Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm managing a huge forum (over 15k posts and 500 users) and lately some guy uses a VPN (probably) to spam my forums with topics such as: "GAYGAYGAYGAYGAYGAYGAY" "FRIGHT IS GAY HAHAHAHHAA" "ADMINS GAYSSSSSSSS" "LOLOLOLOLOLOLOLOL"

Now, I'm pretty sure he's using Tor or a proxy, the IP and the countries are always changing but the posts have the same pattern - it is the same guy. However, I can't seem to find a way to identify him. I am willing to take it seriously as a criminal case.

The guy created over 40 spam accounts and posted over 250 topics and posts with spam.

Here are some posts from whois:

 - http://puu.sh/2cZRJ - data
 - http://puu.sh/2cZS4 - whois
 ___
 - http://puu.sh/2cZOZ - data
 - http://puu.sh/2cZP8 - whois
 ___
 - http://puu.sh/2cZPZ - data
 - http://puu.sh/2cZQb - whois
 ___
 - http://puu.sh/2cZQX - data
 - http://puu.sh/2cZQr - whois
 ___
 - http://puu.sh/2cZSm - data
 - http://puu.sh/2cZSF - whois
 ___
 - http://puu.sh/2cZTh - data
 - http://puu.sh/2cZT2 - whois
 ___
 - http://puu.sh/2cZTK - data
 - http://puu.sh/2cZTY - whois

And loads more, but the list won't end. Please guys, any clue - how can I identify the guy?

share|improve this question
6  
VPN? That's got nothing to do with what's going on here. It would only be relevant if you were on the SAME VPN. He's using proxies (HTTP proxies, TORs or zombies) to hit your server. –  symcbean Mar 6 '13 at 11:58
    
Your comment does not make sense. Stop looking for post counts or whatever. I simply asked how to identify the guy. VPN is in fact proxy, therefore your statement is false. –  Ariel Mar 6 '13 at 12:08
8  
No, your understanding of the term 'VPN' is wrong. –  symcbean Mar 6 '13 at 12:49
5  
Considered posting an answer here, but submitter seems to be bitterly replying to those trying to assist... Not in the mood for that today. –  BrianAdkins Mar 6 '13 at 13:07
6  
How exactly are you going to open a criminal case? On what accusations? The guy posted a lot of "LOLOLOLOLO" on my forum and I feel really bad. I highly doubt this is enough. I think you need to improve your backend and to check and verify who exactly is posting on your forum –  Salvador Dali Mar 6 '13 at 13:49

6 Answers 6

Your forum accepts posts from anybody. That is your core problem. Connecting to your site from various IP throughout the world is trivial, if only by using Tor. Tor provides "high anonymity" in that not only the user's identity is hidden, but each request is anonymous -- you cannot, from the outside, make sure whether two distinct requests are from the same human user or not.

This can be fixed at two levels:

  1. Restricted anonymity: enforce user registration and authentication. Users may use a pseudonym, and need not provide an email address or any other identification, but your forum will insist on a login process before posting. That way, you can know whether two comments come from the same person. Note that this does not totally solve the issue; instead, that moves it to the registration process. The poor sob who has nothing better to do with his time than defacing your forum will adapt and engage into mass registration of phony accounts.

  2. No anonymity (with regards to you): user registration, this time with an email address, which is verified during registration (you make sure that the registrant can read an email sent at the address he provided). The possibility to be identified, if only by law enforcement agencies, could be a powerful deterrent for wannabe spammers (even if the said spam is not necessarily punished by Law: to my constant dismay, there is no law against writing "LOLOLOLOL").

If you choose to retain anonymous posting, then, well, welcome to the wonderful world of Mankind. While most humans are civilized, honest and polite, there is always one user who thinks exposing his lack of education is a smart thing to do. The best you could do, then, is to patiently clean up (possibly proactively, by enforcing pre-publication control of all posts by trusted moderators) until the perpetrator loses interest or reaches the age of 14, whichever comes first. This may take a few weeks or months.

