0

I recently came across some log messages that indicated that someone was trying to compromise a website I manage.

They tried several times to access various url paths that end in /Telerik.Web.UI.DialogHandler.aspx

This page suggests that accessing that page may be used to compromise a site.

I don't use any telerik services in my site, but I'm still concerned that someone is trying to get access.

The client IP was 23.101.181.45, which I found to be a Microsoft server

My web app is hosted in the azure cloud, but I don't believe that this IP has anything to do with my service. My best guess is that this came from an unrelated Azure-hosted virtual machine.

My question is does this analysis seem valid, and should I do anything about this? I'm afraid of ignoring it.

Improve this question
2
  • 4
    Someone is checking if you have that Telerik thing installed. Do you? Better be sure it's up to date, assuming the vendor released a fix for the issue. Don't you? Then it's no problem that they're looking for it. That's really all there is to it.
    – Luc
    Commented May 5, 2020 at 19:56
  • 4
    Is Telerik the only thing that they seem to be trying to exploit? If it is, then I agree with Luc's analysis. It's probably just somebody scanning for Telerik servers. If they start probing for other frameworks, then that could cause more concern. But either way, keep whatever software/libraries you use up to date, use strong authentication, and set reasonable access rights.
    – Fire Quacker
    Commented May 5, 2020 at 20:15

2 Answers 2

Reset to default
4

Welcome to the internet.

This happens all the time. The last time I checked, it took around 20 minutes after connecting a server to a public IP address which had not been used for several months before someone started attacking it.

There is nothing you should do in direct response to these attempts. There are lots of things you should do when provisioning a server on the internet - the list is far too exhaustive to go through here. And simply reiterating that here is of little benefit. You need to understand what the risks are, and implement appropriate measures to mitigate them. Applying a whole lot of configuration and additional code/software you don't understand doesn't help much with security. Your biggest security wins come from knowledge, motivation and good patching practices.

OTOH a proportionate response for a server hosting 200 photos of your cat is different from a proportionate response for a host containing millions of users personal data and providing the livelihood of hundreds of staff.

The stuff you see in your logs will be almost exclusively attacks which failed. Proactively scanning your logs for signs of successful attacks is a good idea for high value assets, but well down the list of priorities.

Improve this answer
0

My question is does this analysis seem valid, and should I do anything about this? I'm afraid of ignoring it.

If you don't use Telerik components you can ignore this but it is a good thing that you are reading the logs. One thing you can do is report the attack to the IP block owner (= 'webhost'), in this case: Microsoft Corporation: ARIN link. Then maybe the client will get a slap on the wrist or their account will be terminated.

But this could become a full-time occupation: on average I witness thousands of attacks on my servers every day. It is automated attacks that may span the whole IPv4 space. So quite likely, you were not personally targeted. It probably is someone scanning a large IP range and exploiting whatever flaws they will find (fishing expedition).

It is very possible that the server in question was hacked (for example due to a weak SSH password) and is now used to hack other machines, and that the client is a legitimate person/entity who has no idea of what's going on...

I hope that your server has some defenses like a properly-configured firewall and an IDS of some sort, for example a fail2ban-like solution (I prefer CSF+LFD). Right now your SSH port may be under attack too, or whatever port is exposed to the Internet (IMAP, SMTP...). HTTP is not the only service that deserves attention.

It should be noted that many companies (or security researchers) probe the Internet en masse for legitimate research/statistical purposes, so a lot of probes may look malicious to the untrained eye but aren't.
In this particular case I am inclined to think this was a malicious attempt.

On the other hand, some research outfits (eg Shoddan) also scan for machines that are potentially vulnerable. If they find worrying results they might report on that with headlines like: "20% of IOT devices have a default password" or: "50% of IP cameras still running unpatched firmware". And you will read about it on specialized/mainstream sites about computing.

That still doesn't mean they were trying to hack into your server. They scratched the surface.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .