Forum under attack?

Braumeisters.net announcements

Forum under attack?

Unread postby niels » Thu Dec 18, 2014 11:55 am

Hi all,

Two days ago I woke up and noticed that the forum was down. It looked like the MySQL service (database) went down. After a quick investigation I restarted the service and all was well again.

About an hour ago the same thing happened. Luckily I was awake and noticed the alert from the monitoring service and acted immediately.

When further investigating I noticed the CPU and network usage was high. I checked the network traffic and noticed a great amount of connections from the same IP (173.208.205.93). This IP seems to be part of a range assigned to WholeSale Internet.

I blocked the IP and the CPU/memory usage went down immediately. So I contacted WholeSale Internet, but I reached the answering machine. I left a message and will try again later during their business hours.

I will improve the monitoring services so I get alerts when suspicious activity happens, so I can react sooner. Hopefully it was a one time thing.

- Niels
User avatar
niels
Site Admin
 
Posts: 1058
Joined: Mon Dec 02, 2013 8:08 pm
Location: Belgium
Model: 50 litres

Re: Forum under attack?

Unread postby BrauTim » Thu Dec 18, 2014 2:49 pm

Random DoS ? Not sure why they would bother with a targeted attack against this kind of forum, unless they were attempting to steal the passwords from the database, but who knows why things happen on the internet nowadays, there could be any number of reasons we've not yet discovered.

If you do some digging you can see that there are ongoing DDoS against TOR networks (and have been for years) and some of those DNS relays are hosted by Wholesale Internet, so it's most likely to be something random.
To brew or not to brew, that would be a stupid question !
User avatar
BrauTim
 
Posts: 595
Joined: Sun Feb 02, 2014 1:03 pm
Location: England
Model: 50 litres

Re: Forum under attack?

Unread postby niels » Thu Dec 18, 2014 3:04 pm

All connection where made on the 443 port which is the SSL port. I still have to check the Apache logs, but it could be an attempt to "crack" the admin password to gain access to the administration panel.

Not sure yet, but I will look at it into detail during the weekend.

It's just waste of my precious time :(

- Niels
User avatar
niels
Site Admin
 
Posts: 1058
Joined: Mon Dec 02, 2013 8:08 pm
Location: Belgium
Model: 50 litres

Re: Forum under attack?

Unread postby dinnerstick » Thu Dec 18, 2014 3:36 pm

wow now i know how my girlfriend feels when i talk beer tech with fellow geeks!
User avatar
dinnerstick
 
Posts: 1015
Joined: Wed Jan 22, 2014 7:51 am
Location: Utrecht NL
Model: 20 litres

Re: Forum under attack?

Unread postby BrauTim » Thu Dec 18, 2014 4:09 pm

niels wrote:
It's just waste of my precious time :(

- Niels


Nothing worse than computers for wasting one's life! Gone are the utopian dreams of less work and more leisure time because computers will do all the work, computers have made the world more complex and made us all work harder, I'm not sure where the benefit really is.
To brew or not to brew, that would be a stupid question !
User avatar
BrauTim
 
Posts: 595
Joined: Sun Feb 02, 2014 1:03 pm
Location: England
Model: 50 litres

Re: Forum under attack?

Unread postby ibbones » Thu Dec 18, 2014 10:15 pm

dinnerstick wrote:wow now i know how my girlfriend feels when i talk beer tech with fellow geeks!

Ha ha...I was thinking the same thing.
"BONES"
20 Liter BM
ibbones
 
Posts: 283
Joined: Tue Mar 18, 2014 4:28 pm
Location: Victoria, Texas
Model: 20 litres


Return to Announcements

Who is online

Users browsing this forum: No registered users and 1 guest