Re: Spam attack, observations, how to repair

Hello Ralf,

thanks for your reply. I will wait with repairing, so we can inspect the
situation:

2014-07-04 10:00 GMT+02:00 Ralf Schlatterbeck <[email protected]>:

There are several cases for HTML:
> - If attached via web-interface there is no special handling, so HTML
>   files are attached normally. You could, however, add an auditor that
>   prevents attachments of html files. Looks like your attacker did that,
>   added a file to an issue and removed it manually. This can be seen in
>   the history of the file you mention.
>

Yes, he did that. From http://bugs.nuitka.net/issue3 (will change once we
have all information necessary) see this:

2014-07-03 23:39:31kayhayensetfiles: - sample-python-code.png
<http://bugs.nuitka.net/file137> 2014-05-01 13:58:00jwillysetfiles: -
index.html <http://bugs.nuitka.net/file139> 2014-05-01 13:56:53jwillysetfiles:
+ index.html <http://bugs.nuitka.net/file139> 2014-05-01
13:56:43jwillysetfiles:
- index.html <http://bugs.nuitka.net/file138> 2014-05-01
13:50:49jwillysetfiles:
- neli12.html <http://bugs.nuitka.net/file38> 2014-05-01
13:48:06jwillysetfiles:
+ index.html <http://bugs.nuitka.net/file138> 2014-05-01
13:35:40jwillysetfiles:
+ sample-python-code.png <http://bugs.nuitka.net/file137>
2013-10-17 17:25:46dryhorse82setfiles: + neli12.html
<http://bugs.nuitka.net/file38>
The "dryhorse82" was the first spammer account, "jwilly" the second,
as you can see, he removed a file, that I had not noticed. In fact I only
noticed issues that were vandalized (title changed). This time around
he didn't, and he has learned to remove the files, detaching it.

The attached files would be available as /filexxx/ from the roundup
server, at least in my configuration, and then they would display as
HTML.

Assuming I am not wrong, it appears that it's pretty easy to victimize
small issue trackers as spam hosts, without the owner noticing. When
I noticed things, it was usually because of vandalism. Even now, a
closed issue is something I wouldn't see.

Also, to me this totally looks like a human doing it.

BTW: I just noticed that the above links work, and saw this:

http://bugs.nuitka.net/file38

2014-05-01 13:50:49jwillyunlinkissue3 files <http://bugs.nuitka.net/issue3>
2013-10-17 17:25:50dryhorse82settype: text/html -> html 2013-10-17 17:25:46
dryhorse82linkissue3 files <http://bugs.nuitka.net/issue3>
2013-10-17 17:25:46dryhorse82create

Maybe this gives an indication. Why did he change the content
type from text/html to html. And apparently now, with the new
account, he unlinked the file. Very strange.

Anyway, maybe that explains why files render.

- HTML files are normally *NOT* displayed as html unless you set
>   "allow_html_file = yes" in config.ini. Can you check if you have
>   set this option? If unset, html files should not be displayed in the
>   browser. The explanation in the config-file explicitly warns that
>   enabling this option is a security risk.
>   If you have *NOT* enabled this option you probably found a bug in
>   roundup, in that case I'd like to hear more to fix it.
>

I am going to create an issue out of this. I definitely have it set, but I
am
not sure for how long.

This is from a dirvish setup, I am making a daily backup of the site, and so
I have the tracker database of almost each day:

+ grep 20131203/tree/lib/roundup/trackers/nuitka/config.ini -e
allow_html_file
allow_html_file = no

That is as far as it goes back. I do not recall to ever have changed it. In
all
likelihood it was even active when the "dryhorse82" account only had the
web interface available.


> - If an email with type multipart/alternative is received, the html
>   alternative is added to the issue as an attachment -- unless you set
>   "ignore_alternatives = yes" in the config-file. So if an email has a
>   text/plain and a text/html part, the html part is *not* attached if
>   this option is set.
>

I have no had email activated. I recall changing this setting when I did
enable email submissions to the tracker.


+ grep 20140207/tree/lib/roundup/trackers/nuitka/config.ini -e
ignore_alternative
ignore_alternatives = no
+ grep 20140209/tree/lib/roundup/trackers/nuitka/config.ini -e
ignore_alternative
ignore_alternatives = yes

It was like that since then, so an HTML attachment shouldn't be coming via
email, right? If you think that is possible, I can check my mailer daemon
logs
and see if it did. But because of above, I doubt that it's necessary.



>  > b) How can I remove the spam users entirely. Will a "retire" do this
> > sort of mostly automatically over time? I did a retire of a file, but it
> > still exists.  I played a lot with roundup-admin, but I didn't find
> > anything there. It would be nice to not have them in the users dropdown
> > list at least.
>
> For removing this type of file attachment spam I've written a script to
> completely remove the traces of this spam -- except for the file object
> (but the contents *is* removed). So you still have the file object but
> the links from the issue and the *history* of the issue is rewritten.
>

I will use it once the issue is clear.

I just checked with your own issue tracker, that both links work:

http://issues.roundup-tracker.org/file1496/roundupdb.py/
http://issues.roundup-tracker.org/file1496/roundupdb.py

The first ought to 404 from roundup in my mind.

What I am saying is that, if that file were HTML, it would be rendered
as HTML, in at least my Chrome browser. I also have evidence of it
being used, due to web master tools crawling these pages.

And, checking closer, I even find working HTML links. I do not want
to give an example so as to not worsen the issue, but since the
robots.txt now covers it, it's probably good.

http://bugs.nuitka.net/file45/23334-12767-23218.html

Some files it wants to download, some it does not, and displays them,
for the ones it does not, I am assuming the trailing "/" would be making
it work. I have unfortunately cleared the issue to webmaster tools
already, so I can't prove that it was submitted to the index.

But that is how I noticed. I don't do much SEO and surely not for the
bug tracker. Had I checked, I would have found that the top search
terms are not Python related.

The script is in the "scripts" sub-directory of the roundup distribution
> and is called spam-remover. It must be run on the host running the
> tracker.
>

Going to check it out.


>  > d) How can I get an email as soon as a new user registered.
> You can add a reactor that triggers for "create" of "user".
>

Ok, going to checkout what these are. So far I didn't need anything
from that feature domain.


>  > e) How can I automatically be nosy on every issue. I am getting emails
> > for issues created, but not later automatically. The traffic on my list
> > is low enough, to do this, and I am interested in all issues anyway.
>
> You can add an auditor that automagically puts you on the nosy list of
> every new issue.
>
> On the other hand: You probably wouldn't have seen the spammer adding
> the file with these settings because the action probably did *not*
> create an email to the nosy list of the affected issue. So you *could*
> add a reactor that monitors file creation and sends you a notice
> whenever new files are generated.
>

Definitely will do so.

Yours,
Kay

------------------------------------------------------------------------------
Open source business process management suite built on Java and Eclipse
Turn processes into business applications with Bonita BPM Community Edition
Quickly connect people, data, and systems into organized workflows
Winner of BOSSIE, CODIE, OW2 and Gartner awards
http://p.sf.net/sfu/Bonitasoft

_______________________________________________
Roundup-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/roundup-users