Thousands of Spammer PMs

[septimus]

One more followup: the script definitely goes looking through profiles -- my online.php file is filled with attempts to send PMs and also guest viewing users profiles. The spams also happened in alphabetical order, for whatever that's worth.

[ED195KW]

I'm getting hit with this right now, looks like it's up to about 'F', just turned off PM's and closed the board.

This is nasty, thanks for your help guys - I will use your db query septimus - I hope it;s sound!

[macrumors]

I'm getting hit with this right now, looks like it's up to about 'F', just turned off PM's and closed the board.

This is nasty, thanks for your help guys - I will use your db query septimus - I hope it;s sound!

The only problem with the db query is it changes it to a random password, which means you won't be able to identify these people afterward. It might make the private message spam cleanup harder.

arn

[Andy]

here's the basic code to find the users in your db with usernames==passwords.

Thank you macrumors for providing us with this code. I was able to quickly see how many of my users had the same password as their username.

I hope the vBulletin team adds a check for not allowing the username and password to be the same on version 3.7.3.

[septimus]

The only problem with the db query is it changes it to a random password, which means you won't be able to identify these people afterward. It might make the private message spam cleanup harder.
arn

Good point -- something to be aware of if you use that DB Query. In our case, we appeared to be lucky because all the PMs had one of just a handful of subject lines and we were able to search the PMs out that way.

In all honesty, we lucked out in that these spammers could have used certain methods (which I suppose I ought not fully lay out here) to make their deeds harder for admins to detect and hunt down.

[ED195KW]

I actually ran a query outputting all users with their passwords set to their usernames first, then ran your query to change their passwords. Jeez...there were a few of them...

[mister]

My forum got hit by this last Thursday, as well. 16000 spams, all from various users who hadn't been logged in in a while and had username==password.

Thanks for the script, macrumors.

[wtrk]

you should make it so that people cant pm till they get like 10 or 20 post, that will pretty much eliminate all pm spam by bots.

[Steve Machol]

Has anyone posted a suggestion yet to have vB check to make sure the username and password are not the same when someone registers or changes their password? If not, then please make this suggestion:

http://www.vbulletin.com/forum/forumdisplay.php?f=55

[macrumors]

you should make it so that people cant pm till they get like 10 or 20 post, that will pretty much eliminate all pm spam by bots.

Actually, it would not in this case. If you read above, these are people's legitimate accounts that have their passwords set as their username.

So, you would reduce it, but I had some long standing members with hundreds of posts who had their password = username.

Has anyone posted a suggestion yet to have vB check to make sure the username and password are not the same when someone registers or changes their password? If not, then please make this suggestion:

done.

arn

[Jason Dunn]

What an ugly problem. Where's the setting in vBulletin to disallow the password chosen to be the same as the username? And if there's not one...yikes! That's bad.

[PepiMK]

Thank you macrumors for reporting this and providing your script for a quick lookup of these accounts

I wrote a very quick hack to block logins for new users (they still try to register with username as password even though I added bold warning text to the register form): product file with plugin that, upon recognizing such a user logging in, does immediately log him off again and reset his password to random (septimus' method), offering them the link to reset their pw.

The error page looks ugly and I should've used a phrase instead of hard-coded text, but since I noticed users still signing up that way and boldly ignoring the bold warning text, some quick code was necessary; there's still time to update it to look nicer if Jelsoft shouldn't issue an update dealing with it themselves.

[M-D]

For anyone searching for a way to get all users that use their username as their password, use the following SQL:

SELECT userid, username 
FROM user 
WHERE password = MD5(CONCAT(MD5(username), salt)); 

Don't know how server intense this is, so you might want to add a LIMIT to this.

Reset passwords
In case you want to invalidate all passwords, you could use something like this:

UPDATE user
SET password = MD5(RAND())
WHERE password = MD5(CONCAT(MD5(username), salt)); 

This will not logout users that are already logged in!
Solution: before running the query above (the password reseting), first run this:

DELETE FROM session
WHERE userid IN (SELECT userid FROM user WHERE password = MD5(CONCAT(MD5(username), salt))); 

And run the reset password query directly after that.


Please note:
I don't know how server intense this is!
Also: create a back-up of you forum before running any of these query's.

It also might be good idea to disable the forum while you do this.


Edit:
Whoops, somebody already posted something like this.

[cheesegrits]

Has anyone posted a suggestion yet to have vB check to make sure the username and password are not the same when someone registers or changes their password? If not, then please make this suggestion:

http://www.vbulletin.com/forum/forumdisplay.php?f=55

Done.

http://www.vbulletin.com/forum/showthread.php?p=1599995#post1599995

Damn, I missed being post 1.6m by 5.

-- hugh

[creativepart]

here's the basic code to find the users in your db with usernames==passwords. I stripped out the destructive part of my code where I actually changed their password to something invalid. This will scan 5000 users and print the results. A more button lets you test the next 5000.

I tried using this and it wouldn't connect to my database... I have 7 or 8 databases on this server and it seemed to be looking for a database name, but when I modified the code to add $dbname = it still didn't work.

Any ideas?