Jump to content

Welcome to MSFN Forum
Register now to gain access to all of our features. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more. This message will be removed once you have signed in.
Login to Account Create an Account


Photo

Websites automatically blocking and banning Windows 95 users

- - - - -

  • Please log in to reply
31 replies to this topic

#1
Andrew T.

Andrew T.

    Junior

  • Member
  • Pip
  • 94 posts
  • OS:95
  • Country: Country Flag
In between Flash 8, kludgy scripts, and restrictive browser checks, I've experienced quite a few frustrations using Windows 95 on the web over the last few years. Only rarely have I encountered downright hostility, though...but this takes the cake.

Over the last year or two, I've stumbled across sites that run some server-side PHP package called Spambot Security ZB Block. If you access one of these sites from a Windows 95 computer (or any browser with a Win95 useragent), this arrogant and absolutely obnoxious message appears:

win95forbid.png

They're not kidding. If I try to access any page on the site from any computer from the same IP afterward (regardless of OS), a plain screen with a "Error 503 : Service Temporarily Unavailable" message is all that results.

Thankfully ZB Block seems to be pretty rare, but I have encountered it here, here, and here. It also afflicts the vendor's own site...including this confrontation thread, ironically enough.

Has anyone else encountered this?
Andrew T.
"Now crush your computer into small chunks, add flour, and bake one hour."


How to remove advertisement from MSFN

#2
Zoinkity

Zoinkity

    Junior

  • Member
  • Pip
  • 63 posts

Thankfully never saw it before.  Guess these people don't realize that people on these forums have found ways around the issue.  Lament.

Crazy that.  You could always go out of your way to complain and explain the situation, but chances are that won't work out well.

 

Haters gotta hate.



#3
tain

tain

    Cyber Ops

  • Super Moderator
  • 3,682 posts
  • OS:none specified
  • Country: Country Flag

Donator

Interesting.  Does just changing your UA string fix this?  (prior to the detection/ban, of course)



#4
bphlpt

bphlpt

    MSFN Addict

  • Member
  • PipPipPipPipPipPipPip
  • 1,797 posts
  • OS:none specified
  • Country: Country Flag

Since they apparently block the IP, he'll have to go take his computer to a different site and/or go through an anonymizer to change his IP in order to try it and see.  And if it doesn't work, he'll have succeeded in blocking that IP from that site.

 

Cheers and Regards


Posted Image


#5
bpalone

bpalone

    Member

  • Member
  • PipPip
  • 175 posts
  • OS:Windows 2000 Professional
  • Country: Country Flag

Donator

Windows 95 is unusable.

 

 

Now that makes just about as much sense as someone pulling up to the toll booth on a roadway in a completely restored 1957 Chevy (or pick your own classic vehicle) and being told that they are not allowed on the road. Because, the vehicle is to old to use the road.

 

DOS is still very usable, as are some old COBOL programs that are still being ran today.  I guess, that when one is young, that anything older than you are is totally outdated and can't be used.  But, we all know better and continue to use our old OSes and programs.

 

Andrew T. I am guessing that your first link of where it has happened was done by their hosting company, not them.  That is assuming that they are not total Penguin addicts and that nothing else is any good, which is not the impression I got from the little I read.

 

bpalone



#6
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,215 posts
  • OS:none specified
  • Country: Country Flag

Now that makes just about as much sense as someone pulling up to the toll booth on a roadway in a completely restored 1957 Chevy (or pick your own classic vehicle) and being told that they are not allowed on the road. Because, the vehicle is to old to use the road.

 

That's why toll booth jumping :w00t: has been invented, AFAIK ;):

 

:lol:

 

jaclaz



#7
cyberformer

cyberformer

    Member

  • Member
  • PipPip
  • 138 posts

Would some one here elaborate on what the Z Bot instigator means by this statement :"MS never updated the Windows TCP/IP stack to handle random port DNS, thus any machine identifying itself with that string, is actually a bot with a B.S user agent."

Could someone explain the technical aspects of the process he alludes to, and how he (if serious) could misconstrue himself into believing no can still use 95 anymore?



#8
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,215 posts
  • OS:none specified
  • Country: Country Flag

Would some one here elaborate on what the Z Bot instigator means by this statement :"MS never updated the Windows TCP/IP stack to handle random port DNS, thus any machine identifying itself with that string, is actually a bot with a B.S user agent."

Could someone explain the technical aspects of the process he alludes to, and how he (if serious) could misconstrue himself into believing no can still use 95 anymore?

The guy himself provides a more extended explanation here:

http://www.spambotse...php?f=14&t=2373

 

The word for today is "syncookies":

http://en.wikipedia....iki/SYN_cookies

 

Though I can understand how a Windows 95 user agent string may be nowadays be more likely connected to a bot of some kind than to a real user, using this only parameter to permanently block an IP makes clearly no sense whatsoever, at the most it could be used to "raise a flag" for monitoring the behaviour of that connection and ONLY when suspicious activity is actually detected, then block (and in any case TEMPORARILY and NEVER permanently) an IP. (if enough people using Dynamic IP actually connect to these stupid sites through a Windows 95 computer, before or later a whole ISP address range will be blocked :w00t: ).

 

jaclaz



#9
submix8c

submix8c

    Inconceivable!

  • Patrons
  • 4,251 posts
  • OS:none specified
  • Country: Country Flag

Google on

"windows 95" "tcp/ip stack" "random port dns"

reveals that these are the only morons indisciminately blocking stuff. Read this thread as well (post #15) -

http://www.stopforum...c.php?pid=12852

Blocking EVERYONE using AOL? Get real!

 

It appears that ANYONE utilizing this software can indiscriminately block ANYONE for ANY REASON, based upon "supicion". IOW, those sites you mention using "ZB Block" are ignorantly blocking, so just don't go there using Windows 95.

 

Wondering about the SpamBot Blocking that MSFN uses? Seems Win95 isn't block "just because", correct?

 

Googling on just

"random port dns"

yelds this additional link - http://marc.info/?l=...50705427468&w=2

Googling this (google "suggested")

microsoft dns random ports

somewhat explains the previous link statements. Plug in "windows 95" (use the quotes) yeilds more info. (All first links directly from MS.)

 

In other words, (IMHO) stupidity on the part of said SpamBot Blocking Software and/or the "setup" of said software based upon ignorance and fear.

 

Hmmm.... of course this may explain it (also all about fear) - http://debian.fmi.un...THER/dos101.txt

Here (web archive) is the subject from the above text. Had to dig "backwards" for it.

http://web.archive.o...mon.co.uk/ping/

So it appears that it's the SITE end that has the problem and NOT the Windows 95 -or- (as stated) Windows NT (which also is "afflicted"). Note the date of the article.

 

Also see this - http://support.microsoft.com/kb/177719

 

:}

 

edit - I believe jaclaz stated it more succinctly. And I provided a link that states they did just that!


Edited by submix8c, 15 January 2014 - 12:20 PM.

Someday the tyrants will be unthroned... Jason "Jay" Chasteen; RIP, bro!

Posted Image


#10
cyberformer

cyberformer

    Member

  • Member
  • PipPip
  • 138 posts

Thanks for all the info guys!  The Z bot fellow seems to especially pride himself  upon his belief that the "death of IPV4" will finish Win 98--(meaning all 9x of course).



#11
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,215 posts
  • OS:none specified
  • Country: Country Flag

Thanks for all the info guys!  The Z bot fellow seems to especially pride himself  upon his belief that the "death of IPV4" will finish Win 98--(meaning all 9x of course).

For NO apparent reason ;), married to the sea! :w00t::

Spoiler

 

:lol:

 

jaclaz



#12
Steven W

Steven W

    Advanced Member

  • Member
  • PipPipPip
  • 365 posts

Would some one here elaborate on what the Z Bot instigator means by this statement :"MS never updated the Windows TCP/IP stack to handle random port DNS, thus any machine identifying itself with that string, is actually a bot with a B.S user agent."

