Suddenly getting spam - why now, what did I do?

[lowflyerguy]

Please help - I am distraught and really heartbroken over recent developments.

My forum has been online  for almost 3 years.  In that entire time, I have only had two incidents where a spammer came and left their mark.  Yes, only twice in almost 3 years -- I know, that's unusual.  The complete lack of this kind of junk has been one of the things that my users love about the forum, and that I've been proud of.  In the past 24 hours, suddenly, all that has changed.

I'm running SMF 1.1RC3, and TP v0.9.5.  Yes, I know there are newer versions of both.

My forum had been pretty much in the exact same state as when it was installed, without any updates or changes, for its entire existence.  It has been 100% flawless, virtually no spam, never any problems. Until about 24 hours ago.

Ironically, I was advised that I should really upgrade my version of SMF and TP due to security concerns.  So 24 hours ago I attempted to upgrade SMF to 1.1.8, but my crude efforts failed and resulted in a non-functional forum and only database errors.  After two failed attempts to make it work, I tried reverting to the previous version. 

Note that I did not do a formal "restore"; as I was uploading the SMF 1.1.8 upgrade, rather than overwriting files, I would first change the name of the existing files.  If a file named foo.php was going to be overwritten, I took the existing file on the server and changed its name to foo_php.OLD, then uploaded the new file.  I didn't worry about overwriting files such as avatars, etc., assuming these were interchangeable.  Mostly I was worried about the files in Packages, Sources, and at the top level.

This was pretty time consuming, but I was very worried that the installation would fail, and my forum would be wrecked (my community really counts on this forum, and for a variety of reasons I won't go into here, it would be devastating to them and to me if it became unusable).

After two attempts to make the upgrade work, I gave up, and reconstructed the old file structure by deleting all the new files, and renaming all the old files back to their old names, i.e. foo_php.OLD to foo.php.  This involved a LOT of careful deleting of (new) files and renaming of old files. My worry was that I wouldn't be able too get them all correct (and maybe I didn't), but after I finished all the deleting and renaming, I took a deep breath and tried the entry URL - and to my great relief, the forum came up, and appeared to be OK.  I took it out of maintenance mode, and let users back in. It all seemed OK.  I can't tell you how relieved I was.

But then -- within no more than two hours, the first spammer struck.  A few hours later, another spammer.  Then another one, and once about an hour ago.   Each time a spammer hit, I would quickly delete the user account, delete their post, and ban them.

Within 24 hours of my mucking around with he SMF files, we had attracted more spam than we had seen in almost three years.

While some people might laugh at anyone complaining about just 4 bits of spam, compared to the previous experience with my forum, the increase is dramatic, and to me and my users, pretty shocking.  I don't know what has changed that could cause this, but it seems more than a coincidence that this suddenly starts happening immediately after a failed upgrade installation followed by a laborious and potentially error-prone undoing of that upgrade.

Can anyone suggest what bit I broke in my crude attempt to install the SMF upgrade and my subsequent equally crude efforts to undo the damage I had done?  What would suddenly attract spammers to my forum, or enable them to get in when we had been blissfully free of their trouble for years?

As I indicated, I'm absolutely despondent over this.  Can't sleep, really angry and depressed, and generally feel like giving up.

Can anyone explain what's happened?  Thanks.

[Zetan]

I think you need to calm down, have a cup of coffee and relax.

Firstly, you need to be asking this at SMF. They will want facts, I know you are upset and want to rant.. but it would be better to ask just a few questions.

You haven't mentioned how they spammed..




While you are at SMF, read this topic:
http://www.simplemachines.org/community/index.php?topic=273816.0

I personally use reCAPTCHA and haven't had any rogue spammers successfully register in a while. There are other mods if you prefer. Antibot puzzles, like a simple math question, or a series of question / response text fields.

[lowflyerguy]

Thanks. Actually, I am relatively calm -- I just care a lot about this thing, and really hate feeling like it's out of my control.  I've put so much of my blood, sweat and tears into this, and I know how important it is to my users.  And I loathe spam with a passion that words can't adequately express.

BTW, I'm not ranting (you think this is a rant? I could show you a rant!) 

I was asking it here, because:

1. In my experience, as soon as you mention TP, folks at SMF start waving you off and say "go ask them".  Which I find very frustrating.
2. For many of us (speaking for all the clueless noobs out here), it's all but impossible to figure out where SMF ends and TP begins.  I have no idea where and to what extent (if any) TP makes changes to bits of SMF.  I find that even more frustrating.
3. The advice I received (you should upgrade SMF and TP, and here's how....) came from someone here.

As to exactly how we were spammed, they're registering for accounts. A new account is created, they come, they post spam, they leave, we see it and smite them. Rinse, lather, repeat.

Thanks for the pointer to the SMF thread on stopping spam. For the moment I've increased the setting for the complexity of visual verification - we'll see what effect that has (I'm very reluctant to install any other mods, since it seems that complicates everything when it comes to upgrades, maintenance, etc. - the example being that it's difficult to get any support at the SMF forum because I have TP installed...).

