6

My girlfriend is an admin on a German speaking site that for some time has been harassed by what we presume is a disgruntled user. At first it was merely an annoyance but a couple of days ago the person started sending child pornography in PMs and in eMails to the board.

The police have been alerted but yesterday they received messages stating that because of this person's skill they will be difficult to find and has promised to find ways to register (they have already begun blocking IPs & hosts, and require a minimum number of posts before you can send PMs) and will start sending the material to every user. There was also death threats against the owner of the forum, the harasser has already posted the owners name and address within the forum so he definitely knows who & where he lives.

I know it is a long back story but my question is is it possible to protect against this or even find him. He is most likely German as that is where the site is based but he is continually using IPs from around the world. They have already had to block lists of tor exit points but it seems futile.

|improve this question
  • 1
    Wow. I can't imagine the police would do much with death threats on web site (that don't have a local component), but sending child pornography pretty much guarantees they'll try to do something. A strange move on the attackers part. – gowenfawr Mar 8 '14 at 14:34
  • 4
    Dig though your logs. He most likely didn't use an anon proxy before starting the harrassment. A good forum software will let you find out the history of an account (and correlate IP addresses with an account) easily. Pass that information to the police. Being an asshole isn't against the law, but death threats and owning/distributing child pronography very clearly are, so you have a strong stance. Police can trivially get hard evidence from the ISP within a 90-day window once they have a concrete suspicion (for which you should be able to find evidence in your logs). – Damon Mar 8 '14 at 18:19
  • 1
    Damon's tip is quite good. He probably is worried to hide only when he tries something. Also try to imagine who could it be. It probably is someone your girlfriend knows in real-life, and a man. Start profiling the stalker. – Quora Feans Mar 8 '14 at 19:03
  • 2
    Users who became inactive the day or the day before the harrassment (or possibly 2 days) would be prime candidates. Unless you run a site like Facebook, that won't be more than a dozen to start with. If you aren't capable of doing an in-depth analysis, you could make a copy of your database for the BKA. That's a good idea anyway, since they sometimes get the awesome idea to seize your equipment for investigation and evidence, no matter whether that means you're out of business. If you've already given them a copy of the database, there's no reason to do that any more. – Damon Mar 8 '14 at 20:34
8

Increasing the time it takes to begin any sort of harrassment, and decreasing the time it takes to take any action of illicit content is going to be the best wat to mitigate the problem.

In this case, contacting the police is your best option as far as taking any direct action against the attacker. In the meantime your primary focus and concern is to mitigate the issue as much as problem. Remember that this is one person who has dedicated his time, he will eventually get bored and move on to something else.

Your primary goal here is to make it harder for him to make any illicit content in the first place, while still allowing your regular users in. Here are some of the steps I took when I had a similar issue on my popular vBulletin website:

  • Blacklisting potential domains or hosts of illicit material
  • Requiring a unique email address, with certain temporary email providers blacklisted
  • Limiting new accounts:
    • I required moderator approval for all posts made with an accout under 15 (approved) posts for anything that embedded a link or image.
    • I required moderator approval for all PMs sent from any account less than 3 days old or with less than 15 (approved) posts.
  • Find an anti-spam plugin or addon that can match possible patterns.
  • Disabling email capability. In most cases, only admins really should have the power to email their users.

Another thing to try is to get a cheap SSL certificate and use HTTPS during registration, or even site-wide. Most standard proxies don't support HTTPS, and most that do are usually for a fee which he may be unwilling to pay after a while. Tor still may support HTTPS, so it's worth trying to block Tor entry points if possible (as you've indicated).

For example, gandi.net has a single-domain for $16/yr that would suffice just fine.

|improve this answer
  • Thanks mate, she already does some of what you suggest but we she takes the rest of your advice gladly. – The_Cthulhu_Kid Mar 8 '14 at 18:33
7

You have already done the correct thing by alerting the police.

