By cel4145 on

This is a heads up to everyone doing 4.7 upgrades. Yesterday, I updated kairosnews.org to the most recent Drupal 4.7 RC. The upgrade itself went fine, but within just a couple of hours of switching the site from maintenance mode to public access, spammers began autoregistering on the site and creating user accounts with links to sites in their profiles. I've since switched the site registration to moderation (I tried the current captcha module, but would not run).

⋅ Categories: Drupal 4.7.x

Comments

laura s’s picture

laura s commented

Did you by chance check the access controls? You have to enable access to captcha in the access controls, or it won't show up.

Captcha works for me. I have it going on two sites so far.

Laura
_____ ____ ___ __ _ _
design, snap, blog

_____ ____ ___ __ _ _
Laura Scott :: design » blog » tweet

cel4145’s picture

cel4145 commented

The version of the captcha module I installed seemed to be broken. It caused problems with the admin->module display page. I'm still finishing up the upgrade, so I'll get back to figuring out what the problem was later.

cel4145’s picture

cel4145 commented

I changed the default registration message, reworking the message text itself and removing the direct links. I also implemented the bad behavior module. User registration has been open since; no spammer registration.

linulo’s picture

linulo commented

Don't forget that captchas will keep the casual spammer out, but if your site becomes more attractive for spammers, they may still break that barrier, even if drupal's captchas are of decent quality.

spyres’s picture

spyres commented

The newest version of the captcha module (which requires the textimage module now) is really awesome. It lets you basically create your own captchas and set the strength of the captcha by controlling how many fonts are used and the rotation/spacing/etc. of the captcha text.

It also allows custom backgrounds to be added so you can further customize it.

Highly recommended.

beginner’s picture

beginner commented

I had a very similar experience to yours.
Two days ago, three new 'users' registered within a minute at wechange. When registering, users can enter some information in their profile.

The spammer used

  1. one of the three registration process to enter links to non-existing web sites in plain text in the profile fields,
  2. one using BBcode
  3. one using html

Obviously, nothing worked.
A few hours later, he tried registering three more accounts (again, within a minute).

Obviously, all six accounts have been deleted. They have not tried again, so far...

This issue has some relevant information
http://drupal.org/node/41535#comment-99606

I think the spammers were only trying to test the 'spammability' of our web sites. The issue above can help make spamming registration even less attractive...

--
http://www.reuniting.info/
Healing with Sexual Relationships.
http://www.wechange.org/
We live in a world of solutions.