Forums Under Attack?

I've been on many websites that use free forum packages like phpBB, SMF, punBB etc and I've noticed that all of them are under attack by users posting threads for drug companies, pron, warez and viruses.

The leadwerks forum had to be shutdown because of this and I've noticed that Gabriels "Glimmer Games" forum is also under attack from members posting threads to sell drugs, warez and pron etc.

Are these legitimate users posting these things or is it bots of some kind? If they're bots, how do they get around the email validation?

Do paid for forums like vBulletin, IKon Board etc suffer these problems? Would these forums be hack proof like BRL custom forum?

Bots that probably sniff through forums of a specific type with an unpatched exploit that gets through and screws the thing over.


I'd highly doubt these forums are hack proof, when there's a will, there's a way, more-so when it's a custom built one, just no ones bothered to do so I guess since why attack one specific forum when you can exploit a widely used one?

nothing is hack-proof, it may be so tight that it is not worth it when you can exploit carbon copy forums so easily

i have never seen those posts on any of the forums i have been to

The phpbb staff seems unconcerned with these issues, which is why I switched. Their solution is to patch the code with user-made hacks. There is no official fix, and they don't seem to think it's necessary.

The new Leadwerks forum is available here:
http://www.leadwerks.com/forum/

Setting the PHPBB forums to authorize new users helps greatly in catching
the spammers/bots.

Verifing their email addys and URLs, but this takes user interaction from the
admin of the forum.

-Garrett

A forum for the guild wars guid I'm in has been getting these sorts of posts. Didn't realise it was happening alot!

That's Advertisement Bots, a client can post massive ad on multiple sites instantly.

Email verification is a common way to deal with this.

They don't really exploit anything, it's simply an automatic process of filling in forms and then posting. No unpatched exploit is needed, the program just goes through the exact same steps that a person would.

Ah yes I've seen those, it's when someone posts simply something like 100 links to a single post.
Really annoying.

Using email verification cut down the number of bots getting through, although they all still sign up. It's annoying because my forum has about 5 regular members so it isn't really the best place for spam.

Loads of forums are being hacked in many ways at the moment.

A huge amount of hacked forums atm are those which were runing a live chat system called flashchat (pre 4.6.2 version) which had a huge security hole in one of its CMS modules (aedating) which allowed the attacker to simply include a file by passing paramaters to this php module. Naturally the file was something on the line of c99shell and many similar ones which gave full access.

They aren't spamming to get your users to click. They're spamming so that Google will think their link is popular.

Yep, which is a shame because I block Googlebot (sucks too much bandwidth)...

If you have a guestbook or something in any website you host and you get these spamms then it's usefull to use JavaScript for stopping it. Most of the bot's don't recognise JS:

<?php
    if ($_POST['post'] == "Y") {
        if ($_POST['check'] != "success") {
            die ("You need to have JavaScript enabled!");
        }
        ... rest of the code ...
    }
?>
<form method="post" name="form" onsubmit="form.check.value='success';">
  <input type="hidden" name="check" value="failed" />
  <input type="hidden" name="post" value="Y" />
     ... rest of the form ...
</form>

It worked for me.

I've seen them first on boards where no registration was required. Something about libido drugs. I've decoded the script and traced it back to a server in russia. it was redirected several times, finally ended somewhere on a domain thas was on sale. It's likely the 2nd last or third last server on the route tried to hack the client, testing for several vulnerabilities (eg like executable jpgs etc.), mainly on XP machines that aren't SP2ed.

It's not Ads, it's malware.

Just put it down to inexperience on the part of the administrators. I thought I set it to force users to verify, but I guess I didn't. I have now removed all objectionable posts and banned all users.

Anyone who signs up in future will not be able to do so without verifying.

I suppose I should have notified you Gab but somehow forgot to do so.

No worries. My GMail account ( or possibly FireFox ) has been on the fritz all week so I probably wouldn't have got it anyway.

Yeah, somehow we gotta learn how to keep this problem from getting too widespread throughout the whole Internet forum community. Man, does every forum site have to be equipped with a firewall anymore? Why can't someone just invent an Internet version of the TeleZapper (as I have mentioned in a spam-affected forum site). Seems like moderators and administrators in half these forums are too burned out, because it IS too much out of hand. Just moderators alone won't solve this problem at its roots, that's something that may have to use some sort of security software, hopefully some genius will develop that type of system.

Like i said, JavaScript is the solution.

Yeah, but it takes someone really experience with JS to tighten all the security holes that one can break through rather easily, especially if the JS can't detect a bot from a normal person.

I said that mostly bots don't know JavaScript not that JavaScript can't detect bots.

Since they are posting on standard forums, guest books, blogs etc. Wouldn't simply going in and adding some random step to the process of posting/registering make the bots fail. I don't know how complex the code of most of these things is, but it can't be that hard. :)

Currently the only solution that stops bots from automated registrations is a request for optical code recognition. An image contaning a word or code that is disguised and distorted in a way that prevents bots from reading it.
Javascript may be a solution too, but I guess it's only a matter of time until those scripts can be handled by bots.

This must be pretty clever programming though musn't it? Bots that look for forums, auto register and post in threads. I see people talking about IRC bots. Are these the same?