Miscellaneous Hacks - Enhanced Captcha Image Verification - stop bots from signing up!!

Title : Enhanced Captcha Image Verification

Version : 1.1

Coder : Andy Calderbank & Jason Williams

Purpose : Add extra Image Verification to the registration process, using an alternative system to the Captcha system.

Why : It would appear that spammers can now "read" the Captcha codes and overcome the verification process.

How : This extra feature uses images which are harder for a spam program/bot to interpret than text characters. The user has a choice of 4 randomly displayed images, and the answer is given below. The user must click on that image to proceed, if the incorrect image is selected an error message is shown. The images are randomly shown (from however many are in the directory - you can have as many as you want, just has to be more that 4!) and are automatically created from the images/verification/ directory - all on the fly. Sample images are included with this release, but you can use your own - I recommend using 100 x 100 pixels, in .jpg format and naming the image with a meaningful title (ie A House.jpg) - the extension is stripped so only the filename itself is shown.

To further enhance security, the images are passed through a script which means that none of the images on the screen have file names - and cannot be associated to the question by title alone.

I have been testing this on my forum and have found it to be effective - I cannot guarantee that this will stop all spamming, but this relies more on human input than a computer "reading" the image.

Important : This has been tested on 3.6.2 - I cannot guarantee it will work on anything above, please test with caution - and as always BACKUP FIRST! This will not work on anything below 3.6.0.

Demo : http://www.steadiforum.com/register.php

I hope this is help to the VBulletin community as I know this is a growing problem. I don't fancy the thought of trawling through hundreds of new members deleting stupid usernames and spam posts.

Installation :

1. Upload the verification/ directory to your images/ folder - make sure .htaccess and show.php are present - otherwise it won't work.
2. Import Product - product-image_verification.xml

Upgrading :

1. Upload show.php to the images/verification/ directory.
2. Import Product - product-image_verification.xml - select Allow Overwrite to enable upgrade.

Requirements : GD Libraries installed

File uploads : 39 (including images)
Files to Import : 1
New Templates : 1
New Phrases : 5
Uses Hooks : 1
New Queries : 0

History :
v1.0 - Original release
v1.01 - Slight code change for forums in sub-directories (thanks go to Barakat for solving this one)
v1.1 - Issue resolved with Windows servers also template clean up for xhtml compliance
v1.11 - Added version check function, minor upgrade.

Done - if you like please click install! (and I won't ask for any donations as long as you click Nominate for MOTM!)

Don't forget you don't have to use the provided images - you can customise these to any you wish - I've used ones that are hopefully universal and everyone will recognise.

[steadicamop]

Rightho ... version 2 is out now - get it here - https://vborg.vbsupport.ru/showthread.php?t=181818

Updated with AdminCP options and new images, should work better, but at beta status as there are a few changes which need fully checking.

Jason

[Christophe_O]

P.P.S. Sorry STEADICAMOP I did not notice your above message: this is an obsolete thread! New version:
Enhanced Image Captcha 2.2b

I came here following a reference by Indie2Industry in the Vbulletin.com thread: Spam bots defeat Recaptcha.

I like this hack!

• So simple, no messing with IP databases, etc.
• I believe much new spam is from 'spamborgs' not bots: humans who do not speak English, acting like trained monkeys. People who speak English generally command a higher salary and their time is too costly for this petty spam. That is why I believe this program will be effective.
• Allows each forum to use different images, thus more difficult to program a robot or train a human to answer correctly at numerous forums.
• Much better for the legitimate visitor than ramping up the obscurity of character recognition.

I am not ready to use this hack yet (my forum just started) but voted anyway as MOTM. I am posting this reply to add a few tips and suggestions, based on my testing today at Steadiforum.com (3.6.2) and TheBlueRoomForum.org (3.7.1).

• Test the 'back' button after clicking the wrong image with Firefox (20% traffic) as well as Explorer (about 80%). Test both the back button on the browser and clicking the word 'back' on the error page. (Some bugs here. Maybe the hack needs automatically to 'refresh'.)
• With Explorer 7 and high speed cable, some of the images at Steadiforum.com did not readily download to my browser. I suggest that all the images files be kept strictly below 4k.
• There are some people from every country who speak English well enough to be good forum members. But may not know Homer Simpson. I suggest keeping the labels generic such as "bald man".
• I don't know if blind people using 'aural readers' can navitate Vbulletin. But if so, they should be directed to a contact form for sign-up.
• I suggest that maybe the directional words such as 'bald man' also be converted to an image? That way, illiterates can not compensate by using translation software. Also 3 directional variations for each image. Example: bald man, hairless person, cartoon man.

P.S. I think this program works well partly because it is not commonly used. This program seems to be especially effective against the current wave of semi-human robots who have trouble reading English.

However, if more widely used, then perhaps added complications may be needed. The choices are limited to about 15, and we must allow 3 tries to be human-friendly. Thus, robots can get through 1/5 the time by guessing. When guessing wrong, they cycle through all other forums, returning the next day until they finally will get through. Maybe this could be overcome by shutting down any IP which sends a guesser three times in three days.

Another option would be to create 2-3 multiple-choice options instead of just one. I.e., the verification page might consist of 2 or 3 challenges to choose the correct image from a row of 7-10 images. The visitor could be asked to check a box beside the correct image, 2-3 times. Still simple for humans, and only requiring a download of 14-21 images, but offering 49-343 possible answers.

P.P.S. Sorry STEADICAMOP I did not notice your above message: this is an obsolete thread! New version:
Enhanced Image Captcha 2.2b

[shawn911]

How do i translate this in French ?
I was looking for a language file.
But there is nothing.
Do i need to go to the Admin CP to translate it ?
If yes, how and what variables to translate ?

Thanks in advance.

[Paul M]

Moved to 3.8 section.

[RedDevil]

installed, nice

[Noonster]

Originally Posted by Paul M

Moved to 3.8 section.

I thought the one in the post above was a never version? Maybe that is the one that needs to be moved? I have installed the one in the link on 3.8 and its working great!

[nectons]

3.8.0 final and works just perfect.

Thanks

Installed

[rob01]

can this support different languages?

[hector2000]

i want use this hack but with diffrent language
when i change name of picture to another language then hack wont work and wont show correct name

[Frank Sinatra]

thanks works perfect!
installed