General security improvements and concerns regarding bin attack prevention.

Hi there,

I’ve recently been back and forth with E-way regarding security around bin attack prevention and Woocommerce EWAY Gateway and I have some general concerns relating to security that both E-Way and I seem to agree on. I’m posting this thread to start a conversation around security, recommend some of my own ideas on how I think security can be improved, and request some more info that can help us all craft some better solutions to improving security as a whole.

Firstly some context. We were recently contacted by EWay because they detected a range of bin attacks coming from one of the websites we manage. We already had Recaptcha v3 installed on our checkout and had some other server-level software in place to help mitigate these kinds of attacks but somehow they still got through. We decided to switch to a manual captcha and add 2 additional honeypot implementations yet somehow, bin attacks still seem to get through.

What I can tell is that I believe the checkout form itself is secure from bots but once a checkout session is created, the URL for the credit card form can be passed freely between different sessions and IP’s. You can reproduce this behavior by going to an EWAY Gateway Enabled Woocommerce site. Entering particulars to get to the credit card form and copying the URL. This URL can be passed to different browsers, different IP’s, even different countries, and the user can still complete the credit card purchase on behalf of someone else.

This means that a secure checkout could be completed by a real user and the credit card form could be passed to a bot to conduct the bin attack on a user’s behalf.

Now I understand that this plugin isn’t designed with checkout security in mind and that Recaptcha and Honey Pots aren’t really part of the package so you can’t guarantee compatibility. BUT I do know that EWay is telling the customers who are victims of these attacks to install Recaptcha and Honeypots on their checkout forms so I feel that adding some additional security checks here could serve a huge benefit to the plugin and it’s users.

Another idea is implementing Recaptcha or Honey Pots on the credit card form itself. I tried to investigate whether this idea is possible but I’m not sure. Correct me if I’m wrong but the credit card form connects directly to Eway using their “Eway Rapid” implementation so if the server is not handling these requests, I assume there’s no way to add additional validation to this form.

In summary I’m looking for
– Tighter security on the credit card form so that it can’t be transferred between different IP’s or sessions.
– An answer to the question “Can Recaptcha or honeypots be installed on the credit card form via validation hooks”.

Cheers and keep up the good work!