Waraxe IT Security Portal

oprime2001 · Beginner

I had a random user JackFromWales4u2 register on one of my phpnuke sites. At first I was annoyed at the random registration, but then paranoia took hold. I checked the logs for any obvious or glaring exploits, but I did not see anything.

I then checked the various phpnuke security sites. I was surprised to see that JackFromWales4u2 was also the latest signup at a forum moderator's site.

I then ran a google search on JackFromWales4u2, and google returned 18600 Shocked

hits!

From a random check of the various google hits, it seems that JackFromWales4u2 has been very busy with a great number of registrations at these various phpnuke and phpbb sites within a span of a couple of days -- September 1-2, 2004.

Now this screams of an exploit/vulnerability! Is there a script or exploit/vulnerability that is out in the wild that is yet unpatched?

Or am I just being paranoid here?
p.s. you might want to check your own phpnuke sites to see if you've had a visit from JackFromWales4u2, too.

SteX · Advanced user

oprime2001 >>> 1,470 results Laughing

I dont think that that is bot,because every member must click on activation link (in mail)..Try contact him,maybe he is just a computer freak Laughing

oprime2001 · Beginner

But if you take a look at the google hits for oprime2001, most of the hits are on a couple of English sites -- mostly NukeCops, ravenphpscripts and a couple of other phpnuke-related sites.

In contrast, the google search for JackFromWales4u2 returns (now) 24,400 hits over numerous (hundreds? thousands?) different sites using various different languages on all kinds of topics. Furthermore, most of the google results are for registration/profile info -- not regular postings.

What is more disconcerting is what you brought up -- that

bima · Regular user

see :

http://www.securityfocus.com/archive/1/374110/2004-09-03/2004-09-09/0

the POST method more nice to check the HTTP respons of the target.

the GET method more difficult to parsing the HTTP respons.

so someone now can write a little script to add user admin to the phpnuke
with more powerfull parsing of target's HTTP respons !!!

Laughing

SteX · Advanced user

Thats exploits can only add or del admin account..
We are talking about user account..

bima · Regular user

waraxe · Site admin

What can i say, is:

1. PhpBB and PhpNuke registration is complete (activated) after
activation email reply. It's not hard to write script or program, which
first does google search for nuke and phpbb, then registers at all the
sites, next logs in to pop3/imap account and retrieves all the emails,
then parses them and finally activates all the accounts.
Only problem i see, is that "turing number" stuff, which is meant to
protect against automated clients (bots). If that image is not enough
"fuzzy" (like in the case of the most nuke installations), then OCR
software can be used and then nothing can stop automated registrations.

2. What's the goal for doing such "spamming"? One reason can be
"googlespam" for trying to elevate some website's pagerank.
But as far as i know, google is allready aware of such attempts and
this kind of "links" does not count for pagerank.

shmk · Active user

oprime2001 · Beginner