I’ve made a newletter signup form for a client, and they keep getting form submissions from non-existent email addresses. Even with an image-verification field on the form, they still keep comin! 90% are from India (+5.5 GMT) Or is that just coincidence?
..etc, the list goes on. What is all this and what is the point of submitting bogus email addresses on a newsletter signup form? It’s not like they can type a message to send spam to anyone.. any ideas how to stop this?
It’s a robot doing this. Not sure what the point is. But in order to prevent it, you should add some extra security to your code, like an image or something. What I do is to generate a unique code with each display of the page and the user has to insert it, else the form won’t be submitted.
Yeah I’ve already done that.. but it doesn’t stop em! It’s a real image-verification too, and my hidden field (that stores the code required) is scrambled and everything. Very bizarre.
But anyway why would a bot be submitting a form that it can’t use for anything? If it detected a textarea field (which this one doesn’t have) then I could see the point… it would be some kind of message body.
Given the huge amount of available labor, perhaps there are humans submitting…
Antic, did you “roll your own” image verification software or are you using a packaged product? I really need to implement this type security on my sites as well…
Well what I did was create an ASPX page which does the following:
Accept a querystring parameter which represents the text to put onto the verification image,
Creates the image using the GDI functions,
Returns a content type of “image/gif” to the browser, which is the image with text on it.
You call this ASPX page in your HTML form, inside an tag, because the ASPX page actually returns image data. Eg:
where “xyz” is your parameter telling the ASPX page what text to put in the image. “xyz” is also stored in a hidden form field, so you can compare it with what they have typed in, once the form is submitted.
You shouldn’t put the exact text in the querystring of course, it should be scrambled/encoded in any way you like, to avoid bots being smart and working out what it is.
That’s the basic idea, and here’s the code for the ASPX page that returns the image:
(note that I use Imports = , which isn’t necessary, just my personal preference)
Imports libIO = System.IO
Imports libSD = System.Drawing
Imports libSDI = System.Drawing.Imaging
Imports libSDT = System.Drawing.Text
Imports libSDD = System.Drawing.Drawing2D
Private Sub Page_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
Dim sVerifyCode As String
' Get the string to put on the image (encoded any way you like)
sVerifyCode = Request.QueryString("stringcode")
' Create the image in memory.
Dim pic As New libSD.Bitmap(65, 22, libSDI.PixelFormat.Format24bppRgb)
Dim g As libSD.Graphics = libSD.Graphics.FromImage(pic)
g.Clear(libSD.Color.White) ' blank the image
g.SmoothingMode = libSDD.SmoothingMode.AntiAlias ' antialias objects
g.TextRenderingHint = libSDT.TextRenderingHint.AntiAlias
g.DrawString(sVerifyCode, New libSD.Font(libSD.FontFamily.GenericMonospace, 14, CType(FontStyle.Bold + FontStyle.Italic, FontStyle)), libSD.Brushes.Black, 2, 1)
' Set the content type and output the image data to the response stream.
Response.Clear() ' Clear any output that .net might have buffered.
' Output the image in GIF format.
' Can be changed to JPG if you prefer, whichever gives a smaller output.
Response.ContentType = "image/gif"
pic.Save(Response.OutputStream, libSDI.ImageFormat.Gif)
g.Dispose()
pic.Dispose() ' Important as bitmaps use unmanaged resources.
Response.End() ' Important to end here so .net doesn't output anything else.
End Sub
I started getting these from lots of client contact forms. Mostly just annoying, but in some cases I started getting dozens per day. Definitely bots - if you capture the sending UserAgent you’ll find it lists itself as Java.xxxxx
Also, image verification on the form won’t help, in most cases. What they’re doing is submitting direct to your form processing script (which they can find from the Form Action=). So they can bypass the form entirely. It may also be that they are able to simulate a form POST via this method.
Not sure what the purpose of this is, but possibly trying a SQL injection hack by adding caracters to the querystrings. Possibly also buffer overflow, since they sometimes try to insert large quantities of data into the form fields.
Here’s what I put in place to stop this in my form processing scripts:
First, make sure this is a form post.
Get the form variables and do a left(request.form(“fieldname”),50) to cut data down to the length you’ve set for each field. Don’t just put the request text directly into an email or your database.
Strip out all non-normal characters like / \ ? % etc. I found a free function on the web to do this.
If this is going to also run a database query, don’t name your query variables the same as your actual SQL field names:
ie: if your SQL key field is “orderID”, do something like this:
orderID = left(request.form(“f1”),6)
I don’t know if any one in particular is effective, but all of these together have totally cut out these bogus form submits.
btw, if any of you process credit cards and go through Bank of America, you may have been forced to submit to a web security audit. Basically BofA pays a company to try to hack your site - even the non-secure pages. The resulting vulnerability report is very informative! But it helped me track down a lot of these issues.
[QUOTE=Sailor]
What they’re doing is submitting direct to your form processing script (which they can find from the Form Action=). So they can bypass the form entirely. It may also be that they are able to simulate a form POST via this method.
[/QUOTE]
If they did that, wouldn’t the hidden field be empty? can’t you just do some verification of the hidden field on the page that does the processing?
But in this case I compare the image string with what they’ve typed in at the server-end. So even if they submit the form directly from their code, it still gets processed in my code once it’s submitted. I don’t try to compare the image verification text in JavaScript, that’s kinda pointless.
So I’m a bit flummoxed how they get em past me, unless of course they have s/ware which visually “reads” (OCR) the numbers in the image. It’s been known to happen.
I’m going to change the signup to double-opt-in now anyway. That’s the only way of stopping it for sure. They will get an email when they sign up, in which they have to click a link to complete the sign-up process. Since all the email addresses they type in are bogus, they won’t actually receive anything therefore no more dud newsletter signups.
I have a feeling it is REAL people, so they can verify it. I know it sounds funny, but there are companies that spam forums advertising that they pay for this type of stuff. We delete 5-10 a day in the moderated advertising forums here.
Agreed, it’s probably people. For interesting side reading, check out the following for reasons bots might be trying to stuff your form mailer scripts:
I’m working on a reasonably bot-safe php mailer for a client. When it’s ready, I’ll be glad to share…probably a couple of days. It won’t stop people but hopefully prevent the injection attacks described in the links.
I know the focus of this thread was on .NET, but as I mentioned in my previous note, I’ve been working on a spambot safe PHP mailer. The initial release is ready for testing if you’re interested. Check it out at http://skypanther.com/spmailer.php
