4

I have a problem that has been going on for at least 6 weeks.

I have Time Warner for my Internet provider and some websites hosted at GoDaddy.

From what GoDaddy tells me the reason I can not view my websites from home office and can't connect to their FTP server is because of a brute force attack on their FTP server originating from my IP address. I had my ISP change my IP address and within 15 minutes GoDaddy had blocked me again because their FTP server was still getting the brute force attack traffic from my new IP address.

I figured it was a problem with GoDaddy, so I set up a new hosting account with 1and1.com but after 4 hours they were blocking my IP address as well because they say they saw too many failed login attempts, just as GoDaddy had.

So, I did a complete shutdown of all my equipment (2 times) for 8 hours overnight, and even unplugged the cable from the cable modem and they still claim that they're seeing the attack traffic coming from my IP address. Neither Time Warner (my ISP) or GoDaddy seem to be able to help me fix this problem. I have run AVG, Malwarebytes, and Rootkit, but nothing has been found. GoDaddy had me send a WireShark trace and they did not see anything, but they can not look at the packets hitting their FTP server because of the volume. I am at the highest level of support at GoDaddy, Time Warner and 1and1.com, but they are are baffled and keep blaming my machine even when I've had it shut down.

I would appreciate any help, as I am about to give up building websites because of this.

|improve this question
  • 2
    Are you sure that they were still getting attacks while your cable modem was unplugged? If so, then it may be that you have a virus that sent your IP address out somewhere and then someone was spoofing traffic from you if they were connecting with a UDP protocol, but the most likely event is that something on your network is compromised unless you've done something in particular to draw the direct wrath of a moderately competent attacker. – AJ Henderson Apr 26 '13 at 21:11
  • @AJHenderson Your first scenario doesn't make sense. FTP runs over TCP, so it was clearly not a spoofed attack. He specified "bruteforce attack against an FTP", so the attacker is making a full TCP connection with the server. It's definitely something relating to a device on his network. – Anorov Apr 26 '13 at 22:21
  • @Anorov - I know that FTP runs on TCP, but the poster also said that the attack was continuing even when the modem was unplugged. My point is that something about the story doesn't add up. Either it wasn't still being attacked with the modem unplugged or the bruteforce on FTP login was not the reason for the block (which could be something UDP related). – AJ Henderson Apr 26 '13 at 23:58
  • I am not sure about anything anymore. TW was not sure about time stamp since there is a 2 hour difference. My login name is being used in the attack logs but not my password so they are not in. My cpu is acting funny now so a format is in order. The really strange thing is I left 3 websites on godaddys server and did not edit the dns to move to 1and1.com. When I do a tracert on them they go to 1and1.com's server! When I do a tracert from a friends house it goes to godaddy like it should. Any ideas? dns at gd's controll pannel piont to GD. Stumped – gary Apr 27 '13 at 0:14
  • you almost certainly have a virus on your computer. Or somewhere on your network. That's the only way that the attacker would get your new hosting information so quickly. He's watching you use it. And no, and anti-virus probably won't catch it. – tylerl Jul 26 '13 at 23:16
6

First and foremost FTP is very insecure and must never be used for authenticated file access. It is in your best interest to never use ftp and always use SFTP or FTPS. If a service provider only offers FTP, use a service provider that actually cares about their customers.

Malware will attack FTP by sniffing the network looking for authentication requests and use this spread by infecting .html or or web application files. Its is likely that your machine or another machine on your network is infected and carrying out attacks using your connection.

|improve this answer
  • I hope that is what it is. Just reset my ipad to factory and have 2 laptops and 3 computers to wipe out. I just don't trust virus scans anymore, seems bad things just reappear. – gary Apr 27 '13 at 0:18
  • Might be someone local, this website business is cutthroat sometimes. How can I find out where this is coming from? I was told by TW that if GD could look at the packets hitting their server with incorrect login they might figure out where it is coming from. will the packet at the other end tell me anything? – gary Apr 27 '13 at 0:32
  • Ok I am spending to much time on this, first person to solve this problem I will send a $100 gift card to. Just let me know what you need to look at or do to assist. – gary Apr 27 '13 at 11:02
2

When you pulled all devices physically, was your phone-line or wifi-router (whichever you use) offline too? If you did and your old (and later new) IP was active while you weren't online in any way, your description "could" fit a MITM (Man In The Middle) attack originating from (eg) a neighbor who's physically "tapping the wire".

|improve this answer
0

The best advice I could give is to leave everything online and Internet-connected, and have Wireshark running on all of your devices for a good many hours. Then do a search for packets that have the IP addresses of the FTP servers as source or destination address.

How many devices are on your network? It sounds like you properly cleared your own computer, but what about other things? Laptops, tablets, phones?

|improve this answer
  • You know seems every time I run malwarebytes it finds something so I am just going to do a good format. My biggest concern is it is happening at 1and1.com now and am afraid there is code in my html pages that might be doing something now. I don't want to manually go through 1000+ pages of code and try to find this thing. Is there a html scaanning software I can use? Godaddy says there security department ran a scan and came out clean and I ran one myself but have never scanned html code. – gary Apr 27 '13 at 0:16
0

If it's something on your local machine, you might be able to find it by opening a command prompt and issuing:

netstat -ABN

Look for a process that is communicating to your provider over port 21.

|improve this answer
0

A cheap network tap and a spare laptop with wireshark should let you pinpoint exactly where the traffic is coming from.

Move the tap around you network using wireshark and a filter for port 21 and you should be able to isolate the exact internal IP tand therefore device the traffic is coming from.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.