Advertisement:

Author Topic: Tidal wave of spambots attacks SMF 1.1.x - How to protect your forum  (Read 220498 times)

Offline Deprecated

  • SMF Hero
  • ******
  • Posts: 3,192
  • Gender: Male
  • I tried being reasonable ....... I didn't like it.
In recent days there has been a huge surge in the numbers of spambots attacking SMF 1.1.x forums. Some have suggested that this is due to the recent SMF 1.1.7 security upgrade, but in fact the attacks are unrelated to the functional changes in SMF 1.1.7. This is supported by the fact that SMF 1.1.6 and earlier versions are also subject to the attacks. The attacks have nothing to do with the SMF 1.1.7 upgrade.

We at SMF believe that this is nothing more than a coincidental, large scale, coordinated attack, possibly orchestrated using the recently updated version of Xrumer or a similar script or program used for spamming forums. Evidently one or more large bot herders have decided to exploit the market and has targeted their fleet towards spamming SMF forums. It is mere coincidence that this happened around the same time as the SMF 1.1.7 upgrade was released.


Why aren't SMF 2.0 forums being targeted?

Nobody knows, but we can speculate that it is due to SMF 2.0's improved functionality, or maybe there are minor differences between 1.1.x and 2.0 that confuse the bots. In either case if you are running 2.0 you should be on the watch for the attack spreading to SMF 2.0.


What can you do?

1.) Everybody should make sure that they are running the latest SMF 1.x or 2.x version. While the spam attacks are not related to security, you should take this occasion as a reminder to check out your security and make sure you have done everything you can to make your forum safe.

2.) At least for now SMF 2.0 has not been affected. The new version has improved spam defenses including the ability to ask any number of verification questions (what year is it? are you a bot?). Since most forums will pick different questions, these questions are very difficult for spambots to answer. If you have been considering upgrading to 2.0, now might be a good time to do so.

3.) Smaller forums may be able to switch from Member Activation to Member Approval and then may examine email addresses, IP addresses, etc. to decide which applications are human and which are spammers. This of course will result in more labor to operate your forum.

4.) You may decide to use post counts to restrict new members to posting a staging area, then give them full access only after they have shown they are human. The staging area can be easily swept of any spam debris.

5.) There are three modification packages that we believe can provide adequate defenses against spambots. I have verified that each of these packages is suitable for SMF 1.1.7. They are:


The last of the three replaces SMF's CAPTCHA system, but if you use one of the other mod packages make sure you have your CAPTCHA enabled. It won't hurt and it may help.


What won't work?

1.) Blaming it on SMF 1.1.7: As I explained above, the attacks are targeting all 1.1.x versions. It has nothing to do with the recent 1.1.7 release.

2.) Banning IP addresses: This is the Internet version of "Whack a Mole." They can create IP addresses and find proxies faster than you can ban them. This is useless in my opinion...

3.) Banning email addresses: Again, they can change them faster than you can ban them. I've never seen a human registration from mail.ru but some of the bots are using Gmail and other accounts. This is probably wasted effort unless you are manually verifying registrations.

4.) Hiding your SMF version: It's impossible for me to beleive that SMF 2.0 wasn't targeted only because the bots are searching for SMF 1.1.x strings. The target of SMF 2.0 would be too irrestible if there were not some other reason than the version tag.


Summary:

Well that's about it. My colleagues at SMF and I agree that there is no new problem with SMF's software, and that this is simply something that was going to eventually happen anyway. The only thing that changed is that some bot master tweaked and tuned his scripts for SMF 1.1.x. and so the attack has arrived this week.

Please take advantage of one or more of the steps that I've outlined above, and we believe that your spam attacks should stop. Be assured that if these measures don't work that either the developers or the mod package authors will come to your defense. Let's just all stay calm and collected, and one way or another we will beat the spambots. Unfortunately this will be an ongoing effort because each side is always going to be trying to upstage the other. Good luck!


EDIT: Added link to new mod: Anti-Spam Verification Questions
« Last Edit: November 23, 2008, 02:17:37 PM by Deprecated »
See a list of my mod packages. No support PMs please!

Offline ccbtimewiz

  • SMF Hero
  • ******
  • Posts: 5,300
  • Gender: Male
  • OXEN
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #1 on: November 11, 2008, 06:54:35 PM »
Thanks for the info. :)

Offline Anthony`

  • Sophist Member
  • *****
  • Posts: 1,347
  • Gender: Male
  • Formerly Project Evolution
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #2 on: November 11, 2008, 07:44:50 PM »
Very helpful. :D

Offline CloFan

  • Semi-Newbie
  • *
  • Posts: 18
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #3 on: November 11, 2008, 07:49:46 PM »
Glad to see I'm not the only one affected.  Woke up this morning to lots of SPAM, and been clearing them out all day!  It got so bad I had to close registration for the time being.  Thanks for the info!

Offline TheDisturbedOne

  • SMF Hero
  • ******
  • Posts: 1,700
    • Disturbed Message Board
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #4 on: November 11, 2008, 07:54:13 PM »
I should keep "one eye open" now.  Wouldn't want my site to be ruined by them.

Offline NFG

  • Semi-Newbie
  • *
  • Posts: 33
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #5 on: November 11, 2008, 08:29:07 PM »
I noticed the problem too and was very happy to see this post of fixes.  I've enabled two of 'em and expect the problem to cease PDQ.

Thank you.

Offline Mac_Hines

  • Semi-Newbie
  • *
  • Posts: 68
  • Gender: Male
    • StartupWorks.com
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #6 on: November 11, 2008, 08:58:20 PM »
Timely advice!!!  Thanks!!!

