Ticket #73 (reopened task)

Opened 1 year ago

Last modified 1 day ago

deal with link spammers

Reported by: warner Assigned to: warner
Priority: major Milestone: undecided
Component: buildbot.net Version:
Keywords: Cc:

Description

we've started to get trac-specific link spammers here: someone created an account, added a bunch of links to the front page, then deleted the account.

I'm thinking that the Register form could acquire an extra field that makes you answer a simple math question. At least defeat the default spambot behavior.

Attachments

SandBox.gz (2.0 kB) - added by warner on 08/23/07 02:23:10.
copy of the SandBox page with spam links inside

Change History

08/01/07 00:45:32 changed by mikel

(You probably already knew this but ...)

Trac should already have support for this (using CAPTCHA) - see the 'spam-filter' section of the TracIni docs :

http://trac-hacks.org/wiki/TracIni

08/02/07 12:31:44 changed by warner

got hit again.. both TracWiki and WikiStart this time. And this time the account wasn't self-deleted yet.

mikel: thanks, I'll check that out.

08/06/07 12:28:07 changed by warner

I like this approach: http://www.exaile.org/trac/wiki/HackingTracAccountManager

I'm experimenting with it now, and if it works on another trac instance I use, I'll apply it here.

08/06/07 15:17:42 changed by warner

  • status changed from new to closed.
  • resolution set to fixed.

I've implemented that hack, now there is a 2+2=? question on the create-new-account page. Somebody let me know if it causes problems.

Now we just wait and see if the new bar is high enough to cut down on the noise..

08/14/07 23:12:14 changed by warner

  • status changed from closed to reopened.
  • resolution deleted.

Nope, not high enough. A creep using the username 'baker' created an account at 1:56 this morning and proceeded to add pill adds to every wiki page they could find. I think this is an actual human, given that they weren't modifying more than a handful of pages per minute (I'd expect a bot to run faster).

I'll change the challenge question to something else and see how long it takes for them to come back.

08/14/07 23:29:03 changed by warner

for reference, it took me 15 minutes to revert all the spammer's changes. It'd be awfully nice if Trac offered a "revert all change made by user X" button.

08/19/07 12:50:41 changed by warner

we were hit again, 8/18 by user 'sems'.

08/20/07 17:31:15 changed by warner

and again 8/20, just the WikiStart page, by 'robiknode'. I'm looking for an SQL command that will delete all wiki entries made by a given user.

08/23/07 01:58:11 changed by warner

and again, by 'myaso'. I'd cleaned all the previous pages except for SandBox, and I was amused to see that the spammer replaced all the previous spam links with new ones (rather than just appending their links to the existing page). All of the links appear to go through compromised university accounts.

08/23/07 02:19:13 changed by warner

awesome, 'DELETE FROM wiki WHERE author = "myaso";' gets rid of all of those pages with a single command.

08/23/07 02:23:10 changed by warner

  • attachment SandBox.gz added.

copy of the SandBox page with spam links inside

08/26/07 21:14:06 changed by warner

hit again today, 12:04pm, by 'bsyao'. All cleaned up.

09/08/07 12:39:08 changed by warner

and again yesterday, 00:52 to 00:57, by 'becool'. All cleaned.

09/11/07 01:11:52 changed by warner

and again yesterday, 23:06, user 'finecool'.

09/13/07 18:30:45 changed by warner

again today, 11:56, user 'finemsn'

09/22/07 13:18:58 changed by warner

again yesterday, 9/21, 9:24, user 'listall'

09/30/07 15:21:42 changed by warner

again today, 'robiknode', 9/22/07 13:42

10/01/07 13:03:09 changed by warner

  • milestone set to undecided.

10/01/07 21:45:34 changed by warner

again today, 10/01/07 21:21, user bbtwoone about 8 seconds per page, 10 minutes total

10/10/07 16:14:31 changed by warner

again today, 10/10/07 11:48, username 'taker'

10/21/07 02:16:41 changed by warner

again 10/16 23:56 and a second bunch 10/18 16:00, by 'bbtwo2'.

10/27/07 09:51:27 changed by warner

again 10/22 14:19 user 'nicer'

10/30/07 02:49:59 changed by warner

again 10/30 1:06 user 'ttbakertt'

11/01/07 17:46:54 changed by warner

again 11/01 11:10-11:36 user 'bbbaker'

11/04/07 12:00:34 changed by warner

again 11/03 11:50 user 'bbbaker' (they re-used the same username as last time)

11/04/07 12:02:09 changed by warner

also, they deleted their own account at some point after they finished spamming. whoever you are: please stop doing this!

11/08/07 01:05:58 changed by warner

again, 11/05 15:24 user 'chiper', they came back 11/06 14:15

11/18/07 12:37:32 changed by warner

another batch: tikitaki 11/14 16:21, tiktaktoe 11/13 13:18, tuper 11/12 12:38, toper 11/09 19:49

11/21/07 02:12:21 changed by warner

again, 11/19/07 11:09 tiptoptop

12/01/07 02:27:08 changed by warner

again 11/29 19:26 and 11/30 16:09, user tipitapi

12/03/07 11:35:04 changed by warner

again 12/03 00:31 ythg2434

12/08/07 10:54:31 changed by warner

again 12/07 07:02 'qq', only three pages this time, must be a different script

12/09/07 12:57:52 changed by warner

again 12/09 04:02 user 'sssss', only four pages

12/13/07 11:18:22 changed by warner

again 12/10/07 22:05:26 user 'qw', only the WikiStart page, probably a human instead of a script

12/14/07 15:56:19 changed by warner

again 12/14/07 10:09 user 'tyjsmd83', lots of pages, certainly a script

12/17/07 14:40:01 changed by warner

again 12/17/07 07:48 user 'qq', only three pages

12/18/07 11:44:36 changed by warner

again 12/18/07 1:14/1:56 user 'qq' again, four pages

12/21/07 00:41:10 changed by warner

Incidentally, we started getting some link spam on the Tahoe trac instance, and the 'sssss' spam (on 2007-12-16 06:27:19) came from IP address 89.218.124.244, which turns out to come from Kazakhstan. The 'qq' spam (on 2007-12-10 01:27:13) came from 91.90.22.82, which comes from the Ukraine.

