Miscellaneous Hacks - Enhanced Captcha Image Verification - stop bots from signing up!!

Title : Enhanced Captcha Image Verification

Version : 1.1

Coder : Andy Calderbank & Jason Williams

Purpose : Add extra Image Verification to the registration process, using an alternative system to the Captcha system.

Why : It would appear that spammers can now "read" the Captcha codes and overcome the verification process.

How : This extra feature uses images which are harder for a spam program/bot to interpret than text characters. The user has a choice of 4 randomly displayed images, and the answer is given below. The user must click on that image to proceed, if the incorrect image is selected an error message is shown. The images are randomly shown (from however many are in the directory - you can have as many as you want, just has to be more that 4!) and are automatically created from the images/verification/ directory - all on the fly. Sample images are included with this release, but you can use your own - I recommend using 100 x 100 pixels, in .jpg format and naming the image with a meaningful title (ie A House.jpg) - the extension is stripped so only the filename itself is shown.

To further enhance security, the images are passed through a script which means that none of the images on the screen have file names - and cannot be associated to the question by title alone.

I have been testing this on my forum and have found it to be effective - I cannot guarantee that this will stop all spamming, but this relies more on human input than a computer "reading" the image.

Important : This has been tested on 3.6.2 - I cannot guarantee it will work on anything above, please test with caution - and as always BACKUP FIRST! This will not work on anything below 3.6.0.

Demo : http://www.steadiforum.com/register.php

I hope this is help to the VBulletin community as I know this is a growing problem. I don't fancy the thought of trawling through hundreds of new members deleting stupid usernames and spam posts.

Installation :

1. Upload the verification/ directory to your images/ folder - make sure .htaccess and show.php are present - otherwise it won't work.
2. Import Product - product-image_verification.xml

Upgrading :

1. Upload show.php to the images/verification/ directory.
2. Import Product - product-image_verification.xml - select Allow Overwrite to enable upgrade.

Requirements : GD Libraries installed

File uploads : 39 (including images)
Files to Import : 1
New Templates : 1
New Phrases : 5
Uses Hooks : 1
New Queries : 0

History :
v1.0 - Original release
v1.01 - Slight code change for forums in sub-directories (thanks go to Barakat for solving this one)
v1.1 - Issue resolved with Windows servers also template clean up for xhtml compliance
v1.11 - Added version check function, minor upgrade.

Done - if you like please click install! (and I won't ask for any donations as long as you click Nominate for MOTM!)

Don't forget you don't have to use the provided images - you can customise these to any you wish - I've used ones that are hopefully universal and everyone will recognise.

[Areku]

Originally Posted by XanderZone

Although, if they programmed their bots well, comparing a piece of text with a filename isn't all that hard to bypass

Well, that should not be happening:

the images are passed through a script which means that none of the images on the screen have file names - and cannot be associated to the question by title alone.

It's actually easier than that for bots.

Problem is actually that with default installation bots just revisit the site UP TO 4 times and they'll come in, just adding the ?parameter=correctanswer to the url...

Just increase the number of images and replace default images/names.



SO the more images you add, the less likely they'll pass thru. It just depends on how many retries the bot has been set to.

[voter]

Nice hack.
Thank you.
Here are some more "intellectual" pictures that may be will help also real users to learn something when already registering to your forum
Attachment 125579
I think due to actual hacked reCAPTCHA problem this mode must get a MoD of The Moth status.

[Big Kahuna]

Well -- that's didn't stop the bots

[voter]

Originally Posted by Big Kahuna

Well -- that's didn't stop the bots

Do you mean it didn't hinder Bots to register into your forum?
I could say that after installing this, new Bot/XRumer registrations in our forum are 0 now. To be honest I increased the complexity to 6 images.

Or if you need to prevent Bots from posting when using already registered, e-mail verified users, then you need to use Spam Management of vbulletin with Akismet?

[Big Kahuna]

ten minutes late I had a couple new registrations --

However I've since changed the directory of the images, and updated the addon and the template for the updated directory name.

I also installed the addon that checks thje ip address against a blacklist of known spammers, and change the human verification to the most complicated captcha -- and the combination of that has stopped the spamming.

[creative-friend]

i have just installed it but the images are not showing

i dont knw why??

[tom001]

Does not work for 3.8.5

[akanevsky]

Why is this mod published in 3.8 section if it's for version 3.6?

[Paul M]

Because it works on 3.8 as well, and was moved in 2009. They have just never updated the version in the first post.

[singh9211]

Can anyone please upgrade it to work with Vbulletin Version 4.xxxx