed...

Re: On the miniscule possibility nobody has noticed...