More forum spammers in the last few days?

[paulius]

Hello everybody,

I want to know your opinion on this. And I want to know if it's not just my brain acting up.

Was there a recent increase of forum spamming bot activity in the last few days?!

No, seriously. This week, on my own forum, I deleted more than 30 spamming threads. Before this week, I used to get probably only one or two per month.
On the forums I visit, not my own, I see about three spam threads per forum.
In an IRC channel, I've also asked other forum admins. They have seemed to realize this fact aswell.

The sad part is that I did a few IP traceroutes. A few come from Korea, one from Lithuania, a few from Russia and a few from USA residential ISPs. Could this be a next generation of botnets spawning? Instead of sending spam email, those bots will spam forums!

How can we fight against this? I think vB's captcha has been defeated. And most of the spam-fighting plugins don't work too well (I'm using them on my forum, but they do nothing)

Comments? Suggestions? Anything is welcome.

[DirectPixel]

By definition, a CAPTCHA cannot be defeated by a computer. However, if there is a flaw/glitch in vB's implementation, they may be exploiting that. If not, then you're probably dealing with humans who are manually registering, either with or without the aid of an automatic form-filler. In the case of a human registering, there is absolutely nothing you can do except to ban, block, and delete.

[paulius]

By definition, a CAPTCHA cannot be defeated by a computer. However, if there is a flaw/glitch in vB's implementation, they may be exploiting that. If not, then you're probably dealing with humans who are manually registering, either with or without the aid of an automatic form-filler. In the case of a human registering, there is absolutely nothing you can do except to ban, block, and delete.

There is. There was recently a website which showed how a software was able to defeat almost 90% of captchas. Link to it: http://www.cs.sfu.ca/~mori/research/gimpy/

And you can even download the software yourself: http://sam.zoy.org/pwntcha/

You can clearly see that it can defeat vB's captcha 100%.

[Steve Machol]

Did you test this with the 3.6.0 captcha?

[paulius]

Did you test this with the 3.6.0 captcha?

Not yet. I'm still running 3.5.5 on my forums.
Is th 3.6.0 captcha better or something?

[Steve Machol]

Yes, it's significantly better.

[Scott MacVicar]

The 3.6.0 captcha addresses all of the weakness identified by that site, though they haven't released the source of the detection algorithm as far as I'm aware.

[DirectPixel]

There is. There was recently a website which showed how a software was able to defeat almost 90% of captchas. Link to it: http://www.cs.sfu.ca/~mori/research/gimpy/

And you can even download the software yourself: http://sam.zoy.org/pwntcha/

You can clearly see that it can defeat vB's captcha 100%.

I'm guess it's simply a modified OCR algorithm, similar to the ones that most scanner software packages use.

It doesn't take much additional work to run the same recognition algorithm through a transformed version of the input.

CAPTCHA: "Completely Automated Public Turing test to tell Computers and Humans Apart". As you can see, by definition, a CAPTCHA cannot be defeated by a computer. If a computer can recognize it, it's not a CAPTCHA, now is it?

[Lierduh]

We have been running beta 2.

We too seen more spams recently. The worst is the ones selling Nokia phones.
They typically come and go. Using a different email address each time. So banning does not worry them.

I think a good way to combat these kind of hit and run is to moderate all new user's posts. Once the first post from a new user is released, then this new user will be considered none spammer. Not sure if anyone has released a hack to do this.

[Scott MacVicar]

I think most of the new ones are simply people actually physically registering, I know the last one or two I've seen are actually people.

You can tell because the time between registering + posting is a few minutes rather than seconds.

[Andy]

I'm getting about 10 bots a day registering and I use a captcha, I'm running vBulletin Version 3.5.3

I think the best soulution is to have a question that is asked at registration time, something simple and if the bot cannot answer the question the registration is denied.

The question and correct answer would be something the admin sets in the Admin CP, every forum would be different and I think this will prevent bots from being able to register.

[Andy]

I think most of the new ones are simply people actually physically registering, I know the last one or two I've seen are actually people.

You can tell because the time between registering + posting is a few minutes rather than seconds.

Hi Scott,

I doubt it. The same answers are being given during registration on the optional profile fields. The answers are clearly bots because some are always the same and others are slightly different. For example I have a Name field and most often they put in 'http://somecrap' or 'http://someothercrap'.

[Lierduh]

Hi Scott,

I doubt it. The same answers are being given during registration on the optional profile fields. The answers are clearly bots because some are always the same and others are slightly different. For example I have a Name field and most often they put in 'http://somecrap' or 'http://someothercrap'.

Incidently, I was building a semi-auto bot yesterday to place orders with a supplier. It can auto login and item numbers and delivery addresses are pulled from my DB. Human is used for confirming each step. So my bot is a browser, yet I am driving my bot under IE. Form inputs are all auto filled.

[DirectPixel]

It may be a human that is using an automated form-filling program to speed up the process.

(Oops, Lierduh beat me to it!)

[Andy]

It may be a human that is using an automated form-filling program to speed up the process.

(Oops, Lierduh beat me to it!)

Even if it is a human that is taking the time to decifer the captcha and then using a script to fill in the optional fields, if there was one question that is asked that is unique for each forum then that would prevent this problem.