Possibly SMF Hack

[Cobra97]

Hi all,

Not sure where to post this, but I think it might be important.
I had a new member join my forum this morning, called peace890
I did a google search on the name and something very strange came up, this name has registered for SMF forums everywhere over the last few days.....It comes up page after page, and each time it's only a SMF forum and this person has never lodged in to any of them.

Is it just me or does this look very strange?

John

[thomase]

I have had this happen today, when loading the site you get a few pop up boxes saying how leet people have hacked the site, etc, fowards to this address:

h t t p : / / w  w  w.xcoderx.byethost13.com/stealthis.php?pwned=PHPSESSID=c41e1a82ccc9b787fe142c7dcb140409

[SleePy]

If you believe that this was done through SMF please fill out a Security Report

Moving to english support

[CN CIA]

I have had this happen today, when loading the site you get a few pop up boxes saying how leet people have hacked the site, etc, fowards to this address:

h t t p : / / w  w  w.xcoderx.byethost13.com/stealthis.php?pwned=PHPSESSID=c41e1a82ccc9b787fe142c7dcb140409 [nofollow]

i'd do a virus and spyware scan after viewing that site, all those popus tells me its not a nice site.  No telling what your computer could have got from it.  I have to go run some scans now....

[GravuTrad]

And with byethost hosting... >...

change it, too strict but not too secure...

[deTrezS6]

Hey,

I think Oldies mentioning this happening on his forum.  From what he described, you're not actually hacked, someone just exploited scripts not properly being escaped.

I'm attempting to re-create the exact bug that I'm believing may have been used, so that I may send a report in - eitherway, Olds probably will send something up if he finds more out (He was mentioning this on IRC; he assumed it was something that was actually a bug in TP or some other mod he was using, but there's no exact way of telling).

Regards,

Trez

[Cobra97]

I found the search terms the person used to find all the SMF forums, I used my reverse tracking.

This was used in google

action-register smf fast "inurl:index php "

www.google.co.uk/search?as_q= action-register smf fast&hl=en&num=100&btnG=Google Search&as_epq=inurl%3Aindex php &as_oq=&as_eq=&lr=&cr=&as_ft=i

[Goodman854]

They joined my forum too. I figured they were another spam bot. Any word on what it is?

[Skhilled]

He/she was using the name "footballyears.net". Was spamming a few sites I admin so I kept banning him. Saw him at tinyportalhosting.net yesterday with the name "peace890". Had a different ip but lead to the same site...footballyears.net.

[Goodman854]

So does it have any major danger? Is it really making an exploit or just posting links?

[Skhilled]

As far as my site goes...he just posted links to pron and other sites. Not sure if anything else...haven't noticed anything strange.

I've been noticing a few others doing this but not posting. Just registering at a lot of different sites.

[Goodman854]

Oh phew. scared me I get LOADS of spam bots good thing thats all this is. Right?

[Skhilled]

yeah, nothing in the logs out of the ordinary...

[H]

There are also some spambots that will register but not post for six months :/.

[Skhilled]

I think I may have found out what they are doing...harvesting emails. Most sites only allow the viewing of members profiles if you are registered.

A friend's site had a member who fit the same description and he later found out that he we using those emails to spam for that "African leader needing money" scam. The guys started spamming that site's users. After a little digging he found out who the spammer was.

To stop this my suggestions are to use the Contact mod so no one can get email addys by direct emailing...can't see the email address.

Also, not allow new users to see profiles until a certain amount of posts.

Using the Country Flag mod and Captcha does help with some bots. But these newcomers seem to be either a new breed of bots or are humans.

Any other ideas are more than welcome to help stop this.

[Goodman854]

Uh oh.

[Lilac]

We have specifically prevented unapproved members from seeing registration details for reasons like this (though harassment was the main cause).

[Goodman854]

Can't bots easily do that on their own?

[marinesct]

Theres a mod out there that adds an extra security feature:  Are You Human?

Ive got it installed.  So far, our members have been legit. Only a couple haven't come back after the initial registration.  We do have the requirement for a mod to approve the registration set, too.  There is an anti-spam mod that works rather well by converting the emails to hexadecimal. I've used this method on static sites as well. Very effective.  It's a seemless integration you won't know that's installed unless you look at the source code and look at the "mailto:" line.

So if new members are coming from a google search, then there are two considerations:

1. To kill the bots, try the above mods out.  The 'Are You Human' mod should cut out any bots and the anti-spam will defeat the bot harvesters.

2. For the human's, it can get tricky. Since my site is for people with a military background, we have membergroups for that.  All non-military/friends fall under the regular member membergroup.  They can't view profiles (permission in membergroups). For them to get the email addresses, they would have to either write them down or click every one of them individually, because of the anti-spam mod.  Very laborious process.

@Cobra97
How did you do the track back? I think maybe if we were able to annotate the track back into the registration process (need a dev for this one), then we could auto block those that come from met that criteria.

[crash56]

I think I may have found out what they are doing...harvesting emails. Most sites only allow the viewing of members profiles if you are registered.

A friend's site had a member who fit the same description and he later found out that he we using those emails to spam for that "African leader needing money" scam. The guys started spamming that site's users. After a little digging he found out who the spammer was.

To stop this my suggestions are to use the Contact mod so no one can get email addys by direct emailing...can't see the email address.

Also, not allow new users to see profiles until a certain amount of posts.

Using the Country Flag mod and Captcha does help with some bots. But these newcomers seem to be either a new breed of bots or are humans.

Any other ideas are more than welcome to help stop this.

Crud.  We just got hit by one of these harvesters. 

Off to put some more security in place.