Server Help :: View topic - MGB vs Spambots

Server Help

Trash Talk - MGB vs Spambots

Cerium - Mon Jun 05, 2006 8:25 pm
Post subject: MGB vs Spambots

What method(s) do you use to go about fighting the plethora of spambots which assault forums setup like this?

Every day I find myself having to delete 1-2 fake usernames who register just to have a link posted in their 'homepage' field. If that wasnt enough, periodically I have one of them post under a guest to spam a couple hundred links.

I dont see that happening here very often, yet we have the same (basic) setup. What have you changed in your version that makes it relatively secure from spam?

CypherJF - Mon Jun 05, 2006 9:39 pm
Post subject:

omega fire forums have the same issue; i have a phpBB hack that lets me mass-edit/delete users on a whim.

Smong - Tue Jun 06, 2006 6:20 am
Post subject:

I think you can check the useragent to see if it's blank and also rename form variables so bots can't use forms such as register or post.

CypherJF - Tue Jun 06, 2006 7:19 am
Post subject:

maybe i didn't implement it correctly; I added a checkbox that they need/should have to click in order to create an account and there should also be a captcha box. :shrug:

Anonymous - Tue Jun 06, 2006 9:06 am
Post subject:

CypherJF wrote:

omega fire forums have the same issue; i have a phpBB hack that lets me mass-edit/delete users on a whim.

You do realise you can just use the prune feature, right?

Anyway, enable all sorts of registration security measures, disable guest posting or install modules like this one has to verify the guest poster will have interaction with the forum that'll prove it's at least a human and will prevent bots from shitting around.

CypherJF - Tue Jun 06, 2006 6:42 pm
Post subject:

pruning doesnt affect user accounts, does it?

Anonymous - Wed Jun 07, 2006 4:07 am
Post subject:

If by affect you mean ban, then no.
If by affect you mean del all posts, then yes.

CypherJF - Wed Jun 07, 2006 7:00 am
Post subject:

I don't want to delete posts; I just want to delete known account's that are spammers. I knew about the pruning of topics etc etc but regarding user del/ban etc options phpBB doesnt have a quick way of doing it so using that bulk edit-user hack is pretty nice.

Animate Dreams - Sat Jun 10, 2006 11:07 pm
Post subject:

Maybe, people just aren't interested in MGB forums. I mean, they aren't very big, so advertising won't get a lot done, and some of the people here can not only forum ban you, but take your IP and ban you from SS(It makes sense that they could, anyway), and no one that's not an SS player is going to hear of these forums anyway. Or such is my theory.

Mine GO BOOM - Sat Jun 10, 2006 11:19 pm
Post subject:

He is talking about bots that go around and auto-post in every phpbb forum or every wiki. My best fix, as even renaming posting.php to makemessage.php didn't stop everything, was the little useless checkbox. Its there whenever you attempt to post as a guest user or sign up for the ASSS Wiki. The only code for it is the error checking if it wasn't checked. So far, not a single bot has gotten by that.

Since I have guest posting enabled, no bots even attempt to register here. Another not-so-successful anti-spam feature I tried was checking the referral. Almost every single spam bot or human attempting to mass spam has the referral being the exact page they are loading. Well, makemessage.php has no link to itself, so technically, you can never visit that page and have the referral being that page with a GET (POST doesn't count). But, problems occurred because for some stupid reason, some people's browsers here do exactly that. If you look at the source on makemessage.php, you'll still notice my testing for referrals. With every post it stores the originally referral for that message, which was how I was able to determine which idiot users caused problems.

It is still enabled and on every person's post, I still have a small light-orange colored text with the person's referral. It doesn't actually do me any good, but too lazy to remove it and its interesting seeing how many people actually browse with their referrals blocked all the time. Oh no! The secret haxors will catch me because I'm sending referrals!!

Cerium - Sun Jun 11, 2006 1:07 am
Post subject:

Unless the permissions on this server allow me to navigate out of my root, I dont believe I will be viewing the source for your modified makemessage.php.

The biggest problem I was having was with the bots generating fake users. This kinda slowed down now that I enabled the captcha 'verification', but some still get by. Ive rarely had to deal with the bots using the guest posting, so deleting them hasnt started to bother me yet, but if it does Ill definately implement the checkbox idea.

Mine GO BOOM - Sun Jun 11, 2006 2:22 am
Post subject:

Cerium wrote:

Unless the permissions on this server allow me to navigate out of my root, I dont believe I will be viewing the source for your modified makemessage.php.

View source of the HTML. Until you post a message, there is no real good way to store the original referral, so I just tack it on as a hidden input.

Captcha is easily defeated by porn. How? Those that run bots have ways to defeat captcha. As sessions last a while, they just tack it onto their free porn site, where the user has to enter it in. Given how often people browse porn sites, there is always someone there to enter it in. So, they find the captcha, rehost it on their site, someone enters it in for them, the bot then forwards the text and registers.