Historically, most societies have dealt with troublemakers by a mixture of ostracism and actual penalties (up to and including death). The apparent anonymity of Internet prevents efficient penalties (with a lot of resources, this anonymity can usually be unraveled, but police forces will not do that until an actual crime is committed). Ostracism is social pressure, so it does not work on people who do not feel the target forum as being a "society" they are part of.

share|improve this answer
    
There's a law against writing "FUCK YOU ALL MOTHERFUCKERS" and some more things that are probably censored. Thanks for the reply though. –  Ariel Mar 6 '13 at 12:23
9  
@Ariel Where are you located? There unfortunately aren't any such laws here in the United States. That precedent has been fairly clearly set by the reversal of Lori Drew's conviction. –  Xander Mar 6 '13 at 13:59
1  
Really? I'd be interested to know where you're located. I might move there and then facebook is in for a whole heap 'o trouble. –  tombull89 Mar 6 '13 at 14:41
    
Im afraid tor is not the only problem its how much restrictions the web app forum applies to the user is important. By simply allowing the user to post based upon predefined time limit can reduce the impact to near seconds and remove the unpredictiable. Also from a public website you cannot expect any form censorship its expected to receive traffic from anywhere by way of internet arch. –  Saladin Mar 6 '13 at 14:56
    
Are you aware of the fact that there are free disposable spam email adresses? (first hit on google: spambog.com/en no affiliation) If the guy knows that, this will have near zero impact. You could of course ask for the scan of an ID or something, but this will get you in trouble with regular users who are pissed by something like that. If there are very distinct spam patterns, why not try to filter posted content by like show a new post as "Currently under review" only if it is hit by the filter. –  Flo Mar 6 '13 at 15:35

I strongly believe that the user is using Tor and possibly other services to anonymize their transmissions. At least two of the IP addresses you mentioned are Tor exit nodes. The points which Thomas Pornin laid out in his answer are the best solution, and are what I would do if I were you. Registration and user reputation are proven ways to alleviate spam. Just look at Stack Exchange for a great example.

You may wish to read The Tor Abuse FAQ for more information. It clearly describes that They are technically unable to identify this user:

There is nothing the Tor developers can do to trace Tor users. The same protections that keep bad people from breaking Tor's anonymity also prevent us from figuring out what's going on.

As a last resort, you could try blocking all Tor users from accessing your site. But as described there, I think that's a very poor solution to the problem:

Second, consider that hundreds of thousands of people use Tor every day simply for good data hygiene — for example, to protect against data-gathering advertising companies while going about their normal activities. Others use Tor because it's their only way to get past restrictive local firewalls. Some Tor users may be legitimately connecting to your service right now to carry on normal activities. You need to decide whether banning the Tor network is worth losing the contributions of these users, as well as potential future legitimate users. (Often people don't have a good measure of how many polite Tor users are connecting to their service — you never notice them until there's an impolite one.)

If you do still want to block all Tor users, the specific implementation will depend on your software.

share|improve this answer
3  
You could just block user registration using tor. Allow users to log into their accounts from behind tor accounts. –  sixtyfootersdude Mar 6 '13 at 14:31
    
Great idea @sixtyfootersdude –  Josh Mar 6 '13 at 15:04
1  
+1 for suggesting StackExchange as a model –  egrunin Mar 6 '13 at 17:27

Why don't you to restrict access to certain privileges based upon community rating system e.g 500 hours of site work to post threads etc. Effectively ban users with consecutive 10 negative feedback

Second you can put all new users post on hold for review then submit it.

As for filtering tor you can block on all exit nodes addresses they are available publicly.

share|improve this answer

You're running a forum, can you say if its custom or what forum software it is?

One way to control this is that it may be possible to check if an IP is a Tor exit node. Have your forum software check an anonymous posters IP against a list of known exit nodes, if it is you can decide to block or show a CAPTCHA.

