Miscellaneous Hacks - Enhanced Captcha Image Verification - stop bots from signing up!!

Title : Enhanced Captcha Image Verification

Version : 1.1

Coder : Andy Calderbank & Jason Williams

Purpose : Add extra Image Verification to the registration process, using an alternative system to the Captcha system.

Why : It would appear that spammers can now "read" the Captcha codes and overcome the verification process.

How : This extra feature uses images which are harder for a spam program/bot to interpret than text characters. The user has a choice of 4 randomly displayed images, and the answer is given below. The user must click on that image to proceed, if the incorrect image is selected an error message is shown. The images are randomly shown (from however many are in the directory - you can have as many as you want, just has to be more that 4!) and are automatically created from the images/verification/ directory - all on the fly. Sample images are included with this release, but you can use your own - I recommend using 100 x 100 pixels, in .jpg format and naming the image with a meaningful title (ie A House.jpg) - the extension is stripped so only the filename itself is shown.

To further enhance security, the images are passed through a script which means that none of the images on the screen have file names - and cannot be associated to the question by title alone.

I have been testing this on my forum and have found it to be effective - I cannot guarantee that this will stop all spamming, but this relies more on human input than a computer "reading" the image.

Important : This has been tested on 3.6.2 - I cannot guarantee it will work on anything above, please test with caution - and as always BACKUP FIRST! This will not work on anything below 3.6.0.

Demo : http://www.steadiforum.com/register.php

I hope this is help to the VBulletin community as I know this is a growing problem. I don't fancy the thought of trawling through hundreds of new members deleting stupid usernames and spam posts.

Installation :

1. Upload the verification/ directory to your images/ folder - make sure .htaccess and show.php are present - otherwise it won't work.
2. Import Product - product-image_verification.xml

Upgrading :

1. Upload show.php to the images/verification/ directory.
2. Import Product - product-image_verification.xml - select Allow Overwrite to enable upgrade.

Requirements : GD Libraries installed

File uploads : 39 (including images)
Files to Import : 1
New Templates : 1
New Phrases : 5
Uses Hooks : 1
New Queries : 0

History :
v1.0 - Original release
v1.01 - Slight code change for forums in sub-directories (thanks go to Barakat for solving this one)
v1.1 - Issue resolved with Windows servers also template clean up for xhtml compliance
v1.11 - Added version check function, minor upgrade.

Done - if you like please click install! (and I won't ask for any donations as long as you click Nominate for MOTM!)

Don't forget you don't have to use the provided images - you can customise these to any you wish - I've used ones that are hopefully universal and everyone will recognise.

[lukemax]

I uploaded an Image Verification directory to the images folder, do I rename it to verification?
Also, where do I upload the xml file from the Admincp?

[lukemax]

This is my first mod. I see a verification directory, does that go into the images folder? Also, I don't get where to import the xml file and what it does?
Thanks

[steadicamop]

The verification directory needs to go in the /images directory - just make sure that when you click in the verification directory that the image filenames are the next thing you see.

The product XML is installed through the AdminCP -> Plugins & Products -> Manage Products then scroll down and click on [Add/Import Product] select the XML file in there and it will automatically install.

HTH

Jason

[lukemax]

Wow, thats magic in my book.
Is there a way I can turn it off and only turn it on when I start to get spammed?
(Like from the AdminCP?)

[phpdevrus]

nice looks good and cant wait to see the next version.

i thought you should come up with a few other verification tests then randomly show one and if incorrect randomly show another. since the tests will be different it wont be so easy to bypass unless it is a real person signing up.

:-)

[lazytown]

Other users are correct -- this can easily be defeated if it gets popular enough. The problem is an easy 1/4 chance to get it right, and the bot could just try again and again as suggested. Even using different IPs/etc. I loved this idea, but unfortunately I have to go with the other method (asking questions) which is more time-consuming to make, but are unique to each forum and require real user input (that has infinite possibilities).

It will help people until there is a crack, so thanks for doing it.

-vissa

[delmarva]

Very nice... Is there any way to change the pictures and the text to somehow match the site you are using it on? For example, I am hosting a fishing forum. Could the folks who register see a certain type of fish, and choose the right one? This might be more interesting and not so childish to these old fogies who sign up. Thanks for you patience.

[steadicamop]

Originally Posted by delmarva

Very nice... Is there any way to change the pictures and the text to somehow match the site you are using it on? For example, I am hosting a fishing forum. Could the folks who register see a certain type of fish, and choose the right one? This might be more interesting and not so childish to these old fogies who sign up. Thanks for you patience.

Yeah this is easy - just remove all the images that come with the package and use your own (it looks neater if you use same size images), and name them something descriptive as the script takes the filename for the answer (ie .... Fish.jpg becomes Fish) - it has the extension stripped.

Jason

[delmarva]

Very cool. Thanks!

[momlwt]

Having same problem with images not showing. GD is installed and path is going to the right place.

On Windows server vB 3.6.4 I would really like to use this but had to disable for now. Any help would be appriciated.