[JGZinv]

I'm an admin on a few forums, moderator on others, but one board
in particular that I help run is under attack by a troll that uses anonymous
networks to mask their IP.

I believe this to be one person with a giant chip on their shoulder.
It's gone on for over a year now, and we recently moved from an EZboard
to a free IPB forum for various reasons - one being this troll.

For a long time it was just spam posts - threatening posts aimed at people that
didn't like a character or particularly the staff, or pornography. Lately that's escalated
to spoofing e-mail addresses between staff, threatening or derogatory remarks in validating
names, threatening and/or repeated slander on one admin's personal blog. The last bit was a
fake greeting card from one admin to another (spoofed e-mail again) with a smart alack remak
about registrations being closed.

When we open up registrations again - the posts eventually come back. It's pretty much getting
to be similar to cyber stalking. It's frustrating.

We've not been keeping a record of the material up to this point, but we will be.
So far we know the person uses the Tor Network as their system of choice.

I know some of the members here are more experienced than I in administration and anti-troll tactics,
so I'm looking for any ideas that may help back track this person or otherwise put a firm halt
to this siege of spam.

Appreciate the help.

[MP-Ryan]

The Tor network has an abuse FAQ that might be worth reading:  http://www.torproject.org/faq-abuse.html.en  See specifically the section entitled "I want to ban the Tor network from my service."  They have some good tips, and one fallback script if desperate.

I'll ask around, I know some networking fellows who may have an idea of a better way.

In the meantime, just keep banning IPs.  If you make it annoying enough for him to register and connect to your forum, he may eventually give up.  Banning forum accounts is probably the fastest way to annoy the guy enough to give up.  Not many people are tenacious enough to register hundreds of forum accounts through an admin-approved system and continually circumvent IP bans.

[JGZinv]

Not sure how much you read of that, but basically Tor does not have a
way of tracking users (so they say), and 90% of their abuse FAQ is geared toward
saying they are in the right doing what they are doing... even though they themselves
list that they have many "jerk" users that cause Tor problems or get Tor blacklisted.

I'm working on trying to figure out Python enough to run that script now.
Honestly I've gone over these pages before, but I wasn't quite irked enough before to
try and learn Python to get something going.

It's been over a year that this person has been hounding us, and that's just the time period
I've been on staff... so I rather doubt they are going to leave. More like a stuck venomous leech.

Thanks.

Edit - The Python script evidently has syntax errors according to what ActivePython has to say about it.
Might be due to age... who knows. I've tried it fresh off the site and with IP edits, it doesn't want to run.

[Inquisitor]

Keep records. Aliases, IP's, email addresses (fake or not).

Eventually, either a pattern will emerge that is google-able or they will make a mistake and put something traceable down. Good forensics sometimes has to make up for poor server administration.

Not had trouble with Tor users myself, can't you just ban the whole network?

[MP-Ryan]

Not had trouble with Tor users myself, can't you just ban the whole network?

That's the trouble with an anonymous system like Tor - it's widely distributed.  That said, supposedly their Python script is supposed to allow you to block all Tor exit points.  Not sure why it isn't working as I don't know anything about Python myself.

Not sure how much you read of that, but basically Tor does not have a
way of tracking users (so they say), and 90% of their abuse FAQ is geared toward
saying they are in the right doing what they are doing... even though they themselves
list that they have many "jerk" users that cause Tor problems or get Tor blacklisted.

I read it all.  Well, as it doesn't have a backdoor and traffic is fairly randomly routed, I believe them about it not being traceable.  That said, there ARE a limited number of exit points, so if you get that script working and also keep running IP bans on your own special jerk, eventually he's going to run out of random access points.

I don't know if you also noticed, but the Tor pages say that their network does not prevent your browser from leaving DNS information behind....  meaning that he has to use a proxy service to mask where his requests are coming from.  There are also a limited number of proxies out there.  Privoxy is the one Tor recommends, so consult their website.  Again, you may find abuse information that helps you get rid of the troll.

At the very minimum he's leaving behind some kind of traceable information on your servers, and the more IP bans you start issuing, the more you'll narrow the field.

On top of that, requiring invitation-only or admin-approved registrations with an introductory letter may cut down on the number of forum user bans you have to issue, but those user bans are probably your best way of getting rid of a really tenacious troll.

[JGZinv]

The plausibility of my idea here is nearly zero, but it's wishful thinking....

It would be nice if we could create a custom cookie that would get downloaded
to the various member's PC's and then send back a notice with their local (actual)
IP address, or maybe MAC address - and a time stamp from when the board was accessed.

Even though the person is going by proxy, they still have to download the content that composes
a page to the actual machine. We could be monitoring who was online at what time and narrow it down with the returned
information and stop this mess.

Granted this sets up all sorts of privacy/vulnerability issues and gives people a way to fake themselves with the information
if say an admin turned rogue. But it would work in theory.

I wasn't aware of Privoxy, I'll check into it.

[MP-Ryan]

Finding the real address of a Tor user:

http://www.fortconsult.net/images/pdf/Practical_Onion_Hacking.pdf 

[JGZinv]

Very nice... basically my idea in practice.

Soon as I figure out everything in there, I'll see about putting it to use.