Geeklog Forums

Somehow an unprivileged, using a newly created regular user account, managed to access the mail component and sent one spam message to all users registered at the website. How this user did it, is still a mistery for me. What I can presume, for the moment, is that there could be a flaw in the admin/mail.php component, since is the only thing I think that could be used to send a email to every registered user.

Unfortunately, there is not any useful data in access.log and error.log.The only data we have is the mail account used: jeniferbaby4life at yahoo dot com. My website uses Geeklog 1.5.2sr6.

The spammer sent a bilingual message with broken spanish and broken english:

---

--
https://www.AlcanceLibre.org/
https://blog.AlcanceLibre.org/
La libertad del conocimiento al alcance de quien la busca.

Hello,

Do you use a captcha on your site?

---

I'm available to customise your themes or plugins for your Geeklog CMS

So in other words, you suspect that they did it through admin/mail.php, but you're not sure? How do you know the email was sent to all users?

Please send us the complete headers of such an email to our security contact.

bye, Dirk

Yes, CAPTCHA was enabled.

---

--
https://www.AlcanceLibre.org/
https://blog.AlcanceLibre.org/
La libertad del conocimiento al alcance de quien la busca.

Me, my wife and all our staff received the mail. Plus a many users sent complaints about the message because it was originated from our web server :-/



I'll ask if somebody kept a copy, but I'm afraid, by now, probably everybody has deleted it.

We revised headers from the message and was originated within the server, as any other mail sent from Geeklog. For the moment I only have forwarded copies from complaints.

For the moment we have resticted the access to all /admin/ using a .htaccess file.

---

--
https://www.AlcanceLibre.org/
https://blog.AlcanceLibre.org/
La libertad del conocimiento al alcance de quien la busca.

Geeklog adds some extra headers, e.g. X-Mailer: Geeklog, so that would help to figure out if the mails were really sent through Geeklog.

If you have enough time and patience, you could send emails through the profiles, so it doesn't have to be a problem with the Mail admin function (in fact I doubt it was sent through the admin panel - if you could break into admin/mail.php, you could just as well break into any other admin function).

Also, have you checked your webserver's logfiles? You should be able to tell whether somebody accessed admin/mail.php at the time the emails were sent.

If you have any more information, please let us know.

bye, Dirk

@joelbarrios
Are you using the newsletter plugin?

-s

---

FlashYourWeb and Your Gallery with the E2 XML Media Player for Gallery2 - http://www.flashyourweb.com

No. Actually, we have deactivated many plugins.

---

--
https://www.AlcanceLibre.org/
https://blog.AlcanceLibre.org/
La libertad del conocimiento al alcance de quien la busca.

Just making sure they weren't somehow sending through the newsletter's mail.class which is different then GL's

-s

---

FlashYourWeb and Your Gallery with the E2 XML Media Player for Gallery2 - http://www.flashyourweb.com

Dirk, I have finally managed to get a copy from the message, but can't publish here, because spamx says it's spam.

The relevant data is:

X-Mailer: Geeklog 1.5.2sr6
X-Originating-IP: 41.214.123.71

IP Address is from Senegal.

---

--
https://www.AlcanceLibre.org/
https://blog.AlcanceLibre.org/
La libertad del conocimiento al alcance de quien la busca.

I have sent full message source to geeklog-security at lists dot geeklog dot net.

---

--
https://www.AlcanceLibre.org/
https://blog.AlcanceLibre.org/
La libertad del conocimiento al alcance de quien la busca.

So this was NOT sent from admin/mail.php - since as of 1.5.2, we don't include the X-Originating-IP header any more for mails that are sent through the admin interface.

Given the origin, this could very well have been a manual operation. Do you have access to your webserver's logfiles at the time those emails were sent? Oh, and did you compare the times on several of those emails? I.e. are they a few minutes apart or all sent at the same time?

bye, Dirk

Thak you, Dirk. You are right. My apologies for blamming admin/mail.php.

Let me confirm, seems at least a hundered users were mailed (we have +2400 registered users, and list purged every week). This made us think it could heve been done from admin/mail.php. CAPTCHA was enabled at Website. I'll ty to check access_log to determine time between first and last email sent. It will take some time, because I have no admin access to my sponsor's server and there are really big logs.

After the issue, we updated to captcha 3.3.0. The day spam happened, we were using captcha 3.1.2. Maybe script made to exploit a flaw in captcha 3.1.2?

