Spam problems, and what's been/being done

[greyback]

Hi all,
regular members of these forums will have noticed that we've developed a bit of a spam problem here.

To tackle this, I have installed a spam honeypot with Project Honey Pot, and all registrations and posts are verified from this. It won't stop all spam, but should lower it considerably.

Somehow the captcha on registration is not having much of an effect, as there are over 34,000 accounts here which I suspect as fake - some have spam in their profiles, and all have made zero posts. Some have not even been registered by the forum as having viewed a page!

So let's see if spam is affected. If not, I'll try something else.

Also I'm to delete those 34,000+ spam accounts. I'm going to run them through the honeypot for any obvious ones, but probably will delete all accounts with zero posts, as it's easier Now's your chance to make a post & introduce yourself!

Comments and criticisms welcome
-G

[greyback]

Well since I set up the additional anti-spam system last night, 245 spammers have been stopped! That's a lot for 12 hours.

However new fraudulent accounts are still being created, still at a high rate
I find it hard to believe the captcha is so ineffective. Anybody have any ideas?

There must be a flaw in the registration system. I'll have to dig deeper.
-G

[heyrick]

A rather impressive bug in SMF, it might be patched in your version:
http://www.simplemachines.org/community/index.php?topic=309741.0

How 4chan hacked recaptcha:
http://musicmachinery.com/2009/04/27/moot-wins-time-inc-loses/
(plus some interesting info on how recaptcha works)

Can't see any obvious "exploit" code for SMF 1.1.12. Are you sure one of the PHP scripts itself hasn't been compromised by an earlier hack?

Otherwise, can you hang an IP tracer on the new user reg code? Could be interesting to see if the signups are coming from specific places.


Best wishes,

Rick.

[ChadV]

I'm not seeing any particular trend in IP addresses, but I've not been paying THAT much attention...