219
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 20 Jun 2023
219 points (100.0% liked)
Technology
37728 readers
612 users here now
A nice place to discuss rumors, happenings, innovations, and challenges in the technology sphere. We also welcome discussions on the intersections of technology and society. If it’s technological news or discussion of technology, it probably belongs here.
Remember the overriding ethos on Beehaw: Be(e) Nice. Each user you encounter here is a person, and should be treated with kindness (even if they’re wrong, or use a Linux distro you don’t like). Personal attacks will not be tolerated.
Subcommunities on Beehaw:
This community's icon was made by Aaron Schneider, under the CC-BY-NC-SA 4.0 license.
founded 2 years ago
MODERATORS
Hunh.
I just had a surge of user registrations on my instance.
All passed the captcha. All passed the email validation.
All, had a valid-sounding response.
I am curious to know if they are actual users, or.... if I just became the host of a spam instance. :-/
Doesn't appear to be an easy way to determine.
Hmmm, I'd check the following:
With those answers I should be able to tell if it's the same or similar attacker getting more sophisticated.
Some patterns I noticed in the attacks I've received:
Some vulnerabilities I know that can be exploited and would expect to see next:
But, here is the interesting part- Other than a few people I have personally invited, I don't think anyone else has ever requested to join.
Then, out of the blue, boom, a ton of requests. And- then, nothing followed after.
The responses, sounded human enough. spez bad, reddit sinking, etc.
But, the traffic itself, didn't follow... what I would expect from social media spreading. /shrugs.
Huh, that is interesting, yeah, that pattern is very anomalous. If you have DB access you can try to run this query to return all un-verified users and see if you can identify if the email activations are being completed:
SELECT p.id, p.name, l.email FROM person AS p LEFT JOIN local_user AS l ON p.id=l.person_id WHERE p.local=true AND p.banned=false AND l.email_verified='f'Only 7 accounts still pending, 2 of which, are unrelated to the above flood.
The email address are left out for privacy- however, they are EXTREMELY normal sounding email addresses.
Based on the provided emails, usernames, and request messages- i'd say, it certainly looks like legit users.
Just- very odd of the timing.
5 huh? That's actually noteable. So far I haven't seen a real human user take longer than a couple of hours to validate. Human registrations on my instance seem to have a 30% attrition. That is, of 10 real human users, I can reasonably expect that 3 won't complete the flow. It seems like your case might be nearing 40-50% which isn't unheard of but couple this with the quickness that these accounts were created - I think you are looking at bots.
The kicker is, though, if one of them IS a real user, it's going to be almost impossible to find out.
This is indeed getting more sophisticated.
I wish I could see this time period on a cloudflare security dashboard, I'm sure there could be a few more indicators there.
Didn't really see anything that stood out there either. A handful of users accessing via tor, but, thats about it.
Ended up turning the security policy from low, back up a bit though, forgot I turned it down while troubleshooting some federation issues.
Oh! I just remembered something. Isn't there a site that recommends a lemmy instance? Might it make sense that multiple users found your website because they change the recommendation to distribute new users to smaller instances (hourly perhaps)? Does that sort of pattern hold in this case?
I checked join-lemmy.org right after this happened- and a few other times. Refreshed multiple times.
To date- I have never seen my instance listed up there.
Interesting, I definitely see mine. I'm wayyyyyy at the bottom of the popular section, (likely due to the 9 bots that added themselves before I banned the accounts.).
I wonder if one of the settings in your firewall is blocking that particular bot?
I don't recall when I would've done the same, but I do recall not being on join-lemmy until - well - now actually.
/shrugs. isn't much in the way of firewall logic, even at the cloudflare logic. Although- only :443 is actually forwarded to go anywhere.