5

I work for an educational institution, and we are seeing entries from our admissions application that amount to spam. Currently I only have one honeypot applied to thwart the spam bots, but these entries looks like input from actual people. There is no garbled text in input fields, no crazy links, just regular names, social security numbers that are all very similar if not duplicates, phone numbers that are very similar, and they may or may not leave an email address. Cities do not match the states. Addresses are non-existent.

It is an online form, using SQL Server and C#, ASP.NET. However, the application submissions go directly to another server. We don't store anything in SQL. I'm not sure what other kind of details to enter.

How can I guard against this type of spam, if possible?

| improve this question | |
  • Do you have any captcha / recaptcha enabled? Bots are fully capable of entering somewhat "coherent" entries and are not limited to garbled text or crazy links. – DKNUCKLES Mar 8 '17 at 22:19
  • Are applicants attaching documents, such as PDFs or DOCs? Perhaps these are attacks sending different types of malware. Consider not accepting an uploaded document until after the application passes initial vetting. – John Deters Mar 8 '17 at 22:21
  • 2
    I'm concerned you are collecting SSN's and other Personally Identifiable Information on a form with little to no protections. Have you thought about the legal and financial implications of this data being stolen? – Trey Blalock Mar 9 '17 at 3:14
  • We do not have captcha/recaptcha, I was hoping to avoid doing that but I think that may be the best solution. There are no attachments possible, it is inputs only. We have a dedicated Information Security staff, and info is sent to and stored on secure servers. – Raquel Mar 9 '17 at 14:43
3

A captcha is the best way. If you are worried about usability, there are other things you can do, but everything can be bypassed.

You can use javascript to perform some type of calculation. For example, taking into account the time the form is loaded and when it is submitted and send that value back to the server. Then on the server you can do a check to see if it makes sense and filter out the ones that dont. You can do a lot of things with javascript which will filter out a lot of bots since most dont interpret javascript.

None of this is fullproof because a sophisticated bot could be using something like phantomjs, and there is also a chance you can be denying legitimate traffic.

Alternatively, you can use a Cheap waf and create custom rules to filter out certain types of traffic too if you can find any similarities in the traffic, which you usually can. That can turn into a game of wack-a-mole though.

Blocking bots is an industry in itself because of the difficulty involed. The most effective solution would be a decent captcha that isnt difficult to read.

| improve this answer | |
  • I've seen some simple, yet effective, non-captchas that ask "silly" questions, like "what is 2+3", or "what is the last name of the current US President". A random attack bot/script will fail it, a human would pass it, there's no Captcha integration, but a bot/script that is adjusted to attack you would not be stopped for long. Good luck. – MikeP Mar 9 '17 at 23:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.