1

I'm running Apache on my local windows machine and I've been having problems with what appears to be a hacking attempt. The requests for some reason actually seem to render my internet very slow [returns to normal when i shut off the webserver]. The access logs look a bit like this:

109.230.216.22 - - [15/May/2011:11:31:03 -0500] "GET /webdav/sip2.php?&IP=82.5.233 HTTP/1.1" 200 15 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
109.230.216.22 - - [15/May/2011:11:31:06 -0500] "GET /webdav/sip2.php?&IP=82.5.15 HTTP/1.1" 200 15 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
109.230.216.22 - - [15/May/2011:11:31:07 -0500] "GET /webdav/sip2.php?&IP=82.6.89 HTTP/1.1" 200 15 "-" "Opera/9.21 (Windows NT 5.1; U; en)"
109.230.216.22 - - [15/May/2011:11:31:07 -0500] "GET /webdav/sip2.php?&IP=82.6.198 HTTP/1.1" 200 15 "-" "Opera/9.21 (Windows NT 5.1; U; en)"

This has been going on for weeks. I've entered the offending IP in window's firewall for good measure, but primarily was trying to rely on the following in my httpd.conf file:

<Directory "C:/xampp/htdocs">

    Options Indexes FollowSymLinks Includes ExecCGI
    AllowOverride All

    Order deny,allow
    Deny from all
    Allow from MY.IP.ADDRESS.HERE

</Directory>

I gave it a quick test by SSHing to a remote server and trying to access a page via wget - and got a 403 response as expected. The request showed up in access.log also as a 403, as expected.

The unexpected part is the requests from 109.230.216.22 continue, unabated and are returning a status code of 200.

How do I block this thing?

1
  • Do you have an .htaccess file that might be messing with your Apache config? May 15, 2011 at 17:01

2 Answers 2

1

I assume you are using a device at the edge of your network to forward port 80 to your windows box. Create a firewall rule on that device and block it there, the Apache config isn't a good place to stop DOS attacks.

If you are sure this is a hack attempt I'd forward a complaint to your ISP's abuse department as well.

2
  • I'm using a belkin router to forward port 80, and while it has a firewall, oddly enough there doesn't seem to be a way to add/remove rules from it - so I'm not sure what it really does. I disabled the webdav extension (which I wasn't using) so at least now the attack doesn't cripple my connection when I'm running the server, but I don't understand why firewall + deny rules weren't enough
    – Erik
    May 15, 2011 at 17:01
  • I'm wondering that too, although even a deny takes bandwidth, so that's why you want to kill it at the edge of your network or have your ISP step in. Did you see my comment on the .htaccess file? Try removing AllowOverride and see if that changes anything. Can you post more on your Windows firewall rule? What version of Windows? May 15, 2011 at 17:19
0

The firewall rule may not been effective against an existing session. Although you added the rule to your firewall, the existing connection from the attacker may have still been in affect as it was established prior to the rule. Breaking the connection after placing the rule into affect would stop the attack situation.

To break the connection, you can just stop and restart the web service.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .