Miscellaneous Hacks - Enhanced Captcha Image Verification - stop bots from signing up!!

Title : Enhanced Captcha Image Verification

Version : 1.1

Coder : Andy Calderbank & Jason Williams

Purpose : Add extra Image Verification to the registration process, using an alternative system to the Captcha system.

Why : It would appear that spammers can now "read" the Captcha codes and overcome the verification process.

How : This extra feature uses images which are harder for a spam program/bot to interpret than text characters. The user has a choice of 4 randomly displayed images, and the answer is given below. The user must click on that image to proceed, if the incorrect image is selected an error message is shown. The images are randomly shown (from however many are in the directory - you can have as many as you want, just has to be more that 4!) and are automatically created from the images/verification/ directory - all on the fly. Sample images are included with this release, but you can use your own - I recommend using 100 x 100 pixels, in .jpg format and naming the image with a meaningful title (ie A House.jpg) - the extension is stripped so only the filename itself is shown.

To further enhance security, the images are passed through a script which means that none of the images on the screen have file names - and cannot be associated to the question by title alone.

I have been testing this on my forum and have found it to be effective - I cannot guarantee that this will stop all spamming, but this relies more on human input than a computer "reading" the image.

Important : This has been tested on 3.6.2 - I cannot guarantee it will work on anything above, please test with caution - and as always BACKUP FIRST! This will not work on anything below 3.6.0.

Demo : http://www.steadiforum.com/register.php

I hope this is help to the VBulletin community as I know this is a growing problem. I don't fancy the thought of trawling through hundreds of new members deleting stupid usernames and spam posts.

Installation :

1. Upload the verification/ directory to your images/ folder - make sure .htaccess and show.php are present - otherwise it won't work.
2. Import Product - product-image_verification.xml

Upgrading :

1. Upload show.php to the images/verification/ directory.
2. Import Product - product-image_verification.xml - select Allow Overwrite to enable upgrade.

Requirements : GD Libraries installed

File uploads : 39 (including images)
Files to Import : 1
New Templates : 1
New Phrases : 5
Uses Hooks : 1
New Queries : 0

History :
v1.0 - Original release
v1.01 - Slight code change for forums in sub-directories (thanks go to Barakat for solving this one)
v1.1 - Issue resolved with Windows servers also template clean up for xhtml compliance
v1.11 - Added version check function, minor upgrade.

Done - if you like please click install! (and I won't ask for any donations as long as you click Nominate for MOTM!)

Don't forget you don't have to use the provided images - you can customise these to any you wish - I've used ones that are hopefully universal and everyone will recognise.

[feldon23]

Originally Posted by el fuego

Could you have it re-order the 4 pictures each time they are presented? So that a click on image #1 would sometimes be correct and sometimes not? Also have the required image name be changed. For instance, one time it asks for the butterfly, the next it may ask for the soccer ball (randomly of course), and each time it changes both the question, and the location of the proper response?
Possibly also expand the hack to include many more possible images, but only randomly choose 4 at a time to display.
Along with your idea of a 24hr lock out for "x" amount of wrong answers, this could be a formidable hack.

I'm no coder... so I have no idea how hard this would be. But it seems to me that this randomness would keep the Bots at bay for quite some time.

The answer to that is not programming, but adding no-cache headers.

[Garyk]

i cant get the images to show up i am running a 3.6.2 forum heres a screen shot

[JD45]

Originally Posted by Garyk

i cant get the images to show up i am running a 3.6.2 forum heres a screen shot

Same thing for me on a 3.6.4

[steadicamop]

Originally Posted by feldon23

The answer to that is not programming, but adding no-cache headers.

In the show.php file - no cache headers are sent :

PHP Code:

header("Cache-Control: no-cache, must-revalidate"); 


I have noticed that when you click back it sometimes doesn't show correctly, I'm busy with work at the moment but dedicating as much time as I can to fixing any issues and making it virtually bullet-proof.

Jase

[steadicamop]

@ GaryK & JD45:

First thing - check to make sure you have the GD libraries installed - see this post. If you don't have GD installed it won't work - if it is installed try this -

Check the structure of the images - they should be:

forum root/images/verification

Here's something to check if that is all correct, in templates check image_verification, and find this code:

PHP Code:

images/verification/show.php 


Change it to your server root ie

PHP Code:

server root/forum/images/verification/show.php 


Make sure that ?1 through to ?4 is kept after show.php otherwise it won't work.

If all else fails PM your site details and I can take a look.

HTH

Jason

[redspider]

I notice today that the radom images dont work well in my forum see attachemnt .

[steadicamop]

Hmmm that's very unusual - try holding Ctrl and pressing F5 or refresh and see if that clears it up - it shouldn't cache any image but it's the only thing I can think that's causing it - if you still have problems let me know I can take a look into it.

Cheers

Jason

[Stavs16]

test on 3.6.2, does not work... upgrading

[steadicamop]

This is very unusual, it should work on 3.6.x - I'm eager to know why sometimes it doesn't work.

I might put together a quick FAQ.

Jase

[soniceffect]

Did you find an answer to garyk's problem above? I have the same issue