Re: Spam attack, observations, how to repair

On Fri, Jul 04, 2014 at 08:53:48AM +0200, Kay Hayen wrote:
> 
> I have questions therefore:
> 
> a) Why is the HTML attached, how to prevent HTML attachments. For my 
> tracker I know for sure, that I only want octet stream or normal UTF8 
> text attachments.

There are several cases for HTML:
- If attached via web-interface there is no special handling, so HTML
  files are attached normally. You could, however, add an auditor that
  prevents attachments of html files. Looks like your attacker did that,
  added a file to an issue and removed it manually. This can be seen in
  the history of the file you mention.
- HTML files are normally *NOT* displayed as html unless you set
  "allow_html_file = yes" in config.ini. Can you check if you have
  set this option? If unset, html files should not be displayed in the
  browser. The explanation in the config-file explicitly warns that
  enabling this option is a security risk.
  If you have *NOT* enabled this option you probably found a bug in
  roundup, in that case I'd like to hear more to fix it.
- If an email with type multipart/alternative is received, the html
  alternative is added to the issue as an attachment -- unless you set
  "ignore_alternatives = yes" in the config-file. So if an email has a
  text/plain and a text/html part, the html part is *not* attached if
  this option is set.

> b) How can I remove the spam users entirely. Will a "retire" do this 
> sort of mostly automatically over time? I did a retire of a file, but it 
> still exists.  I played a lot with roundup-admin, but I didn't find 
> anything there. It would be nice to not have them in the users dropdown 
> list at least.

For removing this type of file attachment spam I've written a script to
completely remove the traces of this spam -- except for the file object
(but the contents *is* removed). So you still have the file object but
the links from the issue and the *history* of the issue is rewritten.

The script is in the "scripts" sub-directory of the roundup distribution
and is called spam-remover. It must be run on the host running the
tracker.

> c) How can I remove all actions of a spam user from the history of the 
> tracker.
See above. The file object itself stays but is no longer linked
anywhere. The html contents *is* removed.
Similar to the script you could extend it to completely remove a user
or to completely remove the file object the user created.

The current script is a compromise between trying to keep history and
removing the most visible traces of a spammer.

> d) How can I get an email as soon as a new user registered.
You can add a reactor that triggers for "create" of "user".

> e) How can I automatically be nosy on every issue. I am getting emails 
> for issues created, but not later automatically. The traffic on my list 
> is low enough, to do this, and I am interested in all issues anyway.

You can add an auditor that automagically puts you on the nosy list of
every new issue.

On the other hand: You probably wouldn't have seen the spammer adding
the file with these settings because the action probably did *not*
create an email to the nosy list of the affected issue. So you *could*
add a reactor that monitors file creation and sends you a notice
whenever new files are generated.

Ralf
-- 
Dr. Ralf Schlatterbeck                  Tel:   +43/2243/26465-16
Open Source Consulting                  www:   http://www.runtux.com
Reichergasse 131, A-3411 Weidling       email: [email protected]
allmenda.com member                     email: [email protected]

------------------------------------------------------------------------------
Open source business process management suite built on Java and Eclipse
Turn processes into business applications with Bonita BPM Community Edition
Quickly connect people, data, and systems into organized workflows
Winner of BOSSIE, CODIE, OW2 and Gartner awards
http://p.sf.net/sfu/Bonitasoft