Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Botspam apocalypse

memex.marginalia.nu

Post reply on HN
Print view View original

271–280 of 358 posts

Re: Botspam apocalypse

#271

Post by bombcar »

SyneRyder wrote: post #165

Really glad to see someone finally talking about this. Does anyone know what's going on with that "Duke de Montosier" spam botnet? It accounts for more than half of the botspam attacks on my sites, and I can't find anyone talking about it online anywhere, except one tweet dating back to mid-2021. It's identifiable by several short phrases that it posts: Duke de Montosier for Countess Louise of Savoy Testaru. Best kno…

I suspect some of these are "bots sold for hire" where they make money selling the bot to people, many of whom don't know how to use it and run it with the default config.

I've found spam email that certainly is the above, because it has things like PUT_LINK_TO_STORE_HERE and other variables that obviously weren't updated in the config file.

Re: Botspam apocalypse

#272

Post by bombcar »

Suzuran wrote: post #201
Lex-2008 wrote: post #174

Earlier quoted context omitted.

re: someone was unable to get past that captcha - this reminded me a story I heard back in ICQ times about some human who couldn't pass anti-bot question: "What planet do we live on?"

I remember a friend's con-group forums who had an issue along these lines - the anti-bot question was "What is the brightest thing in the sky at noon?" the expected answer was "the sun", but some guy got stuck because he was answering "Sol". Since they had an IRC channel the issue was relatively quickly resolved, but it was an in-joke for some time.

The key takeaway is that if you have a second line of communication, humans can use it but bots won't - "Issues registering? Contact someemail or see us on IRC/Discord" can do wonders.

Re: Botspam apocalypse

#273

Post by SyneRyder »

marginalia_nu wrote: post #262
SyneRyder wrote: post #165

Really glad to see someone finally talking about this. Does anyone know what's going on with that "Duke de Montosier" spam botnet? It accounts for more than half of the botspam attacks on my sites, and I can't find anyone talking about it online anywhere, except one tweet dating back to mid-2021. It's identifiable by several short phrases that it posts: Duke de Montosier for Countess Louise of Savoy Testaru. Best kno…

How very numbers station of them. I've seen it suggested that botnets use comment fields for command and control, maybe something like that?

My theory for the phrases above is that they're a "unique seed" used to identify sites that are easily compromised. Do a web search, find a website filled with "Duke de Montosier" comments - bingo, you've identified an easy website to target with your backlink comment spam. Or, more maliciously, a website that is easy to thoroughly compromise with vulnerabilities. But that's just my current theory.

Here's the one tweet I found in Swedish about the comment spam botnet, and it dates back to February 2021. She's the only person I could find who has mentioned it in public. Or maybe my search skills are failing me.

https://twitter.com/aureliagu/status/1357368329573400578

Re: Botspam apocalypse

#274

Post by pphysch »

The only real solution to the abuse of anonymous protocols is to stop using anonymous protocols and use protocols where clients can be held accountable. But that's politically nonviable in the West.

Re: Botspam apocalypse

#275

Post by [deleted] »

boredumb wrote: post #249

I get a ton of spam from my contact me pages even with a captcha in place, i've been experimenting with loading an initial dummy form and replacing it within a few seconds of loading to the real deal which seems to have cut down on bots submitting stuff. Rate limit everything you can and use a captcha where acceptable, there are also a load of public IP and email blacklists that you can use to run a quick check. Work…

[deleted]

Re: Botspam apocalypse

#276

Post by superkuh »

Avamander wrote: post #108

It's annoying for sure. I deal with abuse at a large scale. I'd recommend: - Rate-limit everything, absolutely everything. Set sane limits. - Rate-limit POST requests harder. Preferably dynamically based on geoip. - Rate-limit login and comment POST requests even harder. Ban IPs that exceed the amount. - Require TLS. Drop TLSv1.0 and TLSv1.1. Bots certainly break. - Require SNI. Do not reply without SNI (nginx has 44…

> Require TLS. Drop TLSv1.0 and TLSv1.1. Bots certainly break.

So will people who run older computers with older software. But I guess people who don't have money don't matter for commercial websites so screw 'em.

Re: Botspam apocalypse

#277

Post by eropple »

bluedino wrote: post #214
jart wrote: post #45

Earlier quoted context omitted.

> it costs 10 bux to register an account, if you're a nuisance your account is banned and you pay 10bux to get back on. You've highlighted its biggest tradeoff which is that it creates an economic incentive to ban people. The only way to make more money, is to have more rules and culture for ostracizing people. It would have been smarter of Something Awful (since that's the site we're talking about) to charge $4/mont…

You used to have to really, really try to get banned or even probated on SA, now it doesn't take much at all.

I can't remember the last time I saw a ban on SA that wasn't after a string of "stop trashing discussion" probes--sometimes in the dozens--or wasn't some flavor of FYAD-escapee bigot or death-threat-spewing weirdo. Even extremely tedious, thread-killing arguers will often be left alone unless a IK is ignored when they say "drop it" or whatever, and that's usually just a sixer.

There are people who get really mad that they eat probes for, say, misgendering trans people, and I for one would like those people to be madder still. And preferably no longer on the site.

Re: Botspam apocalypse

#278

Post by Kalium »

superkuh wrote: post #276
Avamander wrote: post #108

It's annoying for sure. I deal with abuse at a large scale. I'd recommend: - Rate-limit everything, absolutely everything. Set sane limits. - Rate-limit POST requests harder. Preferably dynamically based on geoip. - Rate-limit login and comment POST requests even harder. Ban IPs that exceed the amount. - Require TLS. Drop TLSv1.0 and TLSv1.1. Bots certainly break. - Require SNI. Do not reply without SNI (nginx has 44…

> Require TLS. Drop TLSv1.0 and TLSv1.1. Bots certainly break. So will people who run older computers with older software. But I guess people who don't have money don't matter for commercial websites so screw 'em.

Anything that got a significant update in the past ten to twelve years will support TLS 1.2. The window of systems that would support 1.1 but not 1.2 is pretty small. You have to go all the way back to IE on Windows XP before a lack of 1.2 support becomes an issue.

So, yeah. You're absolutely right. In a lot of cases the loss of revenue from users with severely outdated software will be less than the cost decease of cutting spam and abuse.

This gets back to an old question - to what degree should legacy systems be supported and at what level of expense? There's no one easy answer that works for everyone.

Re: Botspam apocalypse

#279

Post by z3t4 »

My trick is to have one field that should always be blank and one field that should always have an value, this stops all automated bots. No "CAPTCHA" needed.

Re: Botspam apocalypse

#280

Post by annoyingnoob »

CodeSgt wrote: post #222
Avamander wrote: post #108

It's annoying for sure. I deal with abuse at a large scale. I'd recommend: - Rate-limit everything, absolutely everything. Set sane limits. - Rate-limit POST requests harder. Preferably dynamically based on geoip. - Rate-limit login and comment POST requests even harder. Ban IPs that exceed the amount. - Require TLS. Drop TLSv1.0 and TLSv1.1. Bots certainly break. - Require SNI. Do not reply without SNI (nginx has 44…

> Rate-limit login and comment POST requests even harder. Ban IPs that exceed the amount Don't ban IPs. Or if you do, let the ban expire relatively quickly (days/weeks, not months/years).

I ban IPs from small data centers all the time. For my purposes there is no need to support traffic from small hosting providers that are everywhere all over the world. I do not tend to ban the IPs of commercial ISPs that provide service to end users.
Post reply on HN