Archive for the 'Spam' Category
In the last two days I’ve seen a tenfold increase in the amount of spam being delivered, both that is being blocked, and isn’t being blocked, by Bad Behavior.
While the spam started around the same time as I released Bad Behavior 2.0.7 yesterday, there doesn’t appear to be any correlation between the two. I inspected a few of the spams and they seem like the same old stuff, just cranked into very high gear.
I’ve personally seen over 3,000 spam attempts in the last day, with over 200 missed. This is spam that Bad Behavior is not yet capable of catching without blocking legitimate users as well.
This is why I have been working on the Bad Behavior Blackhole, in order to identify and block spam by its sources, wherever they are.
The Bad Behavior Blackhole is a feature that, once fully up and running, can identify known sources of blog spam and wiki vandalism and pre-emptively block them without affecting legitimate users.
Unfortunately, time constraints have not permitted me to put in much work on Bad Behavior Blackhole, as I’ve had to work on things which bring in revenue. As I’ve said before, while tens of thousands of people use Bad Behavior, only a few dozen have ever actually contributed back.
If you find Bad Behavior valuable, and you want to see this project up and running sooner rather than later, please contribute to its further development.
Thank you in advance for your support.
Update: Slashdot has coverage of the massive spam increase, which is hitting e-mail spam as well.
Bad Behavior 2.0.7 has been released.
I’ve got a nice roundup of bug fixes this time around. Most people should upgrade right away to take advantage of the fixes and additional spam protections.
New in this release (since 2.0.6):
- A bug (apparently in MediaWiki) which caused blank lines to appear on rendered pages in MediaWiki 1.7 has been worked around.
- In version 2.0.6 four blackhole lists were added and incoming POST requests screened against them. Two of these lists generated significant hits in which primarily non-U.S. users who hadn’t actually sent any spam were being blocked. They have been removed. (Once Bad Behavior Blackhole is up and running, the other two may be removed as well, even though they’re performing fine.)
- Two tests which catch some spambots and content thieves which were present in Bad Behavior 1 were inadvertently dropped from Bad Behavior 2. One of the hazards of rewriting something from the ground up. These tests have been restored.
- A check which blocks users behind a Microsoft ISA Server 2004 proxy server, and one other type of proxy server I forget the name of, has been moved to strict mode only. Please disable strict mode if you are expecting traffic from such a source, and please contact Microsoft for a hotfix, if they’ve bothered to fix the bug in their software.
- An additional IP address range for Google has been whitelisted. If you ever receive spam from an IP address owned by Google, please notify me immediately.
- Several additional spambots have been identified and blocked.
Download Bad Behavior now!
As always, if you find Bad Behavior valuable, please consider making a financial contribution. I develop Bad Behavior in my spare time, and every little bit means I have more spare time to devote to its development.
And don’t forget to subscribe to the RSS feed or the mailing list. (They’re the same content.)
Also please note: Due to excessive levels of spam here on wordpress.com, which doesn’t use Bad Behavior anymore, I’ve had to close comments and pings entirely. You can reach me at badbots@nospam.ioerror.us without the nospam.
A user wrote in to let me know that Bad Behavior 2 has finally been ported to Drupal.
The work is pretty early and needs some spit and polish, but you can get the early results from the Drupal site.
About a year ago I started a project called the Bad Behavior Blackhole. The purpose of the blackhole was to list known sources of blog spam and to publish that data for the use of bloggers who wanted to make use of it to prevent spam.
Due to lack of time, I put the project on hold indefinitely. But I’ve been slowly working on it, off and on, over the last few months. Mostly off, again, due to lack of time. As I’ve said before, I have to spend most of my time on things that pay the bills, and historically, fighting spam hasn’t really been one of them, unfortunately.
With Bad Behavior 2.0.6 this week, I released a new feature which checks POST requests against third-party spam blacklists. This has proven quite effective in stopping a lot of the spam that wasn’t otherwise caught, but it does have a few drawbacks.
