Exploiting My E-mail Form

Ibanez Player 85

Galactic Royalty

Offline

Posts: 428

Exploiting My E-mail Form

« on: July 24, 2005, 08:53:12 AM »

I use cgi-email for a contact page on my website. It's pretty simple, and just contains fields like Name, Company, Website, E-mail, and Comments. Today, I received 7 e-mails between 11:23 and 11:34 AM from someone using the form, but something's not right about it... For this reason, I temporarily removed the form from the website to figure out what this is... Here are a couple of the e-mails I received:

Code:

Customer Contact Information:

Name: zzdmjslvoa@refinedwebdesign.com Content-Type: multipart/mixed; boundary="===============1404986036==" MIME-Version: 1.0 Subject: 8f8d7bdc To: zzdmjslvoa@refinedwebdesign.com bcc: bergkoch8@aol.com From: zzdmjslvoa@refinedwebdesign.com This is a multi-part message in MIME format. --===============1404986036== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit jcehh --===============1404986036==--
Company: zzdmjslvoa@refinedwebdesign.com
Website: zzdmjslvoa@refinedwebdesign.com
Email: zzdmjslvoa@refinedwebdesign.com

Comments:

zzdmjslvoa@refinedwebdesign.com

Code:

Customer Contact Information:

Name: tez@refinedwebdesign.com
Company: tez@refinedwebdesign.com
Content-Type: multipart/mixed; boundary="===============1525976087=="
MIME-Version: 1.0
Subject: 2e2d2560
To: tez@refinedwebdesign.com
bcc: bergkoch8@aol.com
From: tez@refinedwebdesign.com

This is a multi-part message in MIME format.

--===============1525976087==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

pmuaoucx
--===============1525976087==--

Website: tez@refinedwebdesign.com
Email: tez@refinedwebdesign.com

Comments:

tez@refinedwebdesign.com

I only posted two e-mails, but it seems that most of the 7 e-mails I received have a BCC to bergkoch8@aol.com if that's any help at all as to what's going on here. The other e-mails I received are all the same, with the exception of the From and E-mail field, which seems to be gibberish and made-up e-mails with my domain at the end (for example, eshua@refinedwebdesign.com and wtwehbpfkd@refinedwebdesign.com which do not exist). Help is very much appreciated, thank you!

P.S. I removed the form from the HTML page a few minutes ago, and I just received another one of these e-mails. I suppose I should take down the actual contact.txt file that cgi-email uses for the form...


	Logged

Refined Web Design
http://refinedwebdesign.com

Ibanez Player 85

Galactic Royalty

Offline

Posts: 428

Re: Exploiting My E-mail Form

« Reply #1 on: July 31, 2005, 12:47:39 PM »

Any ideas?


	Logged

Refined Web Design
http://refinedwebdesign.com

leighsww

* The Tough Love Cuddly One *
Berserker Poster

Offline

Posts: 14072

Re: Exploiting My E-mail Form

« Reply #2 on: July 31, 2005, 02:12:07 PM »

It looks like spam but using your form to do it.

Maybe someone is using those bots/scripts that auto fill out forms but now using it to create spam Confused


	Logged

KJones

Galactic Royalty

Offline

Posts: 313

Re: Exploiting My E-mail Form

« Reply #3 on: September 13, 2005, 12:05:46 AM »

I was having similar problems. After a bit of research I learned that it's called an "email injection exploit". The spammer inserts code into the contact form that tricks the script into sending emails to people other than the intended recipient.

I programmed my script to look for "MIME-Version:" in all of the fields of my form and not process any emails that it was found in. I also have it so that an email is sent to me containing the spammer's IP address so that I can inform the abuse department of the spammer's internet provider.

My script is written in PHP. If anyone would like to see my code let me know. Wink


	Logged

"I believe that this nation should commit itself to achieving the goal, before this decade is out, of landing a man on the moon and returning him safely to the earth." - John F. Kennedy

TranzNDance

Princess of Naboo
Berserker Poster

Offline

Posts: 11965

Re: Exploiting My E-mail Form

« Reply #4 on: September 13, 2005, 12:17:26 AM »

Quote from: KJones on September 13, 2005, 12:05:46 AM

My script is written in PHP. If anyone would like to see my code let me know. Wink

I've been planning to do the same thing. If you already have it and are willing to share it, I would really appreciate it. Luff Ya


	Logged

dcalgaro

Space Explorer

Offline

Posts: 7

Re: Exploiting My E-mail Form

« Reply #5 on: September 13, 2005, 06:30:14 AM »

I would like to see that script, too. Smile


	Logged

KJones

Galactic Royalty

Offline

Posts: 313

Re: Exploiting My E-mail Form

« Reply #6 on: September 13, 2005, 07:51:42 AM »

If you want the entire contact form/script that I use you can contact me here (that way you can try it out first. Wink

Here is the part of my script that checks for spam:

Code:

if (eregi("MIME-Version: ",$_REQUEST['field1'].$_REQUEST['field2'].$_REQUEST['field3'].$_REQUEST['field4'])) {
$security_passed = false;
$failure_reason = 'Suspected Spam Attempt';
echo '<div style="border: solid 1px #FF3333; color: #FF3333; font-weight: bold; font-size: 14pt; text-align: center; width: 100%;">Security Check Failed!</div>';
echo 'REASON: ' . $failure_reason . '';
echo '';
echo 'DETAILS: An attempt to use this email form to send spam was detected. Your actions have been logged and soon we will be contacting the abuse department of your internet provider.This script has been secured to prevent spamming and your email was not delivered. Don\'t bother trying again.';
echo 'Your IP address is: ' . $_SERVER['REMOTE_ADDR'] . '';
if ($send_alerts == 1) {
$from = 'From: Automated Abuse Report <abuse@yourdomain.com>';
$subject = $failure_reason;
$message_date = date("F j, Y, g:i a");
$message = $message_date . "\n\nSomeone has attempted to use your email contact form to send spam.\n\nThe words \"MIME-Version:\" were found in the email and that is a sign that an email injection exploit was tried. The email was not sent.\n\nThe attempt originated from the following IP address: " . $_SERVER['REMOTE_ADDR'];
mail($to, $subject, $message, $from);
}
} else {
$security_passed = true;
}

Before that can work the following variables have to be set:

$to = 'youremail@yourdomain.com'; // The recipient of the email.
$send_alerts = 1; // Send an email alert to the webmaster if abuse is detected? (0 = No, 1 = Yes)


	Logged

"I believe that this nation should commit itself to achieving the goal, before this decade is out, of landing a man on the moon and returning him safely to the earth." - John F. Kennedy

KJones

Galactic Royalty

Offline

Posts: 313

Re: Exploiting My E-mail Form

« Reply #7 on: September 14, 2005, 09:35:39 PM »

I have made my contact form script available for download here.

The file is zipped. Instructions for how to configure it are included in the zip file. If you have any questions (or suggestions on how to improve it) let me know. Smile

Kel


	Logged

"I believe that this nation should commit itself to achieving the goal, before this decade is out, of landing a man on the moon and returning him safely to the earth." - John F. Kennedy

leighsww

* The Tough Love Cuddly One *
Berserker Poster

Offline

Posts: 14072

Re: Exploiting My E-mail Form

« Reply #8 on: September 14, 2005, 09:56:58 PM »

Can a Moderator/Staff make this a "sticky" so that Kelly's script is not lost as time goes on? Very Happy

So many people lately have been having this "email injection exploit" problem, this thread would come in very handy

I'm also going to add scanman20's "Killbot" link here, so people with this exploit problem have two methods to choose from (whichever they find works best for them):

http://www.notonebit.com/projects/killbot/


« Last Edit: September 14, 2005, 10:06:43 PM by leighsww »	Logged

randya2

Intergalactic Cowboy

Offline

Posts: 55

Re: Exploiting My E-mail Form

« Reply #9 on: November 19, 2005, 10:51:04 AM »

KJones:
I downloaded your script and it works GREAT! Good work Smile

Randy


	Logged

LunarPages Rock!

KJones

Galactic Royalty

Offline

Posts: 313

Re: Exploiting My E-mail Form

« Reply #10 on: November 20, 2005, 06:34:16 PM »

Thanks Randy! I'm glad people are finding the script useful... and I'm REALLY glad spammers are being stopped cold! Smile


	Logged

"I believe that this nation should commit itself to achieving the goal, before this decade is out, of landing a man on the moon and returning him safely to the earth." - John F. Kennedy

scanman20

Master Jedi

Offline

Posts: 1216

Re: Exploiting My E-mail Form

« Reply #11 on: November 21, 2005, 06:07:58 AM »

Quote from: KJones on September 14, 2005, 09:35:39 PM

Kel

Just curoius, what happens in your script is someone has disabled cookies or has a cookie blocker? Also, couldn't a spambot read the key from the source and post that data back to the form as long as it sent cookie headers? Granted it would take a little work to create such a bot but wouldn't that get around that auto generated key?


	Logged

Even a broken clock is right twice a day.
NotOneBit.com
MCSE - MCSA - MCP

KJones

Galactic Royalty

Offline

Posts: 313

Re: Exploiting My E-mail Form

« Reply #12 on: November 21, 2005, 09:24:45 AM »

I'm not sure if cookies are used... the script uses a session to store the key, does that mean it's using a cookie? I guess a bot could read the key but even if it did I can't see how it could send it's spam since I'm filtering out any emails that contain "MIME-Version" and "Content-Type".

The random key may cause problems though, I agree. In future versions I might make it something that you can turn off in the script settings.


	Logged

"I believe that this nation should commit itself to achieving the goal, before this decade is out, of landing a man on the moon and returning him safely to the earth." - John F. Kennedy

scanman20

Master Jedi

Offline

Posts: 1216

Re: Exploiting My E-mail Form

« Reply #13 on: November 21, 2005, 10:38:30 AM »

Yes, sessions set cookies. It's how the server knows how to tie the session vars stored on the server to the specific user. It can also pass the session through the URL but that's typically considered insecure.


	Logged

Even a broken clock is right twice a day.
NotOneBit.com
MCSE - MCSA - MCP

KJones

Galactic Royalty

Offline

Posts: 313

Re: Exploiting My E-mail Form

« Reply #14 on: November 21, 2005, 11:05:01 AM »

The purpose of the key was originally to prevent spammers from using a form on their own site to send spam through my script, not to prevent bots from entering data into my form. I was getting a lot of spam from people that had HTTP Referers that didn't match the address of my contact form.

I think the only real way to prevent bots is to use image verification, like your KillBot script.


	Logged

"I believe that this nation should commit itself to achieving the goal, before this decade is out, of landing a man on the moon and returning him safely to the earth." - John F. Kennedy

Pages: [1] 2 3 Go Up

« previous next »

	Welcome, Guest. Please login or register. Did you miss your activation email?	August 20, 2008, 08:11:08 PM
		Login with username, password and session length