• Repeated guest logins from the same place

    From Nightfox@1:103/705 to All on Fri Sep 8 12:40:50 2017
    A couple months ago, I was getting repeated guest logins every day using "shell" as their location. It was a known bot, but now I've been getting multiple repeated guest logins each day from the same location, but different locations each day or 2. Recently I noticed I was getting 5+ guest logins from Halifax, and yesterday and today I noticed my BBS has had at least 5 guest logins from Turkey, spread over at least 6 hours. I'm not sure if these are genuine users (or the same user) from the same country or if it's another bot. Has anyone else noticed this on their BBS?

    Nightfox

    ---
    * Synchronet * Digital Distortion: digitaldistortionbbs.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Digital Man@1:103/705 to Nightfox on Fri Sep 8 14:59:46 2017
    Re: Repeated guest logins from the same place
    By: Nightfox to All on Fri Sep 08 2017 12:40 pm

    A couple months ago, I was getting repeated guest logins every day using "shell" as their location. It was a known bot, but now I've been getting multiple repeated guest logins each day from the same location, but different locations each day or 2. Recently I noticed I was getting 5+ guest logins from Halifax, and yesterday and today I noticed my BBS has had at least 5 guest logins from Turkey, spread over at least 6 hours. I'm not sure if these are genuine users (or the same user) from the same country or if it's another bot. Has anyone else noticed this on their BBS?

    If you examine the detailed terminal server log(s) for those logins (data/logs/<date>.log), you should be able to easily distiguish between a real user and a bot.

    digital man

    Synchronet "Real Fact" #89:
    Rob played drums on the album "Weedpuller" available for digital purchase/stream
    Norco, CA WX: 87.4oF, 46.0% humidity, 12 mph NE wind, 0.00 inches rain/24hrs --- SBBSecho 3.01-Win32
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From KK4QBN@1:103/705 to Nightfox on Fri Sep 8 17:48:00 2017
    Re: Repeated guest logins from the same place
    By: Nightfox to All on Fri Sep 08 2017 12:40:50

    A couple months ago, I was getting repeated guest logins every day using "shell" as their location. It was a known bot, but now I've been getting multiple repeated guest logins each day from the same location, but different locations each day or 2. Recently I noticed I was getting 5+ guest logins from Halifax, and yesterday and today I noticed my BBS has had at least 5 guest logins from Turkey, spread over at least 6 hours. I'm not sure if these are genuine users (or the same user) from the same country or if it's another bot. Has anyone else noticed this on their BBS?

    Not yet for me, I'm getting the confirmed bot hits (even with a password on the guest account, just not as many). but I have'nt seen this yet.

    Did they do anything or just hang araound?

    --

    Tim Smith (KK4QBN)
    KK4QBN BBS

    ---
    * Synchronet * KK4QBN - kk4qbn.synchro.net - 7064229538 - Chatsworth GA USA
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From mark lewis@1:3634/12.73 to Nightfox on Sat Sep 9 01:20:34 2017

    On 2017 Sep 08 12:40:50, you wrote to All:

    A couple months ago, I was getting repeated guest logins every day using "shell" as their location. It was a known bot, but now I've been getting

    it is the same set of bots and variants, man... they are not going to go away... i do really wish that ""you guys"" would put a fido mailer in frontt of
    your BBSes and let it answer the connections because then you would see exactly
    what is going on and it would buffer it a little from the BBS... then you would
    see that they are connecting and immediately sending a username and a password without waiting for any prompts... they are trying to load a command shell on what they think is a vulnerable IoT device... they are assuming that the shell is loading and then they are issuing commands... you guys are seeing these shell commands being stuffed into the fields in your new user process... the bots don't even know what the hell that is and they don't care... they're recording responses to be able to tell if they got a shell so they can finish infesting the IoT device they think they have accessed...

    [/rant]

    FWIW: here's what they look like on a FrontDoor mailer with the modem debug enabled... this first one has no password... you can tell because there's nothing before the second 0x0a 0x0d (aka CRLF) after they've sent "root" as the
    user name... it is a normal MIRAI hit...

    = 21:12:00 RING
    ? 21:12:00 [ModemDebug] Sending first answer string
    = 21:12:00 CONNECT 57600/ARQ/TEL FROM 65.189.32.123
    ? 21:12:01 Intro: 0072 (r)
    ? 21:12:01 Intro: 006F (o)
    ? 21:12:01 Intro: 006F (o)
    ? 21:12:01 Intro: 0074 (t)
    ? 21:12:01 Intro: 000D
    ? 21:12:01 Intro: 000A
    ? 21:12:01 Intro: 000D
    ? 21:12:01 Intro: 000A
    ? 21:12:01 Intro: 0065 (e)
    ? 21:12:01 Intro: 006E (n)
    ? 21:12:01 Intro: 0061 (a)
    ? 21:12:01 Intro: 0062 (b)
    ? 21:12:01 Intro: 006C (l)
    ? 21:12:01 Intro: 0065 (e)
    ? 21:12:01 Intro: 0000
    ? 21:12:02 Intro: 000D
    ? 21:12:02 Intro: 000A
    ? 21:12:02 Intro: 0073 (s)
    ? 21:12:02 Intro: 0079 (y)
    ? 21:12:02 Intro: 0073 (s)
    ? 21:12:02 Intro: 0074 (t)
    ? 21:12:02 Intro: 0065 (e)
    ? 21:12:02 Intro: 006D (m)
    ? 21:12:02 Intro: 0000
    ? 21:12:02 Intro: 000D
    ? 21:12:02 Intro: 000A
    ? 21:12:02 Intro: 0073 (s)
    ? 21:12:02 Intro: 0068 (h)
    ? 21:12:02 Intro: 0065 (e)
    ? 21:12:02 Intro: 006C (l)
    ? 21:12:02 Intro: 006C (l)
    ? 21:12:02 Intro: 0000
    ? 21:12:02 Intro: 000D
    ? 21:12:02 Intro: 000A
    ? 21:12:03 Intro: 0073 (s)
    ? 21:12:03 Intro: 0068 (h)
    ? 21:12:03 Intro: 0000
    ? 21:12:03 Intro: 000D
    ? 21:12:03 Intro: 000A
    ? 21:12:03 Intro: 002F (/)
    ? 21:12:03 Intro: 0062 (b)
    ? 21:12:03 Intro: 0069 (i)
    ? 21:12:03 Intro: 006E (n)
    ? 21:12:03 Intro: 002F (/)
    ? 21:12:03 Intro: 0062 (b)
    ? 21:12:03 Intro: 0075 (u)
    ? 21:12:03 Intro: 0073 (s)
    ? 21:12:03 Intro: 0079 (y)
    ? 21:12:03 Intro: 0062 (b)
    ? 21:12:03 Intro: 006F (o)
    ? 21:12:03 Intro: 0078 (x)
    ? 21:12:03 Intro: 0020 ( )
    ? 21:12:03 Intro: 004D (M)
    ? 21:12:03 Intro: 0049 (I)
    ? 21:12:03 Intro: 0052 (R)
    ? 21:12:03 Intro: 0041 (A)
    ? 21:12:03 Intro: 0049 (I)
    ? 21:12:03 Intro: 0000
    ? 21:12:05 [ModemDebug] Sending <CR><CR>
    ? 21:12:05 [ModemDebug] Sending Init-1
    ? 21:12:06 [ModemDebug] Done (OK)


    now, here's one that actially tries to download and install something... the items with FFFF are delay points where the remote doesn't send anything but FD is still checking... this one is "guest" with "guest" as the password... note how both issue the same "enable system shell sh" as above before trying anything else...