First, since I don’t maintain any of the lists, it’s difficult for me to help anyone get removed from the lists, other than providing links back to the blacklist providers. I’ve seen a few positive hits which I don’t want to be blocking, such as dynamic IP addresses which once sent a spam two or three years ago and have been blacklisted ever since. (The list involved, list.dsbl.org, will be dropped in the next release, and you can edit the code and remove it yourself if you’re having problems with it.)
I envision the Bad Behavior Blackhole as much more responsive than other blacklists, as the users likely to be affected aren’t going to really know what’s going on, or why they should be blocked because somebody sent a spam back in 2003.
Specifically, Bad Behavior Blackhole will have the following features:
- Immediate removal for anyone upon request, the first time. Removal will be delayed for further requests from the same IP, to prevent spammers from removing themselves and sending more spam.
- Blacklisting only for a specific period of time, and only while spam is actually flowing from a given IP address. Once the spam stops, the address will be delisted automatically after a short time. If it restarts, then the address is relisted.
- List sources which are actually sending spam, as well as sources which are demonstrated to have compromised security, such as open proxy servers and Trojaned machines, before they can send spam.
- Usable from any platform. This covers Movable Type, WordPress, and just about anything else you can think of. Adding support for realtime blackhole lists to any given program is at most a 15-minute hack.
It needs about a day and a half worth of work to finish up and do the initial rollout. (Didn’t you notice the link for it was dead?) But as I said before, I’ve been delaying it due to lack of time. And this is where you come in. I work on Bad Behavior and related projects primarily as I have time, and I can afford to devote more time to it when more people contribute to its development.
Over the past couple of months I’ve been quietly setting up a honeypot blog, and collecting other sources of data on blog spammers, to feed the realtime blackhole list. The data is coming in. At this point it just needs to be connected to the Bad Behavior Blackhole, tested and released. Once this is done we’ll have a much more responsive list which actually keeps spammers out, keeps blocking of legitimate users to an absolute minimum, and provides an easy removal method for the rare person who might be blocked.
If you’d like to see this project completed sooner than later, contribute to further development of the Bad Behavior Blackhole.
And again, thank you all for your continued support in the war on web spam. Bad Behavior could not continue without it.
Bad Behavior 2.0.6 has been released.
About four weeks ago I provided a pre-release copy of Bad Behavior 2.0.6 to a select group of testers in order to evaluate a new method of blocking spam, and it’s proved quite successful at blocking a large chunk of spam. On my testbed it blocked 953 spams and missed about 50. So I expect it to cut the spam flow even further.
I said last month I wasn’t generally releasing it immediately so that I could determine whether it blocked any legitimate users. It did indeed block two people that I know of: one was resolved in moments through the fix-it-yourself link, and the other was myself, while using a Wi-Fi access point. I determined that someone had recently sent spam through the same AP, causing the blockage. It had also caught a third person, before the pre-release, whose computer was actually sending spam at the time.
So I’m releasing 2.0.6 generally. If you received a pre-release copy, this copy is unchanged, and you don’t need to do anything.
New in this release (since 2.0.5):
- A new blocking method using realtime blackhole lists is being used to determine if a post originates from a known spam source, open proxy, etc. GET requests are not screened. Links are provided to blackhole list removal procedures through the fix it yourself link.
Download Bad Behavior now!
As always, if you find Bad Behavior valuable, please consider making a financial contribution. I develop Bad Behavior in my spare time, and every little bit means I have more spare time to devote to its development.
And don’t forget to subscribe to the RSS feed or the mailing list. (They’re the same content.)
Bad Behavior 2.0.6 is currently being tested.
Many of you have noticed the large upturn in spam flow in the past few weeks. Bad Behavior 2.0 to date has blocked much of it, but has not been able to block nearly as much of it as I would like.
I am currently testing a new spam blocking method which looks, for the moment, to be catching virtually all of the remaining uncaught spam which I am seeing.
