We have experienced recent malicious credit card testing attacks against our Civi/Joomla/Stripe site's Contribute pages. How have others successfully deterred such attacks?
- CiviCRM 5.52.2
- Joomla! 3.10.11
- Stripe Processor 6.7.10
We use a publicly accessible Civi Contribute page for donations. Up until these attacks yesterday, Joomla login was not required for a user to submit a donation payment on this page. Ideally, we would like to remove the login requirement again to provide a seamless path to donation for non-members.
Our publicly accessible Civi Contribute donation page started receiving invalid $2 charge attempts at a frequency of ~1 charge per second. Stripe successfully identified these as spam and thankfully blocked every charge (10k+ individual charges).
The frequency of requests to the web server brought the site to a crawl. Accessing the web GUI for Civi and Joomla was nearly impossible. The database also spun up to consume 95% of our available CPU while attempting to handle the queries associated with each malicious charge attempt.
Using Stripe Radar and the Apache access logs, we determined that the attackers were using rotating IP addresses (many hundred per hour).
What we did (in order):
Blocked some of the recurring malicious IPs addresses using our firewall. This did not help, as the attacker just rotated IPs.
Added a reCAPTCHA to the Civi Contribute page. This did not have any effect on the attacks.
Blocked access to the Civi AJAX API using an Apache .htaccess RewriteRule. This stopped the invalid charges from reaching Stripe but also expectedly broke legitimate payment requests.
In the web GUI, modified the Joomla Access Control setting for "CiviCRM: access AJAX API" to only be allowed for logged-in Joomla users.
After blocking non-logged in users from submitting payments we continued to see attack requests at a high frequency for another 3 hours. All those requests were correctly returned a 403 or 500 error. The database took 3 hours to finish processing the queries for the malicious payment attempts.
How have others successfully deterred such attacks? What additional mitigation would folks recommend if want to remove the login requirement from the Contribute page?