Offline Deprecated

  • SMF Hero
  • ******
  • Posts: 3,192
  • Gender: Male
  • I tried being reasonable ....... I didn't like it.
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #7 on: November 11, 2008, 09:00:38 PM »
The other topics were running away, speculative. This subject needed a cold shower. I gave it. :)
See a list of my mod packages. No support PMs please!

Offline papamitsos

  • Newbie
  • *
  • Posts: 2
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #8 on: November 11, 2008, 09:01:45 PM »
Thanks for the info.

For me it just worked to change the complexity of visual verification image from medium to high.

Offline rogueplanet

  • Semi-Newbie
  • *
  • Posts: 31
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #9 on: November 11, 2008, 09:06:35 PM »
i've just added the are-you-human to my install, has this been found to be most effective by most people?

Offline Deprecated

  • SMF Hero
  • ******
  • Posts: 3,192
  • Gender: Male
  • I tried being reasonable ....... I didn't like it.
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #10 on: November 11, 2008, 09:13:28 PM »
We don't have any comparative reports of which mod works best yet. I suspect all work well unless we hear to the contrary. I think all you have to do is mess up the 'bots just slightly and their script will fail.

This topic welcomes comparative discussion on which is the best strategy to use. I've merely outlined the choices so that everybody can pick which works best for them.

Some of the mods are not yet rated by the authors as 1.1.7 compatible. Part of my work involved testing all three to make sure they work on 1.1.7. I didn't test them exhaustively, but they all install and remove and are able to register a new member with no error logs being generated. I tested for that.

BTW two of the mods are up for grabs if anybody wants to support them, karlbenson's mods. MC is still alive and well as of about 2 hours ago when I was chatting on him via IRC, so I think the reCAPTCHA mod is probably not up for grabs. ;)
See a list of my mod packages. No support PMs please!

Offline vbgamer45

  • SMF Friend
  • SMF Super Hero
  • *
  • Posts: 16,431
    • smfhacks on Facebook
    • VBGAMER45 on GitHub
    • @createaforum on Twitter
    • SMF For Free
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #11 on: November 11, 2008, 09:15:19 PM »
I noticed it on one of my forums as well. I will submit a mod to the modsite this weekend to help combat spam.
Community Suite - Take your forum to the next level built for SMF, Gallery,Store,Classfieds,Downloads,more!

SMFHacks.com -  Paid Modifications for SMF

Latest Mod:
EzPortal - Portal System for SMF
Newsletter Pro SMF Gallery Pro SMF Classifieds SMF Store

Offline dustrho

  • Jr. Member
  • **
  • Posts: 132
  • Gender: Male
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #12 on: November 11, 2008, 09:17:13 PM »
I just changed the registration setting to require admin approval, so that should surely stop these mo-fo's from spamming our forum. It's pretty easy to weed out the bots as their usernames and hostnames are all messed up looking, and most of these (in my forum at least) have their IPs showing up in non USA countries.

Offline Deprecated

  • SMF Hero
  • ******
  • Posts: 3,192
  • Gender: Male
  • I tried being reasonable ....... I didn't like it.
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #13 on: November 11, 2008, 09:17:59 PM »
Great VB, I've been thinking along the same lines, but waiting to see if the spambots attack Beta 4 before I decide. :) I'll seeya where the mods play! ;)
See a list of my mod packages. No support PMs please!

Offline Deprecated

  • SMF Hero
  • ******
  • Posts: 3,192
  • Gender: Male
  • I tried being reasonable ....... I didn't like it.
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #14 on: November 11, 2008, 09:19:14 PM »
I just changed the registration setting to require admin approval...

That is one of the strategies that I recommended in the OP, if your forum isn't so big that approval becomes an onerous task.
See a list of my mod packages. No support PMs please!

Offline hurtdidit

  • Newbie
  • *
  • Posts: 8
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #15 on: November 11, 2008, 09:22:49 PM »
Thanks for the post.  I wasn't even aware of the reCAPTCHA mod, and am happy to implement it as it benefits a good cause.

Will be sure to let folks know if this doesn't help. :)

Offline lax.slash

  • Jr. Member
  • **
  • Posts: 333
  • Gender: Male
  • Let's go Buffalo!
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #16 on: November 11, 2008, 09:28:32 PM »
* lax.slash knocks on wood


Haven't been hit yet on 2.0, or 1.1.5 (KEEP FORGETTING TO UPGRADE!!) but will definatly take these precautions. Thanks, Deprecated! :) :) :)

Offline 青山 素子

  • Server Team
  • SMF Super Hero
  • *
  • Posts: 16,515
  • 戦場ヶ原、蕩れ!
    • motokochan on GitHub
    • @motokochan on Twitter
    • Animeneko Network
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #17 on: November 11, 2008, 10:07:27 PM »
As a note, reCAPTCHA for SMF works very well on the 2.0 betas, and in fact is much cleaner in code (because of the structure changes).
Motoko-chan
Director, Simple Machines

Just like... making of enemies / 負ける気しない やめるきない / You are cool but fool - Charisma.com 『HATE』

Note: I am not a member of the Simple Machines Forum project.


Offline rebelsgirl

  • Jr. Member
  • **
  • Posts: 141
  • Gender: Female
    • Crohn's Sanity
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #18 on: November 11, 2008, 10:08:32 PM »
I am using 1.1.7 and *touch wood* haven't had a problem with the spam bots yet.

Offline mouse92im

  • Semi-Newbie
  • *
  • Posts: 87
Re: Tidal wave of spambotbots attacks SMF 1.1.x - How to protect your forum
« Reply #19 on: November 11, 2008, 10:13:07 PM »
Adding an age restriction seems to have helped as well.  I haven't seen any new member requests since.