An open community 
of Macintosh users,
for Macintosh users.

FineTunedMac Dashboard widget now available! Download Here

Topic Options
#30001 - 05/08/14 02:41 AM All forums marked as unread
jchuzi Online


Registered: 08/04/09
Loc: New York State
This morning, all FTM forums except Frequently Asked Mac Questions and Mac FAQ Discussion appeared as if I had never read them. I tried logging out/in but that didn't help. Deleting the FTM cookie and the Safari cache and then re=logging in was unsuccessful. I had installed AdBlock yesterday so I disabled it but that didn't solve the problem.

Other sites seem unaffected so I assume that something is wonky with FTM.


Edited by jchuzi (05/08/14 02:42 AM)
_________________________
Jon

OS 10.14.3, iMac Retina 5K 27-inch, late 2014, 3.5 GHz Intel Core i5, 1 TB fusion drive, 16 GB RAM, Epson SureColor P600, Photoshop CC, Lightroom CC, MS Office 365

Top
#30032 - 05/08/14 04:34 AM Re: All forums marked as unread [Re: jchuzi]
artie505 Online


Registered: 08/04/09
You missed it!

I don't know if it was a denial of services attack or what, but we got hit with a bit more than 1,050 spam posts (Oakley Sunglasses) in a coupl'a hours...every forum, which is why FTM looked like you had never read anything. (They came up faster than I could refresh my browser page.)
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#30033 - 05/08/14 05:06 AM Re: All forums marked as unread [Re: artie505]
jchuzi Online


Registered: 08/04/09
Loc: New York State
Thanks, Artie. All seems well right now.
_________________________
Jon

OS 10.14.3, iMac Retina 5K 27-inch, late 2014, 3.5 GHz Intel Core i5, 1 TB fusion drive, 16 GB RAM, Epson SureColor P600, Photoshop CC, Lightroom CC, MS Office 365

Top
#30034 - 05/08/14 06:54 AM Re: All forums marked as unread [Re: jchuzi]
grelber Offline


Registered: 08/05/09
Loc: North of 49th ||
Having been one of those who notified the moderators of the spam bombing, I hope that one or more will chime in about what happened and whether it can be avoided in future. They did a nice job of cleaning it up in the past couple hours.
It certainly seems as though FTM forums were specifically targeted.

Top
#30035 - 05/08/14 07:06 AM Re: All forums marked as unread [Re: grelber]
jchuzi Online


Registered: 08/04/09
Loc: New York State
Maybe FTM should feel complimented? After all, the spammers must think that we have such a wide audience that it's worth their while. grin
_________________________
Jon

OS 10.14.3, iMac Retina 5K 27-inch, late 2014, 3.5 GHz Intel Core i5, 1 TB fusion drive, 16 GB RAM, Epson SureColor P600, Photoshop CC, Lightroom CC, MS Office 365

Top
#30036 - 05/08/14 08:16 AM Re: All forums marked as unread [Re: artie505]
ryck Online


Registered: 08/04/09
Loc: Okanagan Valley
Originally Posted By: artie505
I don't know if it was a denial of services attack or what, but we got hit with a bit more than 1,050 spam posts (Oakley Sunglasses) in a coupl'a hours...

I saw it when I opened the site much earlier this morning and thought: "What the……?"

To the folks who cleaned up that mess in such short order, "Well done!"
_________________________
ryck

iMac (Retina 5K, 27", 2017), 3.4 GHz Intel Core i5, 8GB RAM, 2400 MHz DDR4
OS High Sierra 10.13.6
Canon MX710 Printer
Epson Perfection V500 Photo Scanner
Time Machine on 320GB OWC Mercury OTG Pro
Super Duper on 500GB OWC Mercury OTG Pro

Top
#30039 - 05/08/14 01:25 PM Re: All forums marked as unread [Re: jchuzi]
tacit Offline


Registered: 08/03/09
Loc: Portland, Oregon, USA
Looking at the server logs, it doesn't seem to be a denial of service or a particularly targeted attack--just run of the mill bot spam with a misconfigured bot. (Most spam bots are programmed not to hit one target more than a certain number of times to avoid tripping automatic protection; this one was probably just badly configured by the spammer.)
_________________________
Photo gallery, all about me, and more: www.xeromag.com/franklin.html

Top
#30042 - 05/08/14 02:14 PM Re: All forums marked as unread [Re: tacit]
artie505 Online


Registered: 08/04/09
> (Most spam bots are programmed not to hit one target more than a certain number of times to avoid tripping automatic protection; this one was probably just badly configured by the spammer.)

Isn't UBB.threads's lack of automatic protection also bad configuration?
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#30043 - 05/08/14 02:55 PM Re: All forums marked as unread [Re: artie505]
tacit Offline


Registered: 08/03/09
Loc: Portland, Oregon, USA
UBB.threads, sadly, lacks automatic flood control and other defenses. Its only defense is a database of known bad IP addresses and forum poster names, and that's not a very effective defense at all when faced with botnets.

I've done some more research, and discovered the spam flood is primarily linking to poorly secured servers in Italy and Switzerland which have been hacked. These hacked servers contain links and redirectors to an Amazon affiliate ID, "as_acph_ap_fallhbag_910_on" (probably automatically generated and possibly one of many). The purpose of the spam run appears to be to generate revenue by Amazon affiliate linking.

I've notified Amazon's security team of thie abuse by this affiliate ID, and notified the Web hosts of the network of compromised servers that they have security issues. With luck, Amazon will shut down the affiliate account--removing the economic incentive to spam appears to be the most effective way to deal with it.
_________________________
Photo gallery, all about me, and more: www.xeromag.com/franklin.html

Top
#30046 - 05/09/14 02:39 PM Re: All forums marked as unread [Re: tacit]
artie505 Online


Registered: 08/04/09
It looked to me like the spam could only be taken down in blocks of 25 posts, and that, combined with its lack defenses, marks UBB.threads as seriously deficient.

Allowing 1,000 posts to go up is bad enough, but not facilitating their removal is compounding the injury.
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top
#30047 - 05/09/14 05:35 PM Re: All forums marked as unread [Re: artie505]
tacit Offline


Registered: 08/03/09
Loc: Portland, Oregon, USA
I'm not disagreeing with you. There are some shortcomings to this software, among them being that it seems to be increasingly poorly supported as time goes on. I'd like to see more robust antispam defenses, Facebook integration (I know not everyone likes Facebook, but the fact is, allowing people to log in with Facebook increases participation tremendously), and better management tools.
_________________________
Photo gallery, all about me, and more: www.xeromag.com/franklin.html

Top
#30048 - 05/09/14 05:51 PM Re: All forums marked as unread [Re: tacit]
tacit Offline


Registered: 08/03/09
Loc: Portland, Oregon, USA
Quick update: I just heard back from Amazon's security team. They revoked the Amazon affiliate account of our spammer, so he won't be making any money from his run on FTM. smile
_________________________
Photo gallery, all about me, and more: www.xeromag.com/franklin.html

Top
#30056 - 05/10/14 01:34 PM Re: All forums marked as unread [Re: tacit]
artie505 Online


Registered: 08/04/09
Just to add a bit of curious perspective to this incident, the spammer first hit at around 2:30AM and left only five posts; he/she/it then came back at around 4:30AM, and that's when the floodgates opened.
_________________________
The new Great Equalizer is the SEND button.

In Memory Of Harv: Those who can make you believe absurdities can make you commit atrocities. ~Voltaire

Top

Moderator:  alternaut, cyn, dkmarsh