2

A bot network(?) has been after my website for quite a while now. Here is a breakdown of what they do:

  1. They register several accounts using random characters for building a first and last name which look like this:

    HludvkxTGVIwP oBScrLdvJ
    AicSJbYk uWrVKZtSdTNAv
    ...
    
  2. The email addresses used for these profiles seem to be valid email addresses from real people but I can not say whether they are just used by the attacker or if they have actual control over those addresses. What I do know, though: The emails are never confirmed by the link sent to those newly registered accounts.

  3. The attacker then goes to the password retrieval page and sends "new password" requests which is weird as I think they don't receive the answer because of the lack of control over the email used in the profiles created …

I would like to understand what the attacker is trying to achieve in order to evaluate if this is a threat. Why would he send password requests for an account just created by themselves a minute ago?

The ip addresses change all the time, so it seems to be a network.

2
  • Are any of the email addresses used for accounts that already exist? What happens in that case? It's possible the botnet is just searching for these existing accounts, to then attack them later. – Steve Sether Jun 22 '20 at 18:41
  • No, none of them. – Armin Hierstetter Jun 23 '20 at 5:59
1

I would like to understand what the attacker is trying to achieve in order to evaluate if this is a threat.

From the points you listed, the symptoms points to DOS attack. Try captcha (only a suggestion: google recaptcha v3) as a means of protection against BOT based resource consumption attacks for web facing tech.

Why would he send password requests for an account just created by themselves a minute ago?

The accounts are all valid and password reset link works as mail bombing attempt. Kindly implement captcha or alternative control to prevent this from occurring.

If the mails are tagged spam instead of receiver hitting unsubscribe due to multiple similar pointless mails, it may hurt your reputation in long term and mails from your domain will soon be blocked my multiple spam filters regularly.

1
  • We can rule out a DOS attack as the number of requests is just way too low for that. BUT: The second option looks like a potential answer – thanks for that! – Armin Hierstetter Jun 23 '20 at 6:03
0

I can think of two things. Both are equally likely in possibility.

The first possibility is the creation of multiple accounts to use on your website. With multiple accounts, if one were to get banned, another one can be used. The only thing needed is for the person who receives the confirmation email to click on the link. You claim that none of the accounts ever get confirmed. Creation of multiple accounts by robots or bots is not a new thing. This is especially seen for email websites. The new accounts can be used to send out spam to email addresses. With multiple bots each creating at least an account, as the IP addresses are different, it can be considered a botnet is interacting with your website.

The interesting point that you said however, is the account creator makes "requests" for password reset. This leads to the second possibility, the password reset mechanism is being used to either spam email addresses or is trying to create a Denial-of-Service attack for those email domains. The DOS is being carried out by the large amounts of password reset emails being sent out. Basically, your server is being used here for carrying out an attack.

1
  • None of the accounts is actually used. The only thing that's used is the password reset function for a couple of times but not to the extent of anywhere near a DOS attack. – Armin Hierstetter Jun 23 '20 at 6:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.