    = 21:13:58 RING
    ? 21:13:58 [ModemDebug] Sending first answer string
    = 21:13:58 CONNECT 57600/ARQ/TEL FROM 115.219.194.19
    ? 21:13:59 Intro: FFFF
    ? 21:14:00 Intro: FFFF
    ? 21:14:01 Intro: FFFF
    ? 21:14:01 Intro: FFFF
    ? 21:14:02 Intro: FFFF
    ? 21:14:03 Intro: FFFF
    ? 21:14:03 Intro: 0067 (g)
    ? 21:14:03 Intro: 0075 (u)
    ? 21:14:03 Intro: 0065 (e)
    ? 21:14:03 Intro: 0073 (s)
    ? 21:14:03 Intro: 0074 (t)
    ? 21:14:03 Intro: 000D
    ? 21:14:03 Intro: 000A
    ? 21:14:04 Intro: FFFF
    ? 21:14:05 Intro: FFFF
    ? 21:14:06 Intro: FFFF
    ? 21:14:07 Intro: FFFF
    ? 21:14:07 Intro: FFFF
    ? 21:14:08 Intro: FFFF
    ? 21:14:09 Intro: FFFF
    ? 21:14:10 Intro: FFFF
    ? 21:14:10 Intro: FFFF
    ? 21:14:11 Intro: FFFF
    ? 21:14:12 Intro: FFFF
    ? 21:14:13 Intro: FFFF
    ? 21:14:14 Intro: FFFF
    ? 21:14:14 Intro: FFFF
    ? 21:14:14 Intro: 0067 (g)
    ? 21:14:14 Intro: 0075 (u)
    ? 21:14:14 Intro: 0065 (e)
    ? 21:14:14 Intro: 0073 (s)
    ? 21:14:14 Intro: 0074 (t)
    ? 21:14:14 Intro: 000D
    ? 21:14:14 Intro: 000A
    ? 21:14:15 Intro: FFFF
    ? 21:14:15 Intro: 0065 (e)
    ? 21:14:15 Intro: 006E (n)
    ? 21:14:15 Intro: 0061 (a)
    ? 21:14:15 Intro: 0062 (b)
    ? 21:14:15 Intro: 006C (l)
    ? 21:14:15 Intro: 0065 (e)
    ? 21:14:15 Intro: 000D
    ? 21:14:15 Intro: 000A
    ? 21:14:16 Intro: FFFF
    ? 21:14:16 Intro: 0073 (s)
    ? 21:14:16 Intro: 0079 (y)
    ? 21:14:16 Intro: 0073 (s)
    ? 21:14:16 Intro: 0074 (t)
    ? 21:14:16 Intro: 0065 (e)
    ? 21:14:16 Intro: 006D (m)
    ? 21:14:16 Intro: 000D
    ? 21:14:16 Intro: 000A
    ? 21:14:16 Intro: FFFF
    ? 21:14:16 Intro: 0073 (s)
    ? 21:14:16 Intro: 0068 (h)
    ? 21:14:16 Intro: 0065 (e)
    ? 21:14:16 Intro: 006C (l)
    ? 21:14:16 Intro: 006C (l)
    ? 21:14:16 Intro: 000D
    ? 21:14:16 Intro: 000A
    ? 21:14:17 Intro: FFFF
    ? 21:14:18 Intro: 0073 (s)
    ? 21:14:18 Intro: 0068 (h)
    ? 21:14:18 Intro: 000D
    ? 21:14:18 Intro: 000A
    ? 21:14:18 Intro: FFFF
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 0069 (i)
    ? 21:14:18 Intro: 006E (n)
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 0075 (u)
    ? 21:14:18 Intro: 0073 (s)
    ? 21:14:18 Intro: 0079 (y)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 006F (o)
    ? 21:14:18 Intro: 0078 (x)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 0077 (w)
    ? 21:14:18 Intro: 0067 (g)
    ? 21:14:18 Intro: 0065 (e)
    ? 21:14:18 Intro: 0074 (t)
    ? 21:14:18 Intro: 003B (;)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 0069 (i)
    ? 21:14:18 Intro: 006E (n)
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 0075 (u)
    ? 21:14:18 Intro: 0073 (s)
    ? 21:14:18 Intro: 0079 (y)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 006F (o)
    ? 21:14:18 Intro: 0078 (x)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 0038 (8)
    ? 21:14:18 Intro: 0031 (1)
    ? 21:14:18 Intro: 0063 (c)
    ? 21:14:18 Intro: 0034 (4)
    ? 21:14:18 Intro: 0036 (6)
    ? 21:14:18 Intro: 0030 (0)
    ? 21:14:18 Intro: 0033 (3)
    ? 21:14:18 Intro: 0036 (6)
    ? 21:14:18 Intro: 0077 (w)
    ? 21:14:18 Intro: 0067 (g)
    ? 21:14:18 Intro: 0065 (e)
    ? 21:14:18 Intro: 0074 (t)
    ? 21:14:18 Intro: 003B (;)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 0069 (i)
    ? 21:14:18 Intro: 006E (n)
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 0075 (u)
    ? 21:14:18 Intro: 0073 (s)
    ? 21:14:18 Intro: 0079 (y)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 006F (o)
    ? 21:14:18 Intro: 0078 (x)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 0065 (e)
    ? 21:14:18 Intro: 0063 (c)
    ? 21:14:18 Intro: 0068 (h)
    ? 21:14:18 Intro: 006F (o)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 002D (-)
    ? 21:14:18 Intro: 006E (n)
    ? 21:14:18 Intro: 0065 (e)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 0027 (')
    ? 21:14:18 Intro: 005C (\)
    ? 21:14:18 Intro: 0078 (x)
    ? 21:14:18 Intro: 0030 (0)
    ? 21:14:18 Intro: 0031 (1)
    ? 21:14:18 Intro: 0038 (8)
    ? 21:14:18 Intro: 0031 (1)
    ? 21:14:18 Intro: 0063 (c)
    ? 21:14:18 Intro: 0034 (4)
    ? 21:14:18 Intro: 0036 (6)
    ? 21:14:18 Intro: 0030 (0)
    ? 21:14:18 Intro: 0033 (3)
    ? 21:14:18 Intro: 0036 (6)
    ? 21:14:18 Intro: 005C (\)
    ? 21:14:18 Intro: 0078 (x)
    ? 21:14:18 Intro: 0037 (7)
    ? 21:14:18 Intro: 0066 (f)
    ? 21:14:18 Intro: 0027 (')
    ? 21:14:18 Intro: 003B (;)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 0069 (i)
    ? 21:14:18 Intro: 006E (n)
