73
votes
Should I respond to an "ethical hacker" who's requesting a bounty?
A true "ethical hacker" would tell you what issue (s)he found in your system, not ask money for that; (s)he could offer to fix it as a contractor, but that would be after telling you what ...
- 71.3k
64
votes
Accepted
Someone is trying to brute force SSH access to my server
Unfortuntately, this is absolutely normal and something every SSH server experiences. Welcome to the internet.
As long as you properly secure your server (e.g. keep it updated, allow only key-based ...
- 99.6k
58
votes
Should I respond to an "ethical hacker" who's requesting a bounty?
While this might be blackmail, there are many possibilities for genuine good intents, too. Therefore, here's some more comprehensive thoughts on how one might handle unsolicited vulnerability reports. ...
- 49.8k
44
votes
Weird SSH, Server security, I might have been hacked
The ClamAV signature for Unix.Trojan.Mirai-5607459-1 is definitely too broad, so it's likely a false positive, as noted by J Rock and cayleaf.
For example, any file that has all of the following ...
- 461
42
votes
Accepted
Potential hijacked SSH session & SSH best practices
The root logins are probably dangling shell sessions that once were you. Your server is also probably getting dDOS'd with all the attempted logins hammering it.
Lock down SSH. Don't allow root login, ...
- 7,136
32
votes
Accepted
Nginx 400 errors due to random encoded string starting with "\x" from random IP addresses
You are most likely seeing this because you are making an HTTPS request to an HTTP endpoint. For example, you're sending an HTTPS request to port 80 of your web server instead of 443. As a result, the ...
- 436
32
votes
Accepted
Weird SSH, Server security, I might have been hacked
Like J Rock, I think this is a false positive. I had the same experience.
I received an alarm from 6 different, disparate, geographically separated servers in a short time span. 4 of these servers ...
- 504
29
votes
Should I respond to an "ethical hacker" who's requesting a bounty?
It's not unusual for someone who discovers a security vulnerability to be paid a bounty for their discovery. A lot of prominent open source projects and web sites have policies of paying a bounty for ...
- 1,181
27
votes
Accepted
What can be learned about a user from a failed SSH attempt?
Well, an item that you haven’t mentioned is the fingerprints of the private keys they tried before entering a password. With openssh, if you set LogLevel VERBOSE in /etc/sshd_config, you get them in ...
- 841
22
votes
Someone is trying to brute force SSH access to my server
Block the IP using your firewall (iptables or whatever your service provides). Yes, they might change IPs, but make them do the work
If you have an external firewall (i.e. AWS console lets you set ...
- 846
17
votes
What can be learned about a user from a failed SSH attempt?
Going little bit further into the LogLevel DEBUG, you can also find out the client software/version in format
Client protocol version %d.%d; client software version %.100s
It will also print the key ...
- 10.1k
12
votes
Accepted
Apache 2.4 log PHP command 200 success, but what is it doing? POST /?q=die('z!a'.'x'); etc
This is a blind probe for PHP web application vulnerabilities. If you have a PHP web application which somehow executes code from untrusted input, from any of the query parameters given, then the ...
- 248k
12
votes
Should I respond to an "ethical hacker" who's requesting a bounty?
Yes, that is blackmail.
The responsible thing to do is to inform you privately. Perhaps with a disclosure policy of eventually going public if no response after some time.
A more polite way of doing ...
- 33.3k
10
votes
Security Wordpress on IIS hosted sites.
I followed this guide which works well
https://codex.wordpress.org/Hardening_WordPress
Couple things to keep in mind, if you are letting multiple users upload content to your site, make their own ...
- 9,588
10
votes
Someone is trying to brute force SSH access to my server
In addition to securing server as Sven points out, one of the best things to do (especially if ssh is therej ust for you, the admin) is just change sshd port away from default 22.
Not only is it ...
- 2,508
10
votes
Should I respond to an "ethical hacker" who's requesting a bounty?
@GlennWillen's comment hit the nail on the head:
Even if the "vulnerabilities" are real, you should not assume they are
useful unless you understand them in context yourself. For example, ...
- 211
8
votes
Stop China from connecting to my Google Compute Engine server
Here are the cloud shell commands to add the firewall rules:
gcloud compute firewall-rules create no-china-1 --description="Blocking these Chinese bots that want to rack up my network charges&...
- 195
7
votes
Someone is trying to brute force SSH access to my server
This pretty normal behavior. I get several thousand of those each day, and I assume even that is minuscule compared to what large companies face.
But do you need to worry?
Have you installed ...
- 138
7
votes
Second Site in a week on our Server hacked. How?
Keep your applications updated. This doesn't include just the core application itself, but every third-party plugin you use as well. Vulnerabilities are very frequently found and exploited in these ...
- 110k
7
votes
Should I respond to an "ethical hacker" who's requesting a bounty?
As someone working in information security and receiving quite a lot of such reports, a few comments:
if the hunter makes a payment a condition to reveal the vulnerability you should pass. This is ...
- 3,657
6
votes
Second Site in a week on our Server hacked. How?
Do what the attackers are doing and scan you customers for common popular and often exploited packages that are out of date/unmaintained by the site owners. Take those off-line before they cause ...
- 80.3k
6
votes
Weird SSH, Server security, I might have been hacked
This just showed up today for me as well in my ClamAV scan for /bin/busybox. I'm wondering if the updated database has an error.
- 61
6
votes
What can be learned about a user from a failed SSH attempt?
If the login attempts are very frequent or happen at all hours of the day, then you could suspect that the login is performed by a bot.
You might be able to deduce the user's habits from the time of ...
- 2,610
6
votes
Accepted
Someone just trying to hack me? login.cgi+wget
Your unwelcome visitor is not trying to hide his attempt to download and run some script on your server.
He may be expecting that, not only you have such login.cgi script in place, it is also not ...
- 9,783
5
votes
Accepted
Someone try to hack my server
First of all, don't panic. Check if any actual login has taken place.
If it has, panic.
If not, everything is still normal. There are many many machines out there trying to use common user/password ...
- 3,848
5
votes
Unknown IP trying to sign in to my phpmyadmin
Part of having a public-facing server is that massive number of infected machines are constