Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

I have a forum that's getting hit a lot by forum spambots, and of course the best way to defeat something is to know thy enemy. I'll worry about defeating those spambots later, but right now I'd like to know more about them. Reading around, I felt surprised about the lack of thorough information on the subject (or perhaps my ineptness to input the correct search terms for better google results).

I'm interested in learning all about spambots. I've asked on other forums and gotten brush-off answers like "Spambots are always users registering on your site."

  • How do forum spambots work?
  • How do they find the 'new user registration' page? (I'm especially surprised because some forums don't have a dedicated URL for this eg, www.forum.com/register.html , but instead use query strings or even other methods invisible to the URL bar)
  • How do they know what to enter into each 'new user registration' field?
  • How do they determine what's a page they can spam / enter data into and what is not?
  • Do they even 'view' this page at all?
  • ..If not, then I'd assume they're communicating with the server directly - how is - this possible? How do they do it?
  • Can forum spambots break CAPTCHAs? Can they solve logic questions (how?)? Math questions?
  • Do they reverse-engineer client-side anti-bot validation scripts? Server-side scripts?
  • What techniques are still valid to prevent them?
  • Where do spambots come from? Is someone sitting behind the computer snickering as they watch their bot destroy site after site? Or are they snickering as they simply 'release' it onto the internet somehow? Are spambots 'run' by an infected computer somewhere? Do they replicate themselves?
  • etc
share|improve this question

4 Answers 4

How do they find the 'new user registration' page? (I'm especially surprised because some forums don't have a dedicated URL for this eg, www.forum.com/register.html , but instead use query strings or even other methods invisible to the URL bar)

They find new sites by:

  • Crawling and looking for signatures of known software. Usually this is a snippet of text like a copyright or a meta tag but it could be any consistent identifier. This usually applies to blog and forum software.
  • Manual inclusion. Human beings, whose labor is cheap in many parts of the world, look for known software or forms that are easily exploitable and add them to a database. This usually applies to custom registration and contact forms.
  • They buy lists. Just like email addresses are sold by spammers, known vulnerable or preferred target site lists are sold as well.

How do they know what to enter into each 'new user registration' field?

They know what to enter into each field by using the field names as a guide. 99.99% of the time the email address field is named "email" or something containing the word "email". You don't have to be a rocket scientist to know that field probably is for an email address. For things like names, login ID, addresses etc. it works on the same principle.

How do they determine what's a page they can spam / enter data into and what is not?

They don't care. The automated tools can try so many forms in such a short period of time at virtually no costs so trying every form possible is a no-brainer to do. When human labor is involved they can be "script kiddies" and try the obvious stuff to see if they get any kind of response that indicates the form is potentially vulnerable. Basically, any form is a potential target to them as is any page that accepts user input.

How do forum spambots work?

Do they even 'view' this page at all? ..If not, then I'd assume they're communicating with the server directly - how is - this possible? How do they do it?

Where do spambots come from? Is someone sitting behind the computer snickering as they watch their bot destroy site after site? Or are they snickering as they simply 'release' it onto the internet somehow? Are spambots 'run' by an infected computer somewhere? Do they replicate themselves?

It's all automated. Tools like xrumer are built, and sold, and contain the ability to exploit software with known vulnerabilities. Anyone can buy it and after setting it up it's more or less fire and forget. It goes to every forum in its list and tries to spam it to the best of its ability. Just due to brute force it is successful and worth it for the spammers. That's why they never stop. They barely have to lift a finger for it to work.

Can forum spambots break CAPTCHAs? Can they solve logic questions (how?)? Math questions?

Yes, but not always. Depends on how well it is implemented. But many captchas, including those offered by big companies, have been beaten and are effectively useless. That's why multiple forms of protection are required to stop them. Even then, humans can usually beat any system.

What techniques are still valid to prevent them?

From a previous answer: You could do several things (and should be doing more then one) including:

1) Putting a fake field that only bots will see. Then if that field is submitted with the rest of the form you can ignore it (and ban them if desired). You can also trap bad bots who follow a hidden link.

2) Use a CAPATCHA like reCAPTCHA

3) Use a field that requires the user to answer a question like what is 5 + 3. Any human can answer it but a bot won't know what to do since it is auto-populating fields based on field names. So that field will be either incorrect or missing in which case the submission will be rejected.

