Distributed attack

Quote

Post by mkniskanen » Wed Mar 23, 2022 6:57 pm

There is a large, distributed attempt to get into the administration of OpenCart based sites. Our log files suddenly filled with POST like this

Code: Select all

xxxxxx.fi.log:185.148.3.93 - - [23/Mar/2022:03:31:51 +0200] "POST /admin/ HTTP/1.1" 200 1283 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0"
There were thousands, tens of thousands of them, coming from every corner of the world. What I did first was firewall the normal unwanted countries (RU,BY,BR,IN,ID,UA etc) off. That did not help a bit, there seemed to be not a single "clean" country. Then I added a Geo restricting code to /admin/index.php that simply checked the country and if that was not in Western Europe it would send header 403 and exit. The attack was so large, however, that I still kept going on and on and finally, I ended up restricting the access to our own country (plus Google and Bing) only, using iptables. Now there are only a few attempts per hour from servers in our country.

All IPs I have tested seem to be from Linux servers which is a bit worrying. In our case, the bombing has been directed to half-a-dozen of shops. Anybody else seen something like this?
mkniskanen
Newbie
Posts
3
Joined
Wed Dec 21, 2016 1:10 am
Top

Re: Distributed attack

Quote

Post by IP_CAM » Wed Mar 30, 2022 7:23 pm

Just to mention it, if one is looking for additional OC-Security, some related HTACCESS Code for Opencart can be found here:
https://github.com/IP-CAM/Opencart-Hard ... Code-Files

My Github OC Site: https://github.com/IP-CAM
5'200 + FREE OC Extensions, on the World's largest private Github OC Repository Archive Site.

User avatar
IP_CAM
Legendary Member
Posts
13012
Joined
Tue Mar 04, 2014 1:37 am
Location - Switzerland
Top

Re: Distributed attack

Quote

Post by johnp » Wed Mar 30, 2022 7:46 pm

These are my two goto add-ons:

Ninja Firewall
https://nintechnet.com/ninjafirewall/pro-edition

Cidram
https://github.com/CIDRAM/CIDRAM

Plus an admin security extension. Not perfect but pretty good. :)

Opencart 1.5.6.5/OC Bootstrap Pro/VQMOD lover, user and geek.
Affordable Service £££ - Opencart Installs, Fixing, Development and Upgrades
Plus Ecommerce, Marketing, Mailing List Management and More
FREE Guidance and Advice at https://www.ecommerce-help.co.uk

User avatar
johnp
Active Member
Posts
1255
Joined
Fri Mar 25, 2011 10:25 am
Location - Surrey, UK
Top

Re: Distributed attack

Quote

Post by Majnoon » Wed Nov 16, 2022 11:08 pm

johnp wrote: ↑
Wed Mar 30, 2022 7:46 pm
 These are my two goto add-ons:

Ninja Firewall
https://nintechnet.com/ninjafirewall/pro-edition

Cidram
https://github.com/CIDRAM/CIDRAM

Plus an admin security extension. Not perfect but pretty good. :)

I will give this shot
Majnoon
Active Member
Posts
212
Joined
Fri Feb 05, 2021 8:29 pm
Top

Re: Distributed attack

Quote

Post by HAO » Wed Jun 07, 2023 3:28 pm

johnp wrote: ↑
Wed Mar 30, 2022 7:46 pm
 These are my two goto add-ons:

Ninja Firewall
https://nintechnet.com/ninjafirewall/pro-edition

Cidram
https://github.com/CIDRAM/CIDRAM

Plus an admin security extension. Not perfect but pretty good. :)
How to install CIDRAM in OpenCart 2.3?

I have changed the admin directory name, I also added the following to my .htaccess file:

Code: Select all

RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{QUERY_STRING} ^$
RewriteRule ^admin/?$ http://%{REMOTE_ADDR}/ [R=301,L]
My VPS host is still slow, how can I block the IP addresses that malicious attempts to attack?
HAO
Active Member
Posts
280
Joined
Fri Jun 03, 2011 2:52 pm
Top

Re: Distributed attack

Quote

Post by JNeuhoff » Wed Jun 07, 2023 7:38 pm

This is a well known bruteforce attacker, see this forum thread for details and solutions on how to reject it.

Export/Import Tool * SpamBot Buster * Unused Images Manager * Instant Option Price Calculator * Number Option * Google Tag Manager * Survey Plus * OpenTwig

User avatar
JNeuhoff
Guru Member
Online
Posts
6740
Joined
Wed Dec 05, 2007 3:38 am
Top

Re: Distributed attack

Quote

Post by johnp » Wed Jun 07, 2023 8:57 pm

HAO wrote: ↑
Wed Jun 07, 2023 3:28 pm
johnp wrote: ↑
Wed Mar 30, 2022 7:46 pm
 These are my two goto add-ons:

Ninja Firewall
https://nintechnet.com/ninjafirewall/pro-edition

Cidram
https://github.com/CIDRAM/CIDRAM

Plus an admin security extension. Not perfect but pretty good. :)
How to install CIDRAM in OpenCart 2.3?

I have changed the admin directory name, I also added the following to my .htaccess file:

Code: Select all

RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{QUERY_STRING} ^$
RewriteRule ^admin/?$ http://%{REMOTE_ADDR}/ [R=301,L]
My VPS host is still slow, how can I block the IP addresses that malicious attempts to attack?
Follow the installation guide. You need to hook Cidram in to either the php.ini or user.ini file. Generally it's the php.ini file.

Opencart 1.5.6.5/OC Bootstrap Pro/VQMOD lover, user and geek.
Affordable Service £££ - Opencart Installs, Fixing, Development and Upgrades
Plus Ecommerce, Marketing, Mailing List Management and More
FREE Guidance and Advice at https://www.ecommerce-help.co.uk

User avatar
johnp
Active Member
Posts
1255
Joined
Fri Mar 25, 2011 10:25 am
Location - Surrey, UK
Top

Re: Distributed attack

Quote

Post by Majnoon » Tue Aug 22, 2023 4:10 pm

HAO wrote: ↑
Wed Jun 07, 2023 3:28 pm
 How to install CIDRAM in OpenCart 2.3?
You should follow this readme.md
https://github.com/CIDRAM/Docs/blob/master/readme.en.md

They do have plugin for Wordpress but not sure if opencart coumnity has time to built and manage this for its users.
Majnoon
Active Member
Posts
212
Joined
Fri Feb 05, 2021 8:29 pm
Top

Re: Distributed attack

Quote

Post by johnp » Tue Aug 22, 2023 4:33 pm

Majnoon wrote: ↑
Tue Aug 22, 2023 4:10 pm
HAO wrote: ↑
Wed Jun 07, 2023 3:28 pm
 How to install CIDRAM in OpenCart 2.3?
You should follow this readme.md
https://github.com/CIDRAM/Docs/blob/master/readme.en.md

They do have plugin for Wordpress but not sure if opencart coumnity has time to built and manage this for its users.
You don't really need a plugin. You can manually install Cidram in 5 minutes.

If you install Ninja Firewall that can be set to automatically block attacking IP addresses.

Opencart 1.5.6.5/OC Bootstrap Pro/VQMOD lover, user and geek.
Affordable Service £££ - Opencart Installs, Fixing, Development and Upgrades
Plus Ecommerce, Marketing, Mailing List Management and More
FREE Guidance and Advice at https://www.ecommerce-help.co.uk

User avatar
johnp
Active Member
Posts
1255
Joined
Fri Mar 25, 2011 10:25 am
Location - Surrey, UK
Top

Re: Distributed attack

Quote

Post by Majnoon » Wed Aug 23, 2023 4:54 pm

johnp wrote: ↑
Tue Aug 22, 2023 4:33 pm
 If you install Ninja Firewall that can be set to automatically block attacking IP addresses.
Do you want to create a fork and then add a Readme.md for specifically for opencart users?
Majnoon
Active Member
Posts
212
Joined
Fri Feb 05, 2021 8:29 pm
Top

Re: Distributed attack

Quote

Post by johnp » Wed Aug 23, 2023 9:47 pm

Majnoon wrote: ↑
Wed Aug 23, 2023 4:54 pm
johnp wrote: ↑
Tue Aug 22, 2023 4:33 pm
 If you install Ninja Firewall that can be set to automatically block attacking IP addresses.
Do you want to create a fork and then add a Readme.md for specifically for opencart users?
I'm too busy at the moment. I might post a guide article on my website though when I get time. Alternatively I can install it for the price of a bag of chips. :-)

Opencart 1.5.6.5/OC Bootstrap Pro/VQMOD lover, user and geek.
Affordable Service £££ - Opencart Installs, Fixing, Development and Upgrades
Plus Ecommerce, Marketing, Mailing List Management and More
FREE Guidance and Advice at https://www.ecommerce-help.co.uk

User avatar
johnp
Active Member
Posts
1255
Joined
Fri Mar 25, 2011 10:25 am
Location - Surrey, UK
Top

Re: Distributed attack

Quote

Post by Majnoon » Thu Aug 24, 2023 12:11 pm

johnp wrote: ↑
Wed Aug 23, 2023 9:47 pm
 I'm too busy at the moment. I might post a guide article on my website though when I get time. Alternatively I can install it for the price of a bag of chips. :-)
Its fine mate, i do have my own dedicated server with CSF and cloudflare etc setup i was only refferring the guide for the other OC users.
Majnoon
Active Member
Posts
212
Joined
Fri Feb 05, 2021 8:29 pm
Top

Re: Distributed attack

Quote

Post by johnp » Thu Aug 24, 2023 4:51 pm

Majnoon wrote: ↑
Thu Aug 24, 2023 12:11 pm
johnp wrote: ↑
Wed Aug 23, 2023 9:47 pm
 I'm too busy at the moment. I might post a guide article on my website though when I get time. Alternatively I can install it for the price of a bag of chips. :-)
Its fine mate, i do have my own dedicated server with CSF and cloudflare etc setup i was only refferring the guide for the other OC users.
No probs. I get that. Ninja Firewall has an install routine with integration instructions. It can be done in minutes by the average OC user. For me it's an essential line of defence on any OC site. It stops a lot of problems. :-)

Opencart 1.5.6.5/OC Bootstrap Pro/VQMOD lover, user and geek.
Affordable Service £££ - Opencart Installs, Fixing, Development and Upgrades
Plus Ecommerce, Marketing, Mailing List Management and More
FREE Guidance and Advice at https://www.ecommerce-help.co.uk

User avatar
johnp
Active Member
Posts
1255
Joined
Fri Mar 25, 2011 10:25 am
Location - Surrey, UK
Top

Re: Distributed attack

Quote

Post by HAO » Tue Sep 12, 2023 5:09 pm

johnp wrote: ↑
Thu Aug 24, 2023 4:51 pm
Majnoon wrote: ↑
Thu Aug 24, 2023 12:11 pm
johnp wrote: ↑
Wed Aug 23, 2023 9:47 pm
 I'm too busy at the moment. I might post a guide article on my website though when I get time. Alternatively I can install it for the price of a bag of chips. :-)
Its fine mate, i do have my own dedicated server with CSF and cloudflare etc setup i was only refferring the guide for the other OC users.
No probs. I get that. Ninja Firewall has an install routine with integration instructions. It can be done in minutes by the average OC user. For me it's an essential line of defence on any OC site. It stops a lot of problems. :-)
This is the installation instruction I saw:
========================================================================

To install a new copy of NinjaFirewall:

1. Create a new directory and upload all files from this package.
2. Goto http://YOUR_SITE/NEW_DIRECTORY/install.php
3. Follow the setup assistant.

========================================================================

To uninstall NinjaFirewall:

1. Remove any instructions added to your PHP INI and/or .htaccess
files during the installation process.
2. Delete all files from the NinjaFirewall folder.

========================================================================

This means I just unzip it on my PC and name it: NinjaFirewall, I only need to execute install.php in the browser to complete the installation?

http://YOUR_SITE/ninjafirewall/install.php?

Do I need to modify the OpenCart 2.3.0.2 original file?
HAO
Active Member
Posts
280
Joined
Fri Jun 03, 2011 2:52 pm
Top

Re: Distributed attack

Quote

Post by johnp » Tue Sep 12, 2023 11:03 pm

Correct. Unzip the file. Create a new folder on your server. I call the folder called "ninja". Upload the files from the unzipped file and run the Ninja firewall installer. You'll be asked to hook Ninja in but that's pretty straightforward.

Opencart 1.5.6.5/OC Bootstrap Pro/VQMOD lover, user and geek.
Affordable Service £££ - Opencart Installs, Fixing, Development and Upgrades
Plus Ecommerce, Marketing, Mailing List Management and More
FREE Guidance and Advice at https://www.ecommerce-help.co.uk

User avatar
johnp
Active Member
Posts
1255
Joined
Fri Mar 25, 2011 10:25 am
Location - Surrey, UK
Top
Post Reply
Return to “General Discussion”
Who is online

Users browsing this forum: No registered users and 49 guests