Was IMG01.EXE actually uploaded to those dirs or just an attempt? Activity like this is not uncommon!
---
â– Synchronet â– Realm of Dispair BBS - http://ephram.synchro.net:82
Synchronet Hack Log reported an attempt of FTP filename hacking with the name IMG01.EXE uploaded to many of the file directories 2 days ago on Saturday, June 13, 2020. These were the IP addresses it sent back to me:
197.219.106.232 -Mozambique - Africa/Maputo (Time Zone)
61.38.37.229 - South Korea - LG Dacom Corporation (ISP)
$ The Millionaire $
Was IMG01.EXE actually uploaded to those dirs or just an attempt?
Activity like this is not uncommon!
---
þ Synchronet þ Realm of Dispair BBS - http://ephram.synchro.net:82
Yes I found it in 3/4 of my directory library. Why send it several times for? Once should be efficient to land a virus on a Bbs as Sysops have told me in the past.
$ The Millionaire $
Synchronet Hack Log reported an attempt of FTP filename hacking with
the name IMG01.EXE uploaded to many of the file directories 2 days ago
on Saturday, June 13, 2020. These were the IP addresses it sent back to me:
197.219.106.232 -Mozambique - Africa/Maputo (Time Zone)
61.38.37.229 - South Korea - LG Dacom Corporation (ISP)
Yes I found it in 3/4 of my directory library.
Why send it several times for?
Once should be efficient to land a virus on a Bbs as Sysops have
told me in the past.
The Millionaire wrote to Digital Man <=-
Synchronet Hack Log reported an attempt of FTP filename hacking
with the name IMG01.EXE uploaded to many of the file directories
2 days ago on Saturday, June 13, 2020. These were the IP
addresses it sent back to me:
197.219.106.232 -Mozambique - Africa/Maputo (Time Zone)
61.38.37.229 - South Korea - LG Dacom Corporation (ISP)
The Millionaire wrote to Digital Man <=-
Synchronet Hack Log reported an attempt of FTP filename hacking
with the name IMG01.EXE uploaded to many of the file directories
2 days ago on Saturday, June 13, 2020. These were the IP
addresses it sent back to me:
197.219.106.232 -Mozambique - Africa/Maputo (Time Zone)
61.38.37.229 - South Korea - LG Dacom Corporation (ISP)
Not all that uncommon of an event... Lots of hackers and assholes
out there in the big world.
What did you want DM to do about it? Why tell him this?
... Can you tell me how to get, how to get to Sesame Street?
--- MultiMail/Linux v0.52
â– Synchronet â– Palantir BBS * palantirbbs.ddns.net * Pensacola, FL
What was the name of the user(s) that did the uploading?
... Windows 3.1 - From the people who brought you EDLIN.
--- MultiMail/Linux v0.52
â– Synchronet â– Palantir BBS * palantirbbs.ddns.net * Pensacola, FL
On 06-15-20 15:49, Rampage wrote to The Millionaire <=-
you need to add that filename to your sbbs/text/file.can...
you should also stop anonymous/guest users from uploading files...
They used the Guest account so there was no name.
The Millionaire wrote to Gamgee <=-
What was the name of the user(s) that did the uploading?
They used the Guest account so there was no name.
The Millionaire wrote to Gamgee <=-
Not all that uncommon of an event... Lots of hackers and assholes
out there in the big world.
What did you want DM to do about it? Why tell him this?
My Bbs is not even advertised or popular by any means so why
would they even pick on small potatoes for?
My Bbs is not even advertised or popular by any means so why would
they even pick on small potatoes for?
Re: Re: Hacking Attempt
By: The Millionaire to Gamgee on Tue Jun 16 2020 04:02:20
Gamgee>> What was the name of the user(s) that did the uploading?
They used the Guest account so there was no name.
that's all the name you need... it tells you they used your anonymous/guest account and that tells you your system is too open if you allow anonymous/guest to upload files... you need to close that door by disallowing them to
upload files... easy peasy...
What did you want DM to do about it? Why tell him this?
My Bbs is not even advertised or popular by any means so why would they even pick on small potatoes for?
Daryl Stout wrote to The Millionaire <=-
Synchronet Hack Log reported an attempt of FTP filename hacking with
the name IMG01.EXE uploaded to many of the file directories 2 days ago
on Saturday, June 13, 2020. These were the IP addresses it sent back to me:
197.219.106.232 -Mozambique - Africa/Maputo (Time Zone)
61.38.37.229 - South Korea - LG Dacom Corporation (ISP)
Added to the Twitlist. I also have Peerblock installed to block
various countries.
They used the Guest account so there was no name.
Not all that uncommon of an event... Lots of hackers and assholes
out there in the big world.
What did you want DM to do about it? Why tell him this?
My Bbs is not even advertised or popular by any means so why would they even pick on small potatoes for?
My Bbs is not even advertised or popular by any means so why would they even pick on small potatoes for?
selecting any specific systems... you are not the target... ANY open/vulnerableMy Bbs is not even advertised or popular by any means so why would
they even pick on small potatoes for?
you've been told several times, they are not looking at any lists or
so your next question is "how did they find me then?"... they simplywar-dialed your IP in a huge block of other IPs...
if you want to allow TOR users to access your system, don't do
this...
Rampage wrote to calcmandan <=-/snip
if you want to allow TOR users to access your system, don't do this...
Added to the Twitlist. I also have Peerblock installed to block
various countries.
Would it be considered wise to add all tor exit nodes to these lists?
Daniel,
Added to the Twitlist. I also have Peerblock installed to block various countries.
Would it be considered wise to add all tor exit nodes to these lists?
I believe Peerblock is free, but to get a yearly subscription for
the lists is only $10. I think the lists are from iblocklist.com --
but I'm not sure.
I'm not sure if blocking the TOR connects is available offhand, but
if it is, one could probably activate it. I moved SyncTerm and
MultiMail (QWK) Mail to my laptop, so I don't have to work on the
BBS computer, unless I update the ham radio and weather data.
Daryl
I use https://myip.ms/files/blacklist/general/full_blacklist_database.zip, it's free ... unzip the list and add it to ip-silent.can ... I have a php script that does it as a daily timed event but it would be easy to script it in js ... you could also use my coob.js for country blocking http://alleycat.synchro.net:81/dls/coob.js
Interesting. Too bad we, as Sysops, have to worry about this.
I gather the list is rather big.
Well, I don't own a BBS and still just a user. This doesn't mean my intentio isn't to run a board. I'm just exploring possibilities here. I wouldn't like block tor exit nodes at first. I'd not want to block any users who rely on t to provide their privacy.
But if none of my users were using tor and attack attempts were originating from TOR then I would definitely work to block them.
Daniel Traechin
I use
https://myip.ms/files/blacklist/general/full_blacklist_database.zip,
it's free ... unzip the list and add it to ip-silent.can ... I have a
php script that does it as a daily timed event but it would be easy to script it in js ... you could also use my coob.js for country blocking http://alleycat.synchro.net:81/dls/coob.js
Daniel,Well said it is your home!
Well, I don't own a BBS and still just a user. This doesn't mean my intentions isn't to run a board. I'm just exploring possibilities here. I wouldn't likely block tor exit nodes at first. I'd not want to block any users who rely on tor to provide their privacy.
That's fine...all Sysops started as users.
But if none of my users were using tor and attack attempts were originating from TOR then I would definitely work to block them.
Now, unless there is a law enforcement subpeona for data (which there
has never been since I started my Sysoping nearly 30 years ago), or for rules violations (there have been those, and I've notified confirmed Visiting Sysops), their data is kept STRICTLY CONFIDENTIAL. When my late wife and Co-Sysop was alive, even she didn't have access to the data.
In short, what their life is outside the BBS, is THEIR BUSINESS. But, they're a guest in my home at logon, and I expect them to act accordingly. If they're not willing to do that, I don't want or need them as a user.
Daryl
... Alert: Scanner shows Sysop in the area. Look innocent!!
Well, I don't own a BBS and still just a user. This doesn't mean my intentions isn't to run a board. I'm just exploring possibilities here.
I wouldn't likely block tor exit nodes at first. I'd not want to block
any users who rely on tor to provide their privacy.
But if none of my users were using tor and attack attempts were originating from TOR then I would definitely work to block them.
Daryl Stout wrote to calcmandan <=-
Daniel,
Added to the Twitlist. I also have Peerblock installed to block
various countries.
Would it be considered wise to add all tor exit nodes to these lists?
I believe Peerblock is free, but to get a yearly subscription for
the lists is only $10. I think the lists are from iblocklist.com --
but I'm not sure.
I'm not sure if blocking the TOR connects is available offhand, but
if it is, one could probably activate it. I moved SyncTerm and
MultiMail (QWK) Mail to my laptop, so I don't have to work on the
BBS computer, unless I update the ham radio and weather data.
Re: Re: Hacking Attempt
By: Mortifis to Daryl Stout on Fri Jun 19 2020 12:19 pm
I use
https://myip.ms/files/blacklist/general/full_blacklist_database.zi Mo>> p, it's free ... unzip the list and add it to ip-silent.can ... I Mo>> have a php script that does it as a daily timed event but it would Mo>> be easy to script it in js ... you could also use my coob.js for Mo>> country blocking http://alleycat.synchro.net:81/dls/coob.js
Interesting. Too bad we, as Sysops, have to worry about this.
I gather the list is rather big.
full_blacklist_database.txt has just a few in there ... as of today 90,207 entries, but it parses quickly
That blacklist that was listed, where is it from? I missed the first post...
I use
https://myip.ms/files/blacklist/general/full_blacklist_database.zi
p, it's free ... unzip the list and add it to ip-silent.can ... I
have a php script that does it as a daily timed event but it would
be easy to script it in js ... you could also use my coob.js for
country blocking http://alleycat.synchro.net:81/dls/coob.js
Interesting. Too bad we, as Sysops, have to worry about this.
I gather the list is rather big.
full_blacklist_database.txt has just a few in there ... as of today 90,207 entries, but it parses quickly
But if none of my users were using tor and attack attempts were originating from TOR then I would definitely work to block them.
Now, unless there is a law enforcement subpeona for data (which there
has never been since I started my Sysoping nearly 30 years ago), or for rules violations (there have been those, and I've notified confirmed Visiting Sysops), their data is kept STRICTLY CONFIDENTIAL. When my late wife and Co-Sysop was alive, even she didn't have access to the data.
In short, what their life is outside the BBS, is THEIR BUSINESS. But, they're a guest in my home at logon, and I expect them to act accordingly. If they're not willing to do that, I don't want or need them as a user.
Daryl
Well said it is your home!
Arelor wrote to calcmandan <=-
Re: Re: Hacking Attempt
By: calcmandan to Daryl Stout on Fri Jun 19 2020 06:21 am
Well, I don't own a BBS and still just a user. This doesn't mean my intentio isn't to run a board. I'm just exploring possibilities here. I wouldn't like block tor exit nodes at first. I'd not want to block any users who rely on t to provide their privacy.
But if none of my users were using tor and attack attempts were originating from TOR then I would definitely work to block them.
Daniel Traechin
I think that if you want to have darknet users in your board you should
be setting a hidden service. Set an i2p interface and tune the
connection rate down a bit. Enable manual account activation for new users. I doubt most boards get many new users anyway.
Not sure if I would be comfortable setting up a hidden service. I avoid TORlike a plague.
Daniel Traechin
Daryl Stout wrote to calcmandan <=-
That's fine...all Sysops started as users.
