Sign in to follow this  
Followers 0
regicide666

willhackforfood.biz

21 posts in this topic

Ouch. I just used one a couple weeks ago too.

0

Share this post


Link to post
Share on other sites
Ouch. I just used one a couple weeks ago too.

I'm guessing because some fuck-nut abused it and word got back to the hosting company. :glare:

0

Share this post


Link to post
Share on other sites

That would be a good guess.

A Nigeria registered an account and has been sending out spam emails, therefore we have temporary disabled it.

0

Share this post


Link to post
Share on other sites
That would be a good guess.

A Nigeria registered an account and has been sending out spam emails, therefore we have temporary disabled it.

Damit , wtf is up with these nigerians!!! I heard some other shit about some nigerian spammers.

0

Share this post


Link to post
Share on other sites

use geo-location software. If they are from africa, they shouldn't be able to goto the site

0

Share this post


Link to post
Share on other sites
use geo-location software. If they are from africa, they shouldn't be able to goto the site

What if they use a proxy that is outside of africa? or even tor?

0

Share this post


Link to post
Share on other sites

I have an idea.

You give everyone login accounts that let them create email accounts, only you also put in some security check at the registrstion stage that checks they're human and that they're not comming from Nigeria. Granted Tor could be a problem and if you find someone abusing the system via TOR, you'll just have to ban TOR ips from registereing too.

Fuck-nuts piss me off. :blowfuse:

EDIT: I suppose if things get really bad, you could link up the willhackforfood site with binrev so that everyone who's registered here and has made more than say 50 posts, can use willhackforfood.

Edited by coding_monkey
0

Share this post


Link to post
Share on other sites

I am pretty sure that last one, the 50 posts, goes against the idea that anyone can sign up for a secure anonymous account. But it does suck that the Nigerian guy was abusing the good service. BTW, he could not ha ve been Nigerian, but just used a proxy from Nigeria.

0

Share this post


Link to post
Share on other sites
I am pretty sure that last one, the 50 posts, goes against the idea that anyone can sign up for a secure anonymous account. 

Yeah, it does.

The only alternative I can think of would be to put in a footer in every email sent out by willhackforfood.biz that explains that any reports of abuse of this email service should be sent to ...blah....blah.... and then the admins can recieve the complaints and ban the offending IPs and close email accounts, etc rather than people complaining to the hosting company and getting the site shut down.

Also, it would help to add a 'look at this picture and enter the letters to confirm you're not a script'-style input box, if you know what I meen.

:jawa:

0

Share this post


Link to post
Share on other sites

Thanks for the ideas, we are currently considering options and will bear them in mind.

0

Share this post


Link to post
Share on other sites

stop fucking postwhoring, damn. "nice" is a useless comment, stop making your e-penis bigger. thanks. and that does suck about willhackforfood.biz. the footer idea sounds best to me, and blocking nigerian ip's too. blocking tor would NOT be a good idea, as if someone is using tor for privacy, and then willhackforfood for privacy also, that would take one of those layers away.

0

Share this post


Link to post
Share on other sites
That would be a good guess.

A Nigeria registered an account and has been sending out spam emails, therefore we have temporary disabled it.

How did they do it?

1. The site wasn't easily google mineable.

2. I would assume that all vulnerabilities were patched.

3. The account only did inbound, not outbound.

4. There were protections on automated account generation (I thought).

5. If an SMTP server was involved, then how did its specs get revealed; and why no authentication?

So how? And is there nothing that can be done to prevent further abuse?

Oh, and I hate spammers. I really, really, really do.

Edited by Seal
0

Share this post


Link to post
Share on other sites

All vulnerabilities were patched (I updated it a week or so before the whole thing happened).

willhackforfood.biz allowed both inbound and outbound email.

Only a single account appears to have been spamming which I suspect was manually registered. It also appears the emails were manually send through the Squirrelmail web interface, mainly using multiple addresses in the CC field.

0

Share this post


Link to post
Share on other sites
All vulnerabilities were patched (I updated it a week or so before the whole thing happened).

willhackforfood.biz allowed both inbound and outbound email.

I'ts a cool service, I'd hate to see it go because of the actions of a few assholes.

You might want to think about scripted outgoing email abuse.

Your login/sign-up page was easily scripted - I tried and wrote a little java app to sign me up to 5 different accounts (just because I actually genuinely needed them for testing some email app I wrote), so I wonder if your outgoing email sending page could be scripted too - my guess is yes. In which case, you should be carefull, because the likelyhood is that the spammer will script an attack to hundreds of victims before getting your service banned by all the major ISPs, before you can shut them down (and by then, it's too late).

So, I recon the best way to handle this is: don't let anyone post more than 1 email every, say.... 40 seconds? Also, for people who send more than 1 email, ask for the 'proof of human life' check again (you know, the 'enter the numbers in the fuzzy picture' thing). Also, you should limit the number of sign-ups from a single ip (I suggest to 1 or maybe 2 per IP).

:ninja:

Edited by coding_monkey
0

Share this post


Link to post
Share on other sites
(you know, the 'enter the numbers in the fuzzy picture' thing)

Its called a turning number ;)

0

Share this post


Link to post
Share on other sites
(you know, the 'enter the numbers in the fuzzy picture' thing)

Its called a turning number ;)

Cool. Thanks.

I found a few open source ones here

0

Share this post


Link to post
Share on other sites

Never heard it called that before, it's usually called a CAPTCHA which is short for completely automated public turing test to tell computers and humans apart.

(you know, the 'enter the numbers in the fuzzy picture' thing)

Its called a turning number ;)

0

Share this post


Link to post
Share on other sites

hehe, likewise to yours. See, you learn something everyday. I had always referred to it as a turning number or turning key.

0

Share this post


Link to post
Share on other sites

heh... you know, I was thinking for a while... 'do they meen TURING test''. :)

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0