Bot Herders Ready Attack Against phpBB Message Forums

[Vin DSL]

Source: http://www.informationweek.com/news/...=Breaking+News

The SANS Institute's Internet Storm Center noted that a bot going by the name "FuntKlakow" has registered on thousands of phpBB forums.

Botnet controllers may be planning a large-scale attack against message forums, TechWeb has learned...

"We might be chasing a ghost here but it's always good to be on the lookout for something like this," wrote Sachs in an alert on the ISC site Sunday...

A Google search for "FuntKlakow" suggested that the bot may have created accounts on more than 36,000 forums. Some of the forums show messages such as "Oh, how nice" and "Wow, I didn't think of that."

[Ron]

Quite a large number of registrations lately, mostly coming from China IPs. I have CAPTHCA enabled, so either they've broken CAPTHCA or they have a boatload of 50c a day workers registering on forums and posting on forums.

I believe that the posters may be humans because I've enabled some non-standard phpbb tactics that they overcome as well. Either that or they have a flexcible bot that they can assign sepecial attributes to for just my site, and that wouldn't seem very time efficient to me. But what do I know?

[Vin DSL]

Source: http://area51.phpbb.com/phpBB/viewto...d=&f=6&t=22880

Keep and eye out for cepelin and budowa_cepa.

They are playing the same game.

FuntKlakow, Cepelin and perhaps budowa_cepa are people you don't want on your messageboard.

You can (I did):
Delete these users, and Disallow their names
Username: FuntKlakow
Username: Cepelin
(budowa_cepa did not hit my board)

Disallow their email addresses
FuntKlakow Email:
funtklakow@socialinfohub.com
Cepelin Email:
speluna@poczta.onet.pl

Disallow their IP addresses
FuntKlakow IP Address:
212.186.84.12
(Cepelin IP Address not yet posted here)

And verify that you have visual confirmation enabled.

I also noticed that I had a new Style called FI Black. I am certain I didn't install it. I deleted it.

As for FI Black. I believe a while back there was an exploit where they would install that style. What version are you using? Sounds like you may be using an older version that has been hacked.

[Vin DSL]

I just Google'd 'FuntKlakow'... 270,000 results...

http://www.google.com/search?&q=FuntKlakow