6

I'm using recaptcha on a very simple forum registration page. The script first of all checks if the recaptcha code is valid, then it process. As soon i did put the website live, it got lots of spam registrations (~30). I was very surprised that how the spam bots could bypass the reCaptcha.

Anyway, to make it more secure, I did implement the stopforumspam.com API. So, first the forum checks the reCaptcha, and then it checks the stopforumspam.com to see if the email is spam or not. However I'm still getting the spam registrations (with the emails which already exist in the stopforumspam database).

I tried to test my registration system by registering with a spam email that already exists in the stopforumspam.com database, and my system did not let me register.

So, now my question is that, is this weakness in my programming code? Or the spammers do not use the registration page, they some how inject the code in the database? Is it possible to check that? Is there coding practice to prevent this problem? Thanks.

Improve this question
1
  • Could you provide more detail about the type of community you are trying to support? Certain techniques work better for certain communities, but ultimately, if you have a top level domain with a discoverable registration page, captcha's are only going to help reduce the amount of spam, not stop it (and generally it will still be a significant amount). Proactive blocking and using shared block resources that prevent known trouble sources are generally your best bet in addition to Captchas. NuCaptcha can also be interesting as it uses video that is potentially harder to analyse.
    – AJ Henderson
    Nov 15 '12 at 17:24
2

I've noticed issues with ReCaptcha not being a good stop for spam registrations on some of my personal sites as well. In many cases, I try to use some bit of information that would be unavailable to the spammer but would be available to community members. Since most of the sites I've put up myself are gaming related, it's typically been some question about the game that is phrased in a way that a simple Google search couldn't find. (For example, leaving out the name of the game and asking an otherwise generic question or even asking what game it is for.)

I realize that this might not work in all cases, but there also isn't really a good one size fits all solution for fighting spam registrations.

Improve this answer
5
  • Strange, because Google, Facebook, TicketMaster, Twitter, 4chan, CNN.com, StumbleUpon, Craigslist and others who also happened to use it, have not noticed the same problem. But your solution is nice, not from security point of view (I highly doubt that your database of questions is reasonably big), but from relaxation - it might be interesting (and viewed as a nice feature) for members of your sites
    – Salvador Dali
    Nov 14 '12 at 22:47
  • 1
    allspammedup.com/2011/01/google-recaptcha-cracked This was the original article I was thinking of and I noticed a dramatic increase in spam registrations around the same time. It is possible it has since been fixed, but as mentioned by others, that still won't stop the services that have people do it. Using information that is not known (what you know) by the attacker when possible is a valid security alternative if it fits the community in question. My main point is simply Recaptcha alone is not a one stop shop answer, but rather a portion of a defense in depth.
    – AJ Henderson
    Nov 15 '12 at 17:13
  • Also, many of these sites have had problems, but they rely on other systems to help prevent it such as user reporting, IP analysis, e-mail verification, etc. Recaptcha makes it more difficult, but it isn't a block and there are both automated and manual ways around it.
    – AJ Henderson
    Nov 15 '12 at 17:16
  • @SalvadorDali How do you know that those sites you listed have not seen this issue?
    – Xander
    Nov 15 '12 at 18:48
  • There were some security issues with reCaptcha, but because it was bought by google, it takes all such threats pretty serious and fix anything before even people start to use it. Of course it is possible that the person is using old version, but as far as I understood he just started his site, so the possibility of old version is unlikely, but still @AJHenderson you are right. Regarding the question of Xander - most probably because they would use something else in such a case. I always believe that if something is working nicely for a huge million dollar corporation, it will work for me
    – Salvador Dali
    Nov 15 '12 at 20:39
1

I guess that there is nothing wrong with your programming, but you might have left open an entrance to register accounts without the actual registration page. For example, if after a successful captcha the page redirects you to http://foo.org/reg.php?name=foo&age=50 there is.no need for access control at all. It makes the registration page a front that only the "good guys" use..

I have a recaptcha fun fact also: In the picture, it is only the clearly computer generated part that needs to be entered. The other one is scanned from a book and you can write whatever, (messing up some ebook somewhere I guess).

Improve this answer
1
  • As far as I remember both parts never were recognized by any OCR software, all the CAPTCHA knowlede reCAPTCHA has was "learned" by human beings, but only one part is actulaly known when shown. ;) google.com/recaptcha/digitizing
    – Manuel Faux
    Nov 14 '12 at 21:42
1

I actually think that there is something wrong with you programming, because in my opinion they are using another way to register on your site without coming from the page you created for registration.

The reasons for thinking this way:

  • you tried to register by yourself with a stopforumspam.com blocked email and you failed, after bypassing captcha (which means that they somehow bypass your check of nonspam email)
  • I am not sure that your site actually worth it (no offence here) to pay people to solve captchas. Up till now this captcha is really strong and I have not heard any incidents of bypassing it without paying people. So if I would find a way to do so, I would rather try to use this knowledge in a better way.

What I would do to test it:

  • delete few registration from spam emails and try to register with them using your page. (This way I will be sure that people who registered in your system really bypassed it, and that is not just an accident with random email with stopforum)
  • if it is really so, in my registration module I will inject some code which will tell me from what page exactly the person came. I am really sure they are using some other page.
  • in retrospect to @ManuelFaux comment: please make sure you are using the API just to match an email (not email,ip,username or whatever tuple)
Improve this answer
5
  • The code is bbPress version 1.1 (stand alone) by WordPress, but it is not actively developed. It has the registration page (register.php), I could not find any other page where it could have registration option. I noticed that after implementing the stop spam API the spam decreased (got around 10 registrations, may be it is by chance). Yes, I did delete the spammer email from my DB, and tried to register using the same email and it did not let me register. And yes, recaptcha also works works fine. I'm using API just to match email address (not IP etc).
    – user16018
    Nov 14 '12 at 21:52
  • The comment was just meant as a general explanation of the features of stopforumspam.com, not related to the concrete question. But I agree, it's worthless to do an exact match with all three components.
    – Manuel Faux
    Nov 14 '12 at 22:08
  • Really good idea to save the "access anchor" when registering a new user!
    – Manuel Faux
    Nov 14 '12 at 22:09
  • @manuel may be I misunderstood your point regarding API
    – Salvador Dali
    Nov 14 '12 at 22:37
  • By the same token as saying that a site isn't worth paying someone to manually do a recaptcha, how much less so would it be worth analyzing for a vulnerability that allowed registration. The thing about most SPAM registrations is that they are looking for TLDs that get indexed so they can generate page links to try to drive up page ranks. It's about gaming the search indexer system and the more TLDs you can get to link to you, the better off you are, as link farmer.
    – AJ Henderson
    Nov 16 '12 at 15:12
0

Spammers often use Chinese human farms to manually enter those captchas. I don't know about that stopspam email register but you can have 1000 captchas decoded for about 1 USD.

Improve this answer
2
  • stopforumspam.com just checks IP address, username, and email address against a list and blocks the registration in case of suspicious data.
    – Manuel Faux
    Nov 14 '12 at 21:36
  • @ManuelFaux he can use API stopforumspam.com/usage only to tell if mail is there. So basically in my opinion everything is OK. He do not need to link it to ip or anything else.
    – Salvador Dali
    Nov 14 '12 at 21:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.