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 0075 (u)
    ? 21:14:18 Intro: 0073 (s)
    ? 21:14:18 Intro: 0079 (y)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 006F (o)
    ? 21:14:18 Intro: 0078 (x)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 0070 (p)
    ? 21:14:18 Intro: 0072 (r)
    ? 21:14:18 Intro: 0069 (i)
    ? 21:14:18 Intro: 006E (n)
    ? 21:14:18 Intro: 0074 (t)
    ? 21:14:18 Intro: 0066 (f)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 0027 (')
    ? 21:14:18 Intro: 005C (\)
    ? 21:14:18 Intro: 0030 (0)
    ? 21:14:18 Intro: 0030 (0)
    ? 21:14:18 Intro: 0032 (2)
    ? 21:14:18 Intro: 0038 (8)
    ? 21:14:18 Intro: 0031 (1)
    ? 21:14:18 Intro: 0063 (c)
    ? 21:14:18 Intro: 0034 (4)
    ? 21:14:18 Intro: 0036 (6)
    ? 21:14:18 Intro: 0030 (0)
    ? 21:14:18 Intro: 0033 (3)
    ? 21:14:18 Intro: 0036 (6)
    ? 21:14:18 Intro: 005C (\)
    ? 21:14:18 Intro: 0031 (1)
    ? 21:14:18 Intro: 0037 (7)
    ? 21:14:18 Intro: 0037 (7)
    ? 21:14:18 Intro: 0027 (')
    ? 21:14:18 Intro: 003B (;)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 0069 (i)
    ? 21:14:18 Intro: 006E (n)
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0065 (e)
    ? 21:14:18 Intro: 0063 (c)
    ? 21:14:18 Intro: 0068 (h)
    ? 21:14:18 Intro: 006F (o)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 002D (-)
    ? 21:14:18 Intro: 006E (n)
    ? 21:14:18 Intro: 0065 (e)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 0027 (')
    ? 21:14:18 Intro: 005C (\)
    ? 21:14:18 Intro: 0078 (x)
    ? 21:14:18 Intro: 0030 (0)
    ? 21:14:18 Intro: 0033 (3)
    ? 21:14:18 Intro: 0038 (8)
    ? 21:14:18 Intro: 0031 (1)
    ? 21:14:18 Intro: 0063 (c)
    ? 21:14:18 Intro: 0034 (4)
    ? 21:14:18 Intro: 0036 (6)
    ? 21:14:18 Intro: 0030 (0)
    ? 21:14:18 Intro: 0033 (3)
    ? 21:14:18 Intro: 0036 (6)
    ? 21:14:18 Intro: 005C (\)
    ? 21:14:18 Intro: 0078 (x)
    ? 21:14:18 Intro: 0037 (7)
    ? 21:14:18 Intro: 0066 (f)
    ? 21:14:18 Intro: 0027 (')
    ? 21:14:18 Intro: 003B (;)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0075 (u)
    ? 21:14:18 Intro: 0073 (s)
    ? 21:14:18 Intro: 0072 (r)
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 0069 (i)
    ? 21:14:18 Intro: 006E (n)
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0070 (p)
    ? 21:14:18 Intro: 0072 (r)
    ? 21:14:18 Intro: 0069 (i)
    ? 21:14:18 Intro: 006E (n)
    ? 21:14:18 Intro: 0074 (t)
    ? 21:14:18 Intro: 0066 (f)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 0027 (')
    ? 21:14:18 Intro: 005C (\)
    ? 21:14:18 Intro: 0030 (0)
    ? 21:14:18 Intro: 0030 (0)
    ? 21:14:18 Intro: 0034 (4)
    ? 21:14:18 Intro: 0038 (8)
    ? 21:14:18 Intro: 0031 (1)
    ? 21:14:18 Intro: 0063 (c)
    ? 21:14:18 Intro: 0034 (4)
    ? 21:14:18 Intro: 0036 (6)
    ? 21:14:18 Intro: 0030 (0)
    ? 21:14:18 Intro: 0033 (3)
    ? 21:14:18 Intro: 0036 (6)
    ? 21:14:18 Intro: 005C (\)
    ? 21:14:18 Intro: 0031 (1)
    ? 21:14:18 Intro: 0037 (7)
    ? 21:14:18 Intro: 0037 (7)
    ? 21:14:18 Intro: 0027 (')
    ? 21:14:18 Intro: 003B (;)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 0069 (i)
    ? 21:14:18 Intro: 006E (n)
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 0075 (u)
    ? 21:14:18 Intro: 0073 (s)
    ? 21:14:18 Intro: 0079 (y)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 006F (o)
    ? 21:14:18 Intro: 0078 (x)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 0074 (t)
    ? 21:14:18 Intro: 0066 (f)
    ? 21:14:18 Intro: 0074 (t)
    ? 21:14:18 Intro: 0070 (p)
    ? 21:14:18 Intro: 003B (;)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 0069 (i)
    ? 21:14:18 Intro: 006E (n)
    ? 21:14:18 Intro: 002F (/)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 0075 (u)
    ? 21:14:18 Intro: 0073 (s)
    ? 21:14:18 Intro: 0079 (y)
    ? 21:14:18 Intro: 0062 (b)
    ? 21:14:18 Intro: 006F (o)
    ? 21:14:18 Intro: 0078 (x)
    ? 21:14:18 Intro: 0020 ( )
    ? 21:14:18 Intro: 0038 (8)
    ? 21:14:18 Intro: 0031 (1)
    ? 21:14:18 Intro: 0063 (c)
    ? 21:14:18 Intro: 0034 (4)
    ? 21:14:18 Intro: 0036 (6)
    ? 21:14:18 Intro: 0030 (0)
    ? 21:14:18 Intro: 0033 (3)
    ? 21:14:18 Intro: 0036 (6)
    ? 21:14:18 Intro: 0074 (t)
    ? 21:14:18 Intro: 0066 (f)
    ? 21:14:18 Intro: 0074 (t)
    ? 21:14:18 Intro: 0070 (p)
    ? 21:14:18 Intro: 003B (;)
    ? 21:14:18 Intro: 000D
    ? 21:14:18 Intro: 000A
    ? 21:14:19 Intro: FFFF
    ? 21:14:19 Intro: 000D
    ? 21:14:19 Intro: 000A
    ? 21:14:21 [ModemDebug] Sending <CR><CR>
    ? 21:14:21 [ModemDebug] Sending Init-1
    ? 21:14:21 [ModemDebug] Done (OK)

    how about an aquario/SATORI variant??

    = 21:38:08 RING
    ? 21:38:08 [ModemDebug] Sending first answer string
    = 21:38:09 CONNECT 57600/ARQ/TEL FROM 170.233.123.11
    ? 21:38:10 Intro: FFFF
    ? 21:38:11 Intro: FFFF
    ? 21:38:11 Intro: 0072 (r)
    ? 21:38:11 Intro: 006F (o)
    ? 21:38:11 Intro: 006F (o)
    ? 21:38:11 Intro: 0074 (t)
    ? 21:38:11 Intro: 000D
    ? 21:38:11 Intro: 000A
    ? 21:38:12 Intro: FFFF
    ? 21:38:13 Intro: FFFF
    ? 21:38:14 Intro: FFFF
    ? 21:38:14 Intro: 0061 (a)
    ? 21:38:14 Intro: 0071 (q)
    ? 21:38:14 Intro: 0075 (u)
    ? 21:38:14 Intro: 0061 (a)
    ? 21:38:14 Intro: 0072 (r)
    ? 21:38:14 Intro: 0069 (i)
    ? 21:38:14 Intro: 006F (o)
    ? 21:38:14 Intro: 000D
    ? 21:38:14 Intro: 000A
    ? 21:38:15 Intro: FFFF
    ? 21:38:16 Intro: FFFF
    ? 21:38:16 Intro: FFFF
    ? 21:38:17 Intro: FFFF
    ? 21:38:17 Intro: 0065 (e)
    ? 21:38:17 Intro: 006E (n)
    ? 21:38:17 Intro: 0061 (a)
    ? 21:38:17 Intro: 0062 (b)
    ? 21:38:17 Intro: 006C (l)
    ? 21:38:17 Intro: 0065 (e)
    ? 21:38:17 Intro: 000D
    ? 21:38:17 Intro: 000A
    ? 21:38:17 Intro: 0073 (s)
    ? 21:38:17 Intro: 0079 (y)
    ? 21:38:17 Intro: 0073 (s)
    ? 21:38:17 Intro: 0074 (t)
    ? 21:38:17 Intro: 0065 (e)
    ? 21:38:17 Intro: 006D (m)
    ? 21:38:17 Intro: 000D
    ? 21:38:17 Intro: 000A
    ? 21:38:17 Intro: 0073 (s)
    ? 21:38:17 Intro: 0068 (h)
    ? 21:38:17 Intro: 0065 (e)
    ? 21:38:17 Intro: 006C (l)
    ? 21:38:17 Intro: 006C (l)
    ? 21:38:17 Intro: 000D
    ? 21:38:17 Intro: 000A
    ? 21:38:17 Intro: 0073 (s)
    ? 21:38:17 Intro: 0068 (h)
    ? 21:38:17 Intro: 000D
    ? 21:38:17 Intro: 000A
    ? 21:38:17 Intro: 0070 (p)
    ? 21:38:17 Intro: 0069 (i)
    ? 21:38:17 Intro: 006E (n)
    ? 21:38:17 Intro: 0067 (g)
    ? 21:38:17 Intro: 0020 ( )
    ? 21:38:17 Intro: 003B (;)
    ? 21:38:17 Intro: 0020 ( )
    ? 21:38:17 Intro: 0073 (s)
    ? 21:38:17 Intro: 0068 (h)
    ? 21:38:17 Intro: 000D
    ? 21:38:17 Intro: 000A
    ? 21:38:18 Intro: FFFF
    ? 21:38:18 Intro: 002F (/)
    ? 21:38:18 Intro: 0062 (b)
    ? 21:38:18 Intro: 0069 (i)
    ? 21:38:18 Intro: 006E (n)
    ? 21:38:18 Intro: 002F (/)
    ? 21:38:18 Intro: 0062 (b)
    ? 21:38:18 Intro: 0075 (u)
    ? 21:38:18 Intro: 0073 (s)
    ? 21:38:18 Intro: 0079 (y)
    ? 21:38:18 Intro: 0062 (b)
    ? 21:38:18 Intro: 006F (o)
    ? 21:38:18 Intro: 0078 (x)
    ? 21:38:18 Intro: 0020 ( )
    ? 21:38:18 Intro: 0053 (S)
    ? 21:38:18 Intro: 0041 (A)
    ? 21:38:18 Intro: 0054 (T)
    ? 21:38:18 Intro: 004F (O)
    ? 21:38:18 Intro: 0052 (R)
    ? 21:38:18 Intro: 0049 (I)
    ? 21:38:18 Intro: 000D
    ? 21:38:18 Intro: 000A
    ? 21:38:19 Intro: FFFF
    ? 21:38:19 Intro: 000D
    ? 21:38:19 Intro: 000A
    ? 21:38:22 [ModemDebug] Sending <CR><CR>
    ? 21:38:22 [ModemDebug] Sending Init-1
    ? 21:38:23 [ModemDebug] Done (OK)


