Anti hack/probing/bot ideas (after today's probing attempt)

SoulReaver

5 (5)

Posts: 149

Earned: 0.003 XMR

Tipped: 0 XMR

Oct 14 23:43

(1)

(0)

#2326

I have reason to believe we just had our first probing attempt that I'm aware of. Someone spun up an account and posted a "listing" that wasn't a listing at all, just every field stuffed w/ junk to test whether the site would run code they typed in instead of just showing it as text. I hope nothing ran, IDK lol?

Also dropped a test thread here on the forum and then left a reply calling it an "authorized XSS assessment". Nobody authorized anything AFAIK. I'd consider this type of testing done w/o permits on the site potentially malicious/dangerous.
https://xmrbazaar.com/forum/topic/400/

There are some ways we can potentially slow these kind of probing type of attempts.

1. Proof of work on signup and on posting a listing. Something like Anubis or mCaptcha.
Wastes some CPU cycles, adds some friction.

2. New accounts can't publish right away. Either a short waiting period or the first listing sits in review before it goes live. Well obviously this's a big friction.

3. A small refundable XMR bond to post. Same idea as the bond/escrow thing for new swappers, and it's the most Monero native option I can think of RN.

None of this stops one determined person. It can delay/slow someone just asking some LLM to "go try to break this site" potentially.

Thoughts?

Edited: Oct 14 23:51

Tip Monero to SoulReaver

8AJJt5FoxgKapYk69YgSLXPaSBYd88hghg32ie25ZXGSFFYgVeKT4ytLkPoCsnJGE3gQninbK6JDUAX4qNCRUqfXFwXe3Hm

Publish Tip to SoulReaver

Please login to publish your tip

nobswebdev

5 (296)

Posts: 99

Earned: 0 XMR

Tipped: 0 XMR

Oct 15 00:01

(1)

(0)

#2328

Reply to post #2326

I would just make sure there is no XSS or any other vulnerability on the website. You can't reliably stop hackers from searching for vulnerabilities.

Tip Monero to nobswebdev

86zpN2bx83rKbhk1WffeHy8qbGYtr6p3sj27fHnJ95XV7hLqmbq9Vix1jo85Fs4JQvZHemPEPq5x6CbmsuQGVrzj6NHsQVb

Publish Tip to nobswebdev

Please login to publish your tip

CANADA

N/A (0)

Posts: 20

Earned: 0 XMR

Tipped: 0 XMR

Oct 17 00:06

(0)

(1)

#2361

I enjoy observing the huge discrepancies betweens devs and actual users, business onwers and so on when it comes to delivering products. The devs are smart no doubt, they know programming and some know math but when it comes to business, user experience, or reasons for doing something, they are absolutely retarded. I'm not reffering to here so don't cry yet, it;s just a general observation from a decade or two of reading the forums around tech and btc.

Now prepare to cry

Ideas 1-3 are bad, they do nothing but impede the users. Having someone come to your site and test your form has been happening for 20 years. They often don't do much else. There is no sense holding back posts either, the community is pretty good at flagging, nobody buys new scammers stuff and they go away after being deleted. Bots do very little harm. I often look at logs with thousands of tests a day, nothing happens. that's like the resources of a grain of rice. And don't even mention anubis, when I see that rodent it's a quick X and I'm off to another search.

If you want people to buy things and sell things, make it is smooth and hassle free as possible. people often leave just because of an uncomfortable feel and too many bells and whistles. I still buy and sell more on craigslist than anything because it only servers one purpose, to buy and sell without accounts, captchas, trackers etc..

I would not bother with fixes until there is a noticable financial loss or gross abuse from scammers/bots.. I don't see that, just a handful of bad users doing scams.

Tip Monero to CANADA

CANADA has not setup a {COIN} tip address yet.

Publish Tip to CANADA

CANADA has not setup a {COIN} tip address yet.

SoulReaver

5 (5)

Posts: 149

Earned: 0.003 XMR

Tipped: 0 XMR

Oct 19 10:47

(0)

#2415

Reply to post #2361

"nothing happens until there's a noticeable financial loss" is terrible security policy. XSS can expose sessions, enable account actions or compromise other users without an immediate, visible financial loss.

Your Craigslist example actually supports the principle of proportionate controls, not doing nothing.
Craigslist literally uses conditional friction:

- Some posts require email or phone verification, not every user on every action.

- Automated systems can also flag and remove posts.

Craigslist is an example of balancing usability and abuse prevention, not proof that it has no friction.

"I would not bother with fixes until there is a noticable financial loss or gross abuse" is like the most security unaware take, ever, lol.

I know of no serious platform that's happy to let people fiddle with its systems unchecked. Ideally, suspicious activity gets detected automatically, logged and blocked. That's basic security practice. You might not be doing anything malicious, just useless probing, but you're still choosing to actively test someone else's security without permission. No serious platform should be expected to tolerate that or accept the risk just because most attempts fail.

Tip Monero to SoulReaver

8AJJt5FoxgKapYk69YgSLXPaSBYd88hghg32ie25ZXGSFFYgVeKT4ytLkPoCsnJGE3gQninbK6JDUAX4qNCRUqfXFwXe3Hm

Publish Tip to SoulReaver

Please login to publish your tip

CANADA

N/A (0)

Posts: 20

Earned: 0 XMR

Tipped: 0 XMR

Oct 19 15:11

(0)

#2417

Reply to post #2415

I guess it's location based on craigslist because none of that happens to me.. I'm sure they have some internal account for users but I can list or respond anytime with one click.

You're complaining about a 404 or form submit and those are not security risks. They are looking for pages and files because poorly designed web sites and sloppy webmaster leave loose files around. Sometimes they are worthwhile like stats or sql front end or if you're really bad /wallet.txt but I have never found this to be a problem, it's just annoying to find in the logs.

Have you ever heard of iptables or fail2ban,. when someone requests a bunch of 404 you put them in iptables and they are blocked at the top level. If you're so concerned about security you can put the known bad subnets in there to start.

Tip Monero to CANADA

CANADA has not setup a {COIN} tip address yet.

Publish Tip to CANADA

CANADA has not setup a {COIN} tip address yet.

XmrBazaar

Anti hack/probing/bot ideas (after today's probing attempt)