Why does the forum keep forgetting me recently?

[Megiddo]

Is this happening to anyone else? I have my login to be remembered forever, but it seems like it doesn't last more than a day...

[Stickly Man!]

Happening to me too, It seems that when I first visit the site after a while it will show me logged in, show me where new posts are, but when I actually go to a new page, it will log me out.. or something. 

[Megiddo]

It appears that there's a distributed password attack going on against the forums. This is probably why it's been logging us out. Please make sure you all have strong passwords! I'm not sure if there's anything else we can do about it, since it's coming from all sorts of different IPs...

Appears it's at about the rate of 15 attempts per hour. It's no DDoS, but it sure is annoying...

[Megiddo]

We banned about 40 IPs this afternoon, and it seems to have effectively stopped it (at least for now).

[MrPresident]

Earlier today the forum was unresponsive for me. Related perhaps?

[Megiddo]

Earlier today the forum was unresponsive for me. Related perhaps?

I saw that too and talked with DreamHost about it. They claimed that Apache froze, so don't think it's related (Unless these bots also know Apache vulnerabilities. Totally plausible, but why go after passwords too in that case?).

[JamminR]

I grow tired of retyping in my 10+ character, strong ascii, password every 2nd visit to the page. I've cleaned my cache n cookies, which by no means is as good as cookies n milk, and it didn't work.

[JamminR]

Additionally, that attack against us is reasonably intelligent.
They're using Tor.

Past 15 or so since 9pm yesterday.

Name:    tor-exit-router39-readme.appliedops.net
Address:  199.48.147.39

Name:    tor-exit-readme.hands.com
Address:  83.142.228.14

Name:    tor-exit-router42-readme.appliedops.net
Address:  199.48.147.42

Name:    tor-exit-router37-readme.appliedops.net
Address:  199.48.147.37

Name:    tor-exit-readme.hands.com
Address:  83.142.228.14

Name:    anonymizer5.torservers.net
Address:  174.36.199.202

> 94.249.153.47
*** UnKnown can't find 94.249.153.47: Non-existent domain

Name:    anonymizer.blutmagie.de
Address:  192.251.226.205
Aliases:  205.226.251.192.in-addr.arpa

Name:    tor-exit-router38-readme.appliedops.net
Address:  199.48.147.38

Name:    173.193.221.28-static.reverse.softlayer.com
Address:  173.193.221.28

Name:    tor-exit-router45-readme.appliedops.net
Address:  199.48.147.45

Name:    n80-237-226-75.cnet.hosteurope.de
Address:  80.237.226.75

> 68.71.46.138
*** UnKnown can't find 68.71.46.138: Non-existent domain

Name:    tor-exit-router45-readme.appliedops.net
Address:  199.48.147.45

Name:    anonymizer6.torservers.net
Address:  174.36.199.203

[Megiddo]

Bah, not much we can do about that...

[Megiddo]

All the bots changed patterns. They're all attacking the user "joealex" now. For those who don't remember, joealex is a very humanish spam bot. The name was initially registered under what was definitely a spam bot with junk links and such. We removed the account and it's one post when we noticed, but it got registered later with that teasing signature and one post again.

I can't help but think that the attacker wants us to know who he is now; before, the attacks always centered around active users or users with a lot of posts.

Other interesting tidbits: joealex is registered on dozens of SMF forums, all with one post, and all registered on November 8th. The IP used to register his account says he's using an ISP in India, but his profile claims he's from "Pennyslivania" [sic]. If we had more evidence, I'd be tempted to report him to his ISP, but it's pretty circumstantial.

Edit: I'm really not sure how to continue at this point. I mean, as far as I can tell, the attack isn't actually hurting anything. It just grates on my nerves that somebody would do this...

Edit again: Can you dig up any further information, JamminR?

[JamminR]

Wow, I believe I've met an actual challenge.
"Joe Alexander" as a name is quite popular. New Orleans or Texas basketball player among several hundred other people.
j.alexander87@yahoo.com finds me nothing other than the reasonably obvious but not any more helpful publicly listed SMF forum profiles.
I did find 'joealex' at this site listed twice. http://www.stopforumspam.com/about
(Didn't research more, they may have a nice plugin we could use?)

I've been tinkering almost an hour now. Maybe I'll look again.
My theory is some type of botnet using Tor, with that account, trying to log in to chat more spam but can't get in and the worm isn't smart enough to be stealthy about it.

[JamminR]

Just a heads up in case any of you admins look at the 'suspected botnet' ban list and go "I could have sworn there were more here"
There were.
Many shared the same first three octets x.x.x.y.
I replaced two or three with x.x.x.* to cover several at once.
I also shortenedd the message shown to the banned guest.
(Heh, whats 10 bytes saved several times a minute in bandwidth charges)

[MrPresident]

One of my garrysmod servers was attacked with a BotNet a couple of nights ago, effectively taking it down. At first it seemed there was nothing we could do about it. We used wireshark to capture about 8 seconds of network traffic producing roughly half a million access requests. Once we filtered through all of them it only seemed that there were about 7000 unique IP addresses in the attack so blocking them was pretty easy through peer block.

Pain in the arse though. We lost about 6 hours of valuable server traffic.

[JamminR]

Hmm. Meg, I forget, you have direct access to httpd configs on dreamhost?
Might do us better 'resource' wise to block the 'growing' list of hosts/ip addresses in our ban list at the httpd level.

Which brings me to my next entry on our ban list.
Hostname *.vpntunnel.org

I found 178.73.208.77 with several bad password attempts for several accounts.
Further inspection found it to be similiar to several other IPs in our current 'botnet attack' ban list.
So, just to make sure, I went ahead and banned the entire vpntunnel.org domain which it reverses to.
Slight chance I'll ban an individual 'real' user, but, meh, paranoid security.

Since I banned tor* ... 312 hits on it.
Also, our record holder (415 hits since we started the botnet antispam ban list), 66.230.230.230, is what seems to be a co-lo server, possibly in Georgia. It doesn't reverse IP, but a tracert to it, last hop is te3-4.co1.as30217.net
I'm 'guessing' co = colocated, and even guessing more that 30217 is zip code location of the colo server.
Franklin, GA - few miles outside of Atlanta, a major colo/fiber line distribution area.

Oh, and, I found this - http://www.stopforumspam.com/whois/66.230.230.230 - it doesn't seem to be too personal, just a major botnet against the forum world.

[Megiddo]

We're not very strapped on resources blocking the bots, since it's only one attack every few minutes. Besides, at the forum level I can have you guys help me ban IPs.

I actually shifted the tor* hostname ban around a couple times, so the current one's only been up a few days. It'll get bigger, just wait.

No idea about that record holding IP. I've been toying with the idea of sending an email to the admin contact for the company in charge of that IP... but meh.