I think in this case it would be better to treat this as a spam problem rather than a Tor problem. You have a user spamming your forum quite easily, a 'legitimate' spammer selling Vi@gr@ can get in too. If you control your spam problem you deal with your troll and any potential spammers.

share|improve this answer
1  
+1 for CAPTCHA suggestion. –  deed02392 Mar 6 '13 at 15:26
    
Captacha just gives a few seconds of delay what if the spammer has the time and patience to manual spray the account with stuff have you thought about shared abused account? –  Saladin Mar 6 '13 at 15:58
1  
+1 for "treat as spam rather than TOR problem". captcha will annoy all users, and if the spammer spams manually this wont bother him him too much –  Flo Mar 6 '13 at 16:27
    
@asadz - No solution is perfect. Modern CAPTCHAs exist to both prevent automated spamming and to slow down manual spamming. Suppose our OP is getting 1000 spam messages and it takes 2 seconds per message, 2000 seconds. Now add a CAPTCHA that adds an extra second per post, thats 3000 seconds (~15 minutes). Throttling posts by IP or user has a similar effect. Now this strategy also affects legitimate users, but a legit user pays a lesser penalty because they only post a few messages or can authenticate. –  Freiheit Mar 6 '13 at 16:39

You can email the VPN provider, mention the abuse and request a take down of the account. You can also ask to get the relevant personal data. The problem is they do not have the answer you in any way.

If it's really annoying file a complaint at your local police office, chance are unfortunately rather high that they won't (be able to) do anything about it either.

Now without identifying you can start by just blocking the IPs of the VPN provider.

EDIT

Since you are being visited through Tor there is not much you can actually do. You should try to implement the suggestion done by Thomas Pornin and restrict anonymity.

share|improve this answer
    
I don't know the proxy provider. That's the issue... –  Ariel Mar 6 '13 at 12:08
1  
It's not a VPN, the user is using Tor. So there's nobody to contact. –  Josh Mar 6 '13 at 13:06

One answer that I haven't seen suggested is to forget the network layer and target the application data. Look for your protection in the Web Application Firewall and Spam Filtering paradigms.

This requires that you have some control over your forum software, and some ability to manipulate it (or to pay someone to do it).

Simply add code to examine the content of a post after it's submitted and before it's posted for everyone to see. If it contains strings like "LOLOL" or "GAY" or "FUCK YOU MOTHERFUCKING ADMINS", then you don't publish the post. Return a success code to the browser as if it was posted, but don't publish it for everyone to see. Drop it in the bit bucket or file it away for human verification and/or use in training future filters.

Your adversary will presumably notice this. He'll presumably notice that some messages get through, and realize that you're looking for objectionable content. He'll adjust his tactics, posting "L0L0L" and "G4Y" and "FRAG YOU GORRAM ADMINS" instead. So you'll need to adjust to that. This is where the Spam Filtering paradigm can come in handy. Bayesian filters can be used to detect things that look like this versus things that look like that without an exact lexicon. Modify your hook so that you're using bogofilter or the like as well as your keyword checks. Use the manual hooks to do initial training using the ones you catch, and set something up to TOE (Train-On-Error) for the ones you miss. Tend to it, and your filter will improve.

Grab the HTTP headers being sent. Even if he's using TOR, your adversary is probably always using the same browser. If you fingerprint it, you can improve your detection - even if he shares a browser string with 25% of your users, that means your filters can ignore 11,000 posters, helping with your accuracy.

Don't engage him other than to can his posts. If he's a bully, it won't matter much; bullies attack weakness. But if he's a troll, engaging him will feed his need for attention, make him fight longer and harder. Either way, you gain nothing by interacting with him publicly or privately.

Spam Filtering is an apt paradigm here. You cannot stop him. You can only lower the damage he causes and raise the amount of effort he's required to exert to attack you. To do so, you must invest your time or your money - and if he gets you to do that, he's won something. On the other hand, if the choice is between your time/money and your forum's viability, maybe you're willing to spend some of the former to secure some of the latter.

Good luck.

share|improve this answer

protected by Community Jul 22 at 9:17

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.