How to block some programs which can register and confirm account automatically!

[Fu-Kwun Hwang]

However, some program can bypass the above procedure. Like Xrumer or Zunker...

Code:

Xrumer allows to post in phpBB and PHP-Nuke (with any modification), yaBB, VBulletin, Invision Power Board, IconBoard, UltimateBB, exBB, and phorum.org.
 Basically, it follows the process below:

   It looks for websites where comments can be inserted.
   It registers itself as a user.
   It posts the message.

This type of websites usually include human verification codes, in order to make automatic registration more difficult for this kind of robots or they use filters in order to block IP addresses that carry out suspicious operations.
That旧 why, this program is able to recognize the texts in the images. It also allows to connect to a list of proxies in order to use different IP addresses.

To prevent posting by programs like the above examples:
Add javascript code to check if data in the form is enter with key stroke.
For example:
1. add a hidden variable in the form to be checked:
2. add javascript to username input textfield: onkeyup="this.form.checkme.value=1;">
3. add javascript code to check it before user submit the form: onsubmit="if(this.form.checkme.value!=1)return false;else return true;">

if you want to see updated blacklist please click

-*-

[lookang]

i am not sure how to add this codes in my own forum simple machine forum php.


I wonder if anyone has made this codes modifications in SMF forum mods (modification)?

It is more easy to adopt if i can just upload, expand it and deploy it like a mods.

basically, the mods just find the codes, and then replace it with another codes. if all finds and replacement are true, the mods will signal success! But i have not made one myself yet

Let me explore more about this and come back.
I do get a couple of registration on my forum each day or so I go check

[lookang]

ok. i am convince i need this codes. http://66.7.205.91/~lookangc/index.php?board=55.0
i have many posts that could be from bots automatically register n post

how do i add them in where of my php files, there are many files.

Thanks!

[Fu-Kwun Hwang]

When you create a lock, there is a key to unlock it.

I have used phpBB for my web site. But it was hacked several years ago. 
Because phpBB was so popular and the code are freely available.
So hacker can study all the protections and find out solution to break in.
Due to so many unrelated messages posted everyday.
I wrote my own code to host all the simulations between 2001-2007 (it is still available). 
However, the system is not familar to most of the users.
The web site still attracted many visitors, but the average posted messages reduced a lot. 

I switch to this system on 2007/02/14, because the system was not the most popular one and seems to have many security features at the time.

However, the code are public available. So someone find ways to hack the system.
Yes. I can add modifications code and post it in SMF forum mods.
However, someone will find the way to hack it soon.
For examples: Visual verfication image was added and user has to type in verfication code from the image.
But program like x r u m e r  can recognize the image. It can read email and click link to confirm the account automatically. That is why so many users use it to add links to web site. (The program cost nearly $520). ---I do not want to add link to help it.

I think the best way is to add a simple but unique solution to prevent it.
The above method I posted does not really prevent the form to be submitted by the hacker.
But the value for checkme submitted to the server will be 0 instead of 1.
So I block the registration with added code (Normal user registration will be the same as usual).

The average number for registered users was 50-60 per days last month.
It reduced to 25 yesterday (from the record: 26 were blocked ).

I knew there are many users registered but never post message.  I found many of those accounts never visit one of the message in this forum, when I check the log files. They only registered and leave several URLs as part of their personal profile. That is why I only allow registered users to be able to view other user's personal profile.

Sent me Themes/default/Register.template.php and Sources/Register.php via private message.
I can modify the code for you and send them back.

I would suggest you: do not allow anyone to view the board link in your message (only visible to yourself).
Because it will help the program to find where the program works (I believe the program use search engine to find web sites as their target).
I also create a board stored all those banned topics.
In the last two weeks, I have to remove those messages more and more often. So I decided to modify the code during the weekend to prevent those messages/registrations.
It is working (at least up to now). 

I am aware that someday they will find another way to break in.
I just have to fix it then.    It might becomes a never ending war!

[lookang]

your SMF codes work well on my forum http://66.7.205.91/~lookangc/index.php , there is rarely any registration now which is correct!

Thanks for solving robot register and confirm account automatically!

[melayu43]

by far, SF is the most secure CMS i've used so far ...

[kenmajor]

I've just applied these to my sites, lets see if works, thanks for the info in advance!

[kenmajor]

hope this works those xrumer's have been spamming my sites to the end of this world

[desertrose3]

There are so many programs out there now to overpass all the plug-ins and everything now though 

[smith8890]

I am impressed by the quality of information on this website. There are a lot of good resources here.
I am sure I will visit this place again soon.-*-

[diagobd2]

I am aware that someday they will find another way to break in.



-*-

[cpsclicker]

I have my own forum site too and this xrummer makes me nuts. How can I prevent this to happen?