Security Questions

[theprofessional]

Hello,

I am most impressed w/Vbulletin's features and relative cheapness.

I wondered if someone could take the time to answer some serious security concerns I need addressing before buying a licence given some rather bad experiences w/other such boards.

(1) Is it possible to ban particular ISPs rather than just IPs? From bitter experience I know that banning IPs alone is totally ineffective. IPs are rarely static and can easily be spoofed, making IP banning pointless. If the board itself does not come with these feature, can I write an additional script to do so?

(2) Is it possible to prevent a banned user even from viewing the board in the fist place?

(3) Does the script provide me with the ability to see if attempts at hacks are being made (some kind of hacklog) and see, for example, if private forums are being breached and by who (ie. storing the IPs).

(4) Is it possible to record the IP which at which a membership was registered and the IP from which posts are made? This way it is possible to detect malicious users more easily. For example, a banned user can get someone else to register for them at an unbanned IP and then use a different IP to post from.

(5) I want a board which is totally secure. If I find that the board has been breached will Vbulletin remedy the situation or else refund me?

I thank you in advance for taking the time to answer my questions.

Yours sincerely,

George

[tubedogg]

1) There is no way to ban a particular ISP, either in vBulletin or in anything else. How would you do it? The user doesn't send out a "I'm on AOL" flag or whatever. The best you can do is ban that ISP's range of IPs.

2) Yes. You can move users to a group of banned users and disallow that group from doing anything including view the forums.

3) No there is no hacklog. You would need to rely on your webserver's logs for that.

4) The IP a user uses when registering is recorded. I am unsure if that is saved indefinitely, but I know that the IP that a user uses to post is also recorded.

5) We cannot offer any refunds due to the visible source nature of the product. If you come across any security problems and notify us of them we will endeavor to fix them as soon as possible and release a fix to all registered members.

[theprofessional]

Thx for replying.

Well if u log the posters IP then u can use a program like visualroute to trace that persons ISP and then ban the ISP.

I know ppl who have created their own scripts that allow this.

I can't write an entire board, but I could do perhaps add a script to it, modifying it. Is there no way to do this then?

[Steve_S]

I have a few very small local ISPs banned. arin.net and then you ban the entire range of IPs that this ISP owns. Not perfect but the best that can be done.

Who's On line lets Admins/Super Mods see the IPs of members and guests.

The Admin of vB let's you see all the IPs a member ever used + a lookup and do a fast search to see if other members use the same ISP This is a powerfull tool

The IP of each poster may be displayed in the post so that other members can see it.

HTH

[theprofessional]

Steve,

Thx for your reply.

The ability to see at a glance all IPs a user has used as well as checking if other users are on those IPs (ie. user more than one username) sounds very useful indeed.

Would it be possible for me tho to write some sort of additional script to ban partic ISPs and integrate it?

Thx a lot for your help!

[Adrian Ko]

One security measure I'd like to recommend to the fine vBulletin team.

After evaluating five or so bulletin board systems, so far, vBulletin is in the lead for me and my staff, so we're gearing up for a purchase.

One thing I would very much like to see but do not see any software doing this is to go beyond just numeric IP address lookup. Sure, we can ban 234.212.*.* or whatever, or we can even use a subnet mask. But what about doing an NSlookup on someone who is posting, and factoring a slight additional layer of intelligence there?

Being only able to ban by numeric IP is highly restrictive. Let me give you an example. If you ban an abuser who uses AOL, and ban using the first 3 octets, the abuser reconnects, gets a new dynamic IP address from DHCP and bypasses your ban because their DHCP range covers the last two octets. But if you ban the first 2 octets to be more comprehensive, you end up banning so many innocent users - including those who live geographically nowhere near the abuser, even those in different States and counties!

The NSLookup information is valuable because it gives you an idea of the geographical range the abuser is connecting from. Banning based on a text string e.g. *rochester.ny* would help tremendously - that's how they do it on IRC.

Just a humble suggestion. I praise vBulletin's team for being innovative and I trust that they'll take this under serious consideration - or implement something better than what I've typed here!

[theprofessional]

Yup that's EXACTLY what I meant.

I personally have had EXACTLY those probs on the board I use at present. To block the malicious user I have to ban innocents too. It has caused no end of aggravation for all concerned. The malicious user in question is loving it and continually finding ways around the IP block.

Other than that I too and very impressed with Vbullein. Maybe we should both withhold our cash until they change it

[Goldfinger]

you can ban by as many octets as you please. like for explain.. on my board this guy was spamming like crazy and his i.p. was 234.234.212.121 (example ip) so i just put.. 234.234 in the banned ip section of my options and the "abuser" than im'ed me on aim complaining and asking why he was banned this works and if this is what you guys wanted that it is already included . And from my experiences vB is the best bulletin board out there.

[theprofessional]

but that bans lots of innocent users too

Ie. all the innocents that have IPs: 234.234.XXX

For example, if a malicious user is an AOL, u can only get rid of him by banning all AOL'ers, which isn't very helpful!

[mcncyo]

aol use proxy servers. so the only way to ban them is ban the proxy servers which ban alot of people. It is a no win soultion.

[WizyWyg]

There is no "all" solution to banning. YOU can't exactly ban on "domain" name because there are drawbacks on it. So you have to rely on banning ip addresses. But since dial=ups give you a new ip everytime you log on. ITs a no win situation, and until everyone has broadband access, you'll just have to deal with the problem. But at least you'll have some peace of mind.

[Goldfinger]

maybe if you were to send that user a cookie. Banning him from the board. Which would work just until he resets cookies .

[Adrian Ko]

I'd suppose, but consider this

It used to be that you could do an NSLOOKUP on an AOL address (A.O.L. = Army Of Lamers) and get a geographical location. I suppose now you see "spider-tj034.proxy.aol.com".

But AOL isn't the only problem.

There are some who try to terrorize bulletin board sites from public library terminals, etc.

All I'm saying is that it would be *nice* to be able to do a ban by first doing an NSLOOKUP, capturing that information, comparing it against a text filter, and be done with it.

[WizyWyg]

Well library terminals and school related terminals have fix ip's (or they run on a proxy server so you can just ban their proxy)

a NS look up is not going to do any good because all you will get is their "domain" registratin information. AOL will alwasy give you their "headquarters' address. I could log in from Hawaii on AOL< but grab an IP that is actually hosted in Alabama. That's just how their systems work.

How will an nslookup work for banning? That's what Im failing ot understand.

Ban the ip addresses or the entire block. You dont need to know who is hosting it unless you want to make a complaint against the user.

[Adrian Ko]

An even BETTER idea

Okay, you just gave me an even better idea.


What if the forum system bans the proxy server - sure, this bans a lot more innocent users - HOWEVER, it allows trusted registered users that you manually indicate are trusted? This is similar to a Router statement "DENY ALL but PERMIT so-and-so."

Since user ID registrationis automatic, deleting an abuser's ID or changing his password merely means he'll log back on under a different ID and harass users. However, add a layer of logic to protect the whole community, as follows:

1. User is posting
2. Is the User's IP address within a site-ban range? (e.g. 142.34.*.*)
3. If so, is the user ID on the list of "trusted" community members?
4. If (3) is "Yes" then allow the user to post. If "No" then shoot off a default e-mail explaining that there is an abuser on the same network as the user, and that a Moderator will look into the situation more closely; in the meantime, please feel free to operate in a "read-only" mode.

Would you consider that as a solution?