Synchronet Hack Log reported an attempt of FTP filename hacking with the name IMG01.EXE uploaded to many of the file directories 2 days ago on Saturday, June 13, 2020. These were the IP addresses it sent back to me:
197.219.106.232 -Mozambique - Africa/Maputo (Time Zone)
61.38.37.229 - South Korea - LG Dacom Corporation (ISP)
$ The Millionaire $
Was IMG01.EXE actually uploaded to those dirs or just an attempt? Activity like this is not uncommon!
---
â– Synchronet â– Realm of Dispair BBS - http://ephram.synchro.net:82
Was IMG01.EXE actually uploaded to those dirs or just an attempt?
Activity like this is not uncommon!
---
þ Synchronet þ Realm of Dispair BBS - http://ephram.synchro.net:82
Yes I found it in 3/4 of my directory library. Why send it several times for? Once should be efficient to land a virus on a Bbs as Sysops have told me in the past.
$ The Millionaire $
Synchronet Hack Log reported an attempt of FTP filename hacking with
the name IMG01.EXE uploaded to many of the file directories 2 days ago
on Saturday, June 13, 2020. These were the IP addresses it sent back to me:
197.219.106.232 -Mozambique - Africa/Maputo (Time Zone)
61.38.37.229 - South Korea - LG Dacom Corporation (ISP)
Yes I found it in 3/4 of my directory library.
Why send it several times for?
Once should be efficient to land a virus on a Bbs as Sysops have
told me in the past.
The Millionaire wrote to Digital Man <=-
Synchronet Hack Log reported an attempt of FTP filename hacking
with the name IMG01.EXE uploaded to many of the file directories
2 days ago on Saturday, June 13, 2020. These were the IP
addresses it sent back to me:
197.219.106.232 -Mozambique - Africa/Maputo (Time Zone)
61.38.37.229 - South Korea - LG Dacom Corporation (ISP)
The Millionaire wrote to Digital Man <=-
Synchronet Hack Log reported an attempt of FTP filename hacking
with the name IMG01.EXE uploaded to many of the file directories
2 days ago on Saturday, June 13, 2020. These were the IP
addresses it sent back to me:
197.219.106.232 -Mozambique - Africa/Maputo (Time Zone)
61.38.37.229 - South Korea - LG Dacom Corporation (ISP)
What was the name of the user(s) that did the uploading?
... Windows 3.1 - From the people who brought you EDLIN.
--- MultiMail/Linux v0.52
â– Synchronet â– Palantir BBS * palantirbbs.ddns.net * Pensacola, FL
Not all that uncommon of an event... Lots of hackers and assholes
out there in the big world.
What did you want DM to do about it? Why tell him this?
... Can you tell me how to get, how to get to Sesame Street?
--- MultiMail/Linux v0.52
â– Synchronet â– Palantir BBS * palantirbbs.ddns.net * Pensacola, FL
On 06-15-20 15:49, Rampage wrote to The Millionaire <=-
you need to add that filename to your sbbs/text/file.can...
you should also stop anonymous/guest users from uploading files...
They used the Guest account so there was no name.
The Millionaire wrote to Gamgee <=-
What was the name of the user(s) that did the uploading?
They used the Guest account so there was no name.
The Millionaire wrote to Gamgee <=-
Not all that uncommon of an event... Lots of hackers and assholes
out there in the big world.
What did you want DM to do about it? Why tell him this?
My Bbs is not even advertised or popular by any means so why
would they even pick on small potatoes for?
My Bbs is not even advertised or popular by any means so why would
they even pick on small potatoes for?
Re: Re: Hacking Attempt
By: The Millionaire to Gamgee on Tue Jun 16 2020 04:02:20
Gamgee>> What was the name of the user(s) that did the uploading?
They used the Guest account so there was no name.
that's all the name you need... it tells you they used your anonymous/guest account and that tells you your system is too open if you allow anonymous/guest to upload files... you need to close that door by disallowing them to
upload files... easy peasy...
Daryl Stout wrote to The Millionaire <=-
Synchronet Hack Log reported an attempt of FTP filename hacking with
the name IMG01.EXE uploaded to many of the file directories 2 days ago
on Saturday, June 13, 2020. These were the IP addresses it sent back to me:
197.219.106.232 -Mozambique - Africa/Maputo (Time Zone)
61.38.37.229 - South Korea - LG Dacom Corporation (ISP)
Added to the Twitlist. I also have Peerblock installed to block
various countries.
