UBB.threads PHP Forum Software Community Forums UBB.threads 6 Version 6 Support Site under some sort of attack???

I'm an admin for our UBB Threads forums.

I discovered an apparent problem with our Users table and posted a thread about it here:

https://www.ubbcentral.com/forums/ubbthreads.php/ubb/showflat/Number/184614/page/1#Post184614

However, since that time, I've been copying UNCONFIRMED user records to a research table before they get automatically deleted and I thinks I've uncovered some commonalities that causes me some sort of concern that we may be under some sort of attack, or something nefarious may be happening.

Since 5/24/07, there have been 28 users register, but then fail to confirm the new ID. By our standards that is a LOT.
The VAST majority of all these unconfirmed users report having russian email addresses.
There are only 4 or 5 IP address that account for all 28 of these registrations.
In all cases, these fields have these specified abnormalities:
U_Display = there is a QUOTE symbol (") in front of word "threaded"
U_View = there is a QUOTE symbol (") in front of word "collapsed"
U_SessionId = this should be a 32 character alpha-numeric code, HOWEVER, for each of these users the entry is just a "0".
U_Approved = This should be a "yes" once confirmed, but I am unsure what it should look like before it is confirmed. However, for each of these unconfirmed users, the actual value is the first 8 characters of what I'm guessing alpha-numeric Session_ID.

Now at first it accured to me that perhaps there issome sort of character set issue going on. Perhaps the Russian character set is not being "read" correctly. In SOME of the records, the U_Location field is populated with these two words Ðîññèÿ
and Óêðàèíà. HOWEVER, not all are like this. The majority of the rest list locations such as Oklahoma, or USA, or GB, and yet they too display the same field anomalies (even though they also provide a russian email address.

I realize I could block the IP addresses, but I hesitate to do that because it is not hard to come from a different IP address, AND it robs me of the opportunity to understand what is happening here.

Has anybody seen anything like this before?
Are we under some sort of attack and if so, what do they hope to gain or damage?
Is this a character set issue, and if so, is there a way to fix the problem for these Russian visitors?

Humm sorry mate, beyond my scope.

I think I placed the thread in the wrong forum so here is a link to the other forum.
https://www.ubbcentral.com/forums/ubbthreads.php/ubb/showflat/Number/185848/page/1/gonew/1#UNREAD

Perhaps a Mod will want to move it?

what is your site.. is the port 3306 open and un passworded ?

More than likely, it's just a spambot doing an automatic signup routine or a real, human spammer. They quit getting in once I turned on CAPTCHA.

Every security precaution can be subverted with the knowledge of how to do it; even email verification (which is actually fairly simple if you know what you're doing)

moved & merged.

BTW - please feel free to enter your site into your profile, always assists assistance if people can visit your site

Mors,
http://www.thenorthfaceguru.com/ubbthreads/ubbthreads.php?Cat=0
We're hosted on Dreamhost. The lamest of the lame, but as lame as they are, I'd have to think they have their ports ports secure. Just to be sure, I'll send an email.

THANKS!!!

Harold,
"They quit getting in once I turned on CAPTCHA."
Would you mind elaborating on this?
What is "CAPTCHA"?

Gizmo,
It's easy to tell from the link what is going on in the email verification, but I'm confused as to how that could be subverted.
Even if a nefarious user knew the UBB schema, he/she would still have to know the table prefix to do anything?

Ian,
I've added our site to my profile.

Thanks to all for you insights!

An odd extra thing I've noticed is that in some cases, even users that do confirm have the messed up U_SessionId and U_Approved fields. I can't help but wonder if there isn't two seperate issues at work, or if the attempted SPAM BOTs may have damaged an index table.

One thing I did just remember is that we did get ONE spam poster that did successfully get in and post to some porn sites with the ID Anonymous. I had the good fortune of being on the site right when it happened and was able to delete the post. However, before I did, I manually looked Users tble and there was no trace of an Anonymous ID (which is blocked by the system anyway). Now that I've remembered it, I've checked my archived copy of that post and the IP address is the same as two of the recent unconfirmed registrants.

hmmm. I suppose I aught to block that IP address.

Bilbo,

CAPTCHA is the image verification used before a user signs up or posts as anonymous. The new version of Threads now has this built in. I'd update to it if possible for you. The new version has many new characteristics that make it worth the expense and effort. Forums run faster and safer along with many new forum owner requested features.

I just took a look at your site. With 10,000 or less posts, an import to the version 7 series should be easy to do.

you'd be suprised.

A CAPTCHA is a visual verification image; you must see it and type what it says. This is only available in UBB.Threads 7.1+

Basically, when an email is sent you just have to click a link; setup a small program to act as a mail client and click any links; you could do this with CURL in PHP or by creating a simple program in vbasic/cpp.