That, or just get a good programmer. PWNtcha is very private, but works great. Give it a shot, download a captcha picture from your registration and submit it there. They say it is 97% for phpbb.

Muskrat - Sun Jun 11, 2006 3:15 am
Post subject:

Wow, porn people are pretty keen.

SpecShip - Sun Jun 11, 2006 3:57 am
Post subject:

Mine GO BOOM wrote:

Oh no! The secret haxors will catch me because I'm sending referrals!!

Being a security nutcase, I've crippled my browser to half disable everything and half authorize through me everything.
I can't be blamed if my referrals are blocked...though they probably aren't.

Cerium - Sun Jun 11, 2006 4:54 am
Post subject:

Muskrat wrote:

Wow, porn people are pretty keen.

Wow indeed. I just figured someone wrote an algo that was good enough to decypher the image with reasonable accuracy, but this is probably easier and just as effective...

D1st0rt - Mon Jun 12, 2006 2:44 pm
Post subject:

You could try something like hashcash that makes them calculate something before they can get to anything. Might slow them down, at any rate

Doc Flabby - Mon Jun 12, 2006 3:15 pm
Post subject:

I think the only answer to make sure it was a human would be a Captcha such as this:

http://www.phpbb.com/phpBB/viewtopic.php?t=398147

http://www.kessels.com/captcha/

Cyan~Fire - Mon Jun 12, 2006 4:40 pm
Post subject:

Uhh even I can't read some of those. Are the flashing letters part of the code or not?

Smong - Mon Jun 12, 2006 4:47 pm
Post subject:

Depends on how it is configured I think. In some certain characters are only visible at certain times, the interesting ones animate slower.

Maurauth - Thu Jun 22, 2006 7:43 am
Post subject:

You're so boring you might as well be a bot, arolas.

SpecShip - Thu Jun 22, 2006 10:21 am
Post subject:

His name is...arolas?

Purge - Thu Jun 22, 2006 11:36 am
Post subject:

SpecShip wrote:

His name is...arolas?

That was his first SS alias, I believe.

Maverick - Thu Jun 22, 2006 11:42 am
Post subject:

D1st0rt wrote:

You could try something like hashcash that makes them calculate something before they can get to anything. Might slow them down, at any rate

How about a picture with a (very) simple (text-only) question on it? Bots can't ever beat it but it can still be solved by porn viewers.

I'd say such a thing is the best solution (since the question can't be answered by bots) but you need a big database of very simple questions. Heh someone should make a site for it with a huge database for everyone to use

Solo Ace - Thu Jun 22, 2006 1:25 pm
Post subject:

How about a question only Continuum people can answer, that's not hard to do and you don't need lots of questions. I don't think people who spam forums even bother to find out.

In Continuum, what's the ship's name for ESC+{[1-8]}1?
With the default key mappings, what function does 'Delete' have?

I don't know, that last one was stupid, but you get the point.

I think my proxy used to be hiding referrals, but that's a long time ago.

And.. uh gotta go.

SpecShip - Thu Jun 22, 2006 1:51 pm
Post subject:

In SubSpace, what's the title of someone who calls the game Continuum?

Chambahs - Thu Jun 22, 2006 1:53 pm
Post subject:

A NEWB

GG where is my prize.

SpecShip - Thu Jun 22, 2006 1:53 pm
Post subject:

*zzz* Wrong! *zzz*

The answer is : trenchie!

Solo Ace - Thu Jun 22, 2006 3:36 pm
Post subject:

They're supposed to be easy questions, not retarded.

The game's called "Continuum", whoever still calls it Subspace needs glasses or a shower.

Cerium - Thu Jun 22, 2006 11:06 pm
Post subject:

Well, since you guys are driving this thread clear off topic, I think its my civic duty to bring it back on topic.

The bots finally got bad enough where I had to employ the checkbox method for posting as a guest. Hopefully I didnt butcher something and the bots dont just check everything.

SpecShip - Fri Jun 23, 2006 1:50 am
Post subject:

Solo Ace wrote:

I'm an idiot

'Nuff said.

Cerium, good luck, may the force be with you.

Contempt+ - Fri Jun 30, 2006 10:53 pm
Post subject:

SpecShip wrote:

[..]

'Nuff said.

You're the idiot. Try getting the punctuation right next time.

Chambahs - Sat Jul 01, 2006 11:30 am
Post subject:

Wheres the punctuation supposed to go? Last time I checked "Nuff" stood for "Enough". The "ff" in "nuff" subsitutes the "gh" in "enough"....so i think the ' was properly placed at the beggining since there is no "E" sound in "nuff".

SpecShip - Sat Jul 01, 2006 11:45 am
Post subject:

Shh, you're upsting the SSE NETWORK ADMINISTRATOR!!! *hitchcock shower scene sfx*