Archive for the 'MediaWiki' Category
Bad Behavior 2.0.8 has been released.
This version contains updates for various “false positive” reports and is recommended for all users.
Updated in this release (since 2.0.7):
- Verizon Wireless EV-DO users are no longer blocked.
- Blocked requests will be subject to a two-second delay before a response is sent. (See below.)
- Some blackhole lists previously used in Bad Behavior have been scaled back or removed.
- The address for the Bad Behavior Blackhole has been added. (See below.)
- Some new spambots have been identified and blocked.
In recent days spam attacks have been on the rise, with one especially obnoxious bot delivering requests so fast that some sites have been taken offline by them. While the requests aren’t especially numerous or resource-intensive, the most common software used by Web hosting providers is very inefficient at serving dynamic pages such as PHP-based Web sites. So even a moderate number of requests can take a whole server down, or lead the hosting provider to take the site down before the whole server goes down.
Bad Behavior now counters this by introducing a short two second delay to blocked requests, before the HTTP response is sent. Since most spambots wait for the response before going on to the next request, this should sufficiently slow down most of the overly aggressive spambots and give Web site operators some breathing room. While I would have liked to put in a delay of a minute or more, there remains the slight chance that an actual human being would be blocked, and they should be able to get a response back in a reasonable time.
With respect to realtime blackhole lists, all of the existing lists target e-mail spam, and since spambots who send link spam are almost always also sending e-mail spam through the same servers, these are a fairly effective means of blocking link spam. However, since they target e-mail spam, they also block legitimate users. The primary issue here is that while an IP address may be added to a blackhole list quickly, it is not removed quickly — or at all — once the spam stops. Thus, people with dynamic IP addresses are unfairly blocked because some other customer was sending spam.
Bad Behavior Blackhole, which should go online within the next few weeks, is designed specifically for link spam. It adds IP addresses to its database quickly when actual spam is received, and in addition, drops the IP addresses once the spam stops. This helps prevent dynamic IP customers from being blocked because another user’s computer was sending spam. Once Bad Behavior Blackhole is online, all other realtime blackhole lists will be dropped from Bad Behavior.
Download Bad Behavior now!
As always, if you find Bad Behavior valuable, please consider making a financial contribution. I develop Bad Behavior in my spare time, and every little bit means I have more spare time to devote to its development.
And don’t forget to subscribe to the RSS feed or the mailing list. (They’re the same content.)
In the last two days I’ve seen a tenfold increase in the amount of spam being delivered, both that is being blocked, and isn’t being blocked, by Bad Behavior.
While the spam started around the same time as I released Bad Behavior 2.0.7 yesterday, there doesn’t appear to be any correlation between the two. I inspected a few of the spams and they seem like the same old stuff, just cranked into very high gear.
I’ve personally seen over 3,000 spam attempts in the last day, with over 200 missed. This is spam that Bad Behavior is not yet capable of catching without blocking legitimate users as well.
This is why I have been working on the Bad Behavior Blackhole, in order to identify and block spam by its sources, wherever they are.
The Bad Behavior Blackhole is a feature that, once fully up and running, can identify known sources of blog spam and wiki vandalism and pre-emptively block them without affecting legitimate users.
Unfortunately, time constraints have not permitted me to put in much work on Bad Behavior Blackhole, as I’ve had to work on things which bring in revenue. As I’ve said before, while tens of thousands of people use Bad Behavior, only a few dozen have ever actually contributed back.
If you find Bad Behavior valuable, and you want to see this project up and running sooner rather than later, please contribute to its further development.
Thank you in advance for your support.
Update: Slashdot has coverage of the massive spam increase, which is hitting e-mail spam as well.
Bad Behavior 2.0.6 has been released.
About four weeks ago I provided a pre-release copy of Bad Behavior 2.0.6 to a select group of testers in order to evaluate a new method of blocking spam, and it’s proved quite successful at blocking a large chunk of spam. On my testbed it blocked 953 spams and missed about 50. So I expect it to cut the spam flow even further.
I said last month I wasn’t generally releasing it immediately so that I could determine whether it blocked any legitimate users. It did indeed block two people that I know of: one was resolved in moments through the fix-it-yourself link, and the other was myself, while using a Wi-Fi access point. I determined that someone had recently sent spam through the same AP, causing the blockage. It had also caught a third person, before the pre-release, whose computer was actually sending spam at the time.
So I’m releasing 2.0.6 generally. If you received a pre-release copy, this copy is unchanged, and you don’t need to do anything.
New in this release (since 2.0.5):
- A new blocking method using realtime blackhole lists is being used to determine if a post originates from a known spam source, open proxy, etc. GET requests are not screened. Links are provided to blackhole list removal procedures through the fix it yourself link.
Download Bad Behavior now!
As always, if you find Bad Behavior valuable, please consider making a financial contribution. I develop Bad Behavior in my spare time, and every little bit means I have more spare time to devote to its development.