What did you want DM to do about it? Why tell him this?
My Bbs is not even advertised or popular by any means so why would they even pick on small potatoes for?
Not all that uncommon of an event... Lots of hackers and assholes
out there in the big world.
What did you want DM to do about it? Why tell him this?
My Bbs is not even advertised or popular by any means so why would they even pick on small potatoes for?
They used the Guest account so there was no name.
My Bbs is not even advertised or popular by any means so why would they even pick on small potatoes for?
My Bbs is not even advertised or popular by any means so why would
they even pick on small potatoes for?
you've been told several times, they are not looking at any lists or selecting any specific systems... you are not the target... ANY open/vulnerable system is the target for these bots...
so your next question is "how did they find me then?"... they simply war-dialed your IP in a huge block of other IPs...
Rampage wrote to calcmandan <=-/snip
if you want to allow TOR users to access your system, don't do this...
if you want to allow TOR users to access your system, don't do
this...
Added to the Twitlist. I also have Peerblock installed to block
various countries.
Would it be considered wise to add all tor exit nodes to these lists?
Daniel,
Added to the Twitlist. I also have Peerblock installed to block various countries.
Would it be considered wise to add all tor exit nodes to these lists?
I believe Peerblock is free, but to get a yearly subscription for
the lists is only $10. I think the lists are from iblocklist.com --
but I'm not sure.
I'm not sure if blocking the TOR connects is available offhand, but
if it is, one could probably activate it. I moved SyncTerm and
MultiMail (QWK) Mail to my laptop, so I don't have to work on the
BBS computer, unless I update the ham radio and weather data.
Daryl
I use
https://myip.ms/files/blacklist/general/full_blacklist_database.zip,
it's free ... unzip the list and add it to ip-silent.can ... I have a
php script that does it as a daily timed event but it would be easy to script it in js ... you could also use my coob.js for country blocking http://alleycat.synchro.net:81/dls/coob.js
I use https://myip.ms/files/blacklist/general/full_blacklist_database.zip, it's free ... unzip the list and add it to ip-silent.can ... I have a php script that does it as a daily timed event but it would be easy to script it in js ... you could also use my coob.js for country blocking http://alleycat.synchro.net:81/dls/coob.js
Interesting. Too bad we, as Sysops, have to worry about this.
I gather the list is rather big.
Daryl Stout wrote to calcmandan <=-
Daniel,
Added to the Twitlist. I also have Peerblock installed to block
various countries.
Would it be considered wise to add all tor exit nodes to these lists?
I believe Peerblock is free, but to get a yearly subscription for
the lists is only $10. I think the lists are from iblocklist.com --
but I'm not sure.
I'm not sure if blocking the TOR connects is available offhand, but
if it is, one could probably activate it. I moved SyncTerm and
MultiMail (QWK) Mail to my laptop, so I don't have to work on the
BBS computer, unless I update the ham radio and weather data.
Well, I don't own a BBS and still just a user. This doesn't mean my intentio isn't to run a board. I'm just exploring possibilities here. I wouldn't like block tor exit nodes at first. I'd not want to block any users who rely on t to provide their privacy.
But if none of my users were using tor and attack attempts were originating from TOR then I would definitely work to block them.
Daniel Traechin
Well, I don't own a BBS and still just a user. This doesn't mean my intentions isn't to run a board. I'm just exploring possibilities here.
I wouldn't likely block tor exit nodes at first. I'd not want to block
any users who rely on tor to provide their privacy.
But if none of my users were using tor and attack attempts were originating from TOR then I would definitely work to block them.
Daniel,Well said it is your home!
Well, I don't own a BBS and still just a user. This doesn't mean my intentions isn't to run a board. I'm just exploring possibilities here. I wouldn't likely block tor exit nodes at first. I'd not want to block any users who rely on tor to provide their privacy.
That's fine...all Sysops started as users.
But if none of my users were using tor and attack attempts were originating from TOR then I would definitely work to block them.
