Spam attack in blogs
My system crashed today. It was a good crash: mysql went really down, bind was the following to fall (I use mysql-dlz) and even cron and kernel exploted.
While I was trying to understand what happened, I reboot and it took ages to start. Even "top" was painful slow, and… wow! I got 46.0 load just 1 minute later!
PHP was to blame. I narrowed it down and it seems a big spammer "felt in love" with one of my websites (which runs a blog), and was (and still is) sending a LOT of fake spam requests to the site every second. That collapsed my web server, as apache starts php (in cgi-suexec'd mode) and the blog has to send a webpage (querying mysql in its way) to the spammer.
So, mod_security is a good toy, and this:
> SecFilterSelective HTTP_Referer ".bigbig.com" "nolog"
seems to be an effective way to get rid of that particular spammer. This stops the attack before php is launched and my system runs now at 0.3. I'm still being hit by that spammer, but it makes no harm now. I've also added some other common rules like "penis", "enlarge", "cialis" and so on, so I hope a great % of the spam will be off.
The question… do you know
a) a way to live-update mod_security from maybe an online source (something like spam blacklists postfix uses).
b) a better way to deal with blog spammers?
I can take the b2evo spammer list and transformate it into SecFilterSelective things by hand, but maybe there is some automated way to do this, or a better solution for the problem.
Anyway, my system seems to be more stable now. Hope your websites don't suffer from this!
9 Replies
@fernandonajer:
I've also added some other common rules like "penis", "enlarge", "cialis" and so on, so I hope a great % of the spam will be off.
It's a good thing caker doesn't block words like that on this board, or we wouldn't have been able to read your post!
@fernandonajer:
"cialis"
Don't hate on oldos!
(i name my webservers after ED drugs, cialis.oldos.org is my current incarnation)
@Xan:
It's a good thing caker doesn't block words like that on this board, or we wouldn't have been able to read your post!
What Jay says can be a problem if he ever link my website from his… You couldn't reach my website from his, but if you navigate somewhere else or close the browser and then load mine it would work.
SecFilterSelective HTTP_Forwarded ".+" log,status:403
SecFilterSelective HTTP_Via ".+" log,status:403
SecFilterSelective HTTP_Proxy-Connection ".+" log,status:403
SecFilterSelective HTTP_X-Forwarded-For ".+" log,status:403
SecFilterSelective HTTP_X-BlueCoat-Via ".+" log,status:403
Set inside of a properly-defined location block it's proven to be pretty effective.
But it depends on how you implement it. You could first use a directive that would allow all requests other than those making a comment post:
SecFilterSelective REQUEST_URI "!/path/to/script\.php\?.*argtomatch=" allow
Then add a directive to allow requests from authenticated users by checking for the appropriate values in COOKIESNAMES, along with one to check the HTTPReferer to make sure that the request comes from your domain/site if the cookies aren't present.
Edit: These are the rules that I use for wordpress:
SecFilterSelective REQUEST_URI "!wp-comments-post\.php" allow
SecFilterSelective COOKIES_NAMES "wordpresspass_.*" allow
SecFilterSelective HTTP_Referer "!blog.domain/folder" nolog,redirect:http://blog.main.page/
Add the proxy matching rules after something like these and you should be good to go.
@fernandonajer:
a) a way to live-update modsecurity from maybe an online source (something like spam blacklists postfix uses). Well, I've played around with one at
~~[http://www.gotroot.com/downloads/ftp/mod security/rules.conf" target="blank"> ](http://www.gotroot.com/downloads/ftp/mo … rules.conf">http://www.gotroot.com/downloads/ftp/modsecurity/rules.conf ](, however the site's giving me 500s at present.
Kenny
Say you let people post a name, a website, and a comment. In your code, name those fields something odd… I used Spanish. nombre, sitio, commentario.
Now, add a field called "name." Label it "Leave blank", just in case somebody sees it. Hide it with css (style="display:none"). In the submission script, if that hidden field is filled out, reject the post.
I've been using this since March, and not ONE bot has managed to spam my comments. Not one.