Hack attacks on Apache port 80

[Vernon Brown_4]

I just upgraded from Apache 1.3.19 which was getting trojan hits about 3 times a week requiring reformat and restore from backups. Now with the upgrade I haven't been shut down yet ( 3 days ) but the attempts keep coming in. I've posted some sample records from my access_log at:
http://cabot-biz.com/samples
The hits are over 32 K and the exact size changes by about 2 bytes each hit. This resembles an old stack-overflow where they get a return address placed on the stack that goes to some execuitable.

Any ideas ?? Discussion ?? I've tried dig -x on the IP's but they're all different. Must be comming in through open proxy's.

[Steven E. Protter]

Vernon

Shut off apache.

Upgrade to the last apache release from apache.org 1.3.27

There are a number of security holes in the version you are using.

apache release in the 2.0.x series.

Its obvious that your IP address has been marked and shared by hackers. You should probably do a little investigative work and email the webhosts of those sites and warn them against keeping that information.

So I'd do the following:

1) Most current version of apache you can get your hands on. Its not that big.
2) Run apache in a chroot shell.

See this link. In a chroot shell, any apache hacks will not get root priviledges and therefore be totally harmless when and if they happen.

This is my search. One of these links will work. I'm converting my HP-UX apache server to chroot right now. They provide a script with the depots that makes it a snap.

SEP

[Vernon Brown_4]

Thanks Steven; I did get the latest Apache 1.3.29 and installed it. Works Ok; it seems to be withstanding the hack attacks. I'm wondering if anyone else is seeing these hits in their access_log.

I tried Apache2 but had trouble with the syntax of the proxy directory. It is ready to go as soon as I get the syntax right.

[Martin P.J. Zinser]

Hello Vernon,

I do get search / requests every now and then on my server, but since they are getting a 501 (server can not fulfill request) immediatly the hackers seem to be discouraged ;-)

This server is not running Apache (nor on Linux for that matter). Pretty much as soon as you open port 80 hackers will try to attack your server. I also get loads of requests for Windows vulnerabilities (which do not work either on this particular system ;-)

One thing you should make a habit is scanning your logs to see if anything unusual crops up.

Good luck,

Martin

[Vernon Brown_4]

Thanks; I hope others will start watching for that SEARCH./ srting. Maybe we can discourage the culpret or culprets.

Can't figure what they're after; I don't keep anything important on the server; it's just my gateway to the Internet.

[Stuart Browne]

Simply put, they aren't after you or anything on your box.

What they are after is a launching point to attack others without being tracked. That, and to cause nusience.

Welcome to the wonderful world of 'script kiddies' who do nothing other than cause a pain-in-the-ass for us hard working admins.

Your IP is probably listed on one of many many websites that list open-relays, or other exploitable things. After a week or two, the entry will go away, and these attacks will reduce, and maybe dissapear all together.

At one point, one of my office proxies was open to the world (mis-understanding on how closed off the virus scanner was), and got listed on such a site. Took us about 2 days to figure out what the hell was going on.

Tightened the firewall, and just watched the attempts slow, and then stop entirely.

[Vernon Brown_4]

Open proxy must be what started it. When I first installed the site I inadvertently left proxy open. Found out it was open; tightened it up; hacks started.

[Martin P.J. Zinser]

Hello Stuart,

interesting observation. I can not confirm that for my system. The script kiddies do not get anywhere there since several months and the number of hack attempts on the web server has not really gone down. Where I did see something similiar to what you report was with my SMTP server. This acted as an open relay for a couple of days due to a misconfiguration. After I tightend it up the number of attempts to misuse the server has gone down dramatically over time. On the other hand I also get every day a few attempts to access anonymous ftp on my system (which is disabled).

Greetings, Martin

[Stuart Browne]

I also get half a dozen attempts a day against my apache install here.

It comes with the territory or running a web-server.

You also get the RedAlert and other Win32 exploit attempts.

A guy at my office was bored one day so every machine that used a given exploit against his machine, he used the same exploit on the offending machine to shut the remote machine down. Personally I thought that was going a bit far, but I guess it stopped some hack attempts :P

You'll never stop these sort of attempts from occuring. You just have to be patched enough that they won't affect what you're trying to do.

A secure, stable system is the name of the game. And it is a game to some people! Don't ever beleive it's not.

You just have to be a step ahead of the game.

That's what buglists such as CERN and Bugtraq are about. You find out about the exploits and the fixes early so you can do something about it.

In this instance, you could possibly even use 'iptables' to drop packets destined for port 80 that are above a given size. Assuming you don't require POST's of large amounts of data, you could have been protected. It just means more work for your firewall. (NOTE: Never done it, don't know how to do it off the top of my head, but I'm sure it could be done!).

[Martin P.J. Zinser]

Hello Stuart,

never knew that CERN (as in www.cern.ch) did run a major bug database (althoug they certainly would have enough gear to test pretty much every possible bug ;-), or did you refer to CERT (as in www.cert.org)?

Cheers, Martin

[Stuart Browne]

Oops, my apologies. Easter holidays = brain fart :P Yes. CERT.

[U.SivaKumar_2 · Accepted solution]

Hi,

In my previous thread , i overlooked the possibility of windows based exploits trageting linux servers.
Sincere apologies...

The requests are caused by IIS WebDAV exploits targeting windows IIS servers. Worms like nachi uses this exploit.

Eventhough Apache is not affected by this exploit , continous requests can cause DoS killing httpd. These requests also will occupy your Internet bandwidth.

You can block the sources of the requests using iptables or use snort in reactive mode to block those connections.

regards,

U.SivaKumar.

[Vernon Brown_4]

Thanks for all the good info.

I'll look into trying to block with IpTables.

Vern

[Steven E. Protter]

I feel obligated to add, that I to see a dozen or so attempts to put hack my web servers, all of which do fail.

They fail for the following reasons:

1) I check the user list almost every day looking for new users that i didn't add.
2) I change the passwords of users that appear to be administrative. Sometimes people at the OS shop leave passwords blank or set the same as the username. It doesn't slow down root one bit using these accounts so with the acception of bin and adm, I set passwords.
3) I'm constant monitoring the access_log, the error_log,/var/log/messages,/var/log/maillog for suspicious stuff. I've turned up the logging level on everything, including iptables to the max I can tolerate looking at.
4) When I see the work of script kiddies i block via iptables. They key is access attempts that don't look like search engines. They try and run scripts like hostform.cgi without running the web page that loads that script. See next note.
5) Don't use common names for cgi scripts. The spammers that were bothering you before just picked common names like hostform.cgi and ran then, looking for standard names with fieldnames that can accommodate a few hundred email addersses.

Summary:
1) User accounts
2) Sendmail security
3) apache security(chroot pita, still working on that).
4) Eyeball patrol scanning the logs.


SEP

[Steven E. Protter]

See the lightbulb over my head?

I just thought of something as to how i cut down on hack attempts.

Since you are re-installing, go to iptables and turn off ping response. I think one of the reasons I don't get messed with so much any more is my machines don't respond to pings. If it doesn't answer, there can't be anything interesting there right?

-A INPUT -i eth0 -p icmp -m icmp --icmp-type 8 -j DROP
-A INPUT -i eth0 -p icmp -m icmp --icmp-type 11 -j DROP

Its cut down on my traffic a lot.

SEP

[Vernon Brown_4]

Thanks Steven; I'll disable ping.