---

--
https://www.AlcanceLibre.org/
https://blog.AlcanceLibre.org/
La libertad del conocimiento al alcance de quien la busca.

I have analized the access_log file. It's pretty huge output to post here (787 lines). So, this is a summary:

Basically, the culprit accessed the forum on 30/May/2010:09:05:24 -0500 and watched members list:



Then... at 09:05:29 -0500, showing he/she has no-life, started mailing one by one:



After sending last message, then went back to members list and mailed again to next user:



Mailed users from 3698 ID down to 3323 ID (again, seems his guy/gal has no life). Repeated until 16:03:06 -0500:



Around 30/May/2010:16:03:06 -0500, I detected spam delivered to my mail account and deleted user's account. That day I received lots of complaints about the spam, originated from my website and targeted to resgitered users. We thought it was via admin/mail.php because the large ammount of users affected, and restricted access to /admin directory to allow acces only from certain Latin American countries.

Looking more closely at access_log, we discovered more activity. On June 01 2010 at 21:43 -0500, returned with another browser and started to mail stories util 23:59:10 -0500:



Same day, for unknown reasons, he/she aparently felt interest for open source docs, accessed filemgmt and downloaded a few of files I host there:



Seems he/she returned on jun 02 2010 at 00:03 and then started to access profiles directly (do not know what he/she did), first the ones starting with number 1:



Etc, etc. etc., Then 20's, 30's, 40's, 50's, 90's and then random users.



Nobody complained since sunday. Do not know what he/she did or intended to do.

On 02/Jun/2010:00:07:25 -0500 I decided to block 41.214.0.0/16 (I don't care about Senegal. My target audience is in Latin America and Spain).

Again, my apologies for blamming admin/mail.php.

Never realized that actually there were people with so much time to spare to do something like this.

---

--
https://www.AlcanceLibre.org/
https://blog.AlcanceLibre.org/
La libertad del conocimiento al alcance de quien la busca.

I've had literally millions of $_REQUEST (s) like those.
And the same pattern repeats day after day after day...... Different IP every day but in the same range.

I had thought (at one time) that geeklog sites were being targeted as the same requests were being tried / specifically geeklog directories(unproven)
But my *bsd machine does not allow directory listings and such so no fruit for the hacker?

Losers with plenty of time on their hands :
Hey what good does it do to send 1000's of the same message to the same email account? I ignored the 1st thousand, maybe I'll latch onto the 100,000th?
Spammers have a whole other mentality.

Shoot 'em all.

-s

---

FlashYourWeb and Your Gallery with the E2 XML Media Player for Gallery2 - http://www.flashyourweb.com

Thanks for the analysis.

If you've never heard of those people before, you may want to read up on the "Nigeria" or "419" scammers. They seem to have some criminal energy, a lot of time and patience, but not a very good grasp of technology ...

geeklog.net was also a target of those guys on occasion. At one point, I had the entire 41.0.0.0/8 blocked here, which was an over-reaction but I didn't know how else to stop them

bye, Dirk

In the past I've had some headaches related to the "DTS Agent" which, if I recall correctly, was/is associated with an email address harvester bot. Something like the "Beijing Address Collector" or something similar.

*After-thought: I'm pretty sure that Bad Behavior blocks that agent

This is a very good reason why I have all mail copied from the site to a mailbox in the domain. This way I can monitor any BS the spammers are doing if and when they decide to try and attack me. This has only happened to me once several years ago and I plugged the leak.

Michael
Spacequad AntiSpam Services
Thunder Bay, Ontario

In this morning's weekly PHP Classes newsletter I found a simple firewall.class which may be of interest.
http://www.phpclasses.org/package/6112-PHP-Accept-or-deny-requests-depending-on-IP-address.html

If included at the very beginning of lib-common.php one could easily deny a whole IP range or single IPs before any of the rest of the gl system has to load.
So it would preempt the Ban pugin and all other methods of IP screening/filtering.

This guy even included a great BSOD you could serve up to banned surfers.

-s

---

FlashYourWeb and Your Gallery with the E2 XML Media Player for Gallery2 - http://www.flashyourweb.com

This type of thing happening is one of the reasons why I hoped the Core Notification Service would of happened this Google Summer of Code. As part of the project a rule system could have been created to prevent users from sending so many emails per hour/day.

ON a related note,I would also like to expand the Ban plugin at some point to create rules for visitors to prevent people from downloading entire sites with bots.

Now all I need is the time

---

One of the Geeklog Core Developers.