I thought it was interesting, though, that there was a "a huge surge in the numbers of spambots attacking SMF 1.1.x forums" back in November 2008, and some folks apparently alleged that it was due to "recent SMF 1.1.7 security upgrade".  What seems interesting is that the surge in spam that I'm now experiencing coincided with my botched attempts to upgrade from SMF 1.1RC3 to SMF 1.1.8.  Unless it's an incredible coincidence (which I really doubt), something I did increased my forum's vulnerability.  Which might match up with those allegations going around back in November.

In any case, I'm watching carefully (hell, I'm staying up all night, worried to go to sleep and wake up to a mess in the morning).  I'll keep my fingers crossed and see.

I would still like to learn more about what could possibly have caused this.

Thanks for your input.

[Zetan]

I understand.

The registration is SMF. It has little to do with TinyPortal. If you were getting spam through Article Comments, or the Shoutbox, that's different.

I'm willing to bet that spambots were banging on the door before you even upgraded. I know for a fact that I have at least 20 registration attempts daily by spam bots.

• I would set all registrations to be Activated by email. Not many bots respond to an email.
  
• I have 1 board that new members must post in before they can post in any other board, a welcome board. It features an Automatic Welcome Topic, a mod from SMF.
  
• I would set new members a limit on PMs. My site it's 1 PM, with visual verification. When they have made 1 post in the Welcome Board.. the restrictions start to be removed automatically. It's all in the permissions of Post count Groups.
  

How you do things is up to you. It may seem overkill.. but I have no spam on my site. None. We all hate spam as much as the next person. We need to keep on top of it.

[lowflyerguy]

Thanks.

I wouldn't doubt that the spambots (or human spammers) were always banging on the door previously.  What's different now is that (at least some of them) are getting in.  In the past (almost) 3 years, I've had only 2 pieces of spam show up in the forum (I know, that's unusual).  In the past 24 hours, we've had four - the first one took place about an hour after I finished messing with the SMF and TP bits.  That tells me it's not just luck, something has changed.

Additional data points....

Looking over the "who's online" and tracking the IP addresses, I'm seeing a consistent pattern where search engine indexers (Google, Yahoo, etc.) are generating errors - lots of them.  There are two errors that are repeated in large numbers, both of which smell like they are munged-up bits of TP (or the Amber theme, which I'm using).  The errors are:

Code Select Expand

8: Undefined index: TPortal
File: /home/MyPath/public_html/Themes/default/Login.template.php (eval?)
Line: 204
?topic=3008.0

...and...

8: Undefined index: leftblock
File: /home/MyPath/public_html/Themes/default/Login.template.php (eval?)
Line: 223
?topic=1037.0

I was hoping this would point to a smoking gun, some TP (or Amber theme) file that could easily be replaced, thus plugging the hole.  Probably too much to hope for.

Thanks for any additional input.

[Zetan]

I can only suggest that you go back through the Manual Installation Guide. The error is suggesting the Default Core Theme, not Amber.

You need to: Read the Posting Guidelines.html.

There is no quick fix, we don't know how or what you have done.

How do I manually install TinyPortal?.

[IchBin]

lowflyerguy, you need to keep on topic here please. You've now taken 2 topics off topic by posting about your error. Please start additional topics for a problem not related to the subject at hand.

As for your spam concerns, there is nothing that you did that could possibly tell the spammers to come to your site. What usually happens is these bots search the net for Forums with a certain version number. Because they know these certain versions have exploits in them that allow them to register easily or something. Then, they find a site like yours and they tell all their friends. This is all done automatically. These bots just call home, and then your site URL gets sent to thousands of other spam bots. There is nothing coincidental about this. The only thing you can do is fight back by installing the mods that make it harder for the bots to register. That topic references several great mods for this. I don't use recaptcha myself, I use the Anti-Bot Registration Puzzles and Are You Human? anti bot mods. These mods are very light and small, and do not conflict with TinyPortal.

[Xarcell]

As Ich said, your main problem is you need to make it harder for Bots to register on your site. You site URL is probably put on a spam list, where bots link to your URL and try to register and "login". That's where some of your errors are coming from.

I recommend the reCAPTCHA mod. It can be found at SMF.

As of now, SMF 1.1.x series has been targeted by spammers/spambots. Your not the only one, as there are several long topics over at SMF about it.

So your problem isn't really that serious at this point, not if you understand the problem. Try adding the reCAPTCHA and ARE YOU HUMAN mod's.  It should cut your spamming by 95% or more...

[Ianedres]

My site had a rash of spammers back in November; simple solution was, as it has been already said, to require administrative approval for about two weeks. The 'bots move on to easier targets.

They simply 'network' what sites they find and can possibly exploit, using the version info and such...

[keith021773]

My site had a rash of spammers back in November; simple solution was, as it has been already said, to require administrative approval for about two weeks. The 'bots move on to easier targets.

They simply 'network' what sites they find and can possibly exploit, using the version info and such...

I did the same thing to one of my sites..  Then the spammers went away.