Re: Suspect phpBB users

[Barrie Dempster <barrie () reboot-robot net>]

On Sat, 2004-12-25 at 18:54 -0500, Jack Yan wrote:
> Dear Full-Disclosure members:
>
> I am not a computer expert, just a regular Joe who hopes this information 
> may be useful to you.
>     We are running phpBB and last week, a DoS attack was launched against us.
>     We have since upgraded, but among our new users over the last few days 
> have been a Weber361, a Weber395, and a nderevyanko.
>     Googling the last user name, I've found 4,900 references—most with 
> guestbooks or forums—to which nderevyanko has signed up. He has been 
> preceded by a few Webers, and some Irenas, often citing that 
> killhim.boom.ru is their home page.

I found 10 such users on my forum at the site in my signature.
Attached is a CSV file containing the export from phpbb, they all seem
to have the same password. none of them have posted anything.

Doesn't look like this is a DoS attack or anything like that I believe
it's most likely an attempt at google spamming with the URL they set as
their homepage. I'd recommend disabling them and modifying the homepage
to your own URL. I wouldn't delete them as if they have a script this
would be a sign that the site isn't previously tagged and would then
allow them to regenerate.

The accounts on my site where created on the 22/23 of December incase
that becomes relevant (the site being down leads me to believe this is
the end of it)

With Regards..
Barrie Dempster (zeedo) - Fortiter et Strenue

  http://www.bsrf.org.uk

[ gpg --recv-keys --keyserver www.keyserver.net 0x96025FD0 ]

Attachment: phpbb_users.csv
Description:

Attachment: signature.asc
Description: This is a digitally signed message part

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html