site being hacked

Harold, I completely understand that you weren't saying that spamming was equivalent to hacking. What I'm saying is that if this spamming could not have easily been largely blunted in the past year, it makes me question what's going to happen when there IS a security threat.

Ken Helwig, you are making much ado about nothing. Nearly every forum has volunteer moderators, and for the most part they spend their time cleaning up spam. Which is exactly what those of us who volunteered here were offering to do. I have zero interest in keeping you or anyone else polite, let alone banning a paid member. I simply didn't want to see the forum get spammed to the point where people won't even try and read the posts, which is what it was getting to as of last night.

Hi Eugene

> I've since had to cancel that credit card. I'm not saying the fraudulent activity on
> my credit card was the fault of BPL due to lax security as I simply don't know, but
> it wouldn't surprise me if it was.

It would surprise the he11 out of me if it was! Really!

> With this kind of response to spam, a malicious attack by an amateur …
Not the same thing at all. Basically, the spammer was just using what is called SEO or Search Engine Optimisation. Seriously bad manners and unethical to most people, but definitely NOT hacking. There was zero breach of security.

On a side note, it seems that Google knows about SEO (of course!!!) and looks for it with its robots. When it finds it happening, the company paying for the spam gets down-graded in the search rankings. This upsets some companies who feel using a spammer for SEO should be considered ethical. Snerk! Put them on page 100 I say.

On a second side note: I would get an offer of SEO for my FAQ web site about every two days. Oh, they are keen. Plonk.

Cheers

One of the things that IS being done is to impose a time-out rule. This at least limits the extent of the posters damage. Mostly a measure against hackers, it can be opened up a bit, from the current 30sec to a full minute. This will help a bit.

What James is referring to is called "Flood Control" in more modern, packaged BBS products and it's in effect on sites including Backpacker Mag's forums. A 1-minute buffer *would* annoy some fast-key members of this site, but it will certainly also reduce impact from spam-bot activity when it occurs.

I have something to do with a site that gets a lot more traffic than this one, and that is a regular target for both spam and "true hacking". In terms of spam-controls, I strongly suggest that the Mod/Admins use specific IP bans on the individual IPs used. This is very effective in practice, despite the fact that spammers can and do shift IP's. (Many of us here do, too, whether we know it or not). The fact is, however, if you don't ban the IP, it will continue to be used.

Don't worry: there are plenty of IP's for legit visitors even if you have an IP Ban list that's pages long.

On the "other" site I help moderate, we regularly use IP bans. It may slow things down but it sure doesn't stop them–we have a number of "regular" spammers (Ergo baby carrier, asian escorts) that keep coming back every week or so with different IP numbers. There are databases of spamming IPs, but again, the spammers keep coming back with new ones.

Any one solution is only partial and temporary!

I'd say your current need is for more moderators so there can be quick action when another mass attack occurs (which it will!). There is no lack of alert members here! It would have made a lot of difference if the spammer could have been banned in the first half hour!

See, what I was talking about was a real technical challenge. Spam takes very simple technical solutions to largely hold it back.

It's nice that there's finally a way to delete all the posts associated, but that should have existed a long time ago, and worse, it seems to have caused its own problems. Now threads aren't showing up in the forum listings, and it appears to have been caused by this.

So again, I'm saying that when this spam problem can't be solved correctly with very simple solutions, there's little reason to expect that more complex problems aren't going unnoticed, and have little reason to expect that those more complex problems could be handled. It's a matter of technical capabilities.

Roger, I'm sorry you're the face to this problem. You shouldn't be. It should be Ryan, or maybe Addie. Most of us understand that you're doing what you can, with the limited tools this forums provides you, and we thank you for your efforts.

Hi Eugene

> Now threads aren't showing up in the forum listings,
Can you point to any examples of this please? Deleting a posting by X should NOT remove the whole thread!

Exception: I did delete some threads which had been created by the spammer solely for the spam. Some of those threads had a few comments in them about the spam. Those comments have been deleted as well of course, but they had no other significance.

Cheers

Roger,

The threads aren't removed, just not in the listing.

To find an example, go to Greg's profile:
http://www.backpackinglight.com/cgi-bin/backpackinglight/forums/profile.html?u=greg23

He posted "spam" in a few threads. Those that haven't been bumped will not be visible.

Here's an example:
http://www.backpackinglight.com/cgi-bin/backpackinglight/forums/thread_display.html?forum_thread_id=59795&skip_to_post=592369#592369

The last post in that thread was by Greg was on the 14th, but if you back into the forum level, you won't see anything newer than the 8th.

Roger says:
"Can you point to any examples of this please? Deleting a posting by X should NOT remove the whole thread!"

This one:
http://www.backpackinglight.com/cgi-bin/backpackinglight/forums/thread_display.html?forum_thread_id=69229&skip_to_post=#

Since I posted in it, I can see it in my forum profile, and can access the thread from there. The most recent post was on 10/14/2012 18:45:54 MDT. But if you look at the index of General Lightweight Backpacking Discussion, the thread doesn't appear there.

