3

I am working with a Joomla 3.7.5 site. The registration scheme has always been admin activation from the start. Right now there is a constant deluge of fake Russian user accounts. They aren't getting activated, but the admin is getting spammed by the notifications.

I know that sounds familiar, but this is different than the other Q/As I've seen here. I have also seen this VEL article but it doesn't explain my situation.

I am overriding the core UsersModelRegistration and JMail classes. The JMail override is used to route all system emails through our email relay service. The UsersModelRegistration override is literally a copy of the original with one line added. At the very top of the register function I am just immediately returning, instead of allowing the function to run. The reason for this is because our registration is now done via a custom component. With that modification it should effectively disabled registering in the normal Joomla way. In addition to that, I have added a modification to the com_users controller so it will redirect the register view to the custom registration component. Update: I double-checked and this is how we are handling the redirect, also an override:

public function onAfterRoute() {
        $app = JFactory::getApplication();
        $option = $app->input->get('option', '');
        if ($app->isSite() && ($option == 'com_users' || $option == 'com_jsn')) {
            $task = $app->input->get('task', '');
            $acceptableTasks = array('registration.activate', 'user.login', 'user.logout');
            if (!in_array($task, $acceptableTasks)) {
                $db = JFactory::getDbo();
                $menusql = "SELECT id FROM #__menu WHERE link LIKE '%com_my_custom_component&view=account%'";
                $db->SetQuery($menusql);
                $menuItem = $db->loadObject();
                $menuitemid = (!empty($menuItem)) ? $menuItem->id : 0;
                $regLink = JRoute::_('index.php?option=com_my_custom_component&view=account&Itemid=' . $menuitemid);
                $app->redirect($regLink);
            }
        }
    }

Yet, users are still being created without using the custom form. I can tell pretty easily because every registration on our form will created augmented records in another DB table. These spam users are all the most basic Joomla users. Side note: literally every one of these users I've looked into has a Russian IP address.) They create a user somehow. Since the admin is getting emails for these users, they must also be constructing the URL that verifies their email, although that has to include a hash token and how do they get that? If someone was able to upload a user creation script, why would they be thwarted by the admin activation process? Would they just keep going and get more access? This course of action is annoying, but not profitable or productive for any spammer/hacker.

Has anyone else experienced something like this?

  • Most likely those fake users are created by bots that have found their way to your registration workflow. Just to confirm, you say that if you try to reach at your site and register through example.com/index.php?option=com_users, this will redirect and will not allow a registration? Also note that you should always keep your Joomla (and any other software) up to date. There are a few vulnerabilities for all Joomla versions earlier than 3.8.4. – FFrewin Feb 1 '18 at 7:47
  • I updated the question with the code sample for how we are redirecting from the core Joomla reg functions. I have tried many times and if you manually enter the Joomla registration URL it does redirect to my form. My form is augmented and if it saves successfully it will always create additional DB records, which these fake accounts are not doing. – claywhipkey Feb 1 '18 at 16:44
1

Is there a pattern to the emails used? For example, do these emails have a certain tld at the end? If that's the case, you can add a regex to the model blocking those emails.

Note: If your website only benefits from American traffic, then you can block traffic from countries that we don't want traffic from. Nowadays, most hosts can do that for you. This will save you time and will reduce the attacks on your site. If your benefit from international traffic, then I don't recommend doing this.

Another note: A good idea to understand and (attempt to) prevent the attacks would be to check your server logs.

  • The emails are a spattering of typical Russian sites like mail.ru and the usual public services like gmail, yahoo, etc. I thought about blocking the Russian sites, but it will only go so far. Blocking countries is another idea I considered. This site is for a mostly local but definitely only in the US so that might be the last resort. This post was more about "how is this possible?/where is the security hole so it can be fixed?" kind of thing. – claywhipkey Feb 2 '18 at 2:35
  • 2
    Have you checked your server logs? The key to finding how they are registering is there? – itoctopus Feb 2 '18 at 15:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.