2

On one of our Drupal 7 sites (it's at v. 7.32) we're getting occasional 'bot based account creation requests. This is an information-only site where regular users will never log in, only administrators should be allowed to create accounts and only administrators and content creators can log in.

In Configuration under People "Who can register accounts?" is set to "Adminstrators only." Is that not sufficient to stop this from happening?

The accounts are being created but the admin email is being contacted to approve them, so these users are not actually able to log in, but we'd like to stop this account creation altogether.

Has anyone ever seen this?

Improve this question

1 Answer 1

Reset to default
0

Does your drupal version is up to date ?

Versions before 7.32 need a fix to protect your Drupal from SQL injection ...

https://www.drupal.org/SA-CORE-2014-005

Theres a link to a patch if you cant do the full update

Improve this answer
6
  • Thank for responidng. Sorry, I should have said, this site is at 7.32. I'll edit my question.
    – Dan Barron
    Commented Dec 30, 2014 at 17:03
  • Was the site updated to 7.32 within 24 hours of SA-CORE-2014-005? If not, it's possible that you were compromised.
    – Adam Balsam
    Commented Dec 30, 2014 at 18:05
  • Yep ... One of my site ive been compromised and I did found a new user with no email and no creation date. Was it the same for you Dan ?
    – Math666
    Commented Dec 31, 2014 at 8:23
  • My users do have emails and creation dates. It's the kind of automated account creation we've seen on other sights, with emails like "[email protected]" and usernames like "nelllintonlnhdk" (which don't even match.) I would think if we were comprised, these folks could also authorize their accounts. They are blocked because we require administration approval.
    – Dan Barron
    Commented Jan 26, 2015 at 15:01
  • What I've found is that /user/register is still reachable, even though "Who can register accounts?" is set to "Adminstrators only." Not sure why. Thinking of just putting in a permanent redirect of /user/register to /user/login, though I would really be happier if I knew why this is happening...
    – Dan Barron
    Commented Jan 26, 2015 at 15:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.