Here is the scenario:

I have an application, whose one feature/part is to generate voice calls. I have also provided a (working) demo to generate calls from the website, by inputting your number (without login). To avoid misuse, I have added a CAPTCHA and IP limit.

But there is a user, who manually enters a phone number and keeps on generating calls. They keep on changing their IP, so CAPTCHA and IP limit, both don't work. And it costs me money, as they mostly generate international calls. Blocking international calls, is also not an option, as I provide international service too.

Is there any way to prevent this, without removing the free demo?

I was thinking of doing this using MAC address, or something similar, which blocks a particular computer but I know there will still be loophole due to MAC address spoofing.

How can I solve this? I am using PHP.

  • How do you know it's always the same user? – skooog Sep 27 '17 at 7:20
  • By analyzing the access logs, the country code is same, timing and pattern are same. – kadamb Sep 27 '17 at 7:21
  • 1
    MAC can be spoofed. The demo is not well though: VoIP should be used, email verification and activation code should be enforced. – mootmoot Sep 27 '17 at 7:27
  • Not sure what do you mean by "pattern" but if that is something unique to this user's behaviour, it should be possible to deploy an IPS rule blocking the activity when this pattern is detected. However that doesn't prevent other users from misusing the application in the same way, might be something to think about. – skooog Sep 27 '17 at 7:28

A couple of ideas:

First, the obvious:

  • Change your public ip to other. So migrate the service and notify it to legitimate demo users.

Anyway this is not a definitive method, maybe other (or the same "evil" user) can scan and find you again.

Second one:

Use port knocking. This is a good solution to open services to internet you don't want to be abused. But the problem maybe could be "difficult" to open the port for some users. Not sure if you have a customer db which is supossed to use your free demo service. If you have it, maybe you can notify to all how to do it.

A little example. Let's suposse your service is using port port 12345 and you already have configured port knocking. Anybody scanning your public ip will have a "filtered" response on that port. You can set a combination of ports in order to open it only for the ip "knocking". Let's suppose the combination of ports to open it is 5555, 3432 and 10678.

You can send the instructions to your customers to open it using nmap doing:

for x in 5555 3432 10678; do nmap -Pn --host_timeout 201 --scan-delay 0.5 --max-retries 0 -p $x <yourPublicIp>; done

As I said maybe is too complicated for some customers. It depends of the kind of your customers. If they are IT staff they will have no problems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.