Webforms hacked

Request Type:

Bug Fix

Forums:

Author:

Amber Garrard

Issue/Request:

Hi,

It seems as though the webforms on the sustainability site were somehow hacked last night. We received almost 1000 emails notifying us that webforms had been filled out, presumably in error.

We received notification emails from the Citizen Science webform and the Celebrate SUstainability event submission form

https://sustainability.yale.edu/celebrate-sustainability-submit-event#ov…

Email content looks like this:

Your event has been registered as part of Celebrate Sustainability, October 8 - 12, 2018.

Please email emma.smith@yale.edu as soon as possible with any changes to your event.

Thank you,

Yale Office of Sustainability

Submitted on Thursday, October 25, 2018 - 11:17pm
Submitted values are:

First Name: oafuufhs
Last Name: oafuufhs
E-mail: sample@email.tst
Department/Unit: 1
Event Title: Mr.
Event Date: Friday October 12, 2018
Location: 1
Event Start Time: 1:00 am
Event End Time: 1:00 am
Event Description: 1
Community: Open to the Public
Focus:
- Academics & Research
- Commuting Sustainably
- Managing Materials
- Green Purchasing
- Reducing Paper Use
- Saving Energy
- Sustainable Food & Dining
- Conserving Water
- Promoting Wellness
Event Link/URL: 1
Additional Information: 1

The results of this submission may be viewed at:
https://sustainability.yale.edu/node/681/submission/868

You are now registered for the upcoming Citizen Science bird walk on Thursday November 3, 2016 from 12:00 - 1:00 pm departing from the Yale Peabody Museum of Natural History, 170 Whitney Avenue. Your submission details are below. Please visit our Citizen Science page for more information: http://sustainability.yale.edu/research-education/citizen-science

If you can no longer attend, please email sustainability@yale.edu as soon as possible.

Submitted on Thursday, October 25, 2018 - 11:23pm
Submitted by user: Anonymous
Submitted values are:

First Name: vrvgrpth
Last Name: vrvgrpth
E-mail: sample@email.tst
Department / Affiliation to Yale: 1
Title: 1
Campus Address / Home Address: 3137 Laguna Street
Do you require binoculars for the bird walk? No
Have you attended a bird walk before? No
Questions/Comments: 1

Thomas Hallihan on October 26, 2018:

Hey Amber,

It wasn’t in error. PoliSci got hit as did ISPS . I got 300 plus, ISPS got 200 plus and another affiliated site form sent 1,400 to the Provost.

Anyone that has forms on their site might want to check the forms to see if they should be behind CAS and/or, if outdated, maybe unpublish them.

Any other suggestions from the YaleSites team would be appreciated.

Thank you.

Thomas Hallihan on October 26, 2018:

InfoSec says Captcha should work to prevent this

https://www.ostraining.com/blog/drupal/captcha/

Vincent Massaro on October 26, 2018:

Hello, we are working on pushing out an update enables reCAPTCHA for any forms that do not have it set. That should fix the issue. I’ve gone ahead and update the impacted sites already so you shouldn’t see further spam submissions.