Magento 1.9 Fake customer with address

Question

I have encountered an interesting problem. One of the magento shops I support has a spam problem. A lot of fake customer accounts are created, which I could probably solve easily by adding a honeypot captcha of some sort. But what makes the problem interesting is the fact that these user accounts already have a standard billing and shipping address (always billing = shipping address). But the accounts have not been confirmed (email confirmation). So they could not log in to add the addresses.

How can it be that a user has a billing/shipping address without ever being logged in ???

Is there a way to change the default login form and add values to it, which then get added as address ???

Did someone encounter this problem before ???

The store has all latest security patches and we could not find any suspicious files or admin user accounts.

Thanks in advance..

Answer 1

Can magento have a register form with address input

Yes, there is a flag you can set via layout XML:

<block name="customer_form_register">
    <action method="setShowAddressFields"><value>1</value></action>
</block>

It is only evaluated in the template, so anybody could create a request to create customer accounts with address, even if the flag is not set.

Answer 2

Well, in general, there are ways to create a customer other than the storefront form. Two ways that spring to mind are the admin form (Customers>Manage Customers) and direct manipulation of the database.

One popular avenue of exploiting Magento (or Wordpress, or other frameworks for that matter) is hitting a particular GET or POST route that is not usually available to an end user. Perhaps someone found a route that lets them create a customer, and they sent along the addresses.

Alternatively, maybe they have access to your db, which would be critical, but highly unlikely - if they had db access, why would they bother creating customers?

Odd situation, I agree. Good luck - maybe try adding more granular logging around the creation of customer accounts. That will let you come back later to investigate those weird customer accounts in more detail.