    )\/(ark

    Always Mount a Scratch Monkey
    Do you manage your own servers? If you are not running an IDS/IPS yer doin' it wrong...
    ... Any friggin idiot could understand that. - Einstein, 1938
    ---
    * Origin: (1:3634/12.73)
  • From Nightfox@1:103/705 to mark lewis on Sat Sep 9 20:55:46 2017
    Re: Repeated guest logins from the same place
    By: mark lewis to Nightfox on Sat Sep 09 2017 01:20 am

    it is the same set of bots and variants, man... they are not going to go away... i do really wish that ""you guys"" would put a fido mailer in frontt of your BBSes and let it answer the connections because then you would see exactly what is going on and it would buffer it a little from the BBS... then you would see that they are connecting and immediately sending a username and a password without waiting for any prompts... they are trying to load a command shell on what they think is a vulnerable IoT device... they are assuming that the shell is loading and then they are issuing commands... you guys are seeing these shell commands being stuffed

    IMO, Synchronet already has fairly good protections against this stuff, so I'm not sure a FIDO mailer is really necessary. Any bot that is trying to send these usernames and passwords isn't going to get in because most likely, the username & password combination they're sending don't exist on the BBS. Synchronet will just reject their login attempt. They won't be able to run a command shell that way. So I don't think they're really doing any harm.

    Nightfox

    ---
    * Synchronet * Digital Distortion: digitaldistortionbbs.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From mark lewis@1:3634/12.73 to Nightfox on Sun Sep 10 09:03:56 2017

    On 2017 Sep 09 20:55:46, you wrote to me:

    it is the same set of bots and variants, man... they are not going to
    go away... i do really wish that ""you guys"" would put a fido mailer
    in frontt of your BBSes and let it answer the connections because
    then you would see exactly what is going on and it would buffer it a
    little from the BBS... then you would see that they are connecting
    and immediately sending a username and a password without waiting for
    any prompts... they are trying to load a command shell on what they
    think is a vulnerable IoT device... they are assuming that the shell
    is loading and then they are issuing commands... you guys are seeing
    these shell commands being stuffed

    IMO, Synchronet already has fairly good protections against this
    stuff, so I'm not sure a FIDO mailer is really necessary.

    i didn't say having a FTN mailer was necessaary... i said it was something that
    actually allows the operator to view what's going on instead of all this guessing about what's really going on... hell, take a terminal program like telix or procomm, set it for autoanswer and enable capture mode... put it on port 23 and watch the bots connect and spew... it is all recorded in the capture... the main goal is to be able to /see/ what's going on and quit the guessing and wailing about it...

    Any bot that is trying to send these usernames and passwords isn't

    FWIW: they are not trying... they are doing ;)

    going to get in because most likely, the username & password
    combination they're sending don't exist on the BBS. Synchronet will
    just reject their login attempt. They won't be able to run a command shell that way. So I don't think they're really doing any harm.

    while this is true, it is not the point of my post(s) on the subject... too many are apparently not understanding why they are seeing certain text in certain fields... by seeing what is actually going on and understanding how the
    BBS is processing what is being sent, one can easily understand why they might see "shell" in the location field... and then there's the thing about hoping they will go away... that ain't gonna happen... to be honest, i'm surprised it has taken them this long to start being a bother to us BBS operators... there are scans and probes going on all the time on all the common ports...

    )\/(ark

    Always Mount a Scratch Monkey
    Do you manage your own servers? If you are not running an IDS/IPS yer doin' it wrong...
    ... Another great idea from the man who brought you Beer Milkshakes!
    ---
    * Origin: (1:3634/12.73)
  • From KK4QBN@1:103/705 to mark lewis on Sun Sep 10 10:07:34 2017
    Re: Repeated guest logins from the same place
    By: mark lewis to Nightfox on Sun Sep 10 2017 09:03:56

    while this is true, it is not the point of my post(s) on the subject... too many are apparently not understanding why they are seeing certain text in certain fields... by seeing what is actually going on and understanding how the BBS is processing what is being sent, one can easily understand why they might see "shell" in the location field... and then there's the thing about hoping they will go away... that ain't gonna happen... to be honest, i'm surprised it has taken them this long to start being a bother to us BBS operators... there are scans and probes going on all the time on all the common ports...


