Chips' Fun House ~ View topic - FuntKlakow

Forum Soldier Joined: 10 Mar 2005 Posts: 352

As quoted from Digg:

During the last few days a bot using a name FuntKlakow, has been
registering to at least hundreds (maybe thousands) of phpBB forums.

But most on most forums the bot keeps silent.

Ok, what is a danger?
Next time the phpBB announces a critical vulnerability, the bot would
have everything ready (just a post click away) from attacking
thousands of sites/forums.

Best defence against these kinds of bot-members, might be setting up
honeypot-forums, which the search engines can find but to which there
are no permanent links from the web. When new bot-members are
detected, such would be listed at each particular forum makers
homepage.

When a bot would then try to register to a forum, the forum program
would check the user/bot inputted user-name (or other characteristics)
and if those would match to those catched by a honeypot-forums,
registerin such user detais would be eliminated ( and possible IP
banned for some time)

We need to get him banned from here, i looked and yes he is registered here too. If you know any forums which have this guy, ask them to ban him also please.

Google the username if you do not believe me, he is registered all over the place.

Forum H4xor Joined: 08 Dec 2004 Posts: 2504 Location: NJ

wow , nice find. I think we should move our forums to like this http://www.invisionpower.com/ip.dynamic/products/board/index.html

Welp, I dont know anything about pricing or the like, but we use Invision v2.1.5, and its pretty similiar to phpbb.....although there are some additional customizing features.
Heres a peekie.
http://forums.guns4back2school.com/

can't you just make it so you have to type the letters you see in a picture to make sure these bots don't even get into the forums?

Wow I am totally amazed. Chips if you have the time could you give me the IP? I wish to know which country this bot registered from. I am in the process of banning entire countries from my websites. Turkey has been a real problem for me.

I went to PhPBB's website and it was there (people reporting this).
HERE
& HERE

I don't believe this has reached the ported version php-nuke. Asking Chips to convert this board to another flavor of a bulletin board is a BIG JOB. Knowing PhpBB they will put out an update of some kind to stop this.
They do suggest a visual confirmation to register, all though one claims it's not helping.

I'm going to add these names to the "disallow names:"
- jtfoe1974
- unmmyns
- coldsorin
- fairlande
- largepafilis
- pirsrv
- sadlatour
- bighor-lam
- greatfintan
- budowa_cepa
- Cepelin
- FuntKlakow

...great find Smile

FuntKlakow has been banned by name and e-mail addy ... FuntKlakow@socialinfoclub.com. That name and the other names on the list are now disallowed here. They (or anyone else for that matter) won't be able to register with those names.

Oddly enough...Cepelin had made a post here earlier this week...AS A GUEST !!! Shocked

I don't allow anyone but registered users to post...I have no idea how that happened. All I did at the time when I realized that was delete the post...I should have banned the ip also, wasn't thinking.

I'm not even considering changing over to another board. If you read the posts that Dove referred to...any board is vulnerable if someone REALLY wants in. Even visual confirmations can be beaten...just not worth the effort. I don't even use the simplest of things like account activation on these forums. I count on you folks (and my own efforts of course) to catch the bots and delete their accounts.

My best defense against all of this? I run a cron job at my webhost to back up the forums database on a daily basis. Worst came to worst...I'd just install the latest backup to put things back the way they were. We'd maybe lose some posts...but that's not the end of the world.

Dove has a websote? Surprised

can I get funks IP aswell as I want to ban him from my other website Razz

I don't know the ip...I only see that when someone posts. That account had no posts. It may be in the database somewhere...but since I deleted the account, it's gone now. Just ban the ip for socialinfo.com...that's a good place to start.

Forum Soldier Joined: 10 Mar 2005 Posts: 352

The bot has been known to post on some forums, simply making agreeing statements.

To add to this - I was checking smf's (simple machines) website to see if they were getting bots registering on their boards, and some people suggested that these were low paid individuals -> paid to spam links into websites. So I wonder how one determines if it's a real individual or not. I can believe this to be true because, here's what happened to me more than once on Ed's web.

^^ not sure how well you can see them but this person registered then posted links to mortgage companies, credit cards, etc. He used the comments section to our news. Problem is he posted using several different ips - so I suspect dial-up.

Anyone posting links to such things...or anything n0n-game realted, get the boot. This is a gaming forum...and anything not related to that is out. Twisted Evil

Sorry chips I just started a post and I HAD to post a link to something not game related but for a good reason. You'll see.
http://www.chipsfunhouse.com/forum/viewtopic.php?t=2634