Spammers

Post by **morphim** » July 5th, 2007, 8:17 am

Good day

This isn't particularly for anyone's attention but I've installed a new 'signup' field in the form of a question.

This seems to have stopped the 4 a day spammers.

I'm really pleased.

Juts thought you'd like to know

Hurrah for me!

cow · Post by **cow** » July 5th, 2007, 9:19 am

Hopefully that'll work. I've had the odd contact form abused and have been looking for ways to stop it. I've managed to stop some by using clever validation and I've been wondering about adding one of those 'type in what you see in the picture' things.

Any thoughts/comments from anyone most welcome.

Post by **morphim** » July 5th, 2007, 11:47 am

Well, none of the standard phpbb stuff works ... at all!!
I've tried different visual confirmation stuff but that was no good, as well as variable string doodars.
This last one seems to have helped (two days now and not a sniff of any erroneous registrations.

Fingers crossed.

If it's phpbb2 you're working with, I'll post the mod code. You just need to modify 3 files by pasting(?) 3 little bits of code.

cow · Post by **cow** » July 5th, 2007, 2:43 pm

I'm not messing with phpBB, it's been a few years since I used it.

My issue are spambots trawling through contact forms, auto-filling them and sending crap to the db. I know they do it to inject multiple recipients into the message to send out spam but was wondering if the visual confirmation box would stop it. I can halt the email injection by scrapping the mail at source if a cc:/bcc: etc appears, such as:

if(preg_match("/(%0A|%0D|\r\n|\r|\n|content-type:|from:|to:|cc:|bcc:)/i", $_POST["message"])) {
tellthemtofuckoff(); }

etc...

I'm guessing you're not gonna be the best person to ask about this

maybe Simon will have a use!

Post by **morphim** » July 5th, 2007, 3:05 pm

Errr....My elephant like peanuts

Simon · Post by **Simon** » July 5th, 2007, 6:16 pm

i was interested in these image input thingies simply could create say ten yourself then start from there.

in the database asign the actual code an id and the image file name then compare the inputed info with the code in the right image id et c???

cow · Post by **cow** » July 6th, 2007, 8:35 am

That's pretty much what I was going to do but yesterday found out the spambots are increasingly using optical character recognition to foil the visual checks. I thought about having a selection of 4 letter codes and asking the user to type in character 2 and 3 etc.

I have one client form that's being regularly abused so I can check my progress easily. If I get positive results, I'll let you know as this stuff benefits us all.

Fwiw, here's a collection of techniques that give food for thought:
http://webaim.org/blog/2007/03/07/spam_ ... ble_forms/
http://www.securephpwiki.com/index.php/Email_Injection

The second link, although a longer read, really shows the potential scale of the problem.

Post by **morphim** » July 6th, 2007, 1:49 pm

Cow AND Simon sharing a mutual thread?
The space time continuum must have been breached, captain.
The whole universe is at stake!

cow · Post by **cow** » July 6th, 2007, 3:41 pm

The spammers want their bollocks shoving down their throats. Some strange allies may appear...

Simon · Post by **Simon** » July 8th, 2007, 3:48 pm

we must gather and for a herd to defeat these spammers and all are welcome

Cow, that sounds great. My bank does this with my memorable info, they ask for 3 characters. Each character number randomly etc so the idea of using the image then ask for characters from within sounds good

cow · Post by **cow** » July 9th, 2007, 11:28 am

I'll have a play. I'll build an array of number combinations then bring one in at random with some kind of identifier. Should be easy to use it for validation.

In the meantime, my form validates certain fields for input, returning the user to the semi-filled form if they've missed something. However, if they enter something that looks like a form hijack or email injection, it delivers a response but doesn't return them to the form. With a few other bits built in, hopefully it'll be pretty spam-proof.

I noticed today that one of my client sites has had its contact form used by spammers 6 times yesterday (the first time as far as I know). This is why it's important!!

Post by **morphim** » July 9th, 2007, 4:00 pm

Well, for what it's worth, I've tried an array of visual deterants (?), all to no avail.
This is the first text based validation and (fingers crossed) no spammers since it's implementation.

cow · Post by **cow** » July 9th, 2007, 4:07 pm

Text based as in html text, rather than an image displaying characters?

Post by **morphim** » July 9th, 2007, 7:30 pm

Yes. A simple question that requires an answer to be typed.

All I can guess is that, as you said eariler, that bots can decypher & recognise the visual characters. The fact that they are not getting through the 'simple question' thing pretty much proves this ... for now

Simon · Post by **Simon** » July 9th, 2007, 10:52 pm

probably uses something like this site Whats the Font!