Here's another example from Roger's post history:

http://www.backpackinglight.com/cgi-bin/backpackinglight/forums/thread_display.html?forum_thread_id=69213&skip_to_post=591980#591980

That entire thread occurred on the 13th, but that forum doesn't show any thread activity after the 5th.

This thread was invisible too! Hopefully it's visible again. And now we have another spam campaign from a few hours ago.

It doesn't even take a hacker to lose content here. :p

And now there's a second spammer making the rounds. How many more threads will disappear this time?

How is the new spammer still able to post after having the username changed to "SPAM"? I thought that change included banning the user, which should have stopped the ability to post.

Here's another invisible thread

http://www.backpackinglight.com/cgi-bin/backpackinglight/forums/thread_display.html?forum_thread_id=69377&skip_to_post=594116#594116

Somebody is on duty in the moderator seat because while I was posting on a thread I got a notice from my email saying that their was a new post on a watched thread of mine from "nplantiff".

I followed the link from my email just to go ahead and red flag it for the mods to take care of because it referred to… "Relojes Casio , relojes Omega, venta de relojes , relojes de compra , armani relojes" …and it just wasn't there but the thread that it referred me to was still there.

Is this a step forward for the BPL forums? If it is, HooRay! Score 1 for the humans against the "bots".

Party On,

Newton

Yeah, someone is deleted the spam, but why is that same spammer still able to make new posts?

Worse, some or all of those threads that spam is being deleted from is becoming invisible. If you didn't have a link to that thread, you wouldn't find it in the forum listing.

So it's not a step forward. Now not only is the spammer able to post spam even after being identified as a spammer, but it's also resulting in a loss of legitimate content.

…"but the thread that it referred me to was still there".

There wasn't any lost content, I'm aware of, on the thread that was involved. ;-?

Party On,

Newton

Lost doesn't mean gone, it just means you can't find it unless you know where it is. If it's not listed in the forum listing/directory like it should be, it's lost. If you didn't already have a link to it, you probably wouldn't ever know about it.

http://www.backpackinglight.com/cgi-bin/backpackinglight/forums/thread_display.html?forum_thread_id=69415&skip_to_post=594139#594139

Here are pictures to help you understand what's going on.

In this picture, you see that there are posts from today at 15:06.

Yet when I go check the forum listing, it's not listed. That thread should show up between the Tarptent thread and the fabric breathability thread, yet it's not listed. It's invisible. It's still there, you just can't see it. It's lost.

Yeah, I believe I know what is happening. The database is being corrupted by the direct deletion of the spam posts. The indexing gets off. The index is NOT the database, it only holds pointers to locations where the data is stored. I believe this is what we are seeing.

Content is not lost within the database, and, the generation of a new index(often time consuming) will fix the problem. I am not sure who programmed the "Delete All Spammer Posts" button, but he should have forced a rebuild after it was used in the program after everything was deleted. I think that will fix the database/index mismatch. I might be incorrect, but I have done that myself with some data bases. DBIII, DBIV, and Access, and some others acted like that. Some are smart enough to know better and do it automagically with singular deletions and offer this after a multiple deletion, but as a seperate function. They offer low level deletions and rebuild funtions for these cases, too.

I used "index" earlier, but it seems some people don't understand that terminology. Hopefully the picture is easier for them to understand.

I believe in the past, when spam was deleted, the index remained. After the spam was deleted, it would appear that threads were bumped for no reason. While that wasn't ideal, it's a whole lot better than deleting threads from the index entirely, effectively making them invisible.

I too have noticed quite a few threads that I was following have disappeared. I assume it was probably because the spammer posted in that thread, and when the post was deleted, the entire thread was deleted.

Hopefully this problem becomes fixed soon, because BPL is borderline un-usable in the state it is in right now.

Hi all

I think James is partly right. I don't think the database is being corrupted per se, but it may well be that a thread will disappear for a few minutes after the deletion, while the index is being rebuilt. I have noticed this myself, but all the cases I have looked at resulted in the rest of the thread being fully visible a short time later. For instance, the fabric breathability thread was all there when I looked a few minutes ago.

You can run a database without the indices, but operation them becomes rather slow. Running with indices does mean that there may be maintenance time.

Cheers

For going through and bringing back up the affected threads! A lot of work, but with poor Roger being the only moderator at this point, he needs all the help he can get!

There's gotta be a way to stop these mass spambot attacks. I haven't seen anything of this magnitude on the other forums I follow. Maybe they've just been lucky or maybe their software limits the attacks??? They get spam, but not 270 posts in a couple of hours! More like half a dozen at most.

I suspect that after three big attacks in less than a week, BPL will keep getting them unless a software fix can be put in to reduce the site's vulnerability. If something isn't done soon, the site will become useless, especially if the spambots figure out what time Roger goes to sleep!