Sign-up verification thingy.

[Stealthbomber]

Recently we've seen a number of spam-bots sign up to Arnies and post nonsense.

 

I think it's time we got ourselves one of those verification things where a bunch of letters are displayed in a wobbly picture and you have to type them into a box before you can register.

 

Excuse the technical jargon. I'm sure you know the sort of thing I mean.

[Carrion]

its an alphanumeric keykode. bots cant read it as iirc its in a picture format which they cant copy/paste into the document. thus defeating the, the bots will still be on arnies but trapped in a limbo state of not being able to do anything

[samuel]

Cant hurt can it?

[Samm]

From the thread in question:

...

 

On a more relative note, how exactly are these bots getting past the registration, as we have that image to ensure human registrants; unless someone's bothering to create the accounts first?

 

You would have thought they'd post a helluva lot more threads than this if that was the case. Maybe spam is from aliens afterall.

<{POST_SNAPBACK}>

Meaning that, I thought we already had this I guess it's been a while since I registered.

[Stealthbomber]

From the thread in question:

 

Meaning that, I thought we already had this   I guess it's been a while since I registered.

<{POST_SNAPBACK}>

Must admit, I'm taking a flyer in assuming we don't have it.

 

I can't remember either, TBH.

 

I thought we just had that thing where you sign up and an email gets sent to your email addy which you have to reply to so your account is activated.

Obviously they've discovered a way to allow a bot to do that.

[Bowskill]

Just had a look, you have to enter a numerical code during registration.

[101matt1]

Hmm, human spam bots?

[otherrandomhero]

Won't work, I believe these are actually humans posting these. The MAA forum has one of the text-in-an-image things, I believe, and we got a spambot for penis enlargement just the other day.

[Chris North]

I don't know why we would want to get rid of them. They're almost like a tourist attraction, or something. Very funny to read anymore.

 

Why are we getting more of them though?

[gazchap]

They are spambots. They are registering on the forums via an automated system.

 

How they get around the CAPTCHA (the image-to-text thing) is that they get the URL of the image and download it, and then another website (typically crack websites, or computers that have been infected with a particular type of virus) will pop up a window saying "In order to continue this operation you must type in this code" (making no reference to Arnie's).

 

The user of that site then types in the code believing it to be a security feature of the website they're on, when in actual fact it's the spambot asking an unwitting human to tell them the code so that they can complete registration.

 

They're sneaky buggers, aren't they?

[uscmCorps]

How they get around the CAPTCHA (the image-to-text thing) is that they get the URL of the image and download it, and then another website (typically crack websites, or computers that have been infected with a particular type of virus) will pop up a window saying "In order to continue this operation you must type in this code" (making no reference to Arnie's).

 

The user of that site then types in the code believing it to be a security feature of the website they're on, when in actual fact it's the spambot asking an unwitting human to tell them the code so that they can complete registration.

 

They're sneaky buggers, aren't they?

<{POST_SNAPBACK}>

 

Whoa.... that's pretty hardcore and ingenious.

[otherrandomhero]

So...you're saying we need to bomb the iternet? Darklite, ready the attack!

[Arnie]

We've got that image verification and email verification that's about all we can do, other than blocking IP ranges and killing accounts as soon as we see them. The higher the security levels the less usable the site becomes. Irony really

[Stealthbomber]

I have one idea but, erm, it would require some level of competence by the existing members...

 

Here's how it'd work:-

- You post a "Hello" thread and sticky it in the newbs section.

- In the T&C you make it clear that a person MUST make a post to the "Hello" thread before they can post in the rest of the forums.

- You set accounts so that a newb cannot post until they RECEIVE their first PM.

 

So, our newb posts to say "Hi!" in the Hello thread and an existing member sends them a PM which unblocks their account and allows them to begin posting properly.

 

I know this is complex but I reckon the site sees around-the-clock usage so there'd always be somebody to send the PMs to newbs.

 

Thing is, my email addy now gets 200-odd bits of spam a DAY.

These spambots are going to get worse and worse and worse.

For the moment it might be okay to think "Ahh, we'll just delete the threads as they appear" but I think we need to start thinking of ways to deal with it cos it's gonna get a lot worse in future.

Edited April 21, 2007 by Stealthbomber

[Quilimox]

I have one idea but, erm, it would require some level of competence by the existing members...

 

Here's how it'd work:-

- You post a "Hello" thread and sticky it in the newbs section.

- In the T&C you make it clear that a person MUST make a post to the "Hello" thread before they can post in the rest of the forums.

- You set accounts so that a newb cannot post until they RECEIVE their first PM.

 

So, our newb posts to say "Hi!" in the Hello thread and an existing member sends them a PM which unblocks their account and allows them to begin posting properly.

 

I know this is complex but I reckon the site sees around-the-clock usage so there'd always be somebody to send the PMs to newbs.

 

Thing is, my email addy now gets 200-odd bits of spam a DAY.

These spambots are going to get worse and worse and worse.

For the moment it might be okay to think "Ahh, we'll just delete the threads as they appear" but I think we need to start thinking of ways to deal with it cos it's gonna get a lot worse in future.

<{POST_SNAPBACK}>

its an ok idea but for example if its like 5 o clock in the evening and everyone goes on the forums for their daily dose of arniesairsoft and lots of people read a newcomers "hi" and start pm'ing him thus creating about 50 pm's for the newcomer and also once he has his account unlocked he will have to remember to post a reply to the "hi" topic to say his account is unlocked otherwise he might be reciveing pm's for hi's eversince he registered which would be quite an inconviniance to some people,

just thought i would point that out nice idea tho

cheers

Quil

[gazchap]

Does Invision Power Board have such a feature? i.e. restricting access until they receive a PM?

[otherrandomhero]

Whatever it is, we drastically need one of these before it gets like the MN forums. The bots are posting worse things now. It starts with insurance or something, whatever. Then it goes to "unit" enhancement, not good, but liveable. Then, a bot started posting pornography, NO. Then, one posted a LOT of it. MAJOR NO!!!!!! I think what stealth posted would be a great idea. Though it may have its potential flaws, its better than having bots putting X-rated material on our site.

[Tecro]

Old thread, but no matter...the spam's only getting worse.

 

Spambots can easily work around the captchas. Each image in common bulletin boards has a known size, and the bots can compare the exact size with the actual code that's displayed. What's better is to create custom fields that you have to enter; say, "Enter anything." The bots probably won't know what to do. Even saying "Enter 'abcde'" will throw them off, as they're not programmed to enter fields that aren't defaults.

 

It might take some sorting through the massive CP, but I believe IPB has the option somewhere. Creating a custom field is sure to throw off most of the spambots.

[ETDC]

There's an add-on called 'The Humanizer' for phpBB boards so I'm guessing there'll be one for invision. It asks 'Are you Human?' and is widely held to reduce automated sign-ups to an absolute mimimum.

[Sledge]

I suspect quite a few of us would fail that test.

 

[Bowskill]

Does Invision Power Board have such a feature? i.e. restricting access until they receive a PM?

<{POST_SNAPBACK}>

I believe with Invision there is admin verification, no verification or email verification.

[Arnie]

Avoiding spam bots is a hard one, although mods can disable their ability to post when we see them, Admins can ban ad block entire IP ranges and entire email addresses our countries. .ru is blocked entirely at the moment