Security issue

Plummer

Hi,

I noticed in my web statistics that the URL to the check of ticket status is not encrypted. Not really a big issue one would think. But I noticed already a couple of times that tickets were viewed by IP addresses not belonging to the poster of the ticket but from IP addresses in Japan, China and the Russian Federation. The last one by the way we blocked totally with htaccess.

These IP's harvest IP addresses from our visitors that way.

Is this an issue with our ISP, our users or can we do something else to prevent hacking of tickets ?

Regards, Danny.

Kelli

Maybe I'm missing something, but I don't understand how this should be happening.

If you're talking about the URL that gets sent out upon ticket creation, which contains the client email and ticket ID In the URL, then the only record of that URL's existance should be in your server logs and your client's email account. Even if it were somehow obtained, just hitting it with an automated bot wouldn't do any good, as you still have to physically click a login link.

If you're talking about a URL for tickets.php with an external ticket ID appended, again, the visitor would have to have the email address, and log in to the system before the ticket could be viewed.

Plummer

Check my FireStats log entry

It is the viewticket.html that is being abused/tracked/intercepted :

150.70.66.185 06/12/2010 15 /viewticket.html?e=user@domain.n

l&t=123456. Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)

150.70.66.185 06/12/2010 15 /

This IP 150.70.66.185 is located in Japan, the actual user (owner of the ticket, email for this thread cloaked) is located in the Netherlands.

The URL was accessed by the real owner at 10.

Does this help ?

Kelli

It still doesn't make any sense that they would even be able to get the URL, though, unless the ticket owner's email had been compromised or they had publicly posted it somewhere. These are not pages that can be indexed or crawled.

Plummer

Compromised

That is what I suspect. But is our ISP responsible or lies the problem with the user or is our site hacked ?

Kelli

Good question, and I'm not sure you're going to be able to get an answer without seeing the access logs from the other server. If the offending IPs aren't hitting any other pages, then I would guess that the issues likes on your client's end of things.

Plummer

Other pages

The offending IP's are looking at tickets of multiple users. I have been told that some network sniffer could be responsible for capturing the URL. Since only the web root is accessed and next the viewticket.html I suppose it is some bot that checks the validity of the email address in the package and sends it on to an email harvester.

peter

Is the offending IP accessing one or more tickets? And is it just specific to one user? If yes, then do you have any hyper links on the ticket thread?

Plummer

It is mulitiple user/domain related. The ticket threads do (usually) not contain hyperlinks other then attachments to the ticket (outside the web root). And the threads are not being spammed (thank God). But fact is that email addresses are being exposed. That is what worries me.

I know hyperlinks in a message can be followed by the web stat engine of other parties (where the hyperlink points to). That is why I usually do not enter hyperlinks. When I do so anyway (e.g. pointing to some documentation) it is only to a trusted party.

But you do have a strong point there...