2

As a company, we have a rails application with an administration panel, using active admin gem. If the user has the admin role, then a link to administration page appears. Yesterday, someone got into the admin panel and changed a status to a project, as well as leaving a message. I went to the apache access log file and looked at the time the request was made. Interestingly, the ip that made the request was the company's IP. Does this mean that it's someone from inside the company?

As an additional information, if someone put the admin panel url directly on the browser, he isn't allowed to enter if he is not logged in as a user that has the admin role.

What are the possible cases?

5
  • It's a small company so we have one public static IP. That's the one that appears in the log files.
    – kiriakosv
    Nov 24, 2016 at 12:37
  • What I specifically mean is the company's router IP.
    – kiriakosv
    Nov 24, 2016 at 12:46
  • Have you checked the router configuration for a DMZ or remote configuration (i.e. by the WAN connection)? Routers are far from perfect, someone could bounce out of it. Hell, someone could use the router WAN as a gateway and some routers would still be happy to forward.
    – grochmal
    Nov 24, 2016 at 13:06
  • @grochmal So it is possible for our IP to appear in the log files even if the attacker is not connected to the network? Also, can this be used for session hijacking?
    – kiriakosv
    Nov 24, 2016 at 13:13
  • Does your app not record which user account made the change? Nov 25, 2016 at 6:54

1 Answer 1

2

With respect to the IP address logged in your apache log, there are a number of possibilities that do not necessarily indicate that it came from somewhere within your network.

Firstly, if an external attacker has complete control of your server, it is possible that they could fake the log entries. Secondly if an attacker has control of a local PC, they could use that to make it look like an internal attack. Finally how do you know who was on the local PC at the time?

Real attribution is hard, and as a result you will need more evidence to determine what really happened. If you have other network traffic logs that are time synced you could start to build up a picture of what was happening at the time of the attack.

1
  • I think that the second possibility is more probable. What's very weird is the fact that the attacker logged in as an administration user.
    – kiriakosv
    Nov 24, 2016 at 14:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .