1000 members
phpbb has really loose security and a captcha system a blind mand could break without a keyboard
i am a member of a phpbb forum for a game engine, it got so bad over there i had suggested adding a dumb question (ie whats 3+ 8) and it stopped 99% of them dead in their tracks
its a shame about phpbb, i like the software, but every time ive used it, its almost instantly flooded with bots, So I personally just dont bother with it anymore
i am a member of a phpbb forum for a game engine, it got so bad over there i had suggested adding a dumb question (ie whats 3+ 8) and it stopped 99% of them dead in their tracks
its a shame about phpbb, i like the software, but every time ive used it, its almost instantly flooded with bots, So I personally just dont bother with it anymore
It does, but the captcha can be beaten using crafty image manipulation techniques and the use of OCR. The achilles' heel of captcha is that it must be possible to be read by humans, so it can't be overly dastardly. Thus, a programmer with enough time on his hands can develop algorithms to beat it.
It does. But there are two types of forum spam – automated and human. The CAPTCHA should stop automated spam (i.e. a script automatically signing up accounts and posting spam). It's pretty ineffective here, since phpBB is so widely used and hence the CAPTCHA has been broken. The next version of phpBB (3.0.6) is going to add more CAPTCHA types, including reCAPTCHA and a full API, so it should be a lot easier to customise each forum's CAPTCHA which will improve security. We also have a couple of anti-spam questions added to the registration form (basic maths questions) which have pretty much eliminated the automatic registrations here, since they're unique questions that automatic scripts aren't expecting to be on the registration form.
CAPTCHAs cannot stop spam posted by humans though, which a high majority of forum spam is, since the CAPTCHAs are supposed to be easily solvable to a real person. I would guess this is a case of a human spammer and their account has been deleted, as per forum policies. We actually get these sort of posts fairly often, but they're usually deleted fairly quickly.
Most phpBB bots are pretty basic. Even if you have a bot that can beat the CAPTCHA, the bot will be confused if you make a simple modification to the sign up form.
On the actual sign up form you would put something like this:
Then in the PHP code that processes the form you have some simple code like this:
The bots don't actually parse the sign up form as far as I can tell (perhaps except to get the CAPTCHA), they just attempt a registration using the pre-defined variable names which are expected.
EDIT: Of course this still does not stop human spammers.
Does the forum have e-mail verification? I suppose that's easily broken.
What about asking the person a question about Macs? Something simple that almost anyone interested in this forum would know, but something that a chinese kid getting 10¢/hr to spam forums wouldn't.
Q: A Power Macintosh 4400 contains what kind of CPU?
1. 68K (the chinese might see this in the name of the forum and pick this choice and fail)
2. PPC
3. SPARC
4. POWER4 (they might equate POWER Macintosh 4400 with this)
5. INTEL (maybe they know the latest Macs have Intel chips.)
If the user fails the question then they are directed to email blablabla@68kmla.org for moderator assistance.
On the actual sign up form you would put something like this:
Code:
Code:
if($_POST['f23dfg56er2r'] != "2r3e6f3x2s30") {
die("Go to hell");
}EDIT: Of course this still does not stop human spammers.
Does the forum have e-mail verification? I suppose that's easily broken.
What about asking the person a question about Macs? Something simple that almost anyone interested in this forum would know, but something that a chinese kid getting 10¢/hr to spam forums wouldn't.
Q: A Power Macintosh 4400 contains what kind of CPU?
1. 68K (the chinese might see this in the name of the forum and pick this choice and fail)
2. PPC
3. SPARC
4. POWER4 (they might equate POWER Macintosh 4400 with this)
5. INTEL (maybe they know the latest Macs have Intel chips.)
If the user fails the question then they are directed to email blablabla@68kmla.org for moderator assistance.
That suggestion you have about the input form has merit. In fact, you don't even need to put a value in it. Just leave it blank by default, and it if gets filled in, then abort the registration. A few months ago, I ran a honeypot board which had 5 hidden form fields. They were in a
tag marked as hidden, so the only way to see them was to view the page source code. Every bot which signed up filled out these hidden fields.
tag marked as hidden, so the only way to see them was to view the page source code. Every bot which signed up filled out these hidden fields.
Hmm, sounds like an interesting solution. However, as I said above, we have had virtually no spam-bot registrations since adding the anti-spam questions to the registration form, therefore I see no reason to go messing about with the code to add further measures...
If the anti-spam questions are a built-in phpBB feature, the bot writers will begin to parse those questions and provide the correct answers automatically, and those questions will lose their efficacy. At that time (when spam bot registrations are increasing) - you should consider some of these other ideas.
Any thoughts on the Mac question idea? I thought that was pretty good.
They are implemented using the "custom profile fields" feature of phpBB, but they're not a standard feature when used in this way. The specific questions and the names of the fields that they use (etc) are unique to this forum, which should make writing something to solve the questions significantly more difficult (and I don't think we're a particularly high profile target). I'll see how it goes. I don't see any reason why a Mac specific question would provide that much more security than a basic maths one... but we may well try it if the number of registrations starts to increase!
Yeah, but it depends how determined they are... it doesn't take much effort to look up something on Wikipedia, etc. The situation isn't dire now, since it's easy enough to handle to odd spam message manually, so I'm not too worried about changing things at the moment.
I would agree with TL that handling the spammers as it currently stands is not so difficult. Many of them do post one or two things within an hour or so of having signed up, but even then I'd say the sign-ups are at a rate of less than once per week.
As another thought, please continue to be vigilant with the "report post" button, shown here highlighted in red, which is its mouse-over sate.
As another thought, please continue to be vigilant with the "report post" button, shown here highlighted in red, which is its mouse-over sate.