Now, unless there is a law enforcement subpeona for data (which there has never been since I started my Sysoping nearly 30 years ago), or for rules violations (there have been those, and I've notified confirmed Visiting Sysops), their data is kept STRICTLY CONFIDENTIAL. When my
late wife and Co-Sysop was alive, even she didn't have access to the
data.
In short, what their life is outside the BBS, is THEIR BUSINESS. But, they're a guest in my home at logon, and I expect them to act
accordingly. If they're not willing to do that, I don't want or need
them as a user.
Re: Re: Hacking AttemptTOR like a plague.
By: calcmandan to Arelor on Sat Jun 20 2020 07:43 pm
Not sure if I would be comfortable setting up a hidden service. I avoid
in them than on the rest of the Internet. If I wereDaniel Traechin
I spend a lot of time in different darknets and you don't find more psychos
to set a hidden service I would consider i2p first though, because I think itis a bit more flexible when dealing with things
such as telnet.
I don't know where this comes from, but just in case you are arguing
that people should not use Tor to connect to your BBS because they have nothing to hide from you or because using Tor to access your board is aggressive in nature:
That's fine...all Sysops started as users.
Awwwwww
I'm more concerned that a TOR bbs user having nefarious goals such as hacking. I would be more concerned of drawing law enforcement subpoenas
by running an exit node than running a hidden service. After all, a
small BBS running on a theme of HAM and Aviation isn't on the FBI's priority list as a potential hive of illegal activity. I think they're looking for drug bazaars and sites catering to those who like jr loungeware.
I'm totally with you. Do BBS's still fall victim to members who upload malware or illegal files? I've seen spatterings of it here and there
but only for boards who enable web interfaces and anonymous uploading where bots do the deed.
Back in the day, I know some boards fell victims to these activities.
One bbs I co-sysop'd on got the michelangelo virus. Not only did it
effect all the files in his hand picked file section, but it also
effected all his files as well as on the floppy. I believe it even
wrote itself to the drive's mbr.
Randy Stiles wrote to Daryl Stout <=-
Well said it is your home!
nothing to hide from you or because using Tor tI don't know where this comes from, but just in case you are arguing that people should not use Tor to connect to your BBS because they have
string, which changes every 5 minutes around theaccess your board is aggressive in nature:
I don't care where they logon from. If they can't get past the CAPTCHA
clock, they won't getcontact me on the BBS if they want that info.
any further. I also changed the SSH and QOTD ports to non-conventional values, as folks were slamming them. Verified Users In Good Standing can
What a caller does outside my BBS is their business, but they're a guest in my home at logon. If they don't want to act civil, I don't want them.class and keep his grades up, and if he's going t
I equate that to the late Paul "Bear" Bryant, long time football coach
at Alabama. He said "I don't care if this player knows the playbook inside and out, backwards and forwards, word for word. If he isn't going to go to
get into trouble with
the law, I don't want him".
Daryl
... This tagline is freeware; future support is unavailable.
If I recall correctly, you need to set the access ars to:
REST NOT G
Well said it is your home!
I always hated that analogy. It's not your home, it's a service
accessible to external users. Do you leave your front door wide open
and allow anyone who follows your rules inside?
I don't like that analogy either. I never even thought of that until severa years ago when I started seeing people mention that analogy here. I agree i an online service accessible to external users. It's different from letting guests into your house. And it would be the same whether your BBS is hosted your house or on a server in an office somewhere, or in the cloud, etc..
Randy Stiles wrote to Daryl Stout <=-
Well said it is your home!
I always hated that analogy. It's not your home, it's a service
accessible to external users. Do you leave your front door wide open
and allow anyone who follows your rules inside?
On 06-21-20 11:36, Nightfox wrote to poindexter FORTRAN <=-
I don't like that analogy either. I never even thought of that until several years ago when I started seeing people mention that analogy
here. I agree it's an online service accessible to external users.
It's different from letting guests into your house. And it would be
the same whether your BBS is hosted in your house or on a server in an office somewhere, or in the cloud, etc..
Well said it is your home!
I always hated that analogy.
It's not your home, it's a service accessible to external users.
Do you leave your front door wide open and allow anyone who follows
your rules inside?
Well said it is your home!
I always hated that analogy. It's not your home, it's a service
accessible to external users. Do you leave your front door wide open
and allow anyone who follows your rules inside?
Re: Re: Hacking Attempt
By: Daryl Stout to calcmandan on Fri Jun 19 2020 03:09 pm
But if none of my users were using tor and attack attempts were
originating from TOR then I would definitely work to block them.
Now, unless there is a law enforcement subpeona for data (which there
has never been since I started my Sysoping nearly 30 years ago), or
for rules violations (there have been those, and I've notified
confirmed Visiting Sysops), their data is kept STRICTLY CONFIDENTIAL.
When my late wife and Co-Sysop was alive, even she didn't have access
to the data.
In short, what their life is outside the BBS, is THEIR BUSINESS. But,
they're a guest in my home at logon, and I expect them to act
accordingly. If they're not willing to do that, I don't want or need
them as a user.
Daryl
Not sure if I would be comfortable setting up a hidden service. I avoid TOR like a plague.
Rampage wrote to poindexter FORTRAN <=-
around these parts, kinda yeah... as long as they provide credentials
on initial visit... but we are out in the country and leaving the doors open/unlocked has been quite common for decades... i guess we're a
little more friendly out here in the country than in citified
residential areas... but it also depends on the level and types of
crime in one's area, too...
Does my simple, PIA (Private internet access) VPN offer any decentprotection from people
knowing 'who i am' if they wanted to look?house... but I stil
I simply bought a year of PIA and use it on all my connections out of my
use a TAILS USB if I need to be really private. TOR and TAILS...
But, how protected am I on my PIA VPN??
Daryl Stout wrote to poindexter FORTRAN <=-
In the publication "Ham Radio For Dummies", written by H. Ward Silver, N0AX, he notes that those coming to an examiners residence to take the license exam (3 examiners are required to give it), that "Remember...you are a Guest in someone's home, so act accordingly". I've been involved in ham radio for nearly 30 years, and have been accredited to give exams since 2007.
Yes - that is, literally, someone's HOME, so the analogy holds up.
... Do you have access to your previous configuration?
paulie420 wrote to calcmandan <=-
Re: Re: Hacking Attempt
By: calcmandan to Arelor on Sat Jun 20 2020 07:43 pm
Not sure if I would be comfortable setting up a hidden service. I avoid TOR like a plague.
Why? Do you use a VPN?
Daryl Stout wrote to poindexter FORTRAN <=-
In the publication "Ham Radio For Dummies", written by H. Ward
Silver, N0AX, he notes that those coming to an examiners residence to
take the license exam (3 examiners are required to give it), that "Remember...you are a Guest in someone's home, so act accordingly".
I've been involved in ham radio for nearly 30 years, and have been accredited to give exams since 2007.
197.219.106.232 -Mozambique - Africa/Maputo (Time Zone)
61.38.37.229 - South Korea - LG Dacom Corporation (ISP)
Added to the Twitlist. I also have Peerblock installed to block
various countries.
Would it be considered wise to add all tor exit nodes to these lists?
Back in the day, I know some boards fell victims to these activities.
One bbs I co-sysop'd on got the michelangelo virus. Not only did it
effect all the files in his hand picked file section, but it also
effected all his files as well as on the floppy. I believe it even
wrote itself to the drive's mbr.
| Sysop: | sneaky |
|---|---|
| Location: | Ashburton,NZ |
| Users: | 31 |
| Nodes: | 8 (0 / 8) |
| Uptime: | 88:25:35 |
| Calls: | 2,069 |
| Calls today: | 2 |
| Files: | 11,134 |
| Messages: | 946,757 |