{"id":20283,"date":"2012-07-24T13:52:26","date_gmt":"2012-07-24T19:52:26","guid":{"rendered":"http:\/\/rankexploits.com\/musings\/?p=20283"},"modified":"2012-07-24T13:52:26","modified_gmt":"2012-07-24T19:52:26","slug":"protecting-the-blackboard-from-unauthorized-access","status":"publish","type":"post","link":"https:\/\/rankexploits.com\/musings\/2012\/protecting-the-blackboard-from-unauthorized-access\/","title":{"rendered":"Protecting The Blackboard from “unauthorized access”."},"content":{"rendered":"

The police announcement about closing the Climategate investigation turned my mind back to hack\/spam protection. A few of you will have noticed I’ve been fiddling with the hack protection. I apologize to any who were presented the “scary page”, especially the person using a proxy. <\/p>\n

Just in case my new rules are bad I like to let you know about the recent batch:<\/p>\n

    \n
  1. I tweaked so ZB Block now checks with a list of TOR exit nodes when people comment. This should bounce people who are commenting using TOR exit nodes. If you don’t know what these are, you are almost certainly not using one. (TOR is popular with virulent trolls.)<\/li>\n
  2. For roughly 30 minutes, I tried blocking everything with the word ‘proxy’ in the host unless<\/i> it also contained ‘.googlebot.com’ in the host. I quickly learned why this is a very, very, very bad idea.\n

    Those wondering why I would even consider such a move can learn my motivation by scanning can visit this page<\/a> which shows quite often<\/i>, hackers, bots etc. hide behind hosts with the word “proxy” in the title. Everything on that page got caught for violating some rule other than<\/em> containing the word “proxy” in the title, so I thought I’d give blocking ‘proxy’ a shot. <\/p>\n

    I knew this was iffy. So I added the rule and checked the kill_log.txt file every 5 minutes. Unfortunately, I quickly also saw that hosts like “proxy.a.perfectly.valid.business.com” in the killed logs. I’m sure that was a human. Not only human, but a human who was smart enough not to reload the page 3 times– so they didn’t get themselves banned! If you saw that… sorry. I won’t be blocking you and your coworkers for using a “proxy.a.perfectly.valid.business.com” in future and you should be able to come back. <\/li>\n

  3. I added a rule that notices when someone makes a direct call to a ‘theme’ that does not exist at my site and bans that IP. (The theme is what makes the blog look as it does.) All blog visitors call the theme but no<\/i> blog visitor should ever even think of trying to call a theme directly<\/em> and they certainly shouldn’t call a theme I don’t even use. But bots rather frequently call non-existent themes associated with WordPress vulnerabilities especially the ones associated with the “timthumb.php” or the “uploadify.php” exploit. I’m now catching and banning these very early on. <\/li>\n
  4. I added a rule that notices when someone tries to call a non-existent<\/i> ‘plugin’ directly and bans them. Plugins add functionality to WordPress- for example, one plugin lets you edit comments; another fishes out the recent comments for the sidebar and so on. But people shouldn’t be calling plugins I don’t use at this blog.\n

    This rule makes me a little nervous so I’m watching to see if it affects any humans. So far, it hasn’t. If you see the “scary” page, I apologize in advance. Send me an email and I can fix it. (I think you won’t see the page by accidentally violating a badly written rule but sometimes I only recognize the flaws in the implementation after I implement a rule.) <\/li>\n

  5. Sometime last week, I got sick and tired of my killed_log.txt file filling with Brazilian’s pretending to be googlebot and banned Brazil at Cloudflare. This means people in Brazil will be required to fill out a Captcha. People in China are also required to fill out a Captcha. (To see how constant the Brazilian Googlebot spoofing was, visit googlebot spoofers<\/a>; the letters “BR” stand for Brazil. If you are planning a trip to Brazil, let me know and I can probably whitelist your hotel’s IP. <\/li>\n
  6. I created pages to permit me to search my spam logs for IPs, hosts, and various search terms. I’ll be displaying some of these from time to time in blog posts at the most boring blog ever, Ban Nasties.<\/a> <\/li>\n
  7. I’ve been adding large blocks of IPs from troublesome sites to the range of IPs blocked at Cloudflare. The trouble spots are generally associated with hosting services and cloud networks. Most people surf the web using ISPs; so blocking the more troublesome servers should affect a small fraction of potential visitors. But if you use a VPN you might have a difficulty. If you do, let me know. I some cases, I might whitelist your IP even if the IP you present is associated by a company from which lots of hackage emanates. In somecases, I might suggest you switch IPs (as some VPN hosts permit.) <\/li>\n<\/ol>\n

    I should be back to climate blogging tomorrow or Thursday. <\/p>\n","protected":false},"excerpt":{"rendered":"

    The police announcement about closing the Climategate investigation turned my mind back to hack\/spam protection. A few of you will have noticed I’ve been fiddling with the hack protection. I apologize to any who were presented the “scary page”, especially the person using a proxy. Just in case my new rules are bad I like … Continue reading Protecting The Blackboard from “unauthorized access”.<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[72],"tags":[],"class_list":["post-20283","post","type-post","status-publish","format-standard","hentry","category-random"],"_links":{"self":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/posts\/20283","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/comments?post=20283"}],"version-history":[{"count":0,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/posts\/20283\/revisions"}],"wp:attachment":[{"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/media?parent=20283"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/categories?post=20283"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rankexploits.com\/musings\/wp-json\/wp\/v2\/tags?post=20283"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}