0

I am working on Ubuntu Server with mysql installed, I have a forum application vbulletin 5 installed and there are hundreds of mail.ru and projectgold.ru created on my application, it looks like this: users table on mysql

each user also creating random post like this: forum page Every time I am deleting all the users from my database, a few minutes later it will generate the same user, so deleting the users doen't fix the problem.

I don't have basic security knowledge, I am searching on forums but no clue, I have scanned my server using chkrootkit and clamscan but no infected files found, maybe you guys have any clue on what should I check, is this related to malware? or maybe there are hidden scripts planted on my server?

This is the access.log:

[20/Aug/2017:07:40:25 +0000] "GET /forum/peraturan-forum/peraturan-forum/1346-lars-hjalte-potros-and-mine-boss-rwanda/ HTTP/1.0" 301 0 "http://forum.afi.festiware.com/forum/peraturan-forum/peraturan-forum/1346-lars-hjalte-potros-and-mine-boss-rwanda/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:53.0) Gecko/20100101 Firefox/53.0"

We are using chaptcha on registration form.

  • | Are you using a cms ? | Check your crontab on the server (crontab user -l) | an attack can also be Done via a SQL injection or a XSS attack. Providing an url might help finding the weak point. – Baptiste Aug 21 '17 at 4:27
  • Hi @Baptiste, I am using vbulletin, a proprietary Internet forum software package developed by vBulletin Solutions, Inc., a division of Internet Brands. It is written in PHP and uses a MySQL database server. I have checked the crontab but no cron job is running on any user on my server, I will check about this SQL Injection, or maybe if you have any clue on how to detect XSS would help me a lot – spacetrack Aug 21 '17 at 4:36
3

Here are the Vbulletin recommendations:

(Before reading the quotation below, try to enable reCaptcha V2 as @Mirsad said.)

Most people are being hit with a lot of spam these days. Some things you can do to reduce this are:

  1. Moderate new registrations Admin CP -> Setting -> Options -> User Registration Options -> Moderate New Members -> Yes

  2. Activate email verification Admin CP -> Settings -> Options -> User Registration Options -> Verify Email address in Registration

  3. Upgrade to at least vBulletin version 3.7 or higher. These versions have several Human Verification Options. Admin CP -> Settings -> Human Verification Manager ->

Image Verification: This is the same Images Verification Captcha as in older versions of vB, except that this now requires both GD and Freetype 2 to be installed in PHP.

Question and Answer Verification This allows you to set up a Question and Answer verification during registration. If done correctly it will be almost impossible for bots to enter the correct answer.

reCAPTCHA™ Verification This uses the reCaptcha service. You will need to register with them and get both a Public and Private key.

* Note: As per this announcement, we recommend using the Q&A method with multiple questions. * After you have chosen the method you want to use and have set this up, then make sure the correct Human Verification options are set here: Admin CP -> Settings -> Human Verification Options

And if you have chosen the Image Verification option then you need to choose either GD or ImageMagick here: Admin CP -> Settings -> Options -> Image Settings You can go back to the Human Verification Manager to make sure the image is showing correctly.

Note: Both are equivalent. These are also required if you use thumbnails for attachments or wish to automatically resize pictures that are too large.

  1. Ban 'free' email domains many spammers use. Admin CP -> Settings -> Options -> User Banning Options -> Banned Email Addresses

See this thread for a list of commonly banned email addresses: http://www.vbulletin.com/forum/showthread.php?t=148061

  1. Set these options for the Unregistered, Users Awaiting and COPPA usergroups: Admin CP -> Usergroups -> Usergroup Manager -> Edit -> Can Use Email to Friend -> No Can Email Members -> No

Require Human Verification on Configured Actions -> Yes

  1. Add a new required question to registration. Although there is a Q&A option in the Human Verification Manager, at this time these is no way to use this in conjunction with Image Verification or reCaptcha. However there is a workaround for this. You can create a required profile field to add Q&A to the registration process. To do so, follow these instructions: Add an extra question to the registration to prevent bot registrations.

  2. Restrict Email to Friend to Registered Users. Some people have reported that spammers are using the 'Send Email to Friend' function to spam others from your forums. To reduce this make sure that your Unregistered, COPPA and User's Awaiting groups have the 'Can Use Email to Friend' option set to 'No'.

  3. Stop bots spamming through the Contact Us link. Admin CP -> Settings -> Options -> Human Verification Options -> Check 'Contact Us' and 'Register'

  4. Enabling Spam Management. vBulletin supports managing spam through the Akismet and Typepad Anti-spam services. Both services require an API key to use. Here is how to obtain those keys.

Akismet - To obtain an Akismet key, you need to sign up for a Wordpress.com account. This will give you a key to use within vBulletin. After signing up please see this page for instructions on retrieving your key: http://faq.wordpress.com/2005/10/19/api-key/

Typepad - Typepad also requires a key to be used. To get one go to this link here: http://antispam.typepad.com/info/get-api-key.html

Once you have your key, you need to enter it into your vBulletin Options under: Admin CP -> Settings -> Options -> vBulletin Options -> Spam Management -> vBulletin Anti-Spam Key Powered by Akismet

Note: Either key goes into the same spot. On the same page set 'Anti-Spam Service' to the appropriate service. You can only use one service at a time.

Note: Because of recent spam attacks, we strongly recommend that you combine one of the Image Verification options along with a Q&A as described in item #6 above.

In addition banning free email accounts (#4) will be a major help as well.

source

  • woah this is very helpful my friend, will try this, thanks @Baptiste – spacetrack Aug 21 '17 at 5:14
1

These are classic spammers, how can you solve this problem? Just follow these steps:

  1. Remove spam immediately, ban the offending account, and ban his or her IP address.

  2. reCAPTCHA on registration or if you want you can add option that admin will verify new accounts.

  3. Set-up your forum in a way to prevent flooding, by putting the limit on the number of threads a user can post per hour.

  4. Keep that forum up-to-date.

  • Thanks for the answer: 1. I have try banning the account, and the post but nothing happened 2. CHAPTCHA is used on registration 3. I don't know how to do this but I will discuss with the dev team 4. I will – spacetrack Aug 21 '17 at 4:39
  • Try reCAPTCHA instead that vbulletin captcha. – Mirsad Aug 21 '17 at 4:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.