5

My server (Ubuntu + LAMP) is infected, as I receive security alerts from the sites attacked from my IP.

your Server/Customer with the IP: ********** has attacked one of our servers/partners. The attackers used the method/service: bruteforcelogin on: *Sat, ** *** 2015 17:15:17 +0200*. The time listed is from the server-time of the Blocklist-user who submitted the report. The attack was reported to the Blocklist.de-System on: *Sat, ** **** 2015 21:27:10 +0200*

Is there a tool or method to detect if I do an attack and to block outgoing connections to it ? Or receive at least an alert ?

  • I would be more concerned about kicking the intruder out from your system as to try and block the outgoing requests. – BadSkillz Jul 28 '15 at 11:48
  • @BadSkillz, Yes, I'm agree. But after a week without search results, I think it's better to block the connections at least. – Marin Bînzari Jul 28 '15 at 11:51
  • 1
    @SpartakusMd if you close the connection they might just open it again if they have access to your machine. – sir_k Jul 28 '15 at 11:54
  • 1
    @S.L.Barth, I removed many obfuscated scripts. Even FilesMan was found. Many script files which executed the code from $_POST. Now, Clam AV doesn't report anything, git is clear (it was added after the intrusion). – Marin Bînzari Jul 28 '15 at 14:19
  • 1
    @SpartakusMd - if you're using a clean git state as a way to ensure that code hasn't changed, I'd advise checking for commits that you don't recognize, and added/modified .gitignore files. Personally, I'm fairly sure I could hide malicious code in a way that a casual git inspection (especially a simple git status) won't reveal. – Ethan Kaminski Jul 29 '15 at 1:45
3

One way to mitigate this issue would be to implement egress filtering on your network. For example most web servers should have no requirement to make connections to the SSH ports of arbitrary hosts on the Internet, so if you block this traffic at the firewall your systems become less useful to attackers

Also this can help reduce the risk of compromise in the first place, as egress filtering can make establishing active control of your systems harder (not impossible, but it raises the bar a bit).

If you want to go down the detection route, a network intrusion detection system (e.g. snort) could be used to alert on unusual traffic patterns like brute-force attacks.

0

Fail2ban is an interesting tool for that. From the official wiki page 1:

Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits, etc. Generally Fail2Ban is then used to update firewall rules to reject the IP addresses for a specified amount of time, although any arbitrary other action (e.g. sending an email) could also be configured. Out of the box Fail2Ban comes with filters for various services (apache, courier, ssh, etc).

  • 2
    Fail2Ban is used to mitigate attacks on the server itself, not to prevent outgoing attacks. – BadSkillz Jul 28 '15 at 13:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.