rcain

update: i’ve just opened up the source code & taken a scan over it: nothing suspicious that i can see – no ‘base64’ stuff, no suspicious ‘http”s, no visible trojans or exploits. also, authors details are provided if you want to contact him directly.

i haven’t scanned the images, etc. someone probably should, (i’m hoping wordpress.org have their own inline-upload anti-viral scanners in place on the these plugin repositories – but that is just a hope and would be nice to have confirmed somehow.)

@socialgrower: could it be that your security warning msg from GA was just coincidence, or perhaps related to some other activity happening at that time?

interested to know.

i wonder if someone from wordpress.org could investigate this further
and if true, please REMOVE this plugin from the repository.

Great news Keith! Nicely done. 🙂

One more idea/requirement I’ve just discoverd:

– Ability to remove individual email’s and/or ip’s from the backlist (cache).

Discoverd that I had one or two false positives in the backlist – either legitimate users who just happend to be using email domains I had previously banned, else had been unfortunate enough to have their (dynamic) IP’s added to a public blacklist through no fault of their own.

At present, I the only way I can see of allowing them access to my site again is either a) to clear the entire blacklist cache and/or b) add them to the whitelist (which gets checked first, iirc).

Unless there is another way of achieving this I am unaware of?

Thanks again for all your brilliant work! 🙂

(btw: on one of our clients sites your plugin has so far pevented 45,247 spammers since 2012/07/04 and counting!.Fantastic! And now no registrations clogging up the db either. I would be very happy to make a donation towards this plugin – I’m sure many other people would also (eg: the buddydev site is currently rammed full of spammer registrations, so are most other BP sites i have come across in the wild – they could sure use your plugin!)).

Rob

Hi Keith,

No worries, pleased to help.

It would be good to have it confirmed whether this also fixes the original problem of jmorrow and photoman856 above also.

Re: ‘Dictionary Attacks’ – I know what you mean – our BP sites (also WP, in fact our servers generally) are constantly under attack, have been for a long time. (the numbers can get so high in fact that they consttitute as DOS attack in their own right, slowing performance).

Its one of the reasons why I think your plugin is so CRITICAL.

I installed Fail2Ban on our servers a few years ago to help combat SSH, FTP and Mail attacks and it does reduce those numbers greatly – though not altogether. Have been wondering about trying to extend it’s config to cover WP/BP attacks also – since it is pretty efficient.

I am assuming your attackers are mostly using bots/rootkit probes and rotating proxy IP’s?

I am loath to suggest adding an (anti-robot) capture field on ALL WP/BP forms, but it might have to be the next move.

I have also found it necessary to ban all hotmail, gmail, aol, yahoo email addresses also – (as well as the usual .ru and .cn, etc) since these are INVARIABLY (in fact almost exclusively) used by hackers. Luckily our main sites are for professional users only who should have their own legitimate company email domains (we make manual exceptions for VIP’s who insist on using gmail). I realise such a blanket ban is not suitable for other sites aimed at general public.

We have also made it MANDATORY for registrants to fill in additional extended profile fields INCLUDING a special one asking for ‘Reasons why you would like to become a member of this site?’ – which we inspect manually and ONLY if its well written do the users get activated by admin. (Though this doesnt catch all since many SEO blackhat operators employ real humans in Philipines, elsewhere, to mass-register – but it does help at the cost of extra admin)

(Long term i think we need better legal enforcement internationally and stiff sentences for script kiddies/hackers – but i dont see that happenning anytime soon – unless you are the US DOD or Mossad).

Couple of suggestions to improve your plugin perhaps:

1) the ‘time-out’ parameter(s) – could you make these settable via admin options?
2) additional filters or actions to make it possible to add EXTRA fields for validation – this would help future plugin developers utilise your plugin functionality without having to mod the code its self.
3) space for bigger list of blacklisted IP addresses supported – separated from email addresses – including support for wildcards/ip adress ranges – (i have noticed that bot proxies often eventually start to rotate their lists, (within limited time frames), so gives you a fighting chance so long as you keep on top of it).

Anyway, sorry about slight thread-drift – maybe we need a new thread for this subject.

All best

Rob

‘stream of conciousness programming’ – dont think i wamnt to go there – bad enough when i find myself ‘dreaming code’. simple clases/objects for me any day. small is beautiful.

just tested your latest 4.1 beta downloaded from http://www.blogseye.com/beta-test-plugins/ – repeated test above – same problem i’m afraid: (although rejects it now due to cached badip as expected (so that bit works ok)). but user still gets registerd.

will trace through & see what i can determine.

Rob

Thanks for swift reply Keith,

Will try the 4.1 beta – though suspect it will still not PREVENT Buddpress/Wordpress registrations themselves.

Have been digging through latest Buddypresss code and think I have found the hooks you might need to get that working:

Take a look at:

file: plugins/buddypress/bp-members/bp-members-screens.php
function: bp_core_screen_signup

2/3 ways to acheieve it I think – either:

1) completely remove and replace add_action( ‘bp_screens’, ‘bp_core_screen_signup’ ) with your own registration func based on it
OR
2) add_action( ‘bp_signup_validate’, ‘your_func’ ) – this is called in the above func JUST before user regisratation details are saved, etc
OR
3) bp_core_validate_user_signup() func (in bp-members-functions.php) called from above func near top – also has hooks/filters which could be used – eg: apply_filters( ‘bp_core_validate_user_signup’, $result ).

Of these options 2 would be my fave. Just need to return your own (spammer) error message in $bp->signup->errors and bp/wp will do rest.

This way, the method of spammer (registration) rejection becomes much more logivcal and inline with existing wp/bp user validation process.

Seems from your code you might need to put some sort of simple switch in/around end of your kpg_sfs_checkfunc – to make sure it plays nice (returns) with wp/bp hook rather than simply dying/redirecting – ubt thats about it i think.

Was literally about to attempt a patch to your plugin myself, but I think you might be able to achieve it much faster/more reliably.

Any chance of sometthing like this? Is it sensible suggestion do you think?

All best

Rob

Hi,
I had precisely the same problem.
Evidentially a bug (one of many I have found) in this latest release. Developers – please take note.
My solution – as you – admin, gallery, options, effects – change FROM ‘shutter’ TO ‘lightbox’. Seems to work ok.