Could someone explain the technical aspects of the process he alludes to, and how he (if serious) could misconstrue himself into believing no can still use 95 anymore?

 

 

The entire quote is:

 

 

It means that there are no windows 95 machines that can access the net anymore since they went to random port DNS. This was done to stop domain spoofing/dns server stuffing.
 
Microsoft never updated the Windows 95 TCP/IP stack to handle random port DNS, thus, any machine identing itself with that string, is actually a bot with a B.S. User agent.

 

Don't you wish someone would have told you that you can't access the internet on Windows 95 before you did Andrew T.?  I'm going to have to get the ol' Win 3.1 system up and running to see if I can access the site.  

 

Edit:  User adwade is getting quite an edumacation from that post.   :crazy:


Edited by Steven W, 15 January 2014 - 07:51 PM.


#13
-X-

-X-

    Member

  • Patrons
  • 2,406 posts
  • OS:XP Pro x86
  • Country: Country Flag

Donator

Yeah, I've gotten those many times. Not sure it's the same domain but it happens when I run an extension that checks for defunct URLs and the likes.


Download all Windows XP Post SP3 High-Priority Updates with a simple double click @ xdot.tk post-12166-0-42859000-1399044129.png ]
               If someone helps you fix a problem, please report back so they and others can benefit from the solution. Thanks!


#14
bphlpt

bphlpt

    MSFN Addict

  • Member
  • PipPipPipPipPipPipPip
  • 1,797 posts
  • OS:none specified
  • Country: Country Flag

User adwade is getting quite an edumacation from that post.   :crazy:


He appears to have been brainwashed, since he seems to have bought the misguided, though well intentioned, reasoning by the the site admin. I understand the site admin's thinking from his apparent experience, but he is obviously uninformed since there are indeed a few diehards that still happily use Win95.

Cheers and Regards


Posted Image


#15
Tripredacus

Tripredacus

    K-Mart-ian Legend

  • Super Moderator
  • 9,754 posts
  • OS:Server 2012
  • Country: Country Flag

Donator


Blocking EVERYONE using AOL? Get real!

 

Believe it or not, this is actually an OLD technique. Before such repositories as SFS or security company lists, even ISPs used some archaic methods that I would have hoped would no longer be used. Think back to the turn of the century. Email spam was the thing back then and an ISP would subscribe to some service that would provide information on how to block them so that their users would not get spam. But there was usually another mechanism. When enough spam/junk complaints would come in for a certain email host for a period of time (say 24 hours) the ISP would block that email host, then contact it to inform them they have a spammer there. The problem would be then that the ISP would tell the host that it would keep blocking them until they cleaned up their servers. If this happened, they would do a trial run and if the spam was under some number or percentage, the block would be lifted.

 

Well in 2002 or so, the ISP I worked for blocked AOL.com. At that time, AOL was still one of the top email providers so you can imagine the uproar this caused. :thumbdown


MSFN RULES | GimageX HTA for PE 3-5 | lol probloms
msfn2_zpsc37c7153.jpg

#16
Andrew T.

Andrew T.

    Junior

  • Member
  • Pip
  • 94 posts
  • OS:95
  • Country: Country Flag
Thanks for the feedback and investigation work!

The "handle random port DNS" pronouncements read like incoherent gibberish. My first guess was that it had something to do with systems without the Winsock 2 update...but that's been around for almost as long as Windows 95 itself, so no excuses there.

Andrew T. I am guessing that your first link of where it has happened was done by their hosting company, not them.  That is assuming that they are not total Penguin addicts and that nothing else is any good, which is not the impression I got from the little I read.
 
bpalone

I'd like to think that users of Linux and sub-XP Windows have a fair amount in common...namely, an enterprising spirit and a disenchantment with the state and direction of Microsoft's commercial software development. But I digress...

