php mail injection solution, php mail spam attack!

Every day I get mails into my inbox informing me a spammer has just attempted to hijack one of our website forms that uses the php mail function. This attack is well documented, and is known as an email injection attack.

Problem: Spammers use the extra headers argument of the mail function to hijack your mail script to send out what they want to who they want. The use the Cc: and Bcc: headers to send out to email addresses they have already harvested. The problem is explained in great detail here.

A former colleague of mine is responsible for the functions, that I have used with great success to deny the spammers a free ride.

Solution: Here is the foilspam function and suspiciousInput functions. The first returns a http 403 forbidden header, when a suspected spam attempt occurs. It also alerts an admin of the attempt and the ip of the atacker. The second scans for suspicious input often used in injection attacks!

function foilSpam($check, $message){
if(empty($message)) {
$message = "Spam attempt denied";
}
if(empty($check))
{
$check = "Extra check"; }
mail("admin@admin.com", "Site spam attempt", "$check: $message from IP {$_SERVER['REMOTE_ADDR']}", "From: me@localhost.com\r\n\r\n");
header("HTTP/1.0 403 Forbidden");
die($message);
}

function suspiciousInput($value)
{
return eregi("MIME-Version:|Content-Type:|bcc:|cc:", $value);
}

1)Firstly check the referrering source was from our site.

if (!stristr($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST'])) {
foilSpam("Referrer check", null);
}

2)Check each posted variable one by one for suspicious input often used by spammers:

foreach($_POST as $key => $val) {
if(suspiciousInput($val))
{
foilSpam("Suspicious input check", null);
}
}

Write a comment

Name:
Email:
Subject:
Comment: *

Security Code:
 

Posts: 2

Perhaps?
Reply #2 on : Fri December 08, 2006, 15:08:37

---

I found that this function actually stops most of the spam on some domains.

Of course its a spam bot that is making POSTS to my forms, hence the $_SERVER['HTTP_REFERER'] does not match up with my site.....but as you say the determined spammer can get past this!!

Posts: 2

About your php mail injection solution
Reply #1 on : Tue December 05, 2006, 04:56:35

---

The referrer check won't if they place the host name into the URL. I've seen them using diffent URL sepated by a comma and a space as a referrer. So if one of those URL contain the hostname, the test will fail.