How does PunBB do against spam attacks (Page 1 of 2)

Read this discussion.
Also a CAPTCHA mod, like this, works fine on my board(s).

I use just this simple method. I've only been on Google for about four months, but no spam so far..

where is it that it says "powered by punbb" (dont have ftp open atm)... is it in the footer? cause i would like to change it... change it to say the same thing, but in a differnt way, cause that could be annother spam deter method!

It does like crap, to put it mildly. We had PunBB installed on our site by the person who built the whole thing and have been spammed pretty heavily for the last few months. I updated to the latest version, hacked a few scripts here and there to fool bots but it's not use. Having read through some of the code it becomes clear that this was never written with security in mind. The spammers we get are injecting users and posts straight into our database without ever going through the registration page. This means most of the "fixes" posted here won't work. I had to spend several hours coding my own anti-spam thing which, for now, seems to hold up.

I know the PunBB people are not going to like this but I feel you should be warned.

Do you allow guest posting? Do you use any of the anti-spam mods? Do you require users to verify their registration via email? Using an unmodded, completely open version of just about any forum software is going to get you spam.

Assuming you're not using any of the anti-spam mods that have been released, might I suggest doing so? A lot of homemade anti-spam solutions I've seen people come up with have mistakes in the code that renders them ineffective. Using one of the mods should avoid that issue.

Security is something we take very seriously, so I'm surprised to hear you say that. I'm not exactly sure what you mean though: care to clarify?

I have to go with Dr Jeckyl and say that without more information, this is a bogus claim. I've seen anti-spam solutions work extremely well (I've also seen PunBB forums which have never experienced spam) and I have never seen an SQL injection in PunBB that would allow something like that. If you think you've found an SQL inject in PunBB though (I'm talking about PunBB itself, not a mod you installed or coded yourself), I would encourage you to report it so we can fix it.

Doesn't that directly contradict what you said earlier, that it was "no use" to try to deter spam from a PunBB forum?

Well, it's nice of you to want to look out for another user. However, it would be even better if you could clarify some of your criticism and not make such broad claims without evidence to back it up.

It could just be a troll.

But it pays to keep an open mind. SQL injections and the like are not unheard of with PHP apps.

Of course more information is needed though from the original poster on their diagnosis of the problem and the steps they took to address spam within punBB. The minimal information zap supplied doesn't make their post very useful at all.

If there is a problem, help the punBB folks fix it.

No, no, yes.

That's what I would have considered until I realized it would be pointless if they didn't go through the registration page...

For one thing, there's SQL sprinkled all over the place in the php scripts without systematic (AFAICS) protection against injection. SQL queries built on the fly with user input screams "it's the 90s and security isn't an issue yet". Maybe there's something I don't see (SQL/php isn't really my domain) but it sure doesn't look solid.

Well for one, we didn't get the registration alert emails for the spammers' users. I also implemented a few checks here and there in the register and post scripts and it was clear by looking at the db afterwards that the users/posts had not gone through there. For example, I tried a "minimal first post delay" which was enforced when I manually registered a user but which the spam posts got around like it was a joke (the db often had delays under 10 seconds).

I'd gladly report any SQL inject bug if I only knew how to track it down. Server logs were quite unhelpful; anyone who can inject stuff can obviously fake their IP in the db so it's like looking for a needle in a haystack...

Yes and no. I wouldn't expect most people to be able to come up with some php/SQL to get around spam. And it doesn't really block spam, it simply detects it automatically and hides it.

Unfortunately, that's the way it has to be done to support anyone using the mysql extension (as opposed to mysqli) and (I think) the SQLite extension. Prepared statements, stored procedures, etc aren't features that everyone with a PHP install supports, so this is the way it has to be done.
I would disagree with your overall assessment though. User input is properly sanitized (using $db->escape or intval, depending on the type of data) before being put into the query. We're not just accepting any input from $_GET and shoving it into the query.
If you have a suggestion for another way to construct queries, I'd be interested to hear it.

Are you running the latest version (1.2.15)? Have you actually checked the IPs against entries in the access_log? What mods are you using on your forum?
Could you provide a link to your forum? I'd like to investigate this a bit myself.

Before I forget to say it, zap, thank you for clarifying your post

Hmm, how about we all calm down and drop the bickering?

Are you sure nobody just got hold of your DB info? It certainly seems more plausible.

Seems unlikely. The spam is pretty obviously automated and I doubt someone could grab the information of enough forum databases to make that worthwhile. Unless there's another common hole somewhere which allows that part to be automated... but it all seems farfetched.

Besides, I'm not even sure outside access to the DB is possible with only the DB login. I don't see why it would need to be. So they'd have to have some kind of access to the web server as well... at which point I'd expect problems greater than plain old spam The rest of our website, some of which is also in the DB, is quite intact and spam-free.

zap: Could this (another copy of PunBB using the same database settings but with different pun_config options) be the issue for you?