Since they apparently block the IP, he'll have to go take his computer to a different site and/or go through an anonymizer to change his IP in order to try it and see.  And if it doesn't work, he'll have succeeded in blocking that IP from that site.

It'd be challenging to do useragent experimentation, that's for sure. It's also difficult to discover where these sites exist without being blocked by them first!

Don't you wish someone would have told you that you can't access the internet on Windows 95 before you did Andrew T.?  I'm going to have to get the ol' Win 3.1 system up and running to see if I can access the site.  

"There are no windows 95 machines that can access the net anymore" is a total hoot. I almost wish I could browse the SpambotSecurity site for more gems of trivially-rebuttable idiocy...alas, I'm limited to the Google cache for that.

Wondering about the SpamBot Blocking that MSFN uses? Seems Win95 isn't block "just because", correct?

Well, I'm posting here now! :yes:
Andrew T.
"Now crush your computer into small chunks, add flour, and bake one hour."

#17
Nomen

Nomen

    Member

  • Member
  • PipPip
  • 191 posts
  • OS:98SE
  • Country: Country Flag

Would some one here elaborate on what the Z Bot instigator means by this statement :"MS never updated the Windows TCP/IP stack to handle random port DNS, thus any machine identifying itself with that string, is actually a bot with a B.S user agent."

Could someone explain the technical aspects of the process he alludes to, and how he (if serious) could misconstrue himself into believing no can still use 95 anymore?

 

Here's something about this random-port business:

 

------------

http://marc.info/?l=...50705427468&w=2

 

At 11:08 AM 3/13/2001 -0600, Talamantes, Jeremiah R.  (TC) wrote:

 

> Looking for some help and an explanation to these security alerts...
>
> The source connection info ":53" from "10.1.1.55:53" obviously indicates DNS
> activity, but what type of DNS activity would utilize random porting?

 

DNS queries go out from port 53 (usually) to port 53 on a destination server.
When a query is about to be sent, the local DNS server allocates a random
UDP reply port for the return response; the request effectively says
"here's my question, send the response to this random port". That's why
you're seeing random port DNS activity. The destination port is different
to allow the responses to be associated with an active query.

 

Why you get security alerts is because the DNS servers are aggressive - a
query will be sent out, and if a response isn't quickly returned, another
query goes out to one of the other nameservers for the domain. As soon as
one of the outstanding queries for a request gets a response, the listener
on the other ports gets dropped. If the response for one of the abandoned
queries finally struggles it's way back, you get a security alert.

-------------------

 

I just visited that site (www.rpg.net) with FF2 using it's default user-agent string - and the page came up no problem.  Obviously in your case it is keying in on win-95.

 

There was a comment in this thread about how your IP is now banned on that site.  I don't know how common it is for an ISP to hand out static IP's (especially for residential customers) but I get a different IP from my isp when I tell my modem to disconnect and reconnect.

 

Not to start a flame war, but I really don't see the point of running win-95 vs win-98.  Yes, that site is stupid for blocking win-95.  But if you're going to run win-9x/me, then whats the advantage of 95 over 98?  Seems there are more limitations and troubles than advantages.



#18
submix8c

submix8c

    Inconceivable!

  • Patrons
  • 4,251 posts
  • OS:none specified
  • Country: Country Flag

How odd that you found the same link I posted above... :w00t:


Someday the tyrants will be unthroned... Jason "Jay" Chasteen; RIP, bro!

Posted Image


#19
Andrew T.

Andrew T.

    Junior

  • Member
  • Pip
  • 94 posts
  • OS:95
  • Country: Country Flag

Not to start a flame war, but I really don't see the point of running win-95 vs win-98.  Yes, that site is stupid for blocking win-95.  But if you're going to run win-9x/me, then whats the advantage of 95 over 98?  Seems there are more limitations and troubles than advantages.

