Abuse Complaint - where to look and for what to check?
Linux - SecurityThis forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.
Notices
Welcome to LinuxQuestions.org, a friendly and active Linux Community.
You are currently viewing LQ as a guest. By joining our community you will have the ability to post topics, receive our newsletter, use the advanced search, subscribe to threads and access many other special features. Registration is quick, simple and absolutely free. Join our community today!
Note that registered members see fewer ads, and ContentLink is completely disabled once you log in.
If you have any problems with the registration process or your account login, please contact us. If you need to reset your password, click here.
Having a problem logging in? Please visit this page to clear all LQ-related cookies.
Get a virtual cloud desktop with the Linux distro that you want in less than five minutes with Shells! With over 10 pre-installed distros to choose from, the worry-free installation life is here! Whether you are a digital nomad or just looking for flexibility, Shells can put your Linux machine on the device that you want to use.
Exclusive for LQ members, get up to 45% off per month. Click here for more info.
Abuse Complaint - where to look and for what to check?
hello,
i receive email from my provider. he complained that my server "scanned" the other one (in fact, provider of other server complained to my hosting provider).
they give me next report (ip addresses are hidden):
We have received the below report regarding an unauthorised activity
being carried out from an IP address that we have assigned to you.
Please investigate this report and take appropriate action, which should
be to find and fix the cause of the problem.
Please let us know when this activity has been stopped ASAP so we can
notify the parties which have reported this.
Failure to take action on this report within 24 hours may result in the
IP being taken offline until the problem can be resolved.
Below is original complaint we have received.
============================================================================
===
Dear Sir or Madam,
our monitoring system noticed a network scan (or network attack) from an
IP adress under your responsability.
Please take necessary actions to avoid this in future. Any feedback
would be appreciated. Please use the following link for your feedback: http://abuse.XXX.ey/statements/?toke...45gupo34o5gu4o
Important note:
When you reply to us, please leave the abuse ID [AbuseID:123456:1B]
unchanged in the subject line.
You should get this information only a few minutes after the incident.
All timestamps are in european local time
Can you fill us in on the system in question? You know, things like operating system and running software? At any rate, it might not be a bad idea to take this machine offline until you can investigate. I wouldn't turn it off if you haven't already, just pull the network cable or put up a firewall that keeps out everything except local access or SSH from a trusted IP address.
These look like possible bot floods. If Windows, I'd say check for a bot connected possibly to a C&C, if Linux, possibly the same thing but in a script. Web apps in use? Perl? PHP?
it's machine with online shop application written in php.
Here in the Linux Security forum we try to understand things beyond what is required for posting back one-liners. That means that if there is not enough information we ask questions. Given the questions asked you have got to be a lot more verbose than that. As root display and save to a text file and attach:
- OS and version ('\cat /etc/*release*; uname -a'),
- processes running ('\ps -axfwwwe'),
- open files ('\lsof -Pwnp'),
- network connections ('\netstat -antupe'),
- users connected ('\last; \lastlog'), plus
- web stack (webserver, PHP/Perl, database) versions,
- name and version of the shop application,
- last date the OS and components were updated,
- running services and services provided (system and web stack so don't forget any web or service panels or user-accessible URI's),
- measures in place ('cat /proc/net/ip_tables_names | xargs -iT iptables -vxnL --line-numbers -t 'T'; cat /etc/hosts.*'),
- any package manager you ran for integrity verification or tools like Tiger, Aide, Samhain, Chkrootkit, Rootkit Hunter, LSAT (do not install if not available already),
- check and run commands from the CERT Intruder Detection Checklist archived at at http://web.archive.org/web/200801092...checklist.html
Quote:
Originally Posted by proNick
first advice is useful, but i can not turn off network, because of shop application...
It may not be the case but if the machine may be compromised then your online shop may be compromised. That is not only bad for business but letting the situation exist unmitigated can harm other systems. So please keep the option open. In any case first respond to questions asked.
Is you "online shop application written in php" a home grown application or a well known, well trusted, well tested, off the shelf or open source application?
You may have a problem with cross-site scripting or HTML injection. Basically, someone uses a form that accepts input on your site to execute code that performs the actions.
You may have a problem with cross-site scripting or HTML injection. Basically, someone uses a form that accepts input on your site to execute code that performs the actions.
Unfortunately, until the OP posts back with some actual facts, any sort of diagnosis is going to be nothing but unadulterated speculation.
My advice is lock down the server. OR at the VERY least, install security software such as fail2ban (my personal favorite) and be sure that you have a strong password...
Just an FYI, if you are operating a shopping site that accepts credit cards (and I assume it is,) you can technically be held responsible for any unauthorized transaction that your user have faced... Just be careful, look at your logs (httpd,mysql,ssh) scan for questionable activities....
My advice is lock down the server. OR at the VERY least, install security software such as fail2ban (my personal favorite) and be sure that you have a strong password...
Unfortunately until the OP posts back details such "advice" is way too generic.
Well, that really isn't any surprise at all. Unless there is an investigation, odds are the original flaws get put right back in where they can be exploited by the same people all over again. However, in your case I suspect the original problem never got addressed in the first place.
Quote:
what will be your advice, what to do?
Re-read unSpawn's original post in this thread. Absolutely every single one of those questions still stands. Until you start providing this information, you'll only get useless advice.
Quote:
just to mention, last time provider closed incident by himself, because "they did not have enough information" from server that was attacked.
Well, the problem here isn't the server being attacked, but the server doing the attacking, and apparently that server is yours. In other words, unless you did something (and if you did you need to post details), then you're still looking at the original problem being in place.
Let me be clear.... There is no magic wand here. There is no super button you click to make it all better. You need to do some digging to see if your machine has been compromised and is being used outside of your control. You'll get help here, but you need to start providing some real information.
@ proNick -- In post #5 you were asked to provide a number of different data and outputs from files & commands on the machine in question. Please re-visit post #5 and consider all of the points mentioned, and provide the information requested; the log snippet you did provide does not tell folks anything much at all, certainly not enough to go about suggesting "what to do." short of wiping & reinstalling the entire system, updating every package to its latest release or security patch level, and configuring/hardening the system to make it as secure as possible, before putting it into active service again.
You've successfully 0wn3d a shopping application website and potentially have 100's of credit card numbers + other customer data. Why would you scan other servers knowing that it could tip off the actual owners of the webserver that you've p0wn3ed?
I have a good guess, but I'd like to see what others think of.
I respectfully ask LQ members to wait with discussing anything else until the OP has posted back the required information as not to disturb troubleshooting. If you can't wait please open your own thread and refer back to this one. TIA for understanding.
LinuxQuestions.org is looking for people interested in writing
Editorials, Articles, Reviews, and more. If you'd like to contribute
content, let us know.
