Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

When you have just detected your website is currently under a hack attack that is attempting to penetrate your website, I am not including Denial of service in my question, what do you do? Are there best practice guidelines to follow?

I have found many posts about what you do after a hack, but what do you do when you are under attack does not seem clear.

I am primarily talking about IIS and ASP.net sites, but the question is relevant to all internet facing sites.

Assume that the site is behind a firewall and all requests and info are logged.

My Thoughts are:

  1. Check the logs, get the client IP and block them on the firewall
  2. If this is not slowing down or stopping the attacker/s, ie a coordinated attack with several attackers, take the site and server offline for a temporary amount of time

Is there any other recommended action or best practice?

share|improve this question
add comment

3 Answers

When you're under attack there isn't a whole lot you can do, other than try and block the origins of the attack, which is usually quite futile, as they are a moving target. Such attacks are normally done using compromised systems, numbering anywhere from a few thousand to many millions. Blocking them is like killing flies in summer - for every one you stop there are numerous others to take its place.

Life's too short to go through web logs unless you're looking for something pretty specific. You can however try and block the attack strings in the URLs or restrict access to things like logon or other potentially vulnerable pages. Once that is done your time is best spent ensuring you have a a reliable backup ready and hope the attack fails.

One of my sites has been under attack for about the last 3 or 4 weeks. It's a simple attempted logon attack, using distributed systems. The attack itself was doomed to failure from the start, as my sites don't have the default logon account. However, to ease the load on the web server a little any attempt to reach the logon page from an IP address other than my home now results in a 404 error. I can't stop the attack but I can make it ineffective.

share|improve this answer
add comment

In case of a single source (or limited number of sources) identify the source addresses and block them on the firewall. In case of a distributed attack contact your ISP. Taking the website offline can be a temporary countermeasure to mitigate immediate threats until a vulnerability is fixed, but it certainly isn't a permanent solution.

Depending on the type of attack you may even ignore it in some situations, e.g. when your web application is behind a web application firewall (like ModSecurity) that will only allow known-good traffic. In case of password-guessing runs rate-limiting connections per source address may be effective.

share|improve this answer
add comment

First of all - grab yourself a large piece of paper and some pens - take notes on everything that catches your eyes, every action you take. If possible, record your screen

-> You will do many changes, some of which will need to get to be rolled back. -> You will be in the need to prove you are not responsible for the failures, perhaps there will be legal cases involved lateron

Second: Don't panic - think twice before taking any actions - grab hold of any coworker that is around and discuss the actions

Third: collect any kind of data, search through it and rethink before taking actions. Try to block the IP, network, user, etc.

Taking down the server is always a last resort.

If the attack seems to grow bigger, think about calling for external help (e.g. CERT of your provider)

Last: When the attack is over, check any data you have, identify the security problems that enabled the attack and FIX THEM!!!

tsg

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.