31 Dec
2013
31 Dec
'13
2:31 p.m.
Tuesday, December 31, 2013, 9:55:43 AM, Graham wrote:
Hi Graham,
On Tue, Dec 31, 2013 at 12:11 AM, Tony Andersson
<BitFolkList(a)tony-andersson.com> wrote:
>
> Have a strange attack happening to one of my domains, on the web
> server. It is a small privatish phpBB forum with nothing exciting,
> interesting or valuable going on at all. And it is the only one
> attacked out of a handful web sites on the server.
>
> The site has had a lot of incorrect requests to the server since
> before Christmas. I get POST requests in the region of two per second.
> There's noting in the post request and it is to the root of the
> domain. Like this:
> 184.57.181.141 - - [30/Dec/2013:23:32:24 +0000] "POST / HTTP/1.1" 301 -
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
> 108.205.136.80 - - [30/Dec/2013:23:32:25 +0000] "POST / HTTP/1.1" 301 -
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
> 68.118.233.245 - - [30/Dec/2013:23:32:25 +0000] "POST / HTTP/1.1" 301 -
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
> 173.51.226.12 - - [30/Dec/2013:23:32:25 +0000] "POST / HTTP/1.1" 301 -
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
> 71.10.0.254 - - [30/Dec/2013:23:32:27 +0000] "POST / HTTP/1.1" 301 -
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
> 75.91.250.137 - - [30/Dec/2013:23:32:29 +0000] "POST / HTTP/1.1" 301 -
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
> 108.200.239.239 - - [30/Dec/2013:23:32:31 +0000] "POST / HTTP/1.1" 301 -
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
> 64.40.129.122 - - [30/Dec/2013:23:32:31 +0000] "POST / HTTP/1.1" 301 -
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
> 128.210.19.134 - - [30/Dec/2013:23:32:32 +0000] "POST / HTTP/1.1" 301 -
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
> 12.51.89.194 - - [30/Dec/2013:23:32:33 +0000] "POST / HTTP/1.1" 301 -
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
> 184.57.181.141 - - [30/Dec/2013:23:32:35 +0000] "POST / HTTP/1.1" 301 -
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
> 208.96.191.152 - - [30/Dec/2013:23:32:35 +0000] "POST / HTTP/1.1" 301 -
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
> 70.190.134.120 - - [30/Dec/2013:23:32:37 +0000] "POST / HTTP/1.1" 301 -
"-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
Because it's only the phpBB site that's being
accessed in this way,
it's probably something phpBB-specific. It could be a mobile client
that does something unusual (although it's a strange user-agent string
for something legit), or a phpBB worm / mass hack. Previous phpBB
worms have searched google for phpBB specific urls / signatures and
then exploited them. I suggest that you post on a phpBB specific list,
as you're more likely to find people who know what it is.
Two requests/second isn't really a very effective
DOS attack against
most applications.
Good and valid points! And as I just wrote in reply to Andy, I think
the request looks strange because phpBB is redirecting the original
request, and that is not shown in the Apache access log. (Just like
you only see the 301 there now and noting else.) Fairly sure it is
from the new user registration module, which is completely disabled
now.
Reason for posting here first is that I see this list as a really good
source of experienced knowledge, and other places like the phpBB forum
a bit less so. (Had a problem with my phpBB upgrade and the responses
I got were on the lines of "Force a new installation on top of the old
one and don't worry about the failure of the upgrade process". Which
doesn't sit well with me. And here I am now: The authentication module
for new registrations stopped working for a week and now I have
multiple "attacks" per second compared to a couple per day before. :-P
> The 301 response is something I set up when I
discovered this. There
> should be no POST requests to /, so I do a 301 permanent redirect back
> to the client's own IP address. But that seems to have had no effect
> at all. The requests are still constantly coming in.
>
> I have set up a filter in fail2ban for anyone POSTing to '/' so they
> should be completely banned (using action 'iptables-allports'). But
> due to the sheer amount of different addresses attacking it seems to
> have little effect. Plus the fact I quite often see this in the
> fail2ban log:
> 2013-12-30 23:38:33,080 fail2ban.actions: WARNING [http-ddos] 37.142.202.18 already
banned
>
> So it seems that despite being banned they can still send a request to
> the Apache server? Not sure why, the iptables -L seems to list an
> awful lot of IP addresses and domain names. So the fail2ban filter is
> working as it should with setting up rules in iptables.
fail2ban works aynchronously; the ban rules only get
applied after the
requests appear in the logfiles and fail2ban processes them. So it's
almost certainly possible for several requests to be made from an IP
before fail2ban has a chance to block the IP for the first time. It
should be simple to look in the logs for the timestamps of the
requests and the ban attempt to work out what the sequence of events
was.
I did a scan of the logs, but at 2am I couldn't find anything that my
brain made sense of with regards to that. No two requests from the
same IP within a minute. But I am fairly happy now, 12 hours later and
the "IP already banned" entries have not increased in proportion in
the log, so it is a race condition of some kind, not a fail to ban by
fail2ban. ;-)
> At the same time, postfix is getting a large
amount of requests on
> port 25 too:
>
> Dec 30 23:54:45 bitfolk postfix/smtpd[14601]: connect from unknown[180.67.178.14]
> Dec 30 23:54:45 bitfolk postfix/smtpd[14071]: lost connection after UNKNOWN from
unknown[76.2.133.225]
> Dec 30 23:54:45 bitfolk postfix/smtpd[14071]: disconnect from unknown[76.2.133.225]
> Dec 30 23:54:48 bitfolk postfix/smtpd[27968]: connect from unknown[24.151.82.226]
> Dec 30 23:54:49 bitfolk postfix/smtpd[14107]: lost connection after UNKNOWN from
unknown[173.220.57.214]
> Dec 30 23:54:49 bitfolk postfix/smtpd[14107]: disconnect from
unknown[173.220.57.214]
> Dec 30 23:54:50 bitfolk postfix/smtpd[10196]: lost connection after UNKNOWN from
unknown[72.135.3.145]
> Dec 30 23:54:50 bitfolk postfix/smtpd[10196]: disconnect from unknown[72.135.3.145]
> Dec 30 23:54:50 bitfolk postfix/smtpd[10354]: lost connection after UNKNOWN from
unknown[173.246.215.147]
> Dec 30 23:54:50 bitfolk postfix/smtpd[10354]: disconnect from
unknown[173.246.215.147]
> Dec 30 23:54:51 bitfolk postfix/smtpd[14601]: lost connection after UNKNOWN from
unknown[180.67.178.14]
> Dec 30 23:54:51 bitfolk postfix/smtpd[14601]: disconnect from unknown[180.67.178.14]
>
> And in the mail.warn log:
>
> Dec 30 23:10:15 bitfolk postfix/smtpd[19391]: warning: non-SMTP command from
unknown[96.38.26.186]: UY:l??????????z??????\?
> Dec 30 23:11:22 bitfolk postfix/smtpd[17880]: warning: non-SMTP command from
unknown[181.67.172.79]: U:??[6?
> Dec 30 23:14:46 bitfolk postfix/smtpd[19522]: warning: non-SMTP command from
unknown[24.39.251.34]: @:??>T^R^?d???&U?V<??;W?p4?Gf#???t????,???E?
> Dec 30 23:16:57 bitfolk postfix/smtpd[24688]: warning: non-SMTP command from
unknown[72.181.54.101]: gu:?R?M????
>
> I can only conclude this is sent to the same domain name as is
> attacked on port 80...
Alternatively, it could just be the random scans and
probes that
everyone who runs services on the Internet gets.
The increase in connections and the garbage it sends has increased
from maybe a couple of connection attempts per minute to every second,
and at the same time as I first experienced issues with the phpBB
site, so I suspect it is a "broad spectrum attack".
> Now I am worried all this will consume up my
bandwidth allowance (as
> well as eating into system resources of course), and I have run out of ideas how
> to stop this. Any suggestions are most welcome!
The bandwidth consumption of these requests seems
tiny. Since they've
been going since Christmas they'll have shown up in your weekly data
transfer reports by now, if they were going to cause you a problem.
Thanks Graham, valuable input all of it! Most appreciated. I don't get
any weekly data transfer reports though. Not sure why. I remember in a
distant past getting them, but not for a long time. But Andy says the
bandwidth usage is not high.
Cheers,
__
/ony