15

Just this week someone has been trying to attack the server of the company where I work. I have noticed that they have been trying to brute force root via ssh. fail2ban is handling that well and I never allowed password logins for root in the first place so that's not really a problem but they have been after our website too.

We use the Laravel PHP framework which has some pretty verbose errors. They must have at least found a full path disclosure hole by now. I have inspected the mod_security logs and it seems that they are just running a security scanner on us. They have been trying a bunch of exploits for software we don't actually have installed. Anyway, they have been at if for almost a week now and I'm beginning to become worried.

What is the best thing to do right now? The attacks are not that sophisticated but are attacks none the less. How do I convince my boss and coworkers that whatever actions we have to take are necessary?

  • 1
    Are they coming from multiple IP addresses, or one consistent IP? – David Mar 16 '14 at 19:13
  • They are coming from multiple IPs from China. I think they're proxies. – 735Tesla Mar 16 '14 at 19:49
  • 2
    Ok interesting addition: after some googling I discovered that some of the addresses are of zombies part of a botnet – 735Tesla Mar 16 '14 at 22:38
  • Can you stand up an NDIS appliance in front of your site, or configure your router to block the IPs that attempt to scan it? If the bots can't get to it at all, the bot-herder might give up. – John Deters Mar 16 '14 at 23:46
  • Well the problem is not that I actually fear a breach. So far mod_security has blocked everything and I made it so errors don't display any data. An NDIS appliance would be a good idea but I don't think the attacker is a huge threat at the moment. mod_security and fail2ban are doing their jobs pretty well. My question is more whether it should be temporarily taken offline or if there is something I should do to analyze the log files other than just reading them. Thanks for the suggestion though. – 735Tesla Mar 16 '14 at 23:49
7

Your best bet is to install a web application firewall like mod_security and apply rules to nip this in the butt. Apply Duo Security, to disallow unvalidated sudo commands from a compromised account.

fr00yl00p says:

  • Configure the system to alert you upon logins (e.g. per mail in sshrc and bashrc)

This becomes too cumbersome and complex if you have systems that perform maintenance, e,g, SNMPv3, any kind of rsync accounts, etc. A better mechanism would be an alias of the last command written to terminal whenever you log in. Duo will stop a lot so check it out.

fr00yl00p says:

Let your firewall drop connections with obvious attack patterns. (e.g. http://spamcleaner.org/en/misc/w00tw00t.html)

This is not a feasible mechanism and you'd have to create a whitelist in parallel. Consider the fact that I can spoof connections pretending to be anyone. Imagine I generate enough spoofed messages to simulate say a CIDR /16, /8, or even /2.

fr00yl00p says:

Install PHPIDS (https://phpids.org/)

Unless you're willing to become an incident response analyst, you will be wasting so much time chasing false positives, you'll eventually ignore the alerts from IDS' and IPS' even well trained DFIR people spent hours at a time constantly modifying. Let alone someone who isn't accustomed to using an IDS, nor interpreting its output.

As for other recommendations, you need not block entire ranges for a webserver if you configure a WAF properly. On one of my sites, I PURPOSEFULLY keep Joomla 1.5 running and worry nothing about compromises since my WAF is written to only allow a POST from my static address. Its simplicity at its finest. My website is designed ONLY to allow GETs not POSTs so there is no need to go bezerk on rules.

You need to also be cognizant, that much traffic is generated by infected machines, so you're not stopping or blocking an attacker per-se, you're blocking one infected machine. So I wouldn't go as far as blocking entire IP blocks to a webpage. Mailserver, ssh server sure. In fact, you should have a default "BLOCK ALL" to your webserver, ONLY allowing your address to services such as SSH. However, everyone's designs/needs differ

  • Thanks for the recommendation. I disabled password authentication for ssh completely would you still recumbent blocking addresses? – 735Tesla Mar 17 '14 at 20:40
  • It all depends on your level of security, and what you need to do. I wouldn't block connections to HTTP, but would block ALL to SSH allowing only in my addresses – munkeyoto Mar 18 '14 at 16:48
  • I think you misunderstood the "Let your firewall drop connections" part. The linked site is worth reading ;-) and yes, never go without mod_security. Very good point. – fr00tyl00p Mar 19 '14 at 1:21
3
1

Put the SSH behind the a firewall and require a VPN to access the box -- that cuts off one major attack vector and probably makes it trickier to exploit any application level penetration.

0

I would at least talk with your hosting company. They may have some ways to help, such as by blocking IP address ranges before they can reach you, perhaps they can also set you up with other defense layers.

  • We're hosting it ourselves and blocking as many as we can. They are using socks proxies. – 735Tesla Mar 17 '14 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.