Server Help

[Mine GO BOOM]

Being a good server admin, I try to check the logs as often as I can to find weird things. Well, last night something weird happened, I got a browser who's useragent string was dragonfly(ebingbong@playstarmusic.com). A quick google search resulted in exactly what that user agent means.

Turns out that that it is a spam harvester. Wonderful. Do a full scan of any activity that this bot has done:

Code: Show/Hide 72.29.233.182 - - [25/Aug/2006:22:17:38 -0700] "GET /robots.txt HTTP/1.1" 200 464 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [15/Sep/2006:20:47:42 -0700] "GET / HTTP/1.1" 200 42550 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:46:38 -0700] "GET /groupcp.php?g=5&sid=3dd0955fd6ca58328e8156a24a4128fa HTTP/1.1" 200 21694 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:46:38 -0700] "GET /profile.php?mode=signup&sid=3dd0955fd6ca58328e8156a24a4128fa HTTP/1.1" 200 14963 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:46:38 -0700] "GET /viewtopic.php?p=65284&sid=3dd0955fd6ca58328e8156a24a4128fa#65284 HTTP/1.1" 200 47409 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:46:38 -0700] "GET /profile.php?mode=viewprofile&u=144&sid=3dd0955fd6ca58328e8156a24a4128fa HTTP/1.1" 200 14334 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:46:39 -0700] "GET /profile.php?mode=viewprofile&u=241&sid=3dd0955fd6ca58328e8156a24a4128fa HTTP/1.1" 200 14333 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:46:40 -0700] "GET /profile.php?mode=viewprofile&u=309&sid=3dd0955fd6ca58328e8156a24a4128fa HTTP/1.1" 200 14334 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:46:40 -0700] "GET /profile.php?mode=viewprofile&u=1085&sid=3dd0955fd6ca58328e8156a24a4128fa HTTP/1.1" 200 13950 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:46:40 -0700] "GET /profile.php?mode=viewprofile&u=824&sid=3dd0955fd6ca58328e8156a24a4128fa HTTP/1.1" 200 13950 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:46:40 -0700] "GET /profile.php?mode=viewprofile&u=277&sid=3dd0955fd6ca58328e8156a24a4128fa HTTP/1.1" 200 14334 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:46:40 -0700] "GET /profile.php?mode=viewprofile&u=955&sid=3dd0955fd6ca58328e8156a24a4128fa HTTP/1.1" 200 14334 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:50:07 -0700] "GET /profile.php?mode=editprofile&sid=3dd0955fd6ca58328e8156a24a4128fa HTTP/1.1" 302 - "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:50:08 -0700] "GET /login.php?redirect=profile.php&mode=editprofile HTTP/1.1" 200 14842 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:50:08 -0700] "GET /viewtopic.php?p=65286&sid=3dd0955fd6ca58328e8156a24a4128fa#65286 HTTP/1.1" 200 38543 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:50:07 -0700] "GET /faq.php?sid=3dd0955fd6ca58328e8156a24a4128fa HTTP/1.1" 200 61091 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:50:09 -0700] "GET /profile.php?mode=viewprofile&u=81&sid=3dd0955fd6ca58328e8156a24a4128fa HTTP/1.1" 200 14334 "-" "dragonfly(ebingbong@playstarmusic.com)" 72.29.233.185 - - [20/Sep/2006:23:50:09 -0700] "GET /profile.php?mode=viewprofile&u=225&sid=3dd0955fd6ca58328e8156a24a4128fa HTTP/1.1" 200 14333 "-" "dragonfly(ebingbong@playstarmusic.com)"

As you can see, it did a check a long time ago to find out information about the site. Then last night, it make a quick attack and grabbed a bunch of email addresses, both from topic viewing, group listings, and then direct profiles on people posting in those topics. I assume it went into the profiles to grab IM account numbers/names.

To try my part at trying to prevent spam attacks, I disabled public viewing of anyone's email address. What does this mean? It means, if you are registered, nothing is different. Hover over an email link, and it is a real email link to that user. If you are a guest browsing, you are redirected to the forum's built-in emailing feature, which then forwards you to login. Thus, no bot will be able to view email addresses anymore, and search engine's caches of the site will no longer include email addresses.

Want this on your forums too? In includes\functions.php find the function named init_userprefs. Inside the first if statement checking $userdata['user_id'] != ANONYMOUS just throw in the following statement anywhere inside the brackets:
$board_config['board_email_form'] = 0;

Now go into the admin panel for your forums, the General Configuration section and set User email via board to enabled. Save files and settings and check your forums out as a user and as a guest.

This does not protect users from posting emails in messages or IM accounts. IM accounts I'm not going to bother protecting (unless you guys really get spammed, all mine are set to auto-block anything unless on my list already) and in messages I don't feel that it is being done very heavily. But it won't be hard to make the public's viewing of email accounts in text be non-linked and shown as [EMAIL: bob .at. blah .dot. com] or something equally as stupid and not used yet.

Server Help Forums - Protecting you when it may start to effect me

[Solo Ace]

So...

Chambahs is the only one who got screwed?

[BDwinsAlt]

Wow that's gay. What kind of retard would so something like that? I wouldn't waste my time making a bot that collects email address and sends people junk email. I only read emails from people I know.

[Mine GO BOOM]

Look at the user profiles, there are a bunch listed (see the userid=XXX?). As for who does it? There is lots of money in junk mail. Want evidence? Look at your spam in your own email box. If there wasn't money there, you wouldn't see that much junk.

In fact, there is so much money there, that a bunch of viruses now are designed to make your computer into relays for spam or into the harvesters themselves. Reach almost any research done into viruses that start up IRC bots and see what type of commands are very common; DDoS and Email.

[Quan Chi2]

Oh man. This is probably a new potential phpBB exploit. AWESOMNESS!!

No, but seriously, that must bite for Chambahs, but atleast I wasn't screwed, so we can all be happy. The end.

[Cerium]

The real question, is why these bots dont just report themselves as known browsers? I don't support the spammers in anyway, but if you're going to go through all the effort, why not atleast do that much? That way, people like MGB here aren't able to see and counter their activity as easily.
_________________
There are 7 user(s) ignoring me right now.

[Mine GO BOOM]

[Chambahs]

WTF? Nothing happend to me...what are you guys talking about?

[K']

[Chambahs]

Right...so anyone wanna tell me why "I got fucked"?

[Cerium]

Well... Your father has an attraction to young boys and you like to sleep on your stomache.

[Chambahs(lazy)]

I still dont get what happend here

[Dr Brain]

It took you 2 years to post how you didn't understand something?
_________________
Hyperspace Owner

Smong> so long as 99% deaths feel lame it will always be hyperspace to me

[Chambahs (lazy)]

Lmao, no, i was just revisiting the forums, (killing time) and i stumbled across this topic. Care to explain?

[Samapico]

oh LOL
I thought this was a recent issue hahahaha

I presume you had made your email visible or something
_________________
(Insert a bunch of dead links here)