Our web application offers users with the option to bulk email a bunch of interesting information to multiple email addresses at once. It's fairly easy to register an account with the service and thus it's pretty easy to start spamming people with email they never wanted to receive. You can't actually change the content of the email, but you can send it to any set of addresses.

My understanding is that if someone decides to troll the service and start spamming random people on the Internet from it, the company's domain might get banned from the major email providers out there and we're pretty much never getting ahold of legitimate users again through email.

Couple of questions:

  • Is the above the worst case scenario or are there are aspects I'm not taking in consideration?
  • What are some common and affordable (engineering-wise) prevention and mitigation practices that services use to deal with the above? I imagine that limiting the # of email that an account can send per day is one option. Also requiring that the account show some legitimate activity before it can send email is another valid approach. Anything else major I'm missing?

All other tips are greatly appreciated.

  • What incentive may the attacker have to spam this information? Is there anything that comes to mind other than a denial of service attack on you (by getting you onto spam lists)? – lzam Sep 10 '14 at 1:16
  • 1
    Pretty much no incentive except for DoS. – glitch Sep 10 '14 at 1:23

There are a few things you can try to help prevent malicious actors from abusing your service:

  1. Require a CAPTCHA: This should help cut down on bots abusing your services.
  2. Limit usage of this feature by IP address & time: Don't let a single IP send large amount of mail within a short period of time (keep in mind that you may have multiple users behind NAT though).
  3. Consider limiting the "from" address to verified email adresses: You can have each user register and verify each email address he wants to appear in the from "field." Limit the number of email adresses a user can register for this purpose.

    These steps are not foolproof though. An attacker with multiple IPs (a botnet for example), very good OCR software (or a human CAPTCHA breaking service), and disposable email addresses can still get around this.

It is also possible that even without a botnet, a single attacker with a list of honeypot email addresses may still be able to get you on some blacklists (I don't know the thresholds for the various blacklist services).

You should also be sure to have an optout (unsubscribe) link on all emails sent by this service, so people who don't want to get emails from your service can stop them from coming.

  • 1
    With the CAPTCHA, you almost certainly want to combine it with rate-limiting - require a CAPTCHA only after you hit a certain limit. This means normal users will never have to suffer through it, while spammers will still hit it. – Xiong Chiamiov Sep 11 '14 at 6:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.