7

We have recently observed people creating customer accounts automatically on Magento sites in bulk. Errors in their tools make it obvious that all the accounts they're creating are linked, such as identical corrupted data in signup fields, even though the registration HTTP requests are spread out over time, from a variety of IPs, and using different useragents.

We have never seen these accounts log in or return after the creation step.

So given someone's collecting a list of working customer account/passwords for a particular Magento instance, what purpose could these bulk accounts be for? Is there an attack or exploit class that this is a sign of / warning for?

Improve this question

2 Answers 2

Reset to default
1

Often we see these attacks act as a screen and a few other requests are thrown in to known targets for Magento vulnerabilities, but they could also be trying to exploit a form or something similar.

Improve this answer
1

A site I work on was hit by one such annoying attacker. In our case the attacker seemed to be nothing more than a spammer. They were using our magento site to send really poor advertisements to their spam list.

So obviously our site would get a new customer account that we didn't want, and the first and last names for these customers were quite odd. For example, first name of "www.24pay.ml" and last name of " - U_vas_BONUS_do_55.000_rub"... so the end result was that the recipient on their spam list would get an email from our site with a subject line of "Account creation for www.24pay.ml - U_vas_BONUS_do_55.000_rub"

When I googled it the phrase seemed to say something like "you get 55 rubies" or something, IDK.

So yeah, pretty terrible marketing scam.

But the impact to the business was quite annoying because since the site didn't have proper security checks (like recaptcha) on the new customer page the spammer was able to send so many emails that it actually impacted our ESP reputation, and we were rate limited on how many emails we could send. Ugh!

Improve this answer
1
  • Yeah this is definitely it - wedging spam content into the firstname field and relying on magento templates saying Hi Firstname. I've seen it across almost all our sites without captchas since the original question.
    – xyphoid
    Commented May 10, 2018 at 10:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.