Information about the recent spamming incident

General Announcements about Unreal Tournament and UT99.org

Information about the recent spamming incident

Postby Shade » Fri Feb 05, 2016 2:36 am

Yesterday and today, some spam happened on UT99.org.
Here is some information, what exactly happened:

- Around 14 accounts were created (by hand as it looks), which posted over 4000 posts by automation.
- These accounts deleted their own posts afterwards.
- Just before and after these accounts deleted their own posts, the account luluthefirst deleted some of his own posts, too (by now, nearly all of the account's posts are empty) and PMed me to inform me, that I can now move his (empty) posts over to the fake-author "UT99.org" (which I use as author for posts of users who wants to be deleted. So their posts will not be deleted, too).

What I did now:
- I have deleted all spam accounts.
- The registration is open again.There is no security issue, since these few spam accounts where most likely created by hand.
- I have changed the Flood interval (Number of seconds a user must wait between posting new messages) from 10 to 30 seconds.
- I have written a mail to the e-mail adress of the account luluthefirst to inform about the incident and asking for any information, he probably might have for me. The account is banned for now.

For now, it seems like everything is back to normal.
Yet it is unclear, if the spamming here was caused by luluthefirst itself or by another person who just also hijacked his account (which doesn't look like it happened by random).

To the admins of other forums: If you have a user named luluthefirst, please consider to have a close look at this account's actions.

If incidents like that happen again, please don't hesitate to immediately contact me via mail: mail@ut99.org. That's the fastest way to inform me about anything. Thank you!
User avatar
Shade
Site Admin
 
Posts: 1364
Joined: Sun Jan 27, 2008 12:03 pm
Location: Germany
Personal rank: Founder of UT99.org

Re: Information about the recent spamming incident

Postby JackGriffin » Fri Feb 05, 2016 3:27 am

Not really sure if it is related but I got an email from Bohemia that the DayZ forums were hacked:
http://data.bistudio.com/mailing/html/d ... -2016.html

Could be someone stole login credentials and used them here.
"You damn kids, back in my time we made the items, maps and games ourselves with an unwieldy engine using counter-intuitive crash-prone tools and we liked it so much we built communities around this which nowadays look like cults because they're quasi-parallel societies based on the same old games." -Hellkeeper
User avatar
JackGriffin
Godlike
 
Posts: 3685
Joined: Fri Jan 14, 2011 1:53 pm
Personal rank: Hack coder

Re: Information about the recent spamming incident

Postby Shade » Fri Feb 05, 2016 3:46 am

JackGriffin wrote:Not really sure if it is related but I got an email from Bohemia that the DayZ forums were hacked:
http://data.bistudio.com/mailing/html/d ... -2016.html

Could be someone stole login credentials and used them here.


For that they would need the plain text password.
User avatar
Shade
Site Admin
 
Posts: 1364
Joined: Sun Jan 27, 2008 12:03 pm
Location: Germany
Personal rank: Founder of UT99.org

Re: Information about the recent spamming incident

Postby JackGriffin » Fri Feb 05, 2016 4:00 am

Depends on how they were salted. A decent group could decrypt a password database, especially if it were as large as that one. You'd have a lot of easy ones to crack first to apply to the table.
"You damn kids, back in my time we made the items, maps and games ourselves with an unwieldy engine using counter-intuitive crash-prone tools and we liked it so much we built communities around this which nowadays look like cults because they're quasi-parallel societies based on the same old games." -Hellkeeper
User avatar
JackGriffin
Godlike
 
Posts: 3685
Joined: Fri Jan 14, 2011 1:53 pm
Personal rank: Hack coder

Re: Information about the recent spamming incident

Postby sektor2111 » Fri Feb 05, 2016 7:42 am

Hacked account or not, these spam posts came from let me guess the same IP address. REMOVE access from that range and you can complete spam-bot list (if you are using such thing) - If this would depending on me also known listed proxies would be defaulted to bye bye section.
User avatar
sektor2111
Godlike
 
Posts: 3774
Joined: Sun May 09, 2010 6:15 pm
Location: On the roof.

Re: Information about the recent spamming incident

Postby Dr.Flay » Fri Feb 05, 2016 8:06 am

The IP range was blocked at the same time as the ban
User avatar
Dr.Flay
Site Staff
 
Posts: 3143
Joined: Thu Aug 04, 2011 9:26 pm
Location: Kernow, UK
Personal rank: Chaos Evangelist

Re: Information about the recent spamming incident

Postby LANguy » Fri Feb 05, 2016 10:33 pm

I had this problem once. If it becomes a recurring issue and they get through your CAPTCHAs, add a custom field in registration. For example a hidden field that humans won't see, but that a bot crawling the page would see and fill in. If they try to register with that hidden field populated, let them make the account but all their posts become invisible. Spambots won't know they didn't succeed.

