New users with no birthday? How is this possible?

[chaz7979]

Sigh.

I highly doubt that someone hacked my server just to add a couple of user accounts with no birthdays.

Upgrading to 4.x was a huge mistake.

[Zachery]

Have you tried adding more than one Random question to help combat spam? Is there a reason you won't upgrade to 4.1.2?

[chaz7979]

1. One more question is not going to stop people from being able to get passed the age verification.
2. I just haven't had time AND it stands to reason that it will not make a difference.

[Zachery]

So instead of trying to fix the problem, you'd rather just take an excuse that it wont? Okay,

Well until you are willing to try upgrading I would suggest enabling user moderation, that way you can just delete the users without a birthday, and approve the others.

But, FWIW, if a spammer has figured out that you only have 1 HV question, and the answer is insanely easy to guess. Then you might as well not have it, its possible they're submiting a data stright directly to your register.php with all o the correct information filled out.

[chaz7979]

So instead of trying to fix the problem, you'd rather just take an excuse that it wont? Okay,

Come on man...really? What I am dealing with has never been reported by anyone else nor was it a bugfix in 4.1.2 so, is it realistic to think that upgrading will solve this problem?

I'm going to get to it but, we both know that isnt going to make a difference.

But, FWIW, if a spammer has figured out that you only have 1 HV question, and the answer is insanely easy to guess. Then you might as well not have it, its possible they're submiting a data stright directly to your register.php with all o the correct information filled out.

1. I might as well not have it? Without it, I was seeing 50+ bot submissions per day. With it, I am seeing 4-5. That's not worth it?
2. How are they submitting data directly to the page without entering a birthday if coppa is turned on? Shouldn't vb stop them from registering if they dont pass the age check? That has been my question all along. How can a person get around the age verification? If that is possible, it's a bug... isnt it?

[Zachery]

In theory you could pass all of the data via script if you were so inclined, seeing how you only have 1 random question, they ALWAYS know the answer.

Still, first step in troubleshooting is to be on the most recent version: 4.1.2.
Next would be to add more random questions. They only get one when they view the page, but the point here is to have more than 1 so its not possible to easily brute force the pages.

[chaz7979]

I will add a couple of more questions and upgrade. I am just confused how a script could bypass a post check. I would assume the page is secure enough that a script can not write to or bypass the date check. I removed the js validator and the page still requires me to fill in my birthday. I also cant direct link to the registration page so, I dont see how this is possible. If you are saying that it is, that is fine, I'm sure you dont want to post how to do that here but, it seems like a security hole to me.

[chaz7979]

Still, first step in troubleshooting is to be on the most recent version: 4.1.2.

I upgraded to 4.1.3 today and it is still happening.

[Trevor Hannant]

Are these accounts that are via Facebook Connect or registered directly - as I can't get past your Date of Birth page without entering a date of birth...

[chaz7979]

These are normal direct registrations.

[Trevor Hannant]

I and other users have been unable to register without a date of birth so either:

- they're not registering via your registration for or
- Require Date of Birth was set to No and they registered at that time

[chaz7979]

- they're not registering via your registration form

How is that possible? Shouldn't vbulletin prevent that?

- Require Date of Birth was set to No and they registered at that time

I have never changed the age verification setting since the forum went live years ago.

[Steve Machol]

I believe has to be due to a modification. I cannot duplicate this problem, nor have I heard of it before on an unmodified vB.

By the way, I get this when I try to access your forums.

[chaz7979]

My board is not modified (no plugins). I have even used the default theme and I still see these bad registrations.

Thanks for the heads up, looks like a bad ad was served.

[worried]

I got a spammy registration this morning without the age. It was a facebook registration. Username, "Gülten Toksöz" IP was from RIPE. Couldn't find a match with username or email on facebook.