Hi,

Last night we discovered that our forum is under attack of a password guessing botnet. Each bot tries to logon a few times a day, which resulted in 3000 failed logons the last few days. As temp solution are 200 IP adresses banned. We will keep monitoring this. If you have made a logon failure the last few day, you may have been added too. So if are accused of being a password bot, please let us know.

Marc

wow, the spammers are each time worse.

We also get some spam daily, I think from spam accounts. Any ideas if something more could be done against the creation of spam accounts?

thanks,

Felipe Monteiro de Carvalho wrote

wow, the spammers are each time worse. We also get some spam daily, I think from spam accounts. Any ideas if something more could be done against the creation of spam accounts?

There is a plugin that checks new accounts against a known spammers database. I'm thinking of adding it.

Marc

Is there something like fail to ban for the malling list ? That is several attempts for brute force attack will ban the one that tries.

LINESIP - Opening the source for communication
http://www.linesip.com
http://www.linesip.co.il
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lazarus.freepascal.org/pipermail/lazarus/attachments/20110111/a0f0f560/attachment-0001.html>

Marc Weustink wrote

There is a plugin that checks new accounts against a known spammers database. I'm thinking of adding it.

The amazing thing is that we already have a image, so they are using OCR (Optical character recognition)? Maybe harder images would be a solution?

On Tue, Jan 11, 2011 at 15:01, Felipe Monteiro de Carvalho <

you can use my idea at http://ik.homelinux.org/index.rhtml/contact where I ask logical questions that you need to understand the question and answer a simple single answer. I have over 400 questions there that arrive at random :)

Ido
LINESIP - Opening the source for communication
http://www.linesip.com
http://www.linesip.co.il
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lazarus.freepascal.org/pipermail/lazarus/attachments/20110111/708d8118/attachment.html>

We already have questions, that didn't help much.

Marc

Diversification is as alway the root cause of all evil. In that case diversivication between poor and very poor.

http://www.blackhat-seo.com/2009/captcha-farms/

The only real solution is personal verification of all forum users.

helmut

very likely... they have been making large strides in passing automated captcha...

Maybe harder images would be a solution?

that and possibly even special questions that only humans can answer... what forum software is it? my phpBB3 gets beat on daily but no spammers have been successful at getting in... then again, my IDS/IPS also has special rules to detect such attempts and blocks them at the perimeter so they don't beat the forum server to death ;)

Maybe the admins/moderators should be able to mark users with a class/level of trust and at critical times simply delay the posts from those newly registered until they are manually reviewed and their profile is validated.

As always manually verifying is time consuming and almost nobody wants to do it but in the case of Lazarus/FPC the number of users is not that large.

Razvan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lazarus.freepascal.org/pipermail/lazarus/attachments/20110111/05c5d148/attachment.html>

This doesn't prevent password guesses.

Marc

i forgot to add to my previous post that we also do this... new users sign up and validate via email and confirmation... then their initial posts are moderated until X number of valid ones...

one can also easily find the automated bots trying to stuff the get/post vars because they rarely simply get all of the forms in the proper sequence... this is one of the basic tenets of my IDS/IPS rules sets for this particular activity...

true but blocking on too many failures does ;)

this is also used for many ftp, telnet, smtp, imap, and pop3 servers, just to name a few ;)

On Tue, Jan 11, 2011 at 2:40 PM, Felipe Monteiro de Carvalho <

After reading the thread a thought came, not particularly solution about the posted problem, but maybe for others.

There can be questions about the forum itself, for example
- the name of the last poster in Programming-Design section,
- the date of the last message in "bla bla bla" thread.
- the number of replies in "bla bla bla" thread

In this case the server part is very easy one, for any question it's just an sql query (for whatever base the forum uses, mysql, postgresql) and the result of the query is the word the user should enter. The format strings for question can vary and evolve from time to time.

I know that this approach will require some skills from the user, but it also can be considered a very basic iq test for membership ;)

Max Vlasov
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lazarus.freepascal.org/pipermail/lazarus/attachments/20110112/24ae0ccc/attachment.html>

Max Vlasov wrote

After reading the thread a thought came, not particularly solution about the posted problem, but maybe for others. There can be questions about the forum itself, for example

Ask the user something, for which he *must* read the FAQ => this would at the same time reduce the amount of questions ask by users who currently do not read the FAQ.....
:) :)

Or ask he user for full details to their online banking, get some funding for the project.... :>

SCNR

How about a Capcha that was a coding problem?