Lower tech implementation, a required custom field like: "Are you a spam bot? Type in "no"" with a 2 character input for "no" being the only answer that will permit them to register, pretty much completely killed all the spam in my forum.
LANguy
Novice
 
Posts: 7
Joined: Mon Jan 25, 2016 4:32 pm

Re: Information about the recent spamming incident

Postby JackGriffin » Sat Feb 06, 2016 12:59 am

OK, now I'm confused. Will the real Slim Shade please stand up? Please stand up?
"You damn kids, back in my time we made the items, maps and games ourselves with an unwieldy engine using counter-intuitive crash-prone tools and we liked it so much we built communities around this which nowadays look like cults because they're quasi-parallel societies based on the same old games." -Hellkeeper
User avatar
JackGriffin
Godlike
 
Posts: 3685
Joined: Fri Jan 14, 2011 1:53 pm
Personal rank: Hack coder

Re: Information about the recent spamming incident

Postby papercoffee » Sat Feb 06, 2016 1:09 am

JackGriffin wrote:OK, now I'm confused. Will the real Slim Shade please stand up? Please stand up?

It's one of the guys from yesterday.
User avatar
papercoffee
Site Staff
 
Posts: 9046
Joined: Wed Jul 15, 2009 11:36 am
Location: Cologne, the city with the big cathedral.
Personal rank: coffee addicted !!!

Re: Information about the recent spamming incident

Postby JackGriffin » Sat Feb 06, 2016 1:23 am

Yeah, obviously. I have a feeling this board may be in for a rough patch. Name and shame Shade, let the community assist in the defense.
"You damn kids, back in my time we made the items, maps and games ourselves with an unwieldy engine using counter-intuitive crash-prone tools and we liked it so much we built communities around this which nowadays look like cults because they're quasi-parallel societies based on the same old games." -Hellkeeper
User avatar
JackGriffin
Godlike
 
Posts: 3685
Joined: Fri Jan 14, 2011 1:53 pm
Personal rank: Hack coder

Re: This post has been compromised due to a security issue

Postby EvilGrins » Sat Feb 06, 2016 2:39 am

Image
Shade‭ wrote:

ImageImageImage
http://unreal-games.livejournal.com/
Image
medor wrote:Replace Skaarj with EvilGrins :mrgreen:
User avatar
EvilGrins
Godlike
 
Posts: 6122
Joined: Thu Jun 30, 2011 8:12 pm
Location: Palo Alto, CA
Personal rank: God of Fudge

Re: Information about the recent spamming incident

Postby Shade » Sat Feb 06, 2016 2:49 am

The IPs are too random now. Banning them is useless. But they are logged and the investigation continues. I am in contact with people who have many years of (anti-)hacking experience. UT99.org is no playground for some hackerkiddies, counteraction is garantueed.

(Jfyi: The Spambot "Shade" used ASCII Codes in the name, which were not displayed here. Doing this will not be possible in future registrations.)
User avatar
Shade
Site Admin
 
Posts: 1364
Joined: Sun Jan 27, 2008 12:03 pm
Location: Germany
Personal rank: Founder of UT99.org

Re: Information about the recent spamming incident

Postby PrinceOfFunky » Sat Feb 06, 2016 4:19 am

What if luluthefirst got hacked?
I meant, I know who luluthefirst is, I just don't remember where I met her, but anyway, I found this on the web: https://productforums.google.com/forum/#!topic/youtube/vvyvGTGLePg.
I know it's from late 2010, but still, that user could be the same one from here.
If I remember good she was from Chillingfield (now down since many years I think).

EDIT:
papercoffee wrote:
JackGriffin wrote:OK, now I'm confused. Will the real Slim Shade please stand up? Please stand up?

It's one of the guys from yesterday.

Idk if you meant that the same "guy" hacked him, but anyway, I don't know if his previous rank was: "Hack coder", like it is now.
Image
User avatar
PrinceOfFunky
Inhuman
 
Posts: 991
Joined: Mon Aug 31, 2015 10:31 pm

Re: Information about the recent spamming incident

Postby papercoffee » Sat Feb 06, 2016 4:32 am

PrinceOfFunky wrote:
papercoffee wrote:
JackGriffin wrote:OK, now I'm confused. Will the real Slim Shade please stand up? Please stand up?

It's one of the guys from yesterday.

Idk if you meant that the same "guy" hacked him, but anyway, I don't know if his previous rank was: "Hack coder", like it is now.

between LANguy and Jack was a post of another Shade (a copycat) ...I meant this guy.
The post is already deleted by the staff crew.
User avatar
papercoffee
Site Staff
 
Posts: 9046
Joined: Wed Jul 15, 2009 11:36 am
Location: Cologne, the city with the big cathedral.
Personal rank: coffee addicted !!!

Re: Information about the recent spamming incident

Postby EvilGrins » Sat Feb 06, 2016 4:54 am

papercoffee wrote:The post is already deleted by the staff crew.

Damn straight!
Image
I scared him away.
http://unreal-games.livejournal.com/
Image
medor wrote:Replace Skaarj with EvilGrins :mrgreen:
User avatar
EvilGrins
Godlike
 
Posts: 6122
Joined: Thu Jun 30, 2011 8:12 pm
Location: Palo Alto, CA
Personal rank: God of Fudge

Next

Return to Announcements

Who is online

Users browsing this forum: No registered users and 1 guest