member.php spam prevention

[Ritsui]

I don't know how big of a problem this is, but with spammers getting more desperate and aggresive every day, I'd be surpised if this doesn't start happening a whole lot more.

A forum I run (vb 2.x) just got nailed by a spammer who joined and ran a POST script to iterate through userids until they emailed every user on the forums who had email enabled (well over 1,000 :eek:). This put the site at risk for termination if the emails ended up reported to Spews or Spamcop, so I added a hack to make sure it can't happen again including a minimum post count before you can use the mail functions and a floodcheck to allow only 1 email every X seconds.

I haven't put the hack in publishable form yet, but it's all available on request.

[Koobi]

Ritsui, I experienced the same problem although not all members had recieved this email (I and a few moderators did though).

Could I please have a look at the hack?
Thanks
- Bane

[g-force2k2]

It wasn't the site's fault, and the emails do get sent from the user who sent them so just report the person to their internet provider using their ip address. Hope that everything works out.

Regards,
g-force2k2

[Ritsui]

I contacted the user's ISP immediately, but I wouldn't expect any tangible results from that. I can't speak for others, but Roadrunner didn't give a damn about enforcing their own TOS. They said flat out that they only care if the spam itself originated from one of their address blocks.

As for the hack, please keep in mind this was written as a knee jerk only. I'm not a "vb hacker" and I won't warranty or promise to support anything. This works for me under 2.2.5 and should work under 2.3.3.

Also... CHECK YOUR LOGS. In our case, the spam was definitely run from members.php, but there are many other places in vBulletin using mail(), so they should be looked at as well.