OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: [Full-Disclosure] Suspect phpBB users

From: Barrie Dempster (barriereboot-robot.net)
Date: Mon Jan 03 2005 - 10:00:38 CST

On Sat, 2004-12-25 at 18:54 -0500, Jack Yan wrote:
> Dear Full-Disclosure members:
>
> I am not a computer expert, just a regular Joe who hopes this information
> may be useful to you.
> We are running phpBB and last week, a DoS attack was launched against us.
> We have since upgraded, but among our new users over the last few days
> have been a Weber361, a Weber395, and a nderevyanko.
> Googling the last user name, I've found 4,900 references—most with
> guestbooks or forums—to which nderevyanko has signed up. He has been
> preceded by a few Webers, and some Irenas, often citing that
> killhim.boom.ru is their home page.

I found 10 such users on my forum at the site in my signature.
Attached is a CSV file containing the export from phpbb, they all seem
to have the same password. none of them have posted anything.

Doesn't look like this is a DoS attack or anything like that I believe
it's most likely an attempt at google spamming with the URL they set as
their homepage. I'd recommend disabling them and modifying the homepage
to your own URL. I wouldn't delete them as if they have a script this
would be a sign that the site isn't previously tagged and would then
allow them to regenerate.

The accounts on my site where created on the 22/23 of December incase
that becomes relevant (the site being down leads me to believe this is
the end of it)

With Regards..
Barrie Dempster (zeedo) - Fortiter et Strenue

  http://www.bsrf.org.uk

[ gpg --recv-keys --keyserver www.keyserver.net 0x96025FD0 ]

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBB2WwmsYtTQpYCX9ARAqkqAKCloJ1FyUDsE83Z+hIsbWNP1+8EFgCg0vQT
oh6XuHlSPh8MhMcy8Bsu3NE=
=biCg
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html