zenHttpbl Refreshed!

micheall

So, as I had a bit of time tonight, I dusted off the old coding fingers and dabbled with the zenHttpbl plugin. I did make a few minor changes (See Changelog) and I also moved the plugin to a GitHub repository.

What is zenHttpbl?
zenHttpbl is my implementation of the Project Honeypot service into plugin form for Zenphoto. What the plugin does (before any theme data is sent) it references the browsing IP against the DNS Blacklist service provided by Project Honey Pot. It then returns a threat rating based on actions the IP has done maliciously (spamming, etc). The plugin then, based on the options you set, either allows the IP to browse the Zenphoto site as normal, or it will stop the IP from browsing by various methods.

So if a malicious IP attempts to access your site, not only will it stop them from accessing your site, it stops the traffic completely that would be generated from loading the pages.

Download
Download of the zenHttpbl plugin has been moved to a GitHub repository and can be located here

Changelog
v1.4.4.4

Version update after testing with 1.4.4.4 build.
Moved download to GitHub repository.
Added directions for testing the HoneyPot plugin.
Added redirect to QuickLink if specified and HoneyPot file not specified.
Ordered of redirect/exit in following priority. HoneyPot File -> QuickLink -> Exit()

Please feel free to respond if you have any questions or notice any errors.

Edit:
Sorry, I placed this under general and not plug-ins. -M

jphilbert

SWEET!

vincent3569

hi

in admin/logs/security, I regularly see attempts to connect to my site.
attempts are blocked by zenphoto (I cross fingers to zenphoto don't have security holes).

is that this plugin will block access to the connection url to identified spammers ?
it will be a very good news and will enhance zenphoto security

btw, there was a ticket on bugtracker (I don't remerber ticket number) to implement a honeypot on comment post (a hidden field that allows to detect spammer if it is filled).
since this addition in zenphoto 1.4.4, I don't have spam at all (my akismet plugin seems redundant).
so if your plugin only allows to filter spamming, maybe your plugin is redundant too.

acrylian

I think it might also catch spam by human spammers like Akismet if they post from a know IP.

Btw, note for EU based users that sending (and possibly storing) IPs to US servers for checking can be a privacy and legal issue. Akismet for example is a bit problemtic in German law.

micheall

@acrylian - Good note there, I will put a disclaimer on the readme for that as I had forgotten about that.

@vincent This is a bit different than an anti-spam plug-in like Akismet. By the time those plug-ins have checked to see if the IP is a spammer etc, your site has already served traffic (images etc) to the spammer. If any of that traffic contains email addresses, harvesters & spammers grab that info no problem. What the Project Honey Pot plugin does happens before any webpage traffic is sent to the user(or malicious bot). Then if the IP is in the database, it is then diverted to either a honeypot, or simply exits() the php call stopping the remaining traffic.

acrylian

Since you are not in the EU it is probably nothing you directly have to be concerned about. I just wanted to mention it and if you put a note there great. People should know about their law if using such services.

micheall

@acrylian - Question about the German privacy laws. How would this plugin be doing anything different than say "OpenID" login where the data is checked against another server (often US based)?

Could you link me to a good reference of the priv laws? When I google I get a bunch of blogs about Germany and the Facebook and Google stuff but no actual links to the laws.

acrylian

It is EU in general. I have to look for references btu as said anyone using things needs to know a few things themselves. You cannot do all for them.

The difference is that if you use OpenID or any other service to log in you do it yourself on purpose. If this honey pot does do this without the visitor knowing it is problematic.
Even all the social network buttons do sent cookies just on visiting a site with such a button, if you click or not (I made a plugin based on another script currently unrelease on my GitHub page). Also problematic as is Google Analytics for example.

We have strict laws here in the EU..;-)

micheall

I'd be interested to see how zenHttpbl affects sites getting hit with spammers repeated (such as zenphoto itself). If you are receiving spam traffic and test out this plugin, please leave some comments here to let me know how well it helped!

sbillard

So, I took a look at the code. Very nice and simple.

I have an observation for acrylian and his paranoia on IP addresses. First, as I have said many times before, if the EU laws are as he says (I have not looked) then the internet itself is in violation: DNS servers in particular. Probably that is the case, I have often noticed that legislators write laws about things for which they know nothing, thus bollixing everything.

But back to the plugin. It does not send an a users IP address anywhere, so would not be in violation. It does send a transformation of the IP address, but that is not the address.

If the legislation prohibits sending 4 octet number sets then it it indeed quite expansive and overstepping. There are any number of legitimate uses for octet sets that some suspicious bureaucrat could decide was someone's IP address. If the EU will permit such laws to be valid then they well deserve that the Internet should not work for them.

micheall

Good point sbillard, that's why I was hoping to locate the legislation to read over. To see what it did and did not prohibit.

Also, are you interested in trying it on the Zenphoto.org site to see if it eliminates the forum spammers? I'd bet that it drops the amount of spam drastically (I hope).

As my site has never had intense spam traffic, I haven't noticed a difference. However seeing the projecthoneypot dashboard I've blocked 2000+ visits since I implemented it.

sbillard

Most traffic on Zenphoto.org is the forum, which unfortunately this will not help. I have modified the forum akismet spam plugin to help make the spam load much less demanding on the moderators and Tris has applied some IP based filtering that has also reduced similar traffic. Tris did say what he installed, but I have forgot.

micheall

Is the /support not a zenphoto page with an include as I assumed? If the /support page is still zenphoto with the forums embedded by some method the plugin should be able to stop the traffic as the plugin is called before the page data is sent.

fretzl

The /support page (forum) is actually separated and uses an independent theme to match the main site layout.

micheall

Ahhh that would make sense then.

acrylian

I have an observation for acrylian and his paranoia on IP addresses.

It is not "my paranoia" or my idea, its law overhere that IP addresses are considere privacy related data. If you would use such a service without any proper privacy note you could get costly notes by lawyers of others (a speciality over here that does not exist that way in other countries).
It is not about using IP, it is about storing mainly.

Here is a lenghtly text about for example how to use the Akismet filter correctly:
http://faq.wpde.org/hinweise-zum-datenschutz-beim-einsatz-von-akismet-in-deutschland/
http://www.domainist.de/rechtliches/verwendung-von-akismet-plugin-rechtlich-bedenklich
Sadly it is German for the target group but maybe the Google translator will give you an idea.

The /support page (forum) is actually separated and uses an independent theme to match the main site layout.

Not only that, it is a entired different system..;-)

sbillard

I never said that the law was not existent, only that it is not enforceable. As described in the article you reference, every Domain Name Server, Router, and Switch are in violation of the law. All store and forward IP addresses.

Are these exempt from the law? (The article is a Wordpress interpretation, so may, as it says, not represent the real law.) So, Europe, feel free to enforce this law, you will just not get any content from the US. Or do not enforce the law. But if the law is not uniformly enforced then there is a serious issue with your legal system.

BTW, if DNS servers are exempt, then this plugin is also legal since it uses DNS to provide the information. See how slippery such laws are?

acrylian

I think the problem is that these services set up a kind of database ( and that they often keep the right to use and give these to third parties). Over here you have to agree to that explicitly, it cannot be done just so by surfing by (Opt in instead of apparently loved Opt out by basically all US services). Normal DNS-Servers etc. don't do that exactly.

But it does not matter if you or I think these laws are slippery or whatever (There are quite few things in the US that look weird from this side of the pond as well..;-)). They exist and we or specifially EU citizens have to live with it (they had a weird idea about cookies as well that was even less practicable...I think that didn't get through - keyword bureaucracy)