[Xitami] Fw: Posible Conflit with Tor's Proxy

Thu Nov 16 16:00:56 CET 2006

There are 2 ways that this has happened. One is a real hack, and the other
is simple hole in a program I wrote.
1) I discovered programs that allow telnet access though http, database
manipulation, and email management. that were not put on the server Not by
me. I have removed these programs, changed the passwords. So far they have
not returned, but that my be because of #2.
2) The hacker had figured out how to use one of my programs to send out his
mail. Since I wrote it. I was able to modify it to recorded his actions,
store the %ENV's. (I'm still trying to finger out how you are able to
acquire a visitors email address). that's when I noticed the his IPs were
never the same twice, plus no response from cookies, no calling for images
from the web page the script creates, and that's what lead me to tor.
I don't see any other actions they have taken when they were on my server,
and since they think there getting one over on me by using one of my own
scripts (which is accessible though http, so they don't require full
accesses to my box), I've got the advantage, so far. As long as they keep
trying to submit enters to my script, I still have the opportunity to track
them down.

Can you tell me more about DNSBL?

Stefan.

----- Original Message ----- 
From: "Gene" <fuzzydog at whiteshepherd.net>
To: "Xitami Users General Discussion" <xitami at lists.xitami.org>
Sent: Thursday, November 16, 2006 2:00 AM
Subject: Re: [Xitami] Fw: Posible Conflit with Tor's Proxy

> There are DNSBLs for the detection of Tor proxies and well as published
> IP lists.  If you are being hacked it's not just a Tor problem though.
> It sounds like he has found a security hole in your system he could
> access just as easily from another proxy (exploited machine, worm,
> etc).  How is he sending out spam?
>
> nonlin wrote:
> > Thank you all for your feedback.
> >
> > Yes, Spamming is the problem, The Hacker had been using tor (or
something
> > Like it) to get my Cobult server to send out his spam. So that why I'm
> > trying to learn about it. So I can find a way to Identify an attack and
stop
> > it.
> >
> > Thanks again and I will let you know if I have more questions.
> >
> > ----- Original Message ----- 
> > From: "Gene" <fuzzydog at whiteshepherd.net>
> > To: "Xitami Users General Discussion" <xitami at lists.xitami.org>
> > Sent: Wednesday, November 15, 2006 11:33 AM
> > Subject: Re: [Xitami] Fw: Posible Conflit with Tor's Proxy
> >
> >
> >
> >> Have you thought of setting port 85 as the standard connect port for
> >> Xitami?  As far as Tor our web and IRC servers ban Tor on connect.
> >> We've had to many problems with spammers using it for abuse.
> >>
> >> nonlin wrote:
> >>
> >>> Dear Friends,
> >>>
> >>>     I asked this this question a few weeks ago but no one ansered
> >>> back. So let me try again.
> >>>
> >>> ----- Original Message -----
> >>> *From:* nonlin <mailto:nonlin at erols.com>
> >>> *To:* Xitami Users General Discussion <mailto:xitami at lists.xitami.org>
> >>> *Sent:* Tuesday, October 31, 2006 12:35 AM
> >>> *Subject:* Posible Conflit with Tor's Proxy
> >>>
> >>> Dear Friends,
> >>>
> >>>     *I have a grayhat situation:*
> >>>
> >>>     I have a Cobut Server that a hacker has found a way to use to send
> >>> out his spam though. I have finger out most of what I need to do to
> >>> stop him. But I believe that it will only make him more persistent to
> >>> find another way to use my server. So I need to take this opportunity
> >>> to learn how to make my server more secure. One of the thing that I
> >>> have learned is that most hackers use  a system to "Tor" to Protect
> >>> there identity. So I need to install a copy of Tor on my Local
> >>> computer (which also had Xitami) so I can learn how it works, what the
> >>> effects on my Cobut Server are so I can learn how to identity its use,
> >>> and if there is a way I can defeat it.
> >>>
> >>>     *HEAR IS MY PROBLEM.*
> >>>
> >>>     I was just about to install Tor on my Computer When I noticed that
> >>> there Privoxy 3.0.3 (witch is part of the Tor packeg) Happen to work
> >>> like a server and used Localhost, and the ip 127.0.0.1, the same
> >>> address my Xitami uses, (See instructions for yourself
> >>> http://tor.eff.org/docs/tor-doc-web.html.en) . _*Now my question*_.
> >>> Will there be a conflict between Xitami and the Provoxy, and if so dos
> >>> anyone know how to move the Provoxy out of the way, Since Xitami if
> >>> Primary on my machine and I have written dozens of script referring to
> >>> Xitami as the Localhost.
> >>>
> >>>
> >>> Sincerely,
> >>>
> >>> Stefan
>
>>> ------------------------------------------------------------------------
> >>>
> >>>
> >>> --
> >>> Xitami Users Mailing List -- For Xitami support
> >>> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
> >>>
> >> --
> >> Xitami Users Mailing List -- For Xitami support
> >> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
> >>
> >
> >
> > --
> > Xitami Users Mailing List -- For Xitami support
> > To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami
> >
> >
>
>
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami