Are there any known flaws in ZenPhoto's captcha system? My website is under continuous attack by spam bots, and it appears one of them found a way to defeat the captcha this morning. If there are no known fixes please tell me and I will find a way to patch it.

Captcha uses a key for encrypting/decrypting the captcha code. This key is based on your Admin login, so change your password frequently and it will be hard for the bots to stay current.

I just reviewed the captcha script and there are actually no keys involved. Zenphoto transmits and consumes the wrong hash value, making the captcha a trivial bypass. A spammer would never have to know what is in the image to post a comment.

You are correct. The encryption is missing. It will be added back in tonight's build.

There is a confirmed patch now at http://www.zenphoto.org/trac/ticket/673 in case anyone is reading

Thanks for the quick work sbillard.

My website appeart to be compromised again this morning. D: I'll let you know what I find out.

sbillard, I've written a patch for your patch. I don't know if it will be a permanent solution, but it seems to solve my immediate problems with spam bots. The next logical step would be for me to add an invisible spam bot test, and ultimately to remove the Site field from the comment form to aid in heuristic analysis. One way or another I will force these spammers to meet me at my level.

What does your patch do? You can submit it on a ticket if you think it is of general use.

FYI, I did write an invisible spam bot test just to give the finger to these script kiddies. Without fail, one of them showed up again today and scored 0/21 on the bot test. He never even made it to the cypher function.

ZEN_SPAMMER '221.231.138.19' Sun, 10 Aug 2008 17:22:10 GMT
ZEN_SPAMMER '221.231.138.19' Sun, 10 Aug 2008 17:22:28 GMT
ZEN_SPAMMER '221.231.138.19' Sun, 10 Aug 2008 17:22:36 GMT
ZEN_SPAMMER '91.121.106.120' Sun, 10 Aug 2008 19:51:08 GMT
ZEN_SPAMMER '91.121.106.120' Sun, 10 Aug 2008 19:54:11 GMT
ZEN_SPAMMER '91.121.106.120' Sun, 10 Aug 2008 19:54:15 GMT
ZEN_SPAMMER '200.97.21.173' Sun, 10 Aug 2008 19:56:11 GMT
ZEN_SPAMMER '200.97.21.173' Sun, 10 Aug 2008 19:56:14 GMT
ZEN_SPAMMER '200.97.21.173' Sun, 10 Aug 2008 19:56:21 GMT
ZEN_SPAMMER '78.31.106.146' Sun, 10 Aug 2008 20:04:36 GMT
ZEN_SPAMMER '78.31.106.146' Sun, 10 Aug 2008 20:04:38 GMT
ZEN_SPAMMER '78.31.106.146' Sun, 10 Aug 2008 20:04:40 GMT
ZEN_SPAMMER '194.249.198.98' Sun, 10 Aug 2008 20:05:47 GMT
ZEN_SPAMMER '194.249.198.98' Sun, 10 Aug 2008 20:05:48 GMT
ZEN_SPAMMER '194.249.198.98' Sun, 10 Aug 2008 20:05:50 GMT
ZEN_SPAMMER '89.96.88.105' Sun, 10 Aug 2008 20:09:51 GMT
ZEN_SPAMMER '89.96.88.105' Sun, 10 Aug 2008 20:09:53 GMT
ZEN_SPAMMER '89.96.88.105' Sun, 10 Aug 2008 20:09:57 GMT
ZEN_SPAMMER '89.96.88.105' Sun, 10 Aug 2008 20:10:01 GMT
ZEN_SPAMMER '89.96.88.105' Sun, 10 Aug 2008 20:10:05 GMT
ZEN_SPAMMER '89.96.88.105' Sun, 10 Aug 2008 20:10:07 GMT

And in case he's bothering anyone else out there, now you know how to ID him

Hi,

Can anyone tell which exactly changes I have to make?

I've tried applying changes 2131 and 1996 as described here:

http://www.zenphoto.org/trac/ticket/673

But seems spammers are still able to pass captcha and time from time I am getting spam in comments. I think its very unlikely that someone would come and type captcha codes manually, as my site is very small and it almost wouldn't make sense to waste time on doing anything manually, so it has to be a bot

Thanks for any help!

Your best strategy is to install the nightly build. Maybe you can figure out which changes you need and pick them from the files, but be aware that software changes build on themselves so taking code out of context is a recipe for difficulties, specially if you are not well versed in both the programming language and the software itself.

Thanks sbillard for your reply.

Actually I've managed applying captcha#2.patch to zenphoto 1.1.7 and it seems to work (no spam for a while, I really really hope so it stays that way...).

And regarding nightly build - how stable are? To be honest I was a bit skeptical about trying putting nightly build online and see what happens as from my personal experience nightly builds aren't meant usually for productive systems

The nightly builds have traditionally been quite stable. Of course, on occasions there will be problems. Right now they are specially stable since we are in the count-down for the 1.2 release and have not put new implementation in since August 7.

I'm running version 1.2 [2213] and somehow a bot has gotten through and I'm getting dozens of spam comments a week. Is there any new tweak that updates the captcha or a new implementation that will help stem this?

Thanks

1.2 is a quite old version. You can view the changes via the change log http://www.zenphoto.org/trac/log/trunk. But of course, there are some 2034 changes between your version and the current nightly build (soon to be version 1.2.6)