Comments on: FBI Spam

By: The Evolution of Spam-Consciousness - Pop Occulture

The Evolution of Spam-Consciousness - Pop Occulture — Thu, 25 May 2006 18:05:04 +0000

[...] While we’re on the subject, also check out the spammy blog posts that Garrett recently discovered. Are they written by a real person or a script which is able to simulate natural language? Then we have the enormous spam attacks several of us have been enduring via comments and trackbacks on our WordPress blogs. [...]

By: Tim Boucher

Tim Boucher — Sat, 20 May 2006 19:41:17 +0000

Well, you know you can just turn off comments and trackbacks in WordPress, right? It’s really no reason to leave WP. Anyway, with this blog, I’m also really not willing to turn them off because the whole point is the conversational element, really. But this Akismet plugin seems to be getting the job done just fine.

By: Dan

Dan — Fri, 19 May 2006 19:04:14 +0000

I had exactly the same phenteremine attacks for ages. In the end, I found they were mostly coming from a particular subnet range, so I just just blocked that subnet (via .htaccess). I kept getting lots of spam after from other sites though, another reason why I packed in wordpress. That’s why I’m now comment free and happy at the moment

By: Tim Boucher

Tim Boucher — Fri, 19 May 2006 16:17:05 +0000

Uh…. what? So what do I need to do?

By: Thomas Conlon

Thomas Conlon — Fri, 19 May 2006 08:20:44 +0000

Seems like pingbacks are being used to probe your version of wp as there seems to be a recent bug, I would assume buffer overflow as the likely desired effect.

xml-rpc call plus malicious code and incorrect user permissions (like if the pingback flooded your buffer and inserted an o/s command to set up a pptp tunnel and environment for a user who can log in remotely because his xml shit was run as administrator or the service account for apache.

I would expect a phenteramine company using php probes to want to infiltrate in order to hijack your mail server and send spam.

Apparently you can do:
“0Ã—0031 (49)
Access denied ” as a return code so there must be some type of filtering module

The bad news is that XMLRPC is plain scary and you may be getting a little probe against your system with each pingback

“The payload is in XML, a single structure.

The must contain a sub-item, a string, containing the name of the method to be called. The string may only contain identifier characters, upper and lower-case A-Z, the numeric characters, 0-9, underscore, dot, colon and slash. It’s entirely up to the server to decide how to interpret the characters in a methodName. ”

Like how bout i rip on mysql usernames not “mary’s blog linked to joe’s”
or you gotta have perl installed with php right? Lots you can do to the os there, good luck.

-tc

By: zacharius

zacharius — Thu, 18 May 2006 23:30:23 +0000

yeah, i already had that. it puts them all into batch moderation. no sweat.

hold on…

there’s a FBI assault team outside my door…

FUCK!!

By: Tim Boucher

Tim Boucher — Thu, 18 May 2006 22:18:23 +0000

I’ve also just installed Akismet so hopefully a lot of these spam problems will be diminished even further:

http://akismet.com/faq/