And don’t forget to subscribe to the RSS feed or the mailing list. (They’re the same content.)
When I released Bad Behavior 2, I noted that due to time constraints I was unable to complete everything on the roadmap. Most of that is because spammers have dramatically stepped up their activity in recent weeks and the new version provides greatly improved protection against their attacks. Part of it is that as an unpaid project, I can only devote so much spare time to it.
Now that Bad Behavior 2.0 has stabilized, it’s time to update the roadmap in preparation for the next minor (2.1) and major (3.0) releases.
Continue reading ‘Bad Behavior 2.1 and 3.0 Roadmap’
Bad Behavior 2.0.5 has been released to provide small bug fixes.
New in this release (since 2.0.4):
- A bug affecting MediaWiki and ExpressionEngine users, and possibly others, caused database errors to be thrown when a POST request was received. This has been fixed. (I thought I’d fixed this previously, but apparently not. This one should fix it for real.)
- A couple of additional spambots have been identified and blocked.
Download Bad Behavior now!
As always, if you find Bad Behavior valuable, please consider making a financial contribution. I develop Bad Behavior in my spare time, and every little bit means I have more spare time to devote to its development.
And don’t forget to subscribe to the RSS feed or the mailing list. (They’re the same content.)
Bad Behavior 2.0.4 has been released to provide small bug fixes.
New in this release (since 2.0.3):
- A bug affecting MediaWiki and ExpressionEngine users, and possibly others, caused database errors to be thrown when a POST request was received. This has been fixed.
- A confusing entry in the generic code, which was causing PHP warnings for people who mistakenly used it without changing it, has been altered. The section of code, which users of the generic code are expected to change, referred to a variable which did not exist, and users who failed to change the code for their particular installation received warnings.
- A part of the housekeeping code which optimizes Bad Behavior’s log table has been rescheduled to run in only one of 1000 blocked requests. Under a heavy spam attack this was running much too frequently at its old schedule of one in 25 blocked requests, causing at least one shared hosting provider to complain.
Download Bad Behavior now!
As always, if you find Bad Behavior valuable, please consider making a financial contribution. I develop Bad Behavior in my spare time, and every little bit means I have more spare time to devote to its development.
And don’t forget to subscribe to the RSS feed or the mailing list. (They’re the same content.)
Update: Due to some errors which creeped in, I’ve repacked the 2.0.4 release. If you already downloaded it and are having strange problems, please re-download it.
Before I get into the release announcement, I just want to ask all of you to send me money so I can buy a T-shirt here at the HOPE conference. Oh, and eat too. NYC has drained my wallet to just about empty. Thanks!
Bad Behavior 2.0.3 has been released to provide additional protection from certain Ukrainian spammers and to prevent certain users from being blocked inappropriately.
New in this release (since 2.0.2):
- A check has been added for a high-volume Ukrainian spammer who can generate 500,000 spams per day (and quite possibly much more).
- A blacklist entry has been relaxed in order to prevent inappropriate blocking of a few rare legitimate users and bots.
Download Bad Behavior now!
As always, if you find Bad Behavior valuable, please consider making a financial contribution. I develop Bad Behavior in my spare time, and every little bit means I have more spare time to devote to its development.
And don’t forget to subscribe to the RSS feed or the mailing list. (They’re the same content.)
Bad Behavior 2.0.2 has been released to provide additional protection from certain blog and wiki spammers and email address harvesters.
New in this release (since 2.0.1):
- A check has been added for certain types of blog comment and wiki spam.
- Several email address harvesters have been added to the blacklists.
Download Bad Behavior now!
As always, if you find Bad Behavior valuable, please consider making a financial contribution. I develop Bad Behavior in my spare time, and every little bit means I have more spare time to devote to its development.
And don’t forget to subscribe to the RSS feed or the mailing list. (They’re the same content.)
Bad Behavior 2.0.1 has been released to address a critical bug in the whitelisting code. All users who use or plan to use the whitelisting feature of Bad Behavior should upgrade to version 2.0.1.
New in this release (since 2.0.0):
- A bug causing the whitelist to fail on some POST requests has been fixed.
- Support for the LifeType blog platform has been added. This support was graciously provided by Mark Wu. Unfortunately, I don’t know much about LifeType, so I can’t really give any support for it. You can find more information at Mark’s blog.
- Some additional checks for trackback spam have been added.
Download Bad Behavior now!
As always, if you find Bad Behavior valuable, please consider making a financial contribution. I develop Bad Behavior in my spare time, and every little bit means I have more spare time to devote to its development.
And don’t forget to subscribe to the RSS feed or the mailing list. (They’re the same content.)
It’s been a long time coming, and Bad Behavior 2, the next generation of the Web’s premier malicious traffic killer, is finally here!
