Simple Machines Community Forum

SMF Support => SMF 2.0.x Support => Topic started by: SirLouen on August 20, 2024, 10:17:32 AM

Title: Blasted with a massive spam
Post by: SirLouen on August 20, 2024, 10:17:32 AM
I've been blasted with a brutal spam attack, like 1500 users, 1500 posts in the past 7 days I was away.

I'm now thinking between a roll back with a backup and if there a way to wipe like all back 7 days posts without causing much disaster

I'm not completely familiarized with smf tables

So my protocol would be:
Pruning last 7 days for smf_members, smf_messages, smf_topics and then run the maintenance tasks to sort out logs.

There are like smf_log_ tables. I assume that I can leave them untouch or even purge them, right? Or just run the maintenance tasks in the backend and not mess with this tables.

About smf_sessions, can I truncate it?

I dont see any other relevant table that could cause problems

I will disable registrations for now, and see how can I stop this spamming. I was using hCaptcha, but they have been able to completely sort it :(
I see that this forum uses reCaptcha v3, but they were also able to sort it also.

I need to research more, but I need to also find a good anti-spam system for SMF 2.0 because this is unbearable right now. Dozens of spam accounts per day (if not hundreds)
Title: Re: Blasted with a massive spam
Post by: Kindred on August 20, 2024, 10:58:21 AM
Do not edit the database directly.  Bad things will happen.  Tables are far more interconnected than you think
Title: Re: Blasted with a massive spam
Post by: SirLouen on August 20, 2024, 11:01:25 AM
Quote from: Kindred on August 20, 2024, 10:58:21 AMDo not edit the database directly.  Bad things will happen.  Tables are far more interconnected than you think

Any alternatives?
Title: Re: Blasted with a massive spam
Post by: Illori on August 20, 2024, 11:06:01 AM
restore the full database

or go into the users account and delete the account and posts.
Title: Re: Blasted with a massive spam
Post by: SirLouen on August 20, 2024, 11:23:54 AM
Quote from: Illori on August 20, 2024, 11:06:01 AMrestore the full database

or go into the users account and delete the account and posts.

Not an option, any of the two.
Don't worry, I've sorted it by manipulating the database.
Title: Re: Blasted with a massive spam
Post by: Steve on August 27, 2024, 06:54:00 PM
Why was Illori's's suggestion not good one for you?

What's confusing me is why you would come here and ask for support and be told that one thing is not a good thing to do and restoring was your best option but you did the worst thing you could do anyway.
Title: Re: Blasted with a massive spam
Post by: SirLouen on August 27, 2024, 07:42:23 PM
Quote from: Steve on August 27, 2024, 06:54:00 PMWhy was Illori's's suggestion not good one for you?

What's confusing me is why you would come here and ask for support and be told that one thing is not a good thing to do and restoring was your best option but you did the worst thing you could do anyway.

The problem is that I detected some extra random spam messages from days before and I found a pattern, so restoring was not an option anymore, but doing some clearance was the best from my POV.

I was expecting some simple DB clean-up protocol. I have a big expertise on WordPress but not on SMF, so I'm used to handling issues straight from DB. I could try to dig further to learn more about the nuances of SMF, but was expecting that maybe someone with more experience and knowledge than I have, could give me some clear insights on which tables were relevant for this purpose.

Since I did not get the answer I was expecting in the exact form of: "check these 4 tables", I did it on my own and accomplished the cleanup accordingly, so things are working perfectly right now. As expected, SMF is nothing special. In fact, I happened to find some nice maintenance tools that help to do some extra clean-up after the DBs have been manually manipulated.
Title: Re: Blasted with a massive spam
Post by: Kindred on August 27, 2024, 08:57:20 PM
Those tools are not actually for use after the database has been touched... because we will practically never ever recommend direct database edits  - especially not to delete accounts.
Title: Re: Blasted with a massive spam
Post by: Arantor on August 28, 2024, 02:13:52 AM
Thing is, unlike WP with its default 11 or so tables, SMF ships with 60-odd in 2.0 and 70-odd in 2.1 and the data is *far* more connected.

Did you fix up any reported posts, for example? Likes for deleted posts? And that's before we get into mods.

This is why we don't recommend it, but you have a history of ignoring the advice given to you.