I’m not releasing it immediately, though, so that I can evaluate whether it is generating any false positives, and if so, whether the affected users are able to clean their computers of the viruses and other malware which they contain, and whether this is sufficient to resolve the problem.
It will probably be about a week before I have enough data to be sufficiently satisfied with the false positive handling to put it out for general release, but so far I haven’t seen anything which would qualify as a false positive. It did catch one human being whose computer, it turned out, was sending out thousands upon thousands of e-mail and blog spams.
But if you’d like to get your hands on this code early, I am offering a pre-release package to anyone who has previously contributed financially at least $5.00 to Bad Behavior development (or anyone who contributes now). Just e-mail me and I’ll get your copy sent out.
Keep in mind that I haven’t fully evaluated whether the new code will generate false positives, though the preliminary results are that it should not stop anyone who isn’t actually sending spam, so keep a copy of the previous release around in case you don’t like it or have problems.
And don’t forget to subscribe to the RSS feed or the mailing list. (They’re the same content.)
There’s no release of Bad Behavior this week, as no new bugs have been reported, and no new spammers have been blocked.
But there is a posting, because I am hard at work on a related project to identify and block more spammers before they can even send their first spam, and I need your help.
If you would like to help with this project, and you are running a high traffic blog getting a lot of blocked spam (or missed spam), you may qualify. E-mail me at badbots@ioerror.us with your blog address and an estimate of how much spam Bad Behavior blocks, and how much it misses, in any given day. If you’re only getting a small amount of spam, it’s probably not worth it; I’m looking for higher traffic sites.
You can also help by making a financial contribution. I develop Bad Behavior in my limited spare time, and every little bit allows me to devote more time to battling spammers.
When I released Bad Behavior 2, I noted that due to time constraints I was unable to complete everything on the roadmap. Most of that is because spammers have dramatically stepped up their activity in recent weeks and the new version provides greatly improved protection against their attacks. Part of it is that as an unpaid project, I can only devote so much spare time to it.
Now that Bad Behavior 2.0 has stabilized, it’s time to update the roadmap in preparation for the next minor (2.1) and major (3.0) releases.
Continue reading ‘Bad Behavior 2.1 and 3.0 Roadmap’
Bad Behavior 2.0.5 has been released to provide small bug fixes.
New in this release (since 2.0.4):
- A bug affecting MediaWiki and ExpressionEngine users, and possibly others, caused database errors to be thrown when a POST request was received. This has been fixed. (I thought I’d fixed this previously, but apparently not. This one should fix it for real.)
- A couple of additional spambots have been identified and blocked.
Download Bad Behavior now!
As always, if you find Bad Behavior valuable, please consider making a financial contribution. I develop Bad Behavior in my spare time, and every little bit means I have more spare time to devote to its development.
And don’t forget to subscribe to the RSS feed or the mailing list. (They’re the same content.)
Bad Behavior 2.0.4 has been released to provide small bug fixes.
New in this release (since 2.0.3):
- A bug affecting MediaWiki and ExpressionEngine users, and possibly others, caused database errors to be thrown when a POST request was received. This has been fixed.
- A confusing entry in the generic code, which was causing PHP warnings for people who mistakenly used it without changing it, has been altered. The section of code, which users of the generic code are expected to change, referred to a variable which did not exist, and users who failed to change the code for their particular installation received warnings.
- A part of the housekeeping code which optimizes Bad Behavior’s log table has been rescheduled to run in only one of 1000 blocked requests. Under a heavy spam attack this was running much too frequently at its old schedule of one in 25 blocked requests, causing at least one shared hosting provider to complain.
Download Bad Behavior now!
As always, if you find Bad Behavior valuable, please consider making a financial contribution. I develop Bad Behavior in my spare time, and every little bit means I have more spare time to devote to its development.
And don’t forget to subscribe to the RSS feed or the mailing list. (They’re the same content.)
Update: Due to some errors which creeped in, I’ve repacked the 2.0.4 release. If you already downloaded it and are having strange problems, please re-download it.