Bad Behavior, conceived in 2005 as a fingerprinting method for HTTP requests, has proven, as one user called it, “shockingly effective” at identifying and blocking malicious activity, including blog/wiki spam, e-mail address harvesting, automated cracking attempts, and more. It does all of this looking only at the HTTP request headers; for POST data, the content of the spam is not analyzed at all.
Even so, Bad Behavior blocks the vast majority of web spam, and has gotten the spammers so worked up they’ve actually stopped spamming me with their latest tools, so as to try to prevent me from learning what they’re up to. (It didn’t work. “The king hath note of all that they intend, By interception which they dream not of.” — Shakespeare)
I’ve been developing Bad Behavior 2 in my limited spare time, off and on, for almost a year. And I want to thank all of you for your patience, especially while spammers were bombarding your blogs and wikis, and for your support. It’s been a crazy year, and I’ll be talking more on a personal note about it in the next few weeks.
And that is the reason I am releasing the software now, when not all of the planned features are present: In recent weeks spammers have greatly stepped up their activity, with some sites receiving ten times as much spam as before. I’ve been hard at work on Bad Behavior 2, making sure that it can block this spam without keeping away your regular readers.
New Features
Even without everything I’d planned, Bad Behavior 2 is chock full of new features. Some of them are quite visible, others are more in the backend.
- Bad Behavior 2 is faster than Bad Behavior 1, whether you use database logging or not. It has been completely redesigned from the ground up to be as fast as possible and provide protection on very high traffic sites, such as when you find yourself on the front page of slashdot.org, or you’re the sysop of Wikipedia. For most requests, Bad Behavior 2 issues at most one fast database query, and in many cases, no database queries. Bad Behavior’s run time on fast servers is measured in single milliseconds.
- Bad Behavior 2 has been enhanced with additional checks for spammers who have started or increased their activity in the last year. It also has better screening of trackback spam, killing virtually all of it. Bad Behavior 1 permitted a lot of trackback spam.
- Bad Behavior 2′s options have been standardized across ports, so that the same options work the same way on each software package. (Not all of the options apply to each package, however.) This makes Bad Behavior easier to deploy across multiple sites and different software packages.
- On some software packages, Bad Behavior’s options can be controlled from within the software package. Currently an administrative screen is available on WordPress, and a screen is planned for MediaWiki. (It hasn’t been implemented because developer documentation is sparse, incomplete and wrong, according to Brion. When the documentation improves, the MediaWiki port’s features will improve.)
- For speed reasons, Bad Behavior 2 does not use PHP classes in its core. But Bad Behavior 2′s API has been rewritten to provide a better interface for certain types of software, such as ExpressionEngine, which expect their extensions to be encapsulated in classes. (The EE port isn’t complete, sorry!)
- Some spam delivery methods are easily confused with legitimate users, especially those in large corporations or governments. This is mainly due to the proxies in use at those places. When a spammer uses such a proxy, Bad Behavior cannot easily tell whether the request is legitimate or not. In Bad Behavior 1, these requests were blocked, causing many legitimate users to be blocked. In Bad Behavior 2, you can choose whether to block these requests with the “strict” option.
Upgrading
To upgrade to Bad Behavior 2, you first need to remove all previous versions of Bad Behavior, including any 2.0 pre-release versions. Then you need to drop any database tables Bad Behavior may have created in your database. These may be named, e.g. mw1_bad_behavior or wp_bad_behavior. They may also be bad_behavior_log instead.
Then you are ready to install Bad Behavior 2!
Installation
The basic installation instructions haven’t changed much from Bad Behavior 1. Please see:
Options
For all platforms except WordPress (for now) options are configured by editing them near the top of the bad-behavior-platform.php file. Currently this includes MediaWiki and the generic non-database port. MediaWiki options will be moved to a special page in a future version.
In WordPress, the available options appear in the Options » Bad Behavior administrative page.
The options available to all users are:
- log_table: The name of the database table Bad Behavior should use. This is set by default for all platforms and should not be changed unless you are porting Bad Behavior to a new software package.
- display_stats: When this option is set, Bad Behavior will display statistics in the footer of your web pages. (Currently works only on WordPress.)
- strict: Enables strict mode blocking. When turned on, certain types of spam will be blocked, but legitimate corporate and government users may also be blocked. This is off by default.
- verbose: Enables logging of all requests received. When turned on, the details of every HTTP request Bad Behavior processes will be logged to the database. When turned off, only blocked requests, and a few legitimate but suspicious requests, will be logged. This is off by default.
To-Do List
I’ve pushed this release out the door because it’s proven stable, fast, and effective, and because spammers have greatly stepped up their activity. So several features which were in the roadmap have been postponed. I will be drawing up a new post-2.0 roadmap for these features in the next few days.
Finally…
As always, if you find Bad Behavior valuable, please consider making a financial contribution. I develop Bad Behavior in my spare time, and every little bit means I have more spare time to devote to its development.
Download Bad Behavior Now!
And don’t forget to subscribe to the RSS feed or the mailing list. (They’re the same content.)