1

So I have a site where users can create online surveys and send them out to whomever they like. Over the past few months we have seen an uptick in one particular user who creates an account, then creates a survey where he requests user names and passwords for a different site. It's always the same site that he targets, and he always asks the same sorts of questions.

Our best solution up until now has been to create a monitoring service that searches for potentially malicious surveys and then notifies us when they are found. We then go in and manually review the survey and lock the account if it's up to something shady.

This has not been very effective. Even though the surveys are locked fairly quickly the malicious user still finds value in endlessly creating these surveys under new accounts and sending them out.

The best idea I've come up with is to not allow a survey to be activated by the user if it contains suspect keywords. Require and admin to review and activate it. The problem with this is that there are many false positives that get picked up, so I would need to perform an action more often than I do now in order to let the legit surveys go live.

Can anyone suggest an effective way to thwart this person without spending a chunk of my day performing manual tasks? Is there some way to fingerprint this user to prevent him from using our site for phishing?

Improve this question

3 Answers 3

Reset to default
1

Depending on the language and framework you are using, maybe it's time to look at some machine learning libraries for spam detection. If you use this malicious user's methods as the training set you maybe able to lower your false positive rate.

Improve this answer
1
  • 1
    Yeah that is something that I had considered. My machine learning capabilities are wanting, but this might be a good excuse to beef them up.
    – Abe Miessler
    Aug 11, 2014 at 17:33
0

We've had a lot of problems in the past with spammers using our webmail for sending spam (after phishing passwords from our customers), and that's a similar problem.

It stopped as soon as we set up our webmail software to rate limit message sending to 1 message every 15 seconds. Spammers like convenience and automation, and making message sending more inconvenient or less automatic always shuts them right down.

Your web form should include a Captcha, or you can set up some kind of rate limit like we did.

Improve this answer
3
  • The author's problem is that malicious people use his survey system to create phishing forms, and he needs a way to detect those malicious surveys. A captcha would inconvenience many legitimate users while the malicious ones wouldn't have any problems (from a phisher's perspective, filling a single captcha to create a survey that'll bring you 100 usernames/passwords isn't a problem).
    – user42178
    Sep 10, 2014 at 18:11
  • Well, if the site is all about creating a single message to automatically send to thousands of people, then there's nothing you can do. Literally. Filtering by content only ensures that the spammer learns to not use the content it filters for. The only way a computer can check for the spamminess of the messages sent is if it were to actually gain an understanding of the message. An intelligent (or even semi-intelligent) attacker will always find a way around static defences, just by trying different things.
    – Ernie
    Sep 10, 2014 at 18:22
  • I think you misunderstood. What his site is about is most likely creating a form accessible from a link, and the person spams that link using other means. Thus the site itself does not take part in any spamming.
    – user42178
    Sep 10, 2014 at 18:25
0

What about just adding a notice at the bottom of the page that reads :

Never submit usernames or passwords through <your site's name>.

You can go even further by adding something like this and manually reviewing surveys that were reported :

If this survey asks you for credentials, do not enter them and click here to report this form.

The attacker can still create phishing forms but their efficiency should be greatly reduced by that and he'll move to a self-hosted solution and leave your site alone (or even better, he'll totally stop phishing).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .