I am working on an e-commerce website, wherein make use of mobile OTP authentication for new signups. We have a fair bit of protection against bots and malicious actors by using aggressive rate limiting and firewalls to protect our APIs and pages.
Recently we are facing a challenge wherein the malicious actor:
- Is making 5 hits to our signup API in an interval of roughly 1-2 minute between each request.
- Then he change his IP and repeat step 1
- Mobile number used to signup belongs to different country every time and mobile number also appears to be valid as SMS do get delivered on those numbers.
- As soon as he hits the signup API, a SMS containing OTP is sent to the mobile number given while signing up. Each SMS delivery costs us depending on the country, and with this attack this cost can easily go anywhere over $ 4000.
Now, our observations are:
- We have a check that if signup request is coming more than 5 times from a single IP then we block that IP for a certain interval, hence he change his IP after every 5 request
- He keep a gap of 1-2 minute and sometime more in every consecutive request to keep it under the radar of rate limiter
- He is making use of IPs from across the globe, hence we cannot block requests from a certain country or subnet
- He is using a mainstream User-Agent of Chrome browser, hence can't block based on that as well. Using latest chrome versions.
- We require CSRF token with this request and he is generating a new CSRF token for each request, can't block/rate-limit that as well.
- We cannot add a captcha as it's a hindrance for our genuine users and business team won't go for it.
How we are planning to address it:
- If a person make a hit on signup API and change mobile number in 3-4 request then block that IP or show a captcha. Problem in this approach is that still 3-4 SMS will trigger, at present we are anyways blocking IP after 5 requests. It won't add much value.
- If we see higher number of signups for a particular country from the average, then show a captcha for all signups happening under that country code. Problem here is that, malicious user can change his mobile number to a different country on detecting captcha.
These are the only 2 solutions that we came up with. I am looking to find out any better solution to fix this security issue.