I touched on some of those considerations years ago:
http://www.msfn.org/...me/#entry694890
http://www.msfn.org/...se/#entry858039
Andrew T.
"Now crush your computer into small chunks, add flour, and bake one hour."

#20
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,215 posts
  • OS:none specified
  • Country: Country Flag

Just in case the relevant page is on Wayback Machine alright ;):

https://web.archive..../windows95.html

 

jaclaz



#21
CharlotteTheHarlot

CharlotteTheHarlot

    MSFN Master

  • Member
  • PipPipPipPipPipPipPipPip
  • 2,054 posts
  • OS:none specified
  • Country: Country Flag

In between Flash 8, kludgy scripts, and restrictive browser checks, I've experienced quite a few frustrations using Windows 95 on the web over the last few years. Only rarely have I encountered downright hostility, though...but this takes the cake.

Over the last year or two, I've stumbled across sites that run some server-side PHP package called Spambot Security ZB Block. If you access one of these sites from a Windows 95 computer (or any browser with a Win95 useragent), this arrogant and absolutely obnoxious message appears:

-= IMAGE =-

They're not kidding. If I try to access any page on the site from any computer from the same IP afterward (regardless of OS), a plain screen with a "Error 503 : Service Temporarily Unavailable" message is all that results.

Thankfully ZB Block seems to be pretty rare, but I have encountered it here, here, and here. It also afflicts the vendor's own site...including this confrontation thread, ironically enough.

Has anyone else encountered this?


Never seen that! Reminiscent of script kiddies trying to block MSIE from Netscape fanboy sites, and vice versa. Let the arms race begin. Block Windows XP. Block Apple. Block Microsoft Tiles. :lol: Amateurs.
 

That's why toll booth jumping :w00t: has been invented, AFAIK ;):

-= VIDEO =-


Oh crap. You owe me another monitor. :lol:

... Let him who hath understanding reckon the Number Of The Beast ...


#22
Steven W

Steven W

    Advanced Member

  • Member
  • PipPipPip
  • 365 posts

The only thing I can guess that he could be yabbering about is "RST cookies"

 

 

DoS Attacks (cont.)

Methods of Prevention

 

RST Cookies
 
  • Server sends a false SYNACK back
  • Should receive an RST in reply that something is wrong
  • If this happens, this verifies that host is legitimate
  • Not compatible with Windows 95 or possibly machines behind firewalls 

 

Was there an update that addressed this issue specifically?  Not saying this is how he's detecting 95, just likely what he's talking about.



#23
Steven W

Steven W

    Advanced Member

  • Member
  • PipPipPip
  • 365 posts

I had to laugh when I ran across this:

 

http://adminextra.co.../zb-block.3518/

 

Note Mikey's thoughts:

 

 

So you block this user due to windows 95 being their OS?

 

 

And you are blocking ISP's which you deem unreputable, but SOME of those users on those ISP's are legitimate. I would not use this script if you paid me, seems that alot of the decisions are purely judgemental, rather than helping to protect your site from hackers or bruteforce.

 

 

Amen, Mikey.  Amen.  BTW, I should say that no one with half a brain ever implemented "RST cookies" like I mentioned above. 



#24
jaclaz

jaclaz

    The Finder

  • Developer
  • 14,215 posts
  • OS:none specified
  • Country: Country Flag

Oh crap. You owe me another monitor. :lol:

 

Oh my :ph34r: the list is growing, and I am afraid I won't be able to indemnify you. :(

 

You should vent a bit, and I have a nice device to suggest you, really useful when you want to scream but cannot ;):

http://www.japantren...nger-p-293.html

 

jaclaz



#25
M()zart

M()zart

    Member

  • Member
  • PipPip
  • 277 posts

I'd say more. When I tried to visit http://www.stopforumspam.com/ from my work computer (Windows 7), I also got this page 403. The reason was "RBN". I don't know what it means, but they seem to block a large number of genuine visitors, not just spammers.






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users



How to remove advertisement from MSFN