theiving members, major bandwidth!

[xenigo]

My eyes almost popped out of my head this morning when I checked my stats, and saw 39 gigs sucked today alone. 5.5 gigs / day is the average for previous days. It appears someone posted a l*/p*. I reissued him a new pass and told him not to share his l*/p* with anyone.

I'll probably end up canning his account, but MAN this pisses me off! I was looking through the stats on the referrers and I couldn't see where the traffic was being taken from. It just appeared as if he was linking directly the l*/p*, and people were hearding right into the site. Only 33 visits that I could see, but those 33 visits were spread evenly across all the pages on my site. I'm imagining most of those people were looking at each image.

I'm hoping changing his password fixes the bandwidth leak. Otherwise I really don't know what to do. I'll be installing Strongbox shortly I guess.

This freaks me out. I can't sleep.

[Trev]

You’re more lenient than I am, as I wouldn’t have re-issued the scumbag with a new password.

Plus from your stats showing even coverage across all the pages makes me think they could be hitting you with a site ripper/grabber.

I’d go with installing something like Strongbox sooner rather than later.

[EroticySteve]

Cybercrimes will become easier to prosecute at the Internet matures. We need to keep in mind that the Internet is still in it's infancy. There are so many open doors to crime that it's impossible to forecast exactly what will happen. Sorry to hear your woes. I wouldn't give him any more leeway.

[Peaches]

Aren't there several programs that will lock a u/p if it's used from more than X number of IPs?

[Inabon]

Originally Posted by Peaches

Aren't there several programs that will lock a u/p if it's used from more than X number of IPs?

yes and you can do a lot more server tricks.

but the best way is to have your mrtg always open and watch for spikes. then run to logs and start blocking ips.. then then then

hehe. lots of small quick steps.

[Trev]

Originally Posted by Peaches

Aren't there several programs that will lock a u/p if it's used from more than X number of IPs?

There are loads of programs that do this. Envisionext do the password trojan:

http://envisionextadult.com/documents.php?doc_id=7

[Vick]

Get Pennywize http://www.pennywize.com/

I've used it for many years

In fact I can't believe you are operating a site without password protection, did you just fall off the truck?

Way back when (97-00) I (and many others) used to purposely leak passwords to password trading sites, then change the landing page we set up and redirect all that traffic to other programs, it used to convert way back when, now it's all garbage

[gonzo]

Originally Posted by Vick

Get Pennywize http://www.pennywize.com/

I've used it for many years

In fact I can't believe you are operating a site without password protection, did you just fall off the truck?

Way back when (97-00) I (and many others) used to purposely leak passwords to password trading sites, then change the landing page we set up and redirect all that traffic to other programs, it used to convert way back when, now it's all garbage

Sound advice from Vick.
If you cant afford Pennywize you cant afford to be running a paysite.

Id refunded his money personally and locked him out. Hes gonna do the same thing again.

[Rolo]

Major bandwidth? 39GB is only a few dollars worth of bandwidth (ofcourse depending on what you are paying at your hosting provider ;-)) so nothing to loose sleep over. Get some kind of protection ex. http://www.proxypass.com/

[Raven]

We've used both I-Password and Pennywize for our personal pay sites....both worked well....

Sorry this happened to you.....but give him another password? Why?

[TheEnforcer]

Always heard wonder ful things about pennywise.

[Vick]

Psssss ...

Your member might not have leaked that access
With no protection on your site a script kiddie can run a "hack" program all day until they find a username/password that allow access.
There are bunches of sites that will post accesses gotten like that all day long. In some places that is a whoop-de-do big deal

In fact take a good look at your server stats, you can be getting hit all day long

Your password file is probably open to the world (depending on the permissions)


This is your lesson for today, to thank me please send money and traffic

[xenigo]

Originally Posted by Vick

Psssss ...

Your member might not have leaked that access
With no protection on your site a script kiddie can run a "hack" program all day until they find a username/password that allow access.
There are bunches of sites that will post accesses gotten like that all day long. In some places that is a whoop-de-do big deal

In fact take a good look at your server stats, you can be getting hit all day long

Your password file is probably open to the world (depending on the permissions)


This is your lesson for today, to thank me please send money and traffic

This member in particular DEFINITELY leaked his own password. I typed in the username / password combo into Google and a password trade site was the only result.

I guess I should be flattered that they wanted my shit, right?

[Nickatilynx]

Originally Posted by xenigo

This member in particular DEFINITELY leaked his own password. I typed in the username / password combo into Google and a password trade site was the only result.

I guess I should be flattered that they wanted my shit, right?

Lock him out

[Vick]

Originally Posted by xenigo

This member in particular DEFINITELY leaked his own password. I typed in the username / password combo into Google and a password trade site was the only result.

I guess I should be flattered that they wanted my shit, right?

No, most will take anything for free, please don't feel special because you were leaked

Now it is not necessarily so neophyte
If a script kiddie leaked the password to password trading sites would it be listed just the same?

Please listen when I post, the user may or MAY NOT HAVE leaked the pw
Do you know what a script kiddie is? Do you know how "hacking" software works? Do you know what permissions your password file are set to?

[xenigo]

Originally Posted by Vick

No, most will take anything for free, please don't feel special because you were leaked

Now it is not necessarily so neophyte
If a script kiddie leaked the password to password trading sites would it be listed just the same?

Please listen when I post, the user may or MAY NOT HAVE leaked the pw
Do you know what a script kiddie is? Do you know how "hacking" software works? Do you know what permissions your password file are set to?

I am listening. The password file is in a directory outside the permissions of the web directory. I don't think there's any way that could have been compromised. I believe it was simply a user that posted his password. It looks like that same user has posted the same l/p combo on other password sites.

[Vick]

Originally Posted by xenigo

I am listening. The password file is in a directory outside the permissions of the web directory. I don't think there's any way that could have been compromised. I believe it was simply a user that posted his password. It looks like that same user has posted the same l/p combo on other password sites.

One more time
That is possible
It is also possible someone ran a script that does nothing but try username/password combinations until they cracked an access
There are a few software programs that were built for nothing but hacking accesses to membership sites

When these acesses are compromied they often are posted to password sites

Another good thing that Pennywize does is limited the amount of time an IP can try to enter the site with wrong/random username/password combinations

I'm not taking the users side, I'm telling you it may have not been their fault
Especially if the username/password was something simple like apple/orange

[raymor]

Originally Posted by xenigo

I am listening. The password file is in a directory outside the permissions of the web directory. I don't think there's any way that could have been compromised. I believe it was simply a user that posted his password. It looks like that same user has posted the same l/p combo on other password sites.

Probably 30% of all PHP scripts used by webmasters have a security
hole that will allow an attacker to do exactly that. I see this happen all
the time. (The reason I see it is because I'm the guy webmasters call
for help when it does happen.) You CAN secure your password list
using any of several different methods, most of which involve using stronger encryption such as an MD5 hash. I wrote a page for the Strongbox
manual covering this tooic today, but I left it in the car and I'm on my way to
bed right now, so email me at support@bettercgi.com if you'd like to
loook that over. Strongbox would help you determine if the user himself
leaked the password or if the list was cracked by giving such information
as how many other usernames were compromised at around the same time.
If you have 1,000 members and only this password got posted, and if
this is a also a secure password (long enough, not based on an English word),
he probably gave it out. Onb the other hand, if many different passwords
were posted on the same day the list was probably cracked.
Another possibility is that a cracker got it using a dictionary attack.
If for example his username was "john" and his password was "password"
then the attacker probably guessed it using an automated guessing program
(called a dictionary attack). Definitely chnage the user's password and then
watch what happens with his username in the future.
We'll be standing by to install Strongbox whenever you're ready.

[sarettah]

Originally Posted by Vick

Please listen when I post, the user may or MAY NOT HAVE leaked the pw

Do you know what a script kiddie is?
Do you know how "hacking" software works?
Do you know what permissions your password file are set to?

Oh, I do I do I do.... Call on me please... Here, over here, I know it dammit !!!!!.........

[Rolo]

Originally Posted by xenigo

I guess I should be flattered that they wanted my shit, right?

Naaahh - when you can type in your site name on a random password trading board, and then have 100s of surfer requests to hack your site, then you are special - until then your site is just another 2 min. wanking session on the internet..

[Bhelliom]

Burn down his barns

[Nickatilynx]

Originally Posted by Bhelliom

Burn down his barns

Good thinking!!!

But maybe too Amish??

[DannyCox]

WOW! This sounds like threads posted back in 1998! Are we still doing "Remember when..."?

[Mike AI]

Originally Posted by DannyCox

WOW! This sounds like threads posted back in 1998! Are we still doing "Remember when..."?

Yeah only part that is missing is JoeE and CEN sponsoring the password site!!

[gonzo]

Originally Posted by Mike AI

Yeah only part that is missing is JoeE and CEN sponsoring the password site!!

Beware of being converted over from PPS to rev share!

[slavdogg]

Noah, stop posting and get http://www.pennywize.com/

[Nickatilynx]

Originally Posted by slavdogg

Noah, stop posting and get http://www.pennywize.com/

LOL