Note to self: fix or work around the reverse-proxy limitations that currently prevent buildbot trac from logging the IP address of the clients who change wiki pages. The fact that these spammers seem to be coming from such out-of-the-way machines (and not from US zombies) suggests that it might be possible to do some IP address filtering to fix this problem.

12/21/07 19:50:41 changed by warner

again 12/21/07 03:19, user 'ssssss', only three pages. This occurred within 60 seconds of the same username spamming the tahoe page, so I think somebody has a script that hits multiple tracs at once.

12/25/07 23:39:17 changed by warner

again 12/24/07 22:51 asdklkjh88, all pages

01/14/08 14:28:30 changed by warner

again 12/11/08 12:59 user 'sdf44'. The rate seems to be slowing, if that's any comfort..

01/20/08 12:40:14 changed by warner

oops, I meant 1/11/08 12:59, not 12/11/08.

and again, 1/17/08 20:41 user 'sdf44'

01/28/08 11:45:01 changed by warner

double dose: 1/24 04:22 user '34ythgnb', and again 1/28 11:35 user 'helper'

01/29/08 23:38:14 changed by warner

the sneaky jerk, they did it again 10 minutes after I cleaned up the last batch. 1/28/08 11:55, user 'helper'

02/02/08 22:08:58 changed by warner

2/1/08 4:49 and 2/2/08 8:18, one page each time, user 'dif'

02/03/08 20:19:31 changed by warner

02/02/08 22:34:06 user 'dif', just one page

02/11/08 12:23:09 changed by warner

02/09/08 06:14 user 'sdfsdfsf', all pages

02/21/08 21:46:35 changed by warner

02/16/08 11:23 user 'sf223213', all pages

02/26/08 10:02:00 changed by warner

2/25/08 11:53 user ttrmon, all pages

02/29/08 16:05:45 changed by warner

2/28/08 04:11 user 'fdikqw', all pages

03/04/08 15:15:45 changed by warner

3/4/08 02:09 user 'gloooom', all pages

04/07/08 12:59:01 changed by warner

we went a whole month without wiki spam.. I think that person finally gave up. However we just started getting a new kind: ticket comment spam. The same person hit the Tahoe trac too (allmydata.org). They're advertising a bunch of chinese hotels.

04/07/09 06:43 user 'sell', about 5 tickets.

The SQL expressions to search and destroy are:

SELECT * FROM ticket_change WHERE author == "sell";
DELETE FROM ticket_change WHERE author == "sell";

05/23/08 15:47:37 changed by dustin

user TPEslave -- only changed #270.

06/16/08 16:07:55 changed by warner

sigh, they're back, user 'hloper', adding comment spam to all wiki pages, about 6/11/08

06/30/08 12:22:49 changed by warner

ticket comment spam, user 'add', on ticket #77, 6/30/08 06:45

07/15/08 11:06:36 changed by warner

ticket comment spam, user 'sell', on ticket #130, 5/4, 5/9, 7/3

07/15/08 11:16:59 changed by warner

and, if not exactly spam, some bizarre bot-like comments on #270 by user 'TPEslave', 5/11 and 5/23

07/20/08 11:09:19 changed by warner

ticket comment spam, more iron stuff, user 'add', ticket #77, 7/19/08 06:05

07/31/08 09:58:47 changed by warner

wiki spam, just one page, 7/30/08, user 'meduza'

(in reply to: ↑ description ) 08/05/08 11:00:26 changed by bbl

New spam: on page TracGuide by meduza: line 30 added: buy movies

plus ticket 130 last comment by user "add" 2008-08-03

09/11/08 22:39:10 changed by warner

removed a couple more, users 'meduza', 'china', 'add'.

bbl: thanks for the weeding! I'd like to avoid having these cretins' links still around, so if you wouldn't mind, don't include a copy of the full URL in the description that you post here.

Every once in a while I go through the sqlite DB and delete the rows from the 'ticket_changes' and 'wiki' tables, so don't be surprised if the spam that you undid appears to vanish completely later on :).

thanks,

-Brian

09/15/08 12:23:04 changed by warner

Removed more ticket spam from user 'add', for some reason they're fond of #77 and #130. They've started copying text from other projects' bugs into their additions, to make them harder to spot. Sigh.

09/18/08 09:58:20 changed by warner

A new wiki spammer, username 'marcello44', one page, 9/18/08 07:09

09/21/08 04:34:09 changed by ashcrow

11/14/08 03:17:46 changed by nhemingway

Another one: rrtoper on 11/05/08 (You might also want to remove the reversal by cyberj the following day)

11/22/08 11:33:02 changed by warner

got the rrtoper ones, thanks!

I'm not sure if recaptcha would help much.. I'm assuming that there's a human who creates an account, then they give the username/password to their bot. So a one-captcha-per-registration barrier might not slow them down very much. I'm willing to give it a try, though.

12/02/08 09:10:31 changed by nhemingway

More rrtoper I'm afraid (on Nov 24)