DotNetNuke DNN Spam Registrations Problem Fixed

DotNetNuke DNN Sites getting spam registrations – How to stop them

In recent weeks, many of our DNN websites have systematically been targeted for Spam New User Registrations. There has been some discussion around the how and why, and as much as we can tell, the problem is this:

1. Some script kiddy has bothered to write a bot that finds DNN websites. It is not even a good bot, because it is not capable of validating registrations to automated active email addresses. (If you are the creator of the bot… “YOU ARE DOING IT WRONG” as it is not going to bring the Google results you are looking for.)

2. The bot will attempt access to:  www.yoursite.com /?ctl=Register
?ctl=Register

3. This brings into play the default DNN registration process module.

4. This page is currently available if your site has either Public or Verified registrations enabled.

5. Tricks on derating the bot by raising the password complexity appeared to work a short time only.

6. Enabling the inbuilt Captcha is as good as useless, as almost any OCR application can break it.

7. A better simple solution is needed.

 

ReCaptcha is the FIX that is working well

Here at InteractiveWebs, we decided that we would enable Recapcha (a cleaver Google Initiative https://www.google.com/recaptcha/ ) that is harder to be machine broken, and test the results. We found that all the spam registrations stopped once Recaptcha was used.

To do this we created two Free DNN Modules to add Recaptcha to the URL that this bot is using to register on sites. The two modules are to support DNN 6.2 +  and 7x +.

The modules replace the standard captcha control to a recaptcha

From this:

DNNCaptcha

To this:

DNN Spam Registration Stop

This is a good link explaining how Recaptcha came into existence, and why it works well: https://www.youtube.com/watch?v=cQl6jUjFjp4

The Free Solution and Installing iWebs Regsiter

The free modules are available of download here: http://www.interactivewebs.com/DotNetNukeModules/ModuleDownloads.aspx

To install them and fix your site you will need to follow the instructions below:

Step 1 – Register your site for Recaptcah

Go to: https://www.google.com/recaptcha/intro/index.html  and register your domain, or domains. This will give you the ability to use recaptcha on your DNN sites on any domain you like.

DN Google Recaptcha

Step 2 – Copy the Public Key and Private Key for your Domain

You are going to need they keys that this site provides:

DNN Recaptcha Keys

Similar to these.

 

Step 3 – For you DNN site, Turn on the DNN Captcha system.

ADMIN>>SITE SETTINGS>> USER ACCOUNT SETTINGS>>  “Use CAPTCHA for registration” Ticked.

DNN Enable Captcha

Step 4 – Download and Install iWebs – Register

Install our “iwebs- register” module, making sure you pick the one that is for your DNN version.

  • DNN 6.2 And laters: iWebsRegister 62.6.3.0 PA.zip (at time of writing this)
  • DNN 7 and later:  iWebsRegister 72.7.1.0 PA.zip (at time of writing this)

Once installed, you need to add the module to a page as you would any other. We recommend adding it to it’s own page in the DNN Admin menu, and keeping the page Admin Only.

DNN Recaptcha Module Downlaod DNN Recaptcha Module

Step 5 – Configure the iWebs Register Module.

The module you are looking for is called: iWeb’s – Register – You can select the Settings from the module drop down as you would any other DNN module.

DNN Module Settings

 

Enter the Public Key and Private Keu information that you received from your Google Recaptcha registration of your domain. THEN SELECT UPDATE to save the information.

DNN Captcha Settings

Step 6 – Install the Register Control

After saving your public and private keys by clicking “update” you are ready to:

Click on the “Install Register Control”

This will inject the recaptcha setting into your website. So when you hit any registration URL (www.yoursite.com /?ctl=Register) you now get the recaptcah box.

Update to V2 of Recaptcha

Google has released what they call V2 of Recaptcha. We have update the module to support this. The process of updating to V2 goes like this.

1. By default, previously created recaptcha keys are V1. Any updated installs of our module will need to be put into V1 mode (in the settings) to keep working with your V1 keys that you have previously configured into the module. So after updating our module to the latest release, go into the module settings and enable V1 mode for the module to keep working.

2. V2 recaptcha is better than V1. So we would suggest that all users of the module update to V2. To do this, you update our module to the latest release, then go into the Google Recaptcha management page, and delete your domains security keys, then generate new keys for V2. They have instructions on that process, all be is hard to understand.

Once you have new V2 recaptcha keys, you update these new keys back into our module and ensure that the V1 mode is NOT enabled. The V2 recaptcha will then run on your site.

To Remove and Uninstall

Step 1. From the iwebs – Register module settings, click the “Restore Register Control”

DNN Remove Recaptcha

2. Uninstall the iwebs – Register module as you would any other DNN module.

 

Thoughts

This was a quick solution to some script kiddies attempt to attack DNN. I’m actually struggling to find the purpose (if you wrote the bot and you are reading this, I would love to hear why).  There is little threat by the registrations that I can find. More annoying that anything else. While Recaptcah can be broken, it would take some smarts or costs to use online services for the bot, so I suspect they will not bother and recaptcha will reign for this problem. In any case, if they spend some time and effort making the bot work for recaptcah, it is easy enough for us to implement some of the loads of other solutions available to stop them.

Donations

We included a donation button. If you find the solution, blog, research we did, modules we created and responses we provide to be helpful. Please consider throwing us a few $

Mac Pro 2013 Multiple Displays Stop Working with OS X 10.9.3 – Fixed

Hot to Fix Multiple Monitors not working in OS X 10.9.3OS X 10.9.3 Mltiple Monitor Problems

Mac Pro 2013 computer users have experienced problems in some configurations since upgrading to Mavericks OS X 10.9.3. For most people, the issue related to the use of mini port to DVI external monitors.

The mac pro by design can only run two Miniport to DVI monitors, and any additional monitors need to be run on a converter that has additional power. Apple call this their Dual Link DVI adapter. Essentially this is the same thing, just with a powered USB port on it. If you were to try an run 3 mini port to DVI adapters, what you would find is that only two monitors plugged in would run. Effectively the last two plugged in in any combination would be the two that ran.

Apparently this is by design, and part of the way that the Mac Pro is set to provide a stable and powerful signal in the miniprot to DVI adapters. The additional power that is required is subsequently provided by the Dual Link (USB port).

The problems OS X 10.9.3

With this update, only two monitors would work, were previously more would run fine. Many online communities were talking about this problems that is considered serious for IT professionals. Here at InteractiveWebs.com we identified the problem, and lodged a support ticket with Apple. We had some back and forth providing the photo’s of our configurations, and some software tools that they provided to give system feedback.

The Fix for Multiple Display Problems OS X 10.9.3 – is 10.9.4

Today we received a final version of OS X 10.9.4, and to our joy it has restored the monitor problems that we experienced and things are back and firing as they should.

Comments

I have seen some people digging in for a sledging of Apple over this issue. Personally I am old enough to have experienced this type of serious issue with other more prevalent operating system. In those instances, the disconnect between manufacturer, OS developers and software developers meant that we sometimes never fixed display problems. I can remember one instance with a Matrox graphic card that we paid something like $1200 for, and never could get it working as designed due to operating system changes and software incompatibilities. We later found the same cards on sale for $50 after we had dropped $6 K into the cards. 

It was problems like that that, and the fact that no matter who we told our problems to (MS, Matrox, or 3rd party software developers) that we could never get a fix. No one would own the problem. That is exactly the reason we changed to “Apple Fan Boys” and although we have spent 10 days with less than optimal Mac Pro systems, it still remains that we had a problem. Told Apple, and they fixed the darn thing in a timely manner. Well done I say!

Mars Edit can’t upload images to WordPress on IIS

MarsEditIcon 

Having Troubles Uploading images to WordPress hosted on IIS

If you are like me and enjoy a Mac, and WordPress, then you have probably discovered MarsEdit. We were experiencing problems uploading images to our WordPress blog.

Upload File Error
Can’t do upload file for “blog name” because the server reported an error. The server returned an unexpected response code: 413.

WordPress Upload File Permissions on IIS

You upload an image in WordPress and either you get an error or the image will upload, thumbnails would work but the actual image would not have read permissions.

If you can’t upload an image at all, it’s probably because you need to give the IUSR account Read/Write/Modify permission on your wp-content folder.  This will allow you to upload, and do the WordPress & plugin updates.

IIS WordPress File Upload Permissions

Alos, you may you need to do is give the IIS_IUSRS group Read permissions on your “C:\Windows\Temp” folder.

Make sure to notice that the two permission changes you make are not for the same user/group.   Give IUSR permissions on your wp-content folder and IIS_IUSRS permissions on your Windows temp folder.

Note: If you have edited your php.ini file and change the upload temp directory then you will need to give IIS_IUSRS group read permissions on that folder instead.

IISWordPressIIS_USERS

That should be about all that is required to fix the issue in IIS.