Flooding attack

[elMorvano]

Hey guys, few times a very bad guy is trying to crash our server:

14-04-01 09:27:00 Admin disconnected (93.114.43.179).
14-04-01 09:27:00 Admin disconnected (93.114.43.179).
14-04-01 09:27:00 Admin disconnected (93.114.43.179).
14-04-01 09:27:00 Admin disconnected (93.114.43.179).
14-04-01 09:27:00 Admin disconnected (93.114.43.179).

After server takes 98% of processor and its impossible to join.
Do you know this IP?
Do you know a way of protecting against this? Something another than iptables?

[Akinaro]

Its seems like random IP, looking at google I see that this ip show up few times as forum spam bot.
I had in my database only: 93.114.43.141 with nicks: Major, x-Aro-x, Jeben and few other majors.

Its "hole" in soldat security... For past few years I tried loots of things to block it... nothing.

[darDar]

14-04-01 09:27:00 Admin disconnected (93.114.43.179).
14-04-01 09:27:00 Admin disconnected (93.114.43.179).
14-04-01 09:27:00 Admin disconnected (93.114.43.179).
14-04-01 09:27:00 Admin disconnected (93.114.43.179).
14-04-01 09:27:00 Admin disconnected (93.114.43.179).

Since it says "Admin disconnected" this guy obviously has your admin login or port.
It would say Admin failed to connect else if im right. (?)
Change your adminlog or port and see if it is getting better. He is located in Romania.

install that to your machine:
fail2ban

[Bonecrusher]

http://nixcraft.com/showthread.php/1427-Iptables-block-ip-address

[Akinaro]

Since it says "Admin disconnected" this guy obviously has your admin login or port.
It would say Admin failed to connect else if im right. (?)
Change your adminlog or port and see if it is getting better. He is located in Romania.

Not it dont have logins.
There is app called [dont even think that I give you name] that... crash soldat servers, Its pain in the A$$ that almost everyone can use it. Its so simple that you need to just write [something] to crash it...

[elMorvano]

14-04-01 09:27:00 Admin disconnected (93.114.43.179).
14-04-01 09:27:00 Admin disconnected (93.114.43.179).
14-04-01 09:27:00 Admin disconnected (93.114.43.179).
14-04-01 09:27:00 Admin disconnected (93.114.43.179).
14-04-01 09:27:00 Admin disconnected (93.114.43.179).

Since it says "Admin disconnected" this guy obviously has your admin login or port.
It would say Admin failed to connect else if im right. (?)
Change your adminlog or port and see if it is getting better. He is located in Romania.

install that to your machine:
fail2ban

15:57:06) Admin failed to connect (x.x.x.x).
(15:57:07) Admin disconnected (x.x.x.x).
When I tried to connect with bad PW

[skrX]

bug?

[Xestor]

isnt it called a DDoS?

[Akinaro]

DDoS (Distributed Denial of Service) attacks are sent by two or more persons, or bots.

[elMorvano]

(19:43:52) Admin failed to connect (79.141.166.25).
(19:43:52) Admin failed to connect (79.141.166.25).
(19:43:52) Admin failed to connect (79.141.166.25).



Someone tried to login and i checked processor : 98%. After i turned off server and turned on again. It shows:

14-04-01 13:59:12 Admin disconnected (79.141.166.25).
14-04-01 13:59:12 Admin disconnected (79.141.166.25).
14-04-01 13:59:12 Admin disconnected (79.141.166.25).
14-04-01 13:59:12 Admin disconnected (79.141.166.25).

I changed my adminlog to 'very hard' version. Very strange... I also changed pw to my VPS.

[Akinaro]

changing pass doesn't help here, this app that crash servers use just ip of you server, its dont need anything else, thats why its so damn hard to block it, especially if attacker can change ip.

[elMorvano]

Yeah but it shows like he knows my password btw what about change AdminPassword='' - without password nobody can join as admin?

btw. Probably this attacker read this topic, because I didn't block previous IP and he changed this anyway. He attacked before always with same IP.

[Akinaro]

its not that he trying to log as an admin, this app is for crashing server using security bug in soldat, that send more than 10 fake admin login request to server. such massive amount of logins to one port create huge lags that crash your server

I had this few time, I even have this app, trying to find solution for this and nothing. only blocking IP can help, but only for one IP... if attacker can change his address... you can only wait until he get bored...

[elMorvano]

4th IP attacked us Hosting: Kaia and voxility

[Shoozza]

I didn't see that kind of flood attack yet though, thanks for sharing!

I hope we will find time to improve the flooding protection after 1.6.7.

[Szaman]

I didn't see that kind of flood attack yet though, thanks for sharing!

I hope we will find time to improve the flooding protection after 1.6.7.

Yeah...
http://bugs.soldat.pl/view.php?id=487 (reported in december 2013...)

[dominikkk26]

I do not know Did I I'm doing that I write this unto you but you can yes block servers using two programs known to me:
- *****
- *****

------
Delete post

[dominikkk26]

If you want to have to change yourself's security port or ip and the best name to a hacker he could not find it so quickly.

[Szaman]

Yeah... great solution Maybe let secure server by turning it off ?

[Bonecrusher]

Just direct all your troubles to your host, he should be able to sort it out in no time.