2

On one of our Drupal 7 sites (it's at v. 7.32) we're getting occasional 'bot based account creation requests. This is an information-only site where regular users will never log in, only administrators should be allowed to create accounts and only administrators and content creators can log in.

In Configuration under People "Who can register accounts?" is set to "Adminstrators only." Is that not sufficient to stop this from happening?

The accounts are being created but the admin email is being contacted to approve them, so these users are not actually able to log in, but we'd like to stop this account creation altogether.

Has anyone ever seen this?

0

Does your drupal version is up to date ?

Versions before 7.32 need a fix to protect your Drupal from SQL injection ...

https://www.drupal.org/SA-CORE-2014-005

Theres a link to a patch if you cant do the full update

  • Thank for responidng. Sorry, I should have said, this site is at 7.32. I'll edit my question. – Dan Barron Dec 30 '14 at 17:03
  • Was the site updated to 7.32 within 24 hours of SA-CORE-2014-005? If not, it's possible that you were compromised. – Adam Balsam Dec 30 '14 at 18:05
  • Yep ... One of my site ive been compromised and I did found a new user with no email and no creation date. Was it the same for you Dan ? – Math666 Dec 31 '14 at 8:23
  • My users do have emails and creation dates. It's the kind of automated account creation we've seen on other sights, with emails like "wa.l.t.e.rm.c.k.e.l.ve.y@gmail.com" and usernames like "nelllintonlnhdk" (which don't even match.) I would think if we were comprised, these folks could also authorize their accounts. They are blocked because we require administration approval. – Dan Barron Jan 26 '15 at 15:01
  • What I've found is that /user/register is still reachable, even though "Who can register accounts?" is set to "Adminstrators only." Not sure why. Thinking of just putting in a permanent redirect of /user/register to /user/login, though I would really be happier if I knew why this is happening... – Dan Barron Jan 26 '15 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.