DDOS attacks from amazon servers

Well today one of our client server had worst ddos attack against server main IP. While analyzing i found it is coming from amazon hacked servers. As amazon is offering free ec2 servers for 1 year so some of people don’t care about it after getting it as free. They do not use it and forget it after getting it. These servers are easy to get hacked and then can be used to attack other servers by hackers.

Here is the quick solution for linux centos 7 to deal with these attacks:

1. Access your server from ssh, you can use putty

2. Once you logged in with root access you have to install network monitoring tool, i found Trafshow tool very help full to see what IPs are attacking.

3. Install it with :

yum install trafshow -y

if you get nothing found error, just install epel-release repo by executing following command:

yum install epel-release -y

4. Once you install Trafshow, now you are ready to check incoming requests from IPs. Run following below command:

trafshow -i eth0 tcp

where eth0 is network card, you need to change it with your network interface. if you’re not sure about network interface, run following command:

ifconfig

It will return all the interfaces.

5. Once you run command trafshow -i eht0 tcp it will display all the connections with IPs. Here you can block them by various techniques. One is to add these IPs in config Server Firewall.

6. Here is the list of amazon IPs:

https://ip-ranges.amazonaws.com/ip-ranges.json

Read More

Check active connections to web server – DDOS solution

Here are few commands to check the active connection to apache or to any other web server, you can block IPs having too many connections :

Login to SSH and execute following commands with root access:

1.To see what IPs are connecting to server and how many connections exist from each IP:

netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

2.To see how many connections each IP on the server is receiving:

netstat -plan |grep :80 | awk '{print $4}' | cut -d: -f1 | sort | uniq -c | sort -n

3.Get total current active connections to Apache:

netstat -apn | grep :80 | wc -l

Get Apache status update from command line to see which domain is receiving maximum hits (cPanel/WHM server):

lynx http://localhost/whm-server-status

Read More

DDOS attacks on XMLRPC.php (Fixed)

wordpressXMLRPC.php is php file included with wordpress installation, it allows posting of content remotely through supported web blogs to wordpress blog, it provide many other features as well having many pros and cons. As far as web site security is concerned XMLRPC.php file is famous among hackers and attackers.

Most of the wordpress blogs get hits by attackers on XMLRPC.php usually called DDOS attacks. During the attack XMLRPC.php gets many requests and that makes web site goes down with excessive usage of allocated resources. Some web hosting providers suspend those accounts for high resource usage issues. Read More

Checking Bash Vulnerability and Fixing it

There has been a critical vulnerability found in Bash. The vulnerability affects Linux/Unix distributions that use or have Bash installed. For additional information on this vulnerability please visit the following link:

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-6271

We advise all our clients to keep their servers & software updated constantly to make sure their servers are at minimal risk of potential vulnerabilities. For this particular vulnerability we recommend reading the following links and taking action as soon as possible:

https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
https://access.redhat.com/articles/1200223

To test if your version of Bash is vulnerable, run the following command:

$ env x='() ; echo vulnerable' bash -c "echo this is a test"

If the output of the above command looks as follows:

vulnerable
this is a test

You are using a vulnerable version of Bash. The patch used to fix this issue ensures that no code is allowed after the end of a Bash function.

If you run the above example with the patched version of Bash, you should get an output verifying you are not vulnerable:

$ env x='() ; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test

To fix this issue just update your bash by following command:

yum update bash -y

Now check bash again:

$ env x='() ; echo vulnerable' bash -c "echo this is a test"

It should return :

bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test

OR

this is a test

Check your server for openDNS relay (DNS recursion)

You can check your dedicated/vps server for open dns relay by following below methods. It tells you if your server allows dns recursion or not. Follow these steps:

Login to your server via ssh with root login details

Execute following commands:

dig @yourServerIP google.com

if it returns ANSWER:0 that means there is no recursion allowed on the server. Otherwise recursion is allowed on the server.

I.E:

;; ->>HEADER<<- opcode: QUERY, status: REFUSED, id: 37803
;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

Above output shows NO RECURSION (ANSWER: 0)

libkeyutils.so.1: cannot open shared object file: no such file or directory on centos 6 x64 – Resolution

Today one of my VPS customer got following error : libkeyutils.so.1: cannot open shared object file: no such file or directory on centos 6

He was not able to login to SSH, SSHD server kept on denying with the message : connection to ssh refused.

While inspecting his VPS from node panel i came to know the server is hacked and hacker removed/changed libkeyutils.so.1 and libkeyutils.so.1.3 both are not present in lib64 directory, hacker just deleted them.
Please note these files are necessary files and are responsible for any connections inbound/outbound, so if they are not present or corrupted your server cannot connect to other computers.

Following is the solution to this issue :

Login to your main node (SSH), or your VPS by SSH console provided by your VPS provider.

Now go to /lib64 directory to check if libkeyutils.so.1 and libkeyutils.so.1.3 files are there or not. If files are there just delete them, the file libkeyutils.so.1 is symbolic link to libkeyutils.so.1.3 file. You should delete both of them by :

rm -f /lib64/libkeyutils.so.1 /lib64/libkeyutils.so.1.3

Now you would need to download RPM for libkeyutils.so.1 from centos web site:

wget ftp://ftp.muug.mb.ca/mirror/centos/6.4/os/x86_64/Packages/keyutils-libs-1.4-4.el6.x86_64.rpm

Please note, this is the step you might need assistance from your VPS provider, just ask them to place this RPM in your /lib64 directory as you cannot download it. Wget also does not work without libkeyutils.so.1 file.

Once the RPM package is downloaded, you would need to execute following command in lib64 directory:

rpm -ivh --replacefiles --replacepkgs keyutils-libs-1.4-4.el6.x86_64.rpm

This will replace package library files as well as other files, and now restart SSH by:

service sshd restart

and reboot your server:

reboot

Suggestion: Install config server firewall immediately once you get back the SSH access, your VPS will not get hack again, it takes only 2 minutes:

http://configserver.com/free/csf/install.txt