1

I have encountered an interesting problem. One of the magento shops I support has a spam problem. A lot of fake customer accounts are created, which I could probably solve easily by adding a honeypot captcha of some sort. But what makes the problem interesting is the fact that these user accounts already have a standard billing and shipping address (always billing = shipping address). But the accounts have not been confirmed (email confirmation). So they could not log in to add the addresses.

How can it be that a user has a billing/shipping address without ever being logged in ???

Is there a way to change the default login form and add values to it, which then get added as address ???

Did someone encounter this problem before ???

The store has all latest security patches and we could not find any suspicious files or admin user accounts.

Thanks in advance..

2 Answers 2

2

Can magento have a register form with address input

Yes, there is a flag you can set via layout XML:

<block name="customer_form_register">
    <action method="setShowAddressFields"><value>1</value></action>
</block>

It is only evaluated in the template, so anybody could create a request to create customer accounts with address, even if the flag is not set.

2
  • That looks like what I was looking for. I will try it and then post my findings/solution. Thanks for that :)
    – axe1987
    Jan 23, 2018 at 6:29
  • Nice. That did help. I was able to reproduce the attack. Now I will figure out how to counter it the best way. Thank you very much.
    – axe1987
    Jan 23, 2018 at 8:23
0

Well, in general, there are ways to create a customer other than the storefront form. Two ways that spring to mind are the admin form (Customers>Manage Customers) and direct manipulation of the database.

One popular avenue of exploiting Magento (or Wordpress, or other frameworks for that matter) is hitting a particular GET or POST route that is not usually available to an end user. Perhaps someone found a route that lets them create a customer, and they sent along the addresses.

Alternatively, maybe they have access to your db, which would be critical, but highly unlikely - if they had db access, why would they bother creating customers?

Odd situation, I agree. Good luck - maybe try adding more granular logging around the creation of customer accounts. That will let you come back later to investigate those weird customer accounts in more detail.

1
  • But how can they have an address. I am pretty sure that there is no backend user doing this, and the dB is secure as well. Can magento have a register form with address input? I have only seen username, email, password...
    – axe1987
    Jan 23, 2018 at 5:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.