spoof registrations

Since our site went live on march 12 we have seen three registrations which are clearly 'spam' and may be a security breach; these registrations are not being entered at the front end since they include combinations of plans which are not available but fill in CB fields with dummy info eg phone->12345. I'm concerned that this is compromising users security; I have scanned a download of the site with no problems and Norton reports the site as OK (for what that's worth) but something is clearly amiss ... or is this par for the course?

Please check that Joomla registration is disabled and you've CB registration configured to be independent (see documentation for details). Please then check within CB configuration on the integration tab that you've session spoof checking enabled. We use a spoof string and a check against it so it's impossible to spoof it, but if this feature is disabled it would then be possible to spoof a form (some sites have complications so this parameter was made available). Please also ensure you're using CB 1.4. If done checking you may want to consult with your staff to ensure they're not making accounts via backend.

Joomla Allow Registration=NO; CB spoof checking =YES; CB version =1.4; no-one is making back-end entries except me; these registrations all follow a set pattern; the same fields are filled in to the same format; the name is the username twice, those info fields filled in [only accessible on the front-end to certain plans] are filled with correct English words and phrases but different each time; looks like a spam algorithm to me, but only one a day, more or less

Sounds like a spam bot, fields are HIDDEN on registration.. they're not removed. They're just taken out of the visual spectrum. Review the source and they're still there. So a spam bot parsing through your registration can see and complete them just fine.

I suggest installing and using CB Captcha or some other form of captcha such as a "honey pot" field. This field would as a simple question as its name such as "What is 1 + 1" then using PERL regular expression as the validation for that field you'd simply put /2/, anything but 2 will fail. MOST bots will never bypass this. Real human spammers will have no problems.