Sadly though, if the person is being careful it will be next to impossible to locate or stop him. There really isn't much you can do besides increasing the effort required to start harassing your members and hope he gets bored and stop. It might be a good idea to implement a system like the one Stackexchange uses where a certain amount of helpful contributions is needed to unlock certain privileges.

|improve this answer
  • Thank you, I was worried that that might be the case. The guy has promised not to stop (even gave a list of demands that would include the owner killing himself). I am not part of the forum myself but my girlfriend is and this guy has me worried. He knows her real name, although I don't think our address, but we have 2 small children. I am a developer but I don't have much knowledge about security. Thanks for your time. – The_Cthulhu_Kid Mar 8 '14 at 12:22
  • 2
    Children get tired when you stop giving them attention. Do what you can to mitigate the problems on the back end, but don't give him any attention and hopefully he goes away. – David Houde Mar 8 '14 at 13:12
  • @DavidHoude: that would perfectly work, in the case of an internet troll. But in this case, we certainly have a mad stalker. I don't believe he will stop easily. – Quora Feans Mar 8 '14 at 19:01
2

The nice thing about persistent attackers is that their behavior is consistent and repeated, through which you can establish a pattern which then leads to an identity.

It's possible to be completely anonymous on the Internet, but the only way to do so is to avoid establishing a pattern, and avoid behavior that can be correlated, analyzed, and eventually distilled to find its common feature: you. This is how and why hackers get caught; they don't go silent.

So, if the common target is your forum, then you use the forum to find the common factors in the attack. You already have criminal behavior (child porn and death threats) which is enough to get the police actively involved. That helps with gathering data that would otherwise be inaccessible.

The next step is to start blocking off access routes that can't be traced. Assuming this doesn't adversely affect your other users, you can block TOR exit nodes, known anonymizing proxies and so on, until the only routes to your server left are ones that can be traced by the police.

Obviously this can affect your legitimate users, so you may want to only apply these restrictions for posting messages or new user registrations.

Next you start following up on leads; when you get relevant traffic, you check up on its origin. Did it come from a hacked webserver? If so, get in contact with the site's admin to report the intrusion and find out if they are keeping logs. Many admins will be more than willing to turn over logs of malicious actors, as they'll be just as mad as you are.

Sites like domaintools.com are surprisingly useful in determining who is involved with a given IP, what sites are hosted there, who the owner is or was, etc. A GeoIP lookup will help determine with more precision if IP addresses are physically located near each other.

Eventually you start to see patterns develop. You figure out that he only posts during a given 5 hour window (which probably corresponds to evening where he is), and while he relays his connection through other servers, the originating IP is typically coffee shops in a single city. He uses firefox on OSX. Little details which may come in handy.

The more information you have, the more information you can give to the police, the more likely they are to actually identify him.

Either that or he stops posting and the trail goes cold. Both ways, you win.

|improve this answer
  • Reading this comment, I got an idea. Is it possible to use some methods like on panopticlick.eff.org and then basically match which users are the attacker, get his "unabusive" account, etc. Assuming same PC and browser are being used, which might not be the case. Also, running flash or Java to get user's real IP? – domen Mar 10 '14 at 13:22
1

This Github program I happened to run across today might help to narrow down the identity of the stalker. I read about fingerprinting at the EFF.org site when I ran an the EFF browser Panopticlick privacy checker.

So when I visited Github and saw Valve's fingerprint program, I circled back because I thought: maybe the website owner who was being harassed could've used fingerprinting to pinpoint identities, and particularly helpful would be the many identifiers(?) the Valve program allows.
(Valve's initial description is: "Modern & flexible browser fingerprinting library, a successor to the original fingerprintjs ...".)

|improve this answer
  • It is, thankfully, in the past but thank you for the answer. Might be helpful in the future =) – The_Cthulhu_Kid Nov 11 '16 at 7:26
  • Sigh of relief, thanks for sharing this good news. – Chipaway Nov 11 '16 at 7:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.