Now, unless there is a law enforcement subpeona for data (which there
has never been since I started my Sysoping nearly 30 years ago), or for rules violations (there have been those, and I've notified confirmed Visiting Sysops), their data is kept STRICTLY CONFIDENTIAL. When my late wife and Co-Sysop was alive, even she didn't have access to the data.
In short, what their life is outside the BBS, is THEIR BUSINESS. But, they're a guest in my home at logon, and I expect them to act accordingly. If they're not willing to do that, I don't want or need them as a user.
Daryl
... Alert: Scanner shows Sysop in the area. Look innocent!!
I use
https://myip.ms/files/blacklist/general/full_blacklist_database.zi
p, it's free ... unzip the list and add it to ip-silent.can ... I
have a php script that does it as a daily timed event but it would
be easy to script it in js ... you could also use my coob.js for
country blocking http://alleycat.synchro.net:81/dls/coob.js
Interesting. Too bad we, as Sysops, have to worry about this.
I gather the list is rather big.
full_blacklist_database.txt has just a few in there ... as of today 90,207 entries, but it parses quickly
Re: Re: Hacking Attempt
By: Mortifis to Daryl Stout on Fri Jun 19 2020 12:19 pm
I use
https://myip.ms/files/blacklist/general/full_blacklist_database.zi Mo>> p, it's free ... unzip the list and add it to ip-silent.can ... I Mo>> have a php script that does it as a daily timed event but it would Mo>> be easy to script it in js ... you could also use my coob.js for Mo>> country blocking http://alleycat.synchro.net:81/dls/coob.js
Interesting. Too bad we, as Sysops, have to worry about this.
I gather the list is rather big.
full_blacklist_database.txt has just a few in there ... as of today 90,207 entries, but it parses quickly
That blacklist that was listed, where is it from? I missed the first post...
But if none of my users were using tor and attack attempts were originating from TOR then I would definitely work to block them.
Now, unless there is a law enforcement subpeona for data (which there
has never been since I started my Sysoping nearly 30 years ago), or for rules violations (there have been those, and I've notified confirmed Visiting Sysops), their data is kept STRICTLY CONFIDENTIAL. When my late wife and Co-Sysop was alive, even she didn't have access to the data.
In short, what their life is outside the BBS, is THEIR BUSINESS. But, they're a guest in my home at logon, and I expect them to act accordingly. If they're not willing to do that, I don't want or need them as a user.
Daryl
https://myip.ms/files/blacklist/general/full_blacklist_database.zip
follow Blacklist / IP Database tab and select Download Latest Blacklist IP Addresses text file ... or follow the link above
Re: Re: Hacking Attempt
By: Mortifis to paulie420 on Sat Jun 20 2020 11:19 am
https://myip.ms/files/blacklist/general/full_blacklist_database.zip
follow Blacklist / IP Database tab and select Download Latest Blacklist IP Addresses text file ... or follow the link above
hey is there a limit to how many ip addresses in the blocklists synchronet can handle?
did you ever do tests to see if a very large list would slow down the system significantly?
Well said it is your home!
Re: Re: Hacking Attempt
By: Mortifis to paulie420 on Sat Jun 20 2020 11:19 am
https://myip.ms/files/blacklist/general/full_blacklist_database.zip
follow Blacklist / IP Database tab and select Download Latest Blacklis IP Addresses text file ... or follow the link above
hey is there a limit to how many ip addresses in the blocklists synchrone can handle?
did you ever do tests to see if a very large list would slow down the sys significantly?
No, it is a just a file line read/match so, no, there is no limit; sbbs does not read the file in as an object ... I have been using full_blacklist_datab for years, and, currently, with over 90,000 ips, I still have not seen any performance impact ... just sayin
Arelor wrote to calcmandan <=-
Re: Re: Hacking Attempt
By: calcmandan to Daryl Stout on Fri Jun 19 2020 06:21 am
Well, I don't own a BBS and still just a user. This doesn't mean my intentio isn't to run a board. I'm just exploring possibilities here. I wouldn't like block tor exit nodes at first. I'd not want to block any users who rely on t to provide their privacy.
But if none of my users were using tor and attack attempts were originating from TOR then I would definitely work to block them.
Daniel Traechin
I think that if you want to have darknet users in your board you should
be setting a hidden service. Set an i2p interface and tune the
connection rate down a bit. Enable manual account activation for new users. I doubt most boards get many new users anyway.