When I worked for a mainframe company I sat a developer's aptitude test, and one of the questions showed a set of nested functions in a Pascal-derived language with the question being what value does variable A have at point X. I wonder whether that type of problem could be turned out by software, and whether they could be chosen to be difficult enough to defy automated solution but not so difficult as to deter new users?

Hello Lazarus-List,

Tuesday, January 11, 2011, 10:26:44 PM, you wrote:

MML> How about a Capcha that was a coding problem?

Everything done by machines (like parsing) is done better by machines :)

MML> When I worked for a mainframe company I sat a developer's aptitude test, MML> and one of the questions showed a set of nested functions in a MML> Pascal-derived language with the question being what value does variable MML> A have at point X. I wonder whether that type of problem could be turned MML> out by software, and whether they could be chosen to be difficult enough MML> to defy automated solution but not so difficult as to deter new users?

IMHO the "solution" is to personalize the captcha. The most simple captcha is hard to be resolved by a computer if the captcha "style" change everyday. This is not true for large sites like hotmail, yahoo, and others, but for "small" sites a simple image recognition captcha which changes its carrousell everyday is more than secure as specific attack must be designed for low audiente.

Using ready packages in forum software is like putting "This is the captcha model xxx, look for computer solution at your local captcha resolver provider" :)

OCR is a quite mature technology, so anything based in text is not usefull, computer vision is a different thing, post a photo of a park and ask for the amount of bikes ;) blonde girls, trees, etc... or even better enforce the user to mouse click over the image for each bike.

Thats what is done now, every ip with 2 or more failures is blocked.

Marc

IMHO the "solution" is to personalize the captcha. The most simple captcha is hard to be resolved by a computer if the captcha "style" change everyday.

IMO it depends on the financial interest, when e.g. companies recruit "data entry" people in freelancer.com, or pay for huge numbers of email accounts. All that nowadays is available for a few dollars, in addition to automated intrusion.

DoDi

Mark Morgan Lloyd wrote

How about a Capcha that was a coding problem?

Some users do not speak english very well, so they may not understand the problem that we are trying to express.

And this brings a general issue: making the verification too hard is also a problem for legitime users.

Should animated graphics (gifs, pngs?) be used as captchas?

thanks,
dmitry

Hello Lazarus-List,

you wrote

> IMHO the "solution" is to personalize the captcha. The most simple > captcha is hard to be resolved by a computer if the captcha "style" > change everyday.

HPD> IMO it depends on the financial interest, when e.g. companies recruit HPD> "data entry" people in freelancer.com, or pay for huge numbers of email HPD> accounts. All that nowadays is available for a few dollars, in addition HPD> to automated intrusion.

That's what I try to say :) There is no real solution about captcha farms for large sites, except non standard email posting verification (or something like that) that consumes too much time even for real users.

But they speak Pascal, otherwise why are they trying to register?

function a(b, c: integer): integer;
   function d(c, b): integer;
   begin
     b:= c + d
   end;
begin
   a:= d(c, c)
end;

What does a(2, 3) return?

Mark I think you can do better than that!

Assuming you meant to write

function d(c, b: integer): integer; etc.

it is still a nonsense, a function that tries to alter non-var parameters and has an undefined result.

It's OK to give newcomers to the forum a slight hurdle before entry, but not to offer them this sort of hopeless hoop that can't be jumped through, and suggests that the users of the forum can't write valid Pascal!

Howard

What I'd intended to write was

function a(b, c: integer): integer;
   function d(c, b: integer): integer;
   begin
     d:= c + b
   end;
begin
   a:= d(c, c)
end;

However the problem itself would obviously be machine-generated from a set of templates, I'm not suggesting this as The Test.

For various reasons I couldn't cut and paste that example from where I'd checked it. Thank you but I think one person (Lance) pointing out that I'd got it wrong is entirely adequate.

My apologies for wasting bandwidth.

Mark Morgan Lloyd wrote

But they speak Pascal, otherwise why are they trying to register?

What if they want to learn Pascal?

Then we'll have to implement many variations of such a template, otherwise the bots can handle single cases easily.

DoDi

Very true, but by the time the template has been expanded with different variable/function names and turned into a graphical capcha using one of a range of fonts I think it would make life tricky for them.

In any event, I'm only throwing an idea into the pot and giving it a stir.