4) Use a token and put it into a session and also add it to the form. If the token is not submitted with the form or doesn't match then it is automated and can be ignored.

5) Look for repeated submissions from the same IP address. If your form shouldn't get too many requests but suddenly is it probably is being hit by a bot and you should consider temporarily blocking the IP address.

6) Use Askimet. It is great at identifying spam.

share|improve this answer
5  
+1 for the thorough answer. I had a spam issue and implemented the hidden form element and called it "email"/"mail" and the real email address input I named "address". No more spam! –  mar10 Oct 18 '10 at 23:18
1  
A Good post about how to deal with trolls (the idea is the same for spambots): codinghorror.com/blog/2011/06/suspension-ban-or-hellban.html. –  Johann Jul 30 '12 at 13:35
    
For the captchas, it depends on what tool they are using to defeat them. There are software programs that sometimes (and not always) get passed captchas, and then there are services that use cheap labor to solve captchas and these have a higher success rate. –  ub3rst4r Dec 31 '12 at 19:09

How do forum spambots work?

Talented (if evil) programmers write them - there are probably as many different types of spambots as there are people writing them but, unfortunately, it only takes a few spambot authors sharing and selling their work to ruin life for administrators...

One popular forum spamming application is called "xrumer" - here's a video of xrumer in action (note that there is a fair amount of human intervention required to get it set up).

While I realize that this doesn't answer all of your questions, I think it bears mentioning that anything a bot can't do well (like solve complex non-static logic questions) can be done by a low-paid worker overseas. Spamming is a business much like any other and there is no shortage of cheap labor being plied toward putting spam messages out there.

share|improve this answer
4  
I feel like I just watched a cow being processed in a meat plant. But highly informative. –  rlb.usa Oct 6 '10 at 21:37
    
Interest video, funny that it was made Christmas eve; date was 12-25-2006 12:15am... :-) –  blunders Oct 19 '10 at 18:48
    
Ack! apparently not that talented... That program reminds me of FriendBlaster (we used to use it at work--I was against it, but the boss wouldn't listen). I don't doubt the amount of time & effort the author put into the program. But, honestly, nothing that is being performed is that difficult to implement (and poorly implemented in the case of FriendBlaster). Much more impressive are the hackers and security researchers who develop exploits and break DRM schemes within weeks of their release. –  Lèse majesté Jan 20 '11 at 1:04

I made Anti-spam plugin for WordPress, it blocks spam pretty good without Captcha or anything else.

How does it work: Two extra fields are added to comments form. First is the question about the current year. Second should be empty. If the user visits site, than first field is answered automatically with javascript, second field left blank and both fields are hidden and invisible for the user. If the spammer tries to submit comment form, he will make a mistake with answer on first field or tries to submit an empty field and spam comment will be rejected. User does not have to enter Captcha or anything else to prove it is not a bot, everything is made by javascript.

You may download the plugin and use the code to solve problem with spam on your site.

share|improve this answer
    
So your users need javascript to being able to register? That's a loss of accessibility, right? –  Augustin Riedinger Jul 21 at 13:26
    
@AugustinRiedinger Anti-spam plugin with disabled javascript works like simple captha approach. There are about less than 2% of users with javascript disabled. –  webvitaly Jul 21 at 18:19
    
You mean you'd display the captcha in that case, right? I know it is very few users there, but I was thinking in terms of best practice. Read interesting things about it though. –  Augustin Riedinger Jul 22 at 10:28
    
@AugustinRiedinger Yes, I show captcha-like question about current year if user have disabled javascript. –  webvitaly Jul 22 at 20:12

When trying to defeat them, one thing I'd keep in mind is that their purpose is usually to post links to as many websites as possible for the black-hat SEO benefit.

They care about the amount of sites they gain access to, and not your site specifically. Someone just wanting to spam just your site alone could simply sign up without using a robot.

As such, I'm pretty sure that a well-written bespoke test (eg questions your forum members will know the answer to) is almost always going to be more effective against robots than any pre-written one which robots are likely to be wise to.

For example, if a robot cracked Recaptcha then it would have access to millions of forms to spam. If it cracked a bespoke test, then it would only have access to one website, so no automated spam-bot is going to bother doing that.

https://www.projecthoneypot.org may provide some good data to use (eg keywords and ips to block)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.