Daryl Stout wrote to calcmandan <=-
That's fine...all Sysops started as users.
Now, unless there is a law enforcement subpeona for data (which there has never been since I started my Sysoping nearly 30 years ago), or for rules violations (there have been those, and I've notified confirmed Visiting Sysops), their data is kept STRICTLY CONFIDENTIAL. When my
late wife and Co-Sysop was alive, even she didn't have access to the
data.
In short, what their life is outside the BBS, is THEIR BUSINESS. But, they're a guest in my home at logon, and I expect them to act
accordingly. If they're not willing to do that, I don't want or need
them as a user.
Not sure if I would be comfortable setting up a hidden service. I avoid TOR like a plague.
Daniel Traechin
Re: Re: ipblocklist // hacking attemp
By: Mortifis to MRO on Sat Jun 20 2020 02:02 pm
Re: Re: Hacking Attempt
By: Mortifis to paulie420 on Sat Jun 20 2020 11:19 am
https://myip.ms/files/blacklist/general/full_blacklist_database.zip
follow Blacklist / IP Database tab and select Download Latest Blacklis IP Addresses text file ... or follow the link above
hey is there a limit to how many ip addresses in the blocklists synchrone can handle?
did you ever do tests to see if a very large list would slow down the sys significantly?
No, it is a just a file line read/match so, no, there is no limit; sbbs does not read the file in as an object ... I have been using full_blacklist_datab for years, and, currently, with over 90,000 ips, I still have not seen any performance impact ... just sayin
my ip blocklists are huge too. i'm just curious if there is a limit to how many synchronet can handle before it slows down or barfs
Re: Re: Hacking Attempt
By: calcmandan to Arelor on Sat Jun 20 2020 07:43 pm
Not sure if I would be comfortable setting up a hidden service. I avoid TOR like a plague.
Daniel Traechin
I spend a lot of time in different darknets and you don't find more psychos in them than on the rest of the Internet. If I were
to set a hidden service I would consider i2p first though, because I think it is a bit more flexible when dealing with things
such as telnet.
That's fine...all Sysops started as users.
Awwwwww
I'm more concerned that a TOR bbs user having nefarious goals such as hacking. I would be more concerned of drawing law enforcement subpoenas
by running an exit node than running a hidden service. After all, a
small BBS running on a theme of HAM and Aviation isn't on the FBI's priority list as a potential hive of illegal activity. I think they're looking for drug bazaars and sites catering to those who like jr loungeware.
I'm totally with you. Do BBS's still fall victim to members who upload malware or illegal files? I've seen spatterings of it here and there
but only for boards who enable web interfaces and anonymous uploading where bots do the deed.
Back in the day, I know some boards fell victims to these activities.
One bbs I co-sysop'd on got the michelangelo virus. Not only did it
effect all the files in his hand picked file section, but it also
effected all his files as well as on the floppy. I believe it even
wrote itself to the drive's mbr.
I don't know where this comes from, but just in case you are arguing
that people should not use Tor to connect to your BBS because they have nothing to hide from you or because using Tor to access your board is aggressive in nature:
I don't know where this comes from, but just in case you are arguing that people should not use Tor to connect to your BBS because they have nothing to hide from you or because using Tor t
access your board is aggressive in nature:
I don't care where they logon from. If they can't get past the CAPTCHA string, which changes every 5 minutes around the
clock, they won't get
any further. I also changed the SSH and QOTD ports to non-conventional values, as folks were slamming them. Verified Users In Good Standing can contact me on the BBS if they want that info.
What a caller does outside my BBS is their business, but they're a guest in my home at logon. If they don't want to act civil, I don't want them.
I equate that to the late Paul "Bear" Bryant, long time football coach
at Alabama. He said "I don't care if this player knows the playbook inside and out, backwards and forwards, word for word. If he isn't going to go to class and keep his grades up, and if he's going t
get into trouble with
the law, I don't want him".
Daryl
... This tagline is freeware; future support is unavailable.
Randy Stiles wrote to Daryl Stout <=-
Well said it is your home!
Well said it is your home!
I always hated that analogy. It's not your home, it's a service
accessible to external users. Do you leave your front door wide open
and allow anyone who follows your rules inside?
