Robust Form Spam Blocking JavaScript Technique

Quote from: exside at Feb 24, 2014, 04:40 AM

I also use the honeypot method on almost all of my sites but I don't hide the input field via type="hidden" or css "display: none;" but the container (in my case a div) that holds the input field, so if the bots check the only the input field itself, it seems like a normal field to them (hopefully)...I have quite good success with that, just occasional spams on one site so far, don't know how they get trough there though (maybe 3rd world children, don't know), but its not too bad, maybe once a week...

That's an interesting point exside. I have no idea if the bots care about the input field being wrapped in a <div> tag. It certainly can't hurt to have the input field appear normal, where the containing div is hidden. Wish someone who knows the answer would post here.

I don't know anything about it for sure, but I've tried the method of hiding the containing element and found that some bots still get through. They must be checking visibility in a more sophisticated manner. I think it's only a matter of time before they figure out how to simulate JS click and focus events too, but so far they are not (knock wood).

Quote from: esnyder at Feb 24, 2014, 11:43 AM

I don't know anything about it for sure, but I've tried the method of hiding the containing element and found that some bots still get through. They must be checking visibility in a more sophisticated manner. I think it's only a matter of time before they figure out how to simulate JS click and focus events too, but so far they are not (knock wood).

freejung, are you also esnyder? That's the userid on the email I received from this forum. Confusing. Seems this board has a bug.

I'm pretty surprised that JS is posing such a problem for the bot writers. JS has been around forever and is relatively easy to understand compared to advanced CSS.

??? Sam

As the amount of form and comment spam on my sites has exploded in the last weeks, I've been collecting ideas how to do something about it.

I like the idea of using a honeypot, but I don't think one technique alone will be working for a long time.

Some additional ideas:

Cookies:
Recently I had to fight some shady person using a Wordpress site for ulterior motives. Among other thing he used javascript to pull additional files from another server.

To prevent curious people from simply visiting the url serving those files he used a cookie to find out if the request was actually caused by somebody visiting the infected site.

Blacklists:
I almost never find spam in my GoogleApps account. Handling zillions of emails each and ever day they should have a failtry goog idea what going on. Therefore I think it might be worth to use Google's Safe Browsing API to check notorious black sheeps:

https://developers.google.com/safe-browsing/key_signup?hl=de&csw=1

I see a couple of accessibility problems here, but properly executed this should keep a more of those nasty buggers away from our forms.

Regards,

pepebe

As I read it, the Safe Browsing API has nothing to do with spam or spammers. It lists URLs of phishing and malware sites.

I wish Google *would* release their list of known spammers, but I don't think they have.

Samg, yes but it's not exactly a bug - the forum allows you to use a screen name different from your username. I'd have used "freejung" as the username in the first place, but a spam filter kicked in and objected to the word "free." I had to get special dispensation to change the screen name. Anyway, sorry for the confusion.

I have never tried writing a spam bot, but I expect JS creates problems for two reasons: interpreting, compiling and running JS takes a lot of computing resources, and actually running the code would be dangerous to the bot because site owners could embed malware in their sites designed to attack bots who execute JS. Google has the same problems and it took them many years to learn how to interpret JS. Google has gotten pretty good at it but they have a lot more resources than spammers.

That said, it's always an arms race so it's a good idea to be thinking about what the next step would be. Using a cookie might be interesting, but of course that will disable the form for anyone blocking cookies.

Quote from: esnyder at Feb 24, 2014, 04:59 PM

Samg, yes but it's not exactly a bug - the forum allows you to use a screen name different from your username. I'd have used "freejung" as the username in the first place, but a spam filter kicked in and objected to the word "free." I had to get special dispensation to change the screen name. Anyway, sorry for the confusion.

I have never tried writing a spam bot, but I expect JS creates problems for two reasons: interpreting, compiling and running JS takes a lot of computing resources, and actually running the code would be dangerous to the bot because site owners could embed malware in their sites designed to attack bots who execute JS. Google has the same problems and it took them many years to learn how to interpret JS. Google has gotten pretty good at it but they have a lot more resources than spammers.

That said, it's always an arms race so it's a good idea to be thinking about what the next step would be. Using a cookie might be interesting, but of course that will disable the form for anyone blocking cookies.

This whole thing becomes a game of chess.

Every move by either side elicits a countermove until someone wins. Then the next game is played with a different set of rules and on and on.

Later esnyder.