    We know they're bots and that theyre not going away, most of these posts (besides from new sysops) are just confirming that they suck and that they hate them.. nothing more..

    The first few string of posts did great in helping to get the nice security featured fast tracked (don't know if Rob was going to add them or not), but it don't hurt for others to talk about it.

    We all have'nt gained 100% knowledge of these demons through Fido mailers, so we talk amongst each other.. and thruthfully this is the most traffic i've seen in a couple days :)

    --

    Tim Smith (KK4QBN)
    KK4QBN BBS

    ---
    * Synchronet * KK4QBN - kk4qbn.synchro.net - 7064229538 - Chatsworth GA USA
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Nightfox@1:103/705 to mark lewis on Sun Sep 10 12:56:30 2017
    Re: Repeated guest logins from the same place
    By: mark lewis to Nightfox on Sun Sep 10 2017 09:03 am

    thing about hoping they will go away... that ain't gonna happen... to be honest, i'm surprised it has taken them this long to start being a bother to us BBS operators... there are scans and probes going on all the time on all the common ports...

    I've seen bots try to get onto my BBS for years, but only recently have I started noticing the bot using "shell" and the many repeated guest logins from the same location. So it's not that it's just now started being a bother, I just haven't seen those patterns until recently. And I actually don't feel like it's much of a bother, since I don't think they're actually doing any harm - I was mainly just curious. The biggest thing they're doing is just filling up my BBS log with their login attempts.

    Nightfox

    ---
    * Synchronet * Digital Distortion: digitaldistortionbbs.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Nightfox@1:103/705 to KK4QBN on Sun Sep 10 13:08:56 2017
    Re: Repeated guest logins from the same place
    By: KK4QBN to Nightfox on Fri Sep 08 2017 05:48 pm

    A couple months ago, I was getting repeated guest logins every day
    using "shell" as their location. It was a known bot, but now I've
    been getting multiple repeated guest logins each day from the same
    location, but different locations each day or 2. Recently I noticed
    I was getting 5+ guest logins from Halifax, and yesterday and today
    I noticed my BBS has had at least 5 guest logins from Turkey, spread
    over at least 6 hours. I'm not sure if these are genuine users (or
    the same user) from the same country or if it's another bot. Has
    anyone else noticed this on their BBS?

    Not yet for me, I'm getting the confirmed bot hits (even with a password on the guest account, just not as many). but I have'nt seen this yet.

    Did they do anything or just hang araound?

    It seems one of them ran my ANSI viewer door and left, so it seems they're doing actual things. So they may be real users.

    Nightfox

    ---
    * Synchronet * Digital Distortion: digitaldistortionbbs.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Digital Man@1:103/705 to Nightfox on Sun Sep 10 19:54:38 2017
    Re: Repeated guest logins from the same place
    By: Nightfox to mark lewis on Sun Sep 10 2017 12:56 pm

    Re: Repeated guest logins from the same place
    By: mark lewis to Nightfox on Sun Sep 10 2017 09:03 am

    thing about hoping they will go away... that ain't gonna happen... to be honest, i'm surprised it has taken them this long to start being a bother to us BBS operators... there are scans and probes going on all the time on all the common ports...

    I've seen bots try to get onto my BBS for years, but only recently have I started noticing the bot using "shell" and the many repeated guest logins from the same location. So it's not that it's just now started being a bother, I just haven't seen those patterns until recently. And I actually don't feel like it's much of a bother, since I don't think they're actually doing any harm - I was mainly just curious. The biggest thing they're doing is just filling up my BBS log with their login attempts.

    I just committed a change to exec/logon.js. With this change, add "sh" and "shell" to your text/email.can file and any "Guest" that enters either of those strings for their email address will be immediately disconnected. I did the same for the "location" (using text/location.can), but either seems like it would effective at killing these bot connections.

    digital man

    Synchronet/BBS Terminology Definition #56:
    XOFF = Transmit Off (ASCII 19, Ctrl-S)
    Norco, CA WX: 80.9oF, 50.0% humidity, 3 mph ENE wind, 0.00 inches rain/24hrs --- SBBSecho 3.01-Win32
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Digital Man@1:103/705 to Nightfox on Sun Sep 10 19:55:44 2017
    Re: Repeated guest logins from the same place
    By: Nightfox to KK4QBN on Sun Sep 10 2017 01:08 pm

    Re: Repeated guest logins from the same place
    By: KK4QBN to Nightfox on Fri Sep 08 2017 05:48 pm

    A couple months ago, I was getting repeated guest logins every day
    using "shell" as their location. It was a known bot, but now I've
    been getting multiple repeated guest logins each day from the same
    location, but different locations each day or 2. Recently I noticed
    I was getting 5+ guest logins from Halifax, and yesterday and today
    I noticed my BBS has had at least 5 guest logins from Turkey, spread
    over at least 6 hours. I'm not sure if these are genuine users (or
    the same user) from the same country or if it's another bot. Has
    anyone else noticed this on their BBS?

    Not yet for me, I'm getting the confirmed bot hits (even with a password on the guest account, just not as many). but I have'nt seen this yet.

    Did they do anything or just hang araound?

    It seems one of them ran my ANSI viewer door and left, so it seems they're doing actual things. So they may be real users.

    Or the bot just happened to send a bash/sh command that would by chance start your ANSI viewer door. <shrug>

    digital man

    Synchronet "Real Fact" #67:
    SEXYZ is as a 32-bit replacement for [F]DSZ, CE-XYZ and other protocol drivers. Norco, CA WX: 80.9oF, 50.0% humidity, 3 mph ENE wind, 0.00 inches rain/24hrs --- SBBSecho 3.01-Win32
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From KK4QBN@1:103/705 to Digital Man on Mon Sep 11 14:10:56 2017
    Re: Repeated guest logins from the same place
    By: Digital Man to Nightfox on Sun Sep 10 2017 19:54:38

    I just committed a change to exec/logon.js. With this change, add "sh" and "shell" to your text/email.can file and any "Guest" that enters either of those strings for their email address will be immediately disconnected. I did the same for the "location" (using text/location.can), but either seems like it would effective at killing these bot connections.


    Beautiful, now I don't have to do away with my Guest account... The BOTS are stupid.. But I truly believe they are learning from the BBS systems, they are getting further into the menu system, and even wall apps then ever before.

    I need to make sur eI have'nt made any mods to logon.js, does'nt CVS, or even the sbbs code now add your modifications to new addition.

    I've noticed on some CVS update like

    1.5 >>>>>>>>>> logon.js date

    or something to that extend with older code?

    Have even saw it in my Ansi/Ascii menu files.

    --

    Tim Smith (KK4QBN)
    KK4QBN BBS

    ---
    * Synchronet * KK4QBN - kk4qbn.synchro.net - 7064229538 - Chatsworth GA USA
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Digital Man@1:103/705 to KK4QBN on Mon Sep 11 16:11:02 2017
    Re: Repeated guest logins from the same place
    By: KK4QBN to Digital Man on Mon Sep 11 2017 02:10 pm

    I've noticed on some CVS update like

    1.5 >>>>>>>>>> logon.js date

    or something to that extend with older code?

    That looks like a merge conflict. A "cvs status <filename>" will confirm if that is the case or not. You must reserve conflicts manually (by editing the file) or if you don't care about your local changes, you can force an update to overwrite the local file (not merge).

    digital man

    Synchronet "Real Fact" #59:
    Synchronet apparel and merchandise can be purchased at cafepress.com/synchronet Norco, CA WX: 92.9oF, 40.0% humidity, 5 mph NE wind, 0.00 inches rain/24hrs
    --- SBBSecho 3.01-Win32
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From mark lewis@1:3634/12.73 to KK4QBN on Mon Sep 11 19:52:54 2017

    On 2017 Sep 11 14:10:56, you wrote to Digital Man:

    I just committed a change to exec/logon.js. With this change, add
    "sh" and "shell" to your text/email.can file and any "Guest" that
    enters either of those strings for their email address will be
    immediately disconnected. I did the same for the "location" (using
    text/location.can), but either seems like it would effective at
    killing these bot connections.

    Beautiful, now I don't have to do away with my Guest account... The
    BOTS are stupid..

    yes, they are...

    But I truly believe they are learning from the BBS systems, they are getting further into the menu system, and even wall apps then ever
    before.

    that is only the luck of the draw when the BBS processes the keystrokes that the bot spews (and i use that term specifically) their command strings... it is
    very possible that if hotkeys are enabled, the stuff they spew could easily trigger menu options... but those guys are not interested in BBS systems at all... i have way too many logs of their traffic here to not have noticed a switch in their SOP...

    )\/(ark

    Always Mount a Scratch Monkey
    Do you manage your own servers? If you are not running an IDS/IPS yer doin' it wrong...
    ... Goodness! That was close! I almost gave a damn.
    ---
    * Origin: (1:3634/12.73)
  • From KK4QBN@1:103/705 to Digital Man on Mon Sep 11 20:07:40 2017
    Re: Repeated guest logins from the same place
    By: Digital Man to KK4QBN on Mon Sep 11 2017 16:11:02

    That looks like a merge conflict. A "cvs status <filename>" will confirm if that is the case or not. You must reserve conflicts manually (by editing the file) or if you don't care about your local changes, you can force an update to overwrite the local file (not merge).


    Ok, thats what I though it was, and I'v doing a bit of both (depending on situation). no worries.. I've actually set a mirror SBBS source code directory to update newly updated files (like logon.js) that way I can look through the,m to be sure I'm not overwriting customizations that I have built into the system..

    Thanks@!

    --

    Tim Smith (KK4QBN)
    KK4QBN BBS

    ---
    * Synchronet * KK4QBN - kk4qbn.synchro.net - 7064229538 - Chatsworth GA USA
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)