If I recall correctly, you need to set the access ars to:
REST NOT G
Re: Re: Hacking Attempt
By: Mortifis to paulie420 on Sat Jun 20 2020 11:19 am
https://myip.ms/files/blacklist/general/full_blacklist_database.zip
follow Blacklist / IP Database tab and select Download Latest Blacklist IP Addresses text file ... or follow the link above
hey is there a limit to how many ip addresses in the blocklists synchronet can handle?
did you ever do tests to see if a very large list would slow down the system significantly?
Randy Stiles wrote to Daryl Stout <=-
Well said it is your home!
I always hated that analogy. It's not your home, it's a service
accessible to external users. Do you leave your front door wide open
and allow anyone who follows your rules inside?
I don't like that analogy either. I never even thought of that until severa years ago when I started seeing people mention that analogy here. I agree i an online service accessible to external users. It's different from letting guests into your house. And it would be the same whether your BBS is hosted your house or on a server in an office somewhere, or in the cloud, etc..
On 06-21-20 11:36, Nightfox wrote to poindexter FORTRAN <=-
I don't like that analogy either. I never even thought of that until several years ago when I started seeing people mention that analogy
here. I agree it's an online service accessible to external users.
It's different from letting guests into your house. And it would be
the same whether your BBS is hosted in your house or on a server in an office somewhere, or in the cloud, etc..
Well said it is your home!
I always hated that analogy.
It's not your home, it's a service accessible to external users.
Do you leave your front door wide open and allow anyone who follows
your rules inside?
Well said it is your home!
I always hated that analogy. It's not your home, it's a service
accessible to external users. Do you leave your front door wide open
and allow anyone who follows your rules inside?
Rampage wrote to poindexter FORTRAN <=-
around these parts, kinda yeah... as long as they provide credentials
on initial visit... but we are out in the country and leaving the doors open/unlocked has been quite common for decades... i guess we're a
little more friendly out here in the country than in citified
residential areas... but it also depends on the level and types of
crime in one's area, too...
Daryl Stout wrote to poindexter FORTRAN <=-
In the publication "Ham Radio For Dummies", written by H. Ward
Silver, N0AX, he notes that those coming to an examiners residence to
take the license exam (3 examiners are required to give it), that "Remember...you are a Guest in someone's home, so act accordingly".
I've been involved in ham radio for nearly 30 years, and have been accredited to give exams since 2007.
Does my simple, PIA (Private internet access) VPN offer any decent protection from people
knowing 'who i am' if they wanted to look?
I simply bought a year of PIA and use it on all my connections out of my house... but I stil
use a TAILS USB if I need to be really private. TOR and TAILS...
But, how protected am I on my PIA VPN??
Daryl Stout wrote to poindexter FORTRAN <=-
In the publication "Ham Radio For Dummies", written by H. Ward Silver, N0AX, he notes that those coming to an examiners residence to take the license exam (3 examiners are required to give it), that "Remember...you are a Guest in someone's home, so act accordingly". I've been involved in ham radio for nearly 30 years, and have been accredited to give exams since 2007.
Yes - that is, literally, someone's HOME, so the analogy holds up.
... Do you have access to your previous configuration?
paulie420 wrote to calcmandan <=-
Re: Re: Hacking Attempt
By: calcmandan to Arelor on Sat Jun 20 2020 07:43 pm
Not sure if I would be comfortable setting up a hidden service. I avoid TOR like a plague.
Why? Do you use a VPN?
197.219.106.232 -Mozambique - Africa/Maputo (Time Zone)
61.38.37.229 - South Korea - LG Dacom Corporation (ISP)
Added to the Twitlist. I also have Peerblock installed to block
various countries.
Would it be considered wise to add all tor exit nodes to these lists?
Back in the day, I know some boards fell victims to these activities.
One bbs I co-sysop'd on got the michelangelo virus. Not only did it
effect all the files in his hand picked file section, but it also
effected all his files as well as on the floppy. I believe it even
wrote itself to the drive's mbr.
| Sysop: | Chris Crash |
|---|---|
| Location: | Huntington Beach, CA. |
| Users: | 578 |
| Nodes: | 8 (0 / 8) |
| Uptime: | 29:44:44 |
| Calls: | 10,736 |
| Calls today: | 1 |
| Files: | 5 |
| Messages: | 443,197 |
| Posted today: | 1 |