Announcement

Collapse
No announcement yet.

[Cancelled] Troll/ip-tracker, detect multiple accounts/trolls

Collapse
This topic is closed.
X
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • [vBulletin 3.5-3.7] [Cancelled] Troll/ip-tracker, detect multiple accounts/trolls

    Licensed users can download this hack here.

    History


    In 2005 a forum was founded, for a short period of time that was intended to work as a service for people with a common interest - a reality show. The forum grew big and the traffic was very intensive. Moderators worked day and night to assist the forum. Traffic and events in the show made people show different kind of feelings and some of them showed this in strange ways. They said "I'd better register 10 nicknames, just to secure that noone can ban me". Sometimes, when they got banned, they registered new nicks and sometimes they switched ips but they didn't post anything the same day. Next day, they switched ip again and it suddenly got much harder to trace their nicks back to the start.

    In 2006, the forum opened again (new season) and we was prepared for this. A script, specialized to trace trolls, was written and the main purpose was to trace things that vBulletin missed. This plugin was requested at the vBulletin forums.


    Now, it's here, as a beta production - a trolltracker that stamps all visitors even if they don't post anything. It also, partially, checks if an ip-address can be traced from anonymous proxies by reading headers that proxies are sending to he server (HTTP_VIA and HTTP_X_FORWARDED_FOR).


    Templates to change (Optional): 3


    Attached

    trolltracker-2.0.1.zip - the main archive with the tracker and extras


    The archive

    The zip should contain the following files
    • The product, currently named product-trolltracker_beta.xml because of it's beta status
    • iptracker.php, the tool that makes it easier to trace nicknames and ip's
    • iptracker_search.php, htmlcode - the searchform that iptracker.php is using (old code that never used templates)
    • trollpost.php, a quite slow script that imports ip's and usernames from the post-table to make it possible to trace older data. (If you run this over a web-interface, it might not work, because of timeouts --screendump--)

    How to install
    1. Copy *.php to your forumroot
    2. Install the product code (choose overwrite if you're upgrading)
    3. Check the configuration from your admincp (settings for usergroups that can run the iptracker.php is made from there)
    Additional information


    Track older ips (2.0.x)


    If you want to import older posts, you can do that, but because of timeouts (and bad scripting) trollpost.php may timeout if you run the script from a web-browser. This part is, currently, unsupported, but if someone has any ideas here, feel free to notify me.

    OPM Support

    The ip-tracker supports RBL Monitor.


    How to use it

    Use the tracker by calling http://your-forum.com/iptracker.php


    Database


    The installation creates a table named user_troll for your forum.
    The FQDN-support also adds a table called user_trollresolver for the resolver cache (like the one used in the OPM monitor)

    Information and issues
    • There is no version 1.x - that version was private (this is not an issue)
    • It's still a beta, so bugs may still annoy us
    • Testing on vBulletin 3.6.0 rc1: Works fine
    • Importing posts with trollpost.php might give strange results if you are using the multiple account detector (AE): reports in forum that are posted with a specific userid makes it look like a troll is using other usernames too
    To do

    See CHANGELOG for full details


    Show the tracker in navbar (v2.0.1+)


    To show the tracker in the navbar (only for the admingroups that can be found in the options), edit your template 'navbar' and add this code where you want it to be shown:

    HTML Code:
     <if condition="$show['trolltracker']"><td class="vbmenu_control"><a href="iptracker.php">Trolltracker</a></td></if>
    I chose to put it in the end of navbar, right after this code:

    HTML Code:
            <if condition="$show['member']">
    <td class="vbmenu_control"><a href="login.php?$session[sessionurl]do=logout&amp;logouthash=$bbuserinfo[logouthash]" onclick="return log_out()">$vbphrase[log_out]</a></td>
            </if>
    How to show trolls in the onlinelist

    Edit template:
    whosonlinebit

    Find:
    </tr>

    Add above:
    HTML Code:
        <if condition="$show['trolldata'] AND $userinfo['trolldata'] != ''">
                <td class="alt1">
                $userinfo[trolldata]
                </td>
            </if>
    Edit template:
    WHOSONLINE

    Find:
    HTML Code:
    </tr>
    $onlinebits
    Add above:

    HTML Code:
        <if condition="$show['trolldata']">
                <td class="thead">
                <b>Trolldata</b>
                </td>
            </if>
    Support, help, contact

    Any questions, requests and bugreports can be sent to me by PM, mail or via threads at http://vbulletin.tornevall.net/


    Don't forget to install this plugin
    Attached Files
    Last edited by Tornevall; 2006-10-09, 10:41.
    -

  • #2
    A small database-bug sneaked into the trackercode, it should be fixed here (attachment at the bottom of this post). (So you don't have to wait for the next release)

    Referered link.





    Originally posted by Alfa1
    I am using 'vb9_ as table' prefix. Here is the error:

    Database error in vBulletin 3.5.4:

    Invalid SQL:
    SELECT COUNT(*) AS entries FROM vb9_ user_troll;

    MySQL Error : Table 'servername.vb9_' doesn't exist
    Ahh, a miss by me.

    Look for this code

    PHP Code:
    
    if (file_exists("./global.php")) {
            $sql_count = "SELECT COUNT(*) AS entries FROM " . TABLE_PREFIX . " user_troll"; 
    
    Replace with:

    PHP Code:
    if (file_exists("./global.php")) {
            $sql_count = "SELECT COUNT(*) AS entries FROM " . TABLE_PREFIX . "user_troll"; 
    
    ... then it should work.


    Or get a modified sorce from here
    Attached Files
    Last edited by Tornevall; 2006-06-24, 18:57.
    -

    Comment


    • #3
      Fixes and something to wait for...


      CHANGELOG


      2.0.3 [beta] (bonus release)
      • Autoblacklist banned users

      2.0.2 [beta]
      • Alerter caused blank page when PM-reporting disabled
      • Trolltracker now blocks other usernames too if there's a match with the list in options
      • Trolltracker now blocks linked IP-addresses listed in options
      2.0.1 [beta]
      • Added class="alt1" into tables in iptracker*.php
      • Added "exclude guests from result" in the iptracker (option that won't count users with id 0 - guests, etc)
      • Added report/alerter by PM/forum
      • Added field alert into database
      • Added autodetection on search (if a searchstring contains XX.XX.XX.XX it will be treated as an ip)
      • Done some minor changes to the userlink-function (the one that can bind new usernames to their old ones faster)
      • Fixed the userlink-lookup in iptracker.php (made details)
      • Added function to block specific nicknames when reaching the trigger limit
      • Using strftime for date/time-fields (Tested with vB 3.6)
      • Added search-depth in iptracker.php
      • Added "exclude rbl-results" in iptracker.php (Won't show proxies if any)
      • Added $show[trolltracker]-condition so the tracker can be shown for admingroups in templates
      • Added trolldata to who's online
      • Added highlighted searchresults for iptracker.php
      • Admins will now be excluded from the dupe-checker
      • Blocked users are now shown as blocked in "Who's Online"
      • Scanner using vbphrases instead
      • Queries to database rewritten (JOIN)
      • Added group for administration of the trackerdb (removal of entries)
      • FQDN Compares on undetected users
      To do
      • Add trolldupes.php - quickscan the database for duplicated nicknames and list them
      • iptables support (?)
      • Add exclude userids from scanner (mainly for fixing the AE-Tripper issue)
      • IRC/Eggdrop support for online-tracing and support
      Last edited by Tornevall; 2006-07-16, 04:03.
      -

      Comment


      • #4
        Due to the need of feedback, the first beta has now been released at http://www.vbulletin.org/forum/showthread.php?t=119695
        -

        Comment


        • #5
          Reported:

          The tracker won't let anybody in.

          Part 1
          Part 2

          Possible solution:

          It sounds like something happened, that shouldn't happen and something that must be fixed soon. Was the option for blocking trolls active?

          Can you edit your config.php, try add a line temporarily:

          define('DISABLE_HOOKS', 1);

          After that, you should be able to login, disable the product and get in again (just don't forget to remove the above line later ).

          I'll attach a modified xml that disables blocking of users until the next version is released, just to be sure that it won't happen again. If it was something else that happened, what messages did you see?


          The thread at vbulletin.org
          Attached Files
          -

          Comment


          • #6
            Updates -
            • It's now possible to remove false positives from the tracker - an extra admingroup are added for the purpose, so not everyone can do this
            • Alerts/reports via PM and forum are now finished and seem to work this far
            • Depth-scan is now more effective after replacing almost all SQL-Queries with JOIN's. This also means that blocking duplicate usernames/trolls will be more effective.
            Attached Files
            -

            Comment


            • #7
              Sv: [v3.5/v3.6] Troll/ip-tracker v2.0.1 beta

              Due to a smaller bug that caused a blank page when disabled PM-alerting only, there's now a 2.0.2 with some other fixes too

              2.0.2 [beta]
              • Alerter caused blank page when PM-reporting disabled
              • Trolltracker now blocks other usernames too if there's a match with the list in options
              • Trolltracker now blocks linked IP-addresses listed in options
              -

              Comment


              • #8
                Sv: [v3.5/v3.6] Troll/ip-tracker, Troll/ip-tracker, detect multiple accounts/trolls

                Bonus release:

                2.0.3 [beta]
                • Autoblacklist banned users
                Meaning, if a user is banned, the user can't even touch your forum anonymously (= not logged in) if there's an ipmatch.
                Attached Files
                Last edited by Tornevall; 2006-07-16, 04:20.
                -

                Comment


                • #9
                  Sv: [v3.5/v3.6] Troll/ip-tracker, Troll/ip-tracker, detect multiple accounts/trolls

                  Reported error update:


                  Invalid SQL:
                  SHOW COLUMNS FROM vb3_user_troll WHERE field != 'username';

                  Attachment:

                  A small fix for iptracker.php, in version 2.0.4

                  Hopefully the problem with SHOW COLUMNS is fixed here (replaced with an array instead). I've also added the file in the release at the top, if someone misses this post.

                  Debugging for selfchecking is added, but only for admins. Calling iptracker.php with those parameters should therefore work: ?self=1&selftest=<ip>&selfuser=<username>

                  Also known as "What the user see in the selfcheck"-debugging.


                  FQDN-checking in the selfchecker is also removed. The FQDN lookup should only be available for the tracking.
                  Attached Files
                  -

                  Comment


                  • #10
                    Sv: [v3.5/v3.6] Troll/ip-tracker, Troll/ip-tracker, detect multiple accounts/trolls

                    Changes for 2.0.4 that will be released as soon the caches has been tested:
                    • Using short-time cache to look for duplicates instead of scanning the whole database (based on cookietimeout)
                    • The above cache is used with the whos online-list too
                    • Added cache for alerts so reports only will be sent on changes in the usernames
                    • 2 phrases fixed
                    • Added username exclusions (usernames/userids that won't be blocked)
                    • Fixed the SHOW COLUMNS-problem in iptracker.php

                    If someone thinks that I have forgotten something, please tell me.
                    -

                    Comment


                    • #11
                      Sv: [v3.5/v3.6] Troll/ip-tracker, Troll/ip-tracker, detect multiple accounts/trolls

                      Reference

                      Ok I have found a bug:

                      Code:
                       Invalid SQL:
                      UPDATE user_troll SET timestamp = 1156627674, date = '2006-08-26', username =
                      'dabear's are #1', userid = '0', time = '17:27:54', opm = '0', imported = 0 WHERE
                      idx = '9830' AND deleted = 0 AND fqdn = 0 LIMIT 1;
                      
                      MySQL Error  : You have an error in your SQL syntax; check the manual that
                      corresponds to your MySQL server version for the right syntax to use near 's are
                      #1', userid = '0', time = '17:27:54', opm = '0', imported = 0 WHERE idx = ' at line
                      1
                      Error Number : 1064
                      Date         : Saturday, August 26th 2006 @ 05:27:54 PM
                      Script       : http://www.xxxxxxx.com/forums/register.php
                      Now this error is from anyone who uses an apostrophe in their username. The name I tried to register is "dabear's are #1"

                      This leaves us all open to a SQL attack..


                      Added to 2.0.4
                      • Fixed a serious injection problem
                      -

                      Comment


                      • #12
                        Sv: [vBulletin v3.5/v3.6] Troll/ip-tracker, detect multiple accounts/trolls [cancelle

                        This project closed Aug -07.

                        Referring to this information, the efficiency drops with the speed of a growing site; the bigger the site is, the more problems you get. It is now placed in the modification graveyard.

                        R.I.P
                        -

                        Comment

                        Working...
                        X