0

We got a realatively high bounce rate today, because someone decided to spread some links using our mail server. The implementation looked like this: He used the registration form and planted a link in the firstname field, which appears in the email's first line. Then he sent out like 1200 emails like this. And my question is what can we do to prevent this? We can use captcha for sure, but can we do more about it?

It's the verification email which is sent. Like if you register to any other sites, the website sends you an email to verify your email address. And what he did was to put the link in the firstname field of the registration field. so in the verification email in the place, when it would say - Hello XY! pls verify your email... - there is this instead - Hello <link>! pls verify your email...

I don't think that those email addresses belong to him, because in most of the case we didn't get a bounce, and also all the email messages had a different structure, plus there was more in the firstname field. Example: Здравствуйте Ваш профиль победил в акции. Заберите Ваш бонус на сайте: asuspeci.tk/9b939 ◄◄◄ All of them went to russian email addresses. The string in the link seems to be unique for each email address - I didn't check all, but any of them I checked was different. It also redirects to a russian fake website - I checked it with Tor, javascript disabled

Also the verification email has a template which starts like this: Hello [firstname]!

I think it's might be also good to validate the field and check if it contains some characters which can't be part of a firstname as an extra. This might be better to be done with blacklisting some characters, because some languages has special characters in names, but those are not punctuations.

The recaptcha can't do much against request forgery, so it might be a good idea to also implement an IP filter limit, where you allow only X registration in an Y amount of time only from the same IP address.

  • Hence my question why are you allowing users to send mail?You should rather send mail server side by taking the users mail address and crafting mail yourself. – Vipul Nair Feb 13 at 16:04
  • On our website it's the exact same function to verify the email address of the user who tries to register, like it works in any other websites where you can register. For example if you sign up for facebook, then you will get an email which requests you to press a button and then it will redirect to the fb, and with the hash in the link you will be verified. We have this exact same functionality. And when he sent the verification emails - which is still a registration to our website, his only trick was to write that string with the link in the firstname field on the registration form. – David Hlavati Feb 13 at 16:11
  • "I checked it with Tor, javascript dissabled"...next time you might want to turn off webassembly, too. (and use a fresh VM) – pcalkins Feb 13 at 22:15
  • How did a user get access to being able to send emails? Do you mean that someone registered 1200 times using links as the name and different emails? – schroeder Feb 14 at 11:41
  • yes, he registered ~1200 users - I guess these users were his targets - and the verification email was sent to each users, where the firstname parameter from the registration form contained the link and some other texts – David Hlavati Feb 14 at 12:18
-2

Apart from captcha, another way in which the attacker should fail is by applying a character limitation. You can limit to 30 characters for each field or even less if you separate them properly. For example, not just let them place everything in the same “Name” field, and separating it by “First name”, “Middle name”, “Last name” and so on (even 20 characters would be OK here).

By this means, the attacker won’t be able to place links, nor important messages, so his attack won’t be useful for him, making himself try with another site.

|improve this answer|||||
  • There you go bit.ly/2SnQoRX just 14 characters – Vipul Nair Feb 13 at 16:57
  • How do you convince someone to enter a link that says “Hello bit.ly/2SnQoRX”? – J. Francis Feb 13 at 17:25
  • 3
    Have you thought about doing input validation on the firstname field, and blocking any submissions that contain strings or characters that you would typically find in URLs, but not in first names, such as '/', ':', 'http', etc.? – mti2935 Feb 13 at 21:31
  • I also wouldn't click on a link like "asuspeci.tk/9b939", especially if there whole email is in english, except the first line. @mti2935 yeah, just updated the question with that as possible validation filter. – David Hlavati Feb 13 at 21:43
  • @mti2935 it is a very good option too. Maybe even combining both methods! – J. Francis Feb 13 at 21:45
0

Find a library you can use to parse out domains. Anything with a dot in it should use this library to look for a domain, and then a matching domain would get rejected from the form. This will at least require some obfuscation (like asuspeci . tk). You'll likely still block some legitimate names (you might be surprised how varied naming conventions are), so don't go after obfuscation too hard.

Captcha services have their own algorithms for ratcheting up the difficulty proportional to the user's perceived risk, so I'd suggest them (in addition to traditional rate limiting) as a form of soft rate limiting even if your attacker(s) are passing them. Captcha providers also have analytics to look for abuse, so you'd be helping them help you in this regard.

Here's a prospective rate limiting tweak: put the submitter's IP in the confirmation link (which allows victims to potentially identify their attackers) and don't let that IP submit more submission requests if there are already ~five pending (no confirmation click yet).

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.