DDOS BOT activity

[Yahalimu]

Hi,
Using an OLD version v1.0.5.0.
We've recently been the victim of DDOS attacks from all over the world, for now I've banned most of the world apart from the US and Europe which has eased the situation but not stopped it.
They are using the following type of URL: (example)

domain/acopel-f400-355160-p-2370.html?action=buy_now&ceid=rlp947j3ffraqrojh8bv0no9vg

This seems to place MANY items in the cart at once, sometimes many hundreds, causing our MYSQL server to use much CPU.
It is of course possible its adding one product at a time after hundred of repeated visits, not sure, all I know is if I put the URL's into my browser there are sometimes THOUSANDS of products in the cart.

Is there a fix for this? Even if I limit the number of items able to be put in the cart via configuration menu it still seems to add them all.

[cwh2000]

We are having a similar issue on version 1.0.9.5 with high CPU, Number of Processes & Entry Processes reaching the limits set my ISP. These bots are performing queries such as: /catalog/product_info.php?cPath=10¤cy=EUR&products_id=1236&sort=3d or /catalog/product_info.php?cPath=172_177¤cy=USD&products_id=2375&sort=5a

[azpro]

I am not an expert but I found you can't do much server-side. All the blocking you do does not eliminate the requests bots are making - hence your server keeps the load.

So we finally decided to use Cloudflare to reduce traffic/serverload. Works quite well with the free plan. Off course also has some disadvantages - but does the job.

Success!

[Yahalimu]

Thanks.
I am considering Cloudflare but as it seems like perfectly legitimate call not sure if it will help, as rate limiting won't work as there are thousands of IP's normally only making one fetch every few hours.
At one point our MYSQL was having 58,000 queries per second. Retrieving a massive cart is quite MYSQL intensive.
After all the bans now down to 15,000

[azpro]

as rate limiting won't work as there are thousands of IP's normally only making one fetch every few hours.

The IP's probably come from same ASN.

With Cloudflare you can block Regions or Countries or ASN or individual IP's. It is not just rate limiting.

[Yahalimu]

Hi,
I may try them anyway, I believe you can give them a challenge if in certain countries which may probably stop them.
They're not from the same ASN, they are originating from over 100 different countries so far, thousands of different IP's.
Blocking 80 countries with iptables has made it more manageable but there are still hundreds coming from EU and US which I don't want to block.

[Yahalimu]

TBH as this is causing such an issue for us I think I'll do a quick and easy fix and just change the name of the action from 'buy_now' to something bespoke for now until I get cloudflare up and running.
Fairly convinced they have marked the site as 'os-commerce' type so are using standard attacks for the thousands of sites that use that platform.
They only have to manually visit the site to correct the attack but they may not even bother, even if they do it'll give me a few days hopefully.
Some sort of CRSF token for the 'buy now' button could also fix this.

[burt]

I thought we had CSRF ?
Maybe it's on the admin side only.

Could be added to shop if it's not there.
Interested enough to help out?

[Yahalimu]

It seems that what is happening requesting a category or 'New products' and also including the 'buy_now' action in the GET so it loads the whole category, adds it to the cart and then lists the shopping cart. This is very CPU intensive on the database especially if the cart has 2000 products in it. What is interesting is one bot requests a product page to get a valid session ID then passes it on to other bots that use that ID to fill the carts.
In fact adding a custom rule to my WAF is the easiest fix. Look for the -c- to indicate a category in the URL (in my version) and if there's also a 'buy_now' in there block it. A human will NEVER add a whole category or more than one product type at a time, its not even possible I don't think..
Not sure why its even necessary, maybe loading a customer cart on login?
I'm starting to think about building a new site next year. Would newer versions still be susceptible to this type crafted GET?

[burt]

Would newer versions still be susceptible to this type crafted GET?

https://phoenixcart.org/demo/index.php?cPath=2

Try to replicate and report back.