Miscellaneous Hacks - Enhanced Captcha Image Verification - stop bots from signing up!!

Title : Enhanced Captcha Image Verification

Version : 1.1

Coder : Andy Calderbank & Jason Williams

Purpose : Add extra Image Verification to the registration process, using an alternative system to the Captcha system.

Why : It would appear that spammers can now "read" the Captcha codes and overcome the verification process.

How : This extra feature uses images which are harder for a spam program/bot to interpret than text characters. The user has a choice of 4 randomly displayed images, and the answer is given below. The user must click on that image to proceed, if the incorrect image is selected an error message is shown. The images are randomly shown (from however many are in the directory - you can have as many as you want, just has to be more that 4!) and are automatically created from the images/verification/ directory - all on the fly. Sample images are included with this release, but you can use your own - I recommend using 100 x 100 pixels, in .jpg format and naming the image with a meaningful title (ie A House.jpg) - the extension is stripped so only the filename itself is shown.

To further enhance security, the images are passed through a script which means that none of the images on the screen have file names - and cannot be associated to the question by title alone.

I have been testing this on my forum and have found it to be effective - I cannot guarantee that this will stop all spamming, but this relies more on human input than a computer "reading" the image.

Important : This has been tested on 3.6.2 - I cannot guarantee it will work on anything above, please test with caution - and as always BACKUP FIRST! This will not work on anything below 3.6.0.

Demo : http://www.steadiforum.com/register.php

I hope this is help to the VBulletin community as I know this is a growing problem. I don't fancy the thought of trawling through hundreds of new members deleting stupid usernames and spam posts.

Installation :

1. Upload the verification/ directory to your images/ folder - make sure .htaccess and show.php are present - otherwise it won't work.
2. Import Product - product-image_verification.xml

Upgrading :

1. Upload show.php to the images/verification/ directory.
2. Import Product - product-image_verification.xml - select Allow Overwrite to enable upgrade.

Requirements : GD Libraries installed

File uploads : 39 (including images)
Files to Import : 1
New Templates : 1
New Phrases : 5
Uses Hooks : 1
New Queries : 0

History :
v1.0 - Original release
v1.01 - Slight code change for forums in sub-directories (thanks go to Barakat for solving this one)
v1.1 - Issue resolved with Windows servers also template clean up for xhtml compliance
v1.11 - Added version check function, minor upgrade.

Done - if you like please click install! (and I won't ask for any donations as long as you click Nominate for MOTM!)

Don't forget you don't have to use the provided images - you can customise these to any you wish - I've used ones that are hopefully universal and everyone will recognise.

[steadicamop]

Originally Posted by Keyser S?ze

i hate to be a broken record but any progress on the imagemagik compatibility?

From past experience Imagemagick is a little of a rarity towards image processing - the GD libraries are usually built into PHP so hence why this was written with that in mind - but I am checking out the liklihood of adding that function and make it an AdminCP option.

[steadicamop]

Originally Posted by Dragons76

All the files are in the correct location. I have made the modif for the plugin, and i have the same error

If you PM your site details and include as much info as possible about what the forum root and server root should be I will take a look into it.

[BoredOutOfMyMin]

This does not work under 3.6.7 PL1 running on a Apache Server being viewed on a Linux Computer using Firefox.

[iVox]

Thanks, just what I needed to know. This is an important mod, it should be one of the choices in the default vB setup in the release candidates and final version in my opinion. I might implement it on my forum with the necessary fixes and a few changes, i.e. random numbers or a hash generated associated with each image which would make even guessing impossible by bots written by people exploiting the fact they have a one in five chance of getting past that prompt simply by trying "1" through "5" and attacking the forum multiple times in a row.

I'm in the midst of doing other things, so this might be awhile. If anyone out there, including this mod author, is willing to take this up sooner - go for it.

-jim

[shredded]

I'm pretty new to this but trying to catch on quickly. I want to use this and the secure contact us on our site but want to ask this first. Will I need to make any modifications to my style if I am not using the default VB style? Additionally, I noticed that your demo uses 6 images, which I like, but the install uses 4. I see in the code where that change is made but since it is your code, I ask before I cahnge... I would prefer to have 6 like your demo uses. Do I need your permission and do you see any problem with changing it to 6?

Thanks in advance...

[steadicamop]

Originally Posted by iVox

Thanks, just what I needed to know. This is an important mod, it should be one of the choices in the default vB setup in the release candidates and final version in my opinion. I might implement it on my forum with the necessary fixes and a few changes, i.e. random numbers or a hash generated associated with each image which would make even guessing impossible by bots written by people exploiting the fact they have a one in five chance of getting past that prompt simply by trying "1" through "5" and attacking the forum multiple times in a row.

I'm in the midst of doing other things, so this might be awhile. If anyone out there, including this mod author, is willing to take this up sooner - go for it.

-jim

I'm looking into moving away from using this image based version and using a flash version which should be (hopefully) impossible for bots to get past as it would require a click within the flash area and not a link - this is taking some time though as I don't understand Flash and I need to figure out how to pass the variable to PHP (if anyone can help please PM me!) - I understand as it is, it can be defeated by repeatedly clicking, but it's working well for me and other members here.

Jason

[steadicamop]

Originally Posted by shredded

I'm pretty new to this but trying to catch on quickly. I want to use this and the secure contact us on our site but want to ask this first. Will I need to make any modifications to my style if I am not using the default VB style? Additionally, I noticed that your demo uses 6 images, which I like, but the install uses 4. I see in the code where that change is made but since it is your code, I ask before I cahnge... I would prefer to have 6 like your demo uses. Do I need your permission and do you see any problem with changing it to 6?

Thanks in advance...

Nope it's fine - feel free to change it to any number you prefer and it uses existing styles - so will match for each without and style customisations.

HTH

Jason

[basskiller]

for some reason.. the images stopped showing up.. I've not added any new hacks
http://www.worldclassbodybuilding.co...s/register.php

the images are in the right directory
http://www.worldclassbodybuilding.co...0Butterfly.jpg




when clicking on the show.php? file

Fatal error: Call to undefined function: imagecreatefromjpeg() in public_html/forums/images/verification/show.php on line 21

[ShackMaster]

It's been several months for us using this hack. This has to be the best hack I've come across and I've got quite a few installed. This one has saved us a lot of headaches. We were getting hammered with spam and had tried nearly everything else out there... nothing was working.

This plugin works great!

Thank you Jason!

[Ren? Kunze]

I installed it also times into my forum.
I had the side once seen thereafter, not again.
As it can be which I the pictures only once sees.
I must activate that or somewhere still so.

I have 3.6.7