Miscellaneous Hacks - Enhanced Captcha Image Verification - stop bots from signing up!!

Title : Enhanced Captcha Image Verification

Version : 1.1

Coder : Andy Calderbank & Jason Williams

Purpose : Add extra Image Verification to the registration process, using an alternative system to the Captcha system.

Why : It would appear that spammers can now "read" the Captcha codes and overcome the verification process.

How : This extra feature uses images which are harder for a spam program/bot to interpret than text characters. The user has a choice of 4 randomly displayed images, and the answer is given below. The user must click on that image to proceed, if the incorrect image is selected an error message is shown. The images are randomly shown (from however many are in the directory - you can have as many as you want, just has to be more that 4!) and are automatically created from the images/verification/ directory - all on the fly. Sample images are included with this release, but you can use your own - I recommend using 100 x 100 pixels, in .jpg format and naming the image with a meaningful title (ie A House.jpg) - the extension is stripped so only the filename itself is shown.

To further enhance security, the images are passed through a script which means that none of the images on the screen have file names - and cannot be associated to the question by title alone.

I have been testing this on my forum and have found it to be effective - I cannot guarantee that this will stop all spamming, but this relies more on human input than a computer "reading" the image.

Important : This has been tested on 3.6.2 - I cannot guarantee it will work on anything above, please test with caution - and as always BACKUP FIRST! This will not work on anything below 3.6.0.

Demo : http://www.steadiforum.com/register.php

I hope this is help to the VBulletin community as I know this is a growing problem. I don't fancy the thought of trawling through hundreds of new members deleting stupid usernames and spam posts.

Installation :

1. Upload the verification/ directory to your images/ folder - make sure .htaccess and show.php are present - otherwise it won't work.
2. Import Product - product-image_verification.xml

Upgrading :

1. Upload show.php to the images/verification/ directory.
2. Import Product - product-image_verification.xml - select Allow Overwrite to enable upgrade.

Requirements : GD Libraries installed

File uploads : 39 (including images)
Files to Import : 1
New Templates : 1
New Phrases : 5
Uses Hooks : 1
New Queries : 0

History :
v1.0 - Original release
v1.01 - Slight code change for forums in sub-directories (thanks go to Barakat for solving this one)
v1.1 - Issue resolved with Windows servers also template clean up for xhtml compliance
v1.11 - Added version check function, minor upgrade.

Done - if you like please click install! (and I won't ask for any donations as long as you click Nominate for MOTM!)

Don't forget you don't have to use the provided images - you can customise these to any you wish - I've used ones that are hopefully universal and everyone will recognise.

[yoyoyoyo]

I am using 3.6.8, and just now installed this, and am getting these errors:

Warning: session_start() [function.session-start]: open(/var/sessions/sess_576412532ddd0f178c3d3f7b7934d7a0, O_RDWR) failed: No such file or directory (2) in /register.php(202) : eval()'d code on line 1

Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at /home/mysite/public_html/forum/includes/class_core.php:3117) in /register.php(202) : eval()'d code on line 1

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/mysite/public_html/forum/includes/class_core.php:3117) in /register.php(202) : eval()'d code on line 1

[smoknz28]

Steadicamop, great hack! I appreciate the fact that coders, like yourself, share your countless hours of coding....so Thank You!!

Next, I want to commend you on a hack that I believe is a much better approach then the standard code in place by vb. I recently installed your hack on vb 3.6.8 with only one issue. I didn't catch on to the fact that you had subdirectories to get to the verification images. I would only recommend that you not have so many sub dirs to get to the images. I had initially uploaded the directory with all the sub dirs for the images and got errors upon trying out the hack from registration. Yes your installation instructions were on track, but many of us knuckle-heads, like myself, don't do so well with reading. We get so damn anxious to get the hacks installed that we don't pay close enough attention at times to instructions. Definitely our fault...but I think you can save yourself some heartache from us knuckle-heads asking you questions on the images or it not working due to the above.

Again, great hack and I'm loving it brother!

I also posted about your hack in the vbulletin.com forums: http://www.vbulletin.com/forum/showt...33#post1420833

Thank you to all you coders for sharing your countless hours of code!

Oh, and I did install this on a heavily moded version of vb 3.6.8 and is working great.

Thanks Steadicamop.

[stryderunknown]

I haven't installed the addon, however that's because I'm in the process of look at writing one myself. However I do see a slight flaw in how your addon works (without getting into the reverse engineering of how it works).

The problem is 'finite possibilities', if a Bot were to choose to click(well... emulate a click) the first image every time eventually it would get the right image because of the randomisation process.

