I've dealt with this on a couple of sites in the past week. This isn't your normal spam that is done automatically...there is a lot of human intervention here. From what I can gather:
1. The spammer finds a moodle site that allows account creation and email verification...lots of those out there
2. They manually create their account and verify it
3. They they seem to immediately go to the account profile and change the email address used to create the account...pretty smart actually, since Moodle does no require that a change of email be verified at the "NEW" address entered which allows someone to use a single email account to create an unlimited number of these spam accounts. Some people believe the spammers are using accouts like "mailanitor" to create these, but they can create a moodle account, change the email in the profile, and then use that same email address to create another account, allowing them to use any single email account to create as many moodle accounts as they want.
4. They enter their spam (long list of Pharmacy/Viagra links) in the profile description field. This gives them an automatic webpage that they can now use in their other spam emails.
My experience has been with two different 1.6 installs, but it seems to me the same exploits can happen in any version. So, what can you do?
1. Don't allow email account creation on your site (Not an option for many).
2. Set your site so that users must be logged in to see profiles. (You would think this would limit the value of using a profile for spam, but evidently the spammers aren't smart enough to check that since both sites I found this type spam on required users to be logged in to view profiles).
3. Remove users ability to use the "Description" field in the profile on the site. (This is what I did on both sites. By doing what I describe below, you will delete any information in the description field for all existing users on your site and prevent any new users from entering any useful information in that field).
To disable the ability to enter information in the profile "description" field in Moodle 1.6 -- Not sure about later releases -- I did the following.
1. Opened my database using phpmyadmin
2. Selected the mdl_user table
3. Opened the "description" field to edit the default values
4. Changed field type to CHAR
5. Set Length/Values to "1"
6. Set Default value to "1"
Saved.
Since this field is a required field, now when an account is created it will be automatically populated with the number 1. For all information currently entered in this field for existing accounts, only the first letter will show. If anyone updates an account, they can type as much as they want, but only the first letter will be saved.
Of course, you lose this field for your users, but it doesn't do the spammers any good either.
Disclaimer: This seems to work on the two sites where I applied it, but use at your own risk. Also, there may be easier and/or better ways to deal with this, but since the description field is not critical on the sites I dealt with, this seems to be an effective solution.
Steve