It could be beneficial to log the number of attempts (I'd guess in the db session table) and perhaps blacklist those that reach a certain threshold. Some might suggest generating random numbers for your show.php?# , however again a bot would be able to read it.

One way would to be add the addition of say 4-binary digits via the GD library to the bottom of each image, the user can then be asked to type the binary reference as well as click an image. (And the reference doesn't have to be from the same image as they click).

This increases the complexity and lessens the chances that both will fall on the first image (in fact you could alter the randomisation method to not allow them to fall on the same image)

I would hack that version myself, however I've got another one up my sleeve

Other than that keep up the good work (as well as all those that aid people coding/designing)

[steadicamop]

Originally Posted by yoyoyoyo

better yet, simply change it to

PHP Code:

$vboptions[bburl]/images/verification/show.php 


BTW -where are the settings in the ACP for this hack?

I did a LOT of testing with the [bburl] option but it doesn't work correctly - unless I was using it the wrong way, but I could never find a way of pulling the forum url out correctly from the vboptions system - if this is incorrect I will look at changing it, but this is why it is still hardcoded.

There aren't any options in the AdminCP for this, I haven't been able to proceed with the Flash version so may look into an update with an option for how many images to use and enable/disable, just something simple.

HTH

Jason

[steadicamop]

Originally Posted by smoknz28

Steadicamop, great hack! I appreciate the fact that coders, like yourself, share your countless hours of coding....so Thank You!!

Next, I want to commend you on a hack that I believe is a much better approach then the standard code in place by vb. I recently installed your hack on vb 3.6.8 with only one issue. I didn't catch on to the fact that you had subdirectories to get to the verification images. I would only recommend that you not have so many sub dirs to get to the images. I had initially uploaded the directory with all the sub dirs for the images and got errors upon trying out the hack from registration. Yes your installation instructions were on track, but many of us knuckle-heads, like myself, don't do so well with reading. We get so damn anxious to get the hacks installed that we don't pay close enough attention at times to instructions. Definitely our fault...but I think you can save yourself some heartache from us knuckle-heads asking you questions on the images or it not working due to the above.

Again, great hack and I'm loving it brother!

I also posted about your hack in the vbulletin.com forums: http://www.vbulletin.com/forum/showt...33#post1420833

Thank you to all you coders for sharing your countless hours of code!

Oh, and I did install this on a heavily moded version of vb 3.6.8 and is working great.

Thanks Steadicamop.

Thanks for your kind words - I was just sick of Spam sign ups, so with my limited PHP knowldedge my bro in law and I sat down to code this - it is fairly simple too, but seems to be very useful to other members.

I'm looking into an update in the not too distant future, some extra features.

Thanks again,

Jason

[steadicamop]

Originally Posted by stryderunknown

I haven't installed the addon, however that's because I'm in the process of look at writing one myself. However I do see a slight flaw in how your addon works (without getting into the reverse engineering of how it works).

The problem is 'finite possibilities', if a Bot were to choose to click(well... emulate a click) the first image every time eventually it would get the right image because of the randomisation process.

It could be beneficial to log the number of attempts (I'd guess in the db session table) and perhaps blacklist those that reach a certain threshold. Some might suggest generating random numbers for your show.php?# , however again a bot would be able to read it.

One way would to be add the addition of say 4-binary digits via the GD library to the bottom of each image, the user can then be asked to type the binary reference as well as click an image. (And the reference doesn't have to be from the same image as they click).

This increases the complexity and lessens the chances that both will fall on the first image (in fact you could alter the randomisation method to not allow them to fall on the same image)

I would hack that version myself, however I've got another one up my sleeve

Other than that keep up the good work (as well as all those that aid people coding/designing)

I don't want to step on your toes with this one if you have something in mind, but the digits on the image sounds like a neat idea - it is something that should be fairly easily added, would it be ok with you if I looking into adding this idea into this product - and of course with full credit to yourself.

[steadicamop]

Can we confirm this is definately working on 3.6.8? I will change the version on the page to reflect that it's compatible ... I'm still lagging behind on 3.6.2

[Mystery Man]

works flawlessly on 3.6.8
tested with both firefox and ie
marked as installed
thx hopefully this will kill the bot activity

[Alibass]

I am running this hack on 3.6.8 and your other hack for Contact Us also. Both are working flawlessly. I have both set to display 6 images.

Regards

[steadicamop]

I've updated to reflect that it's compatible - which I'm very glad about for when I upgrade!

I have another idea in the mix at the moment for making it even more secure - it's based on an idea from this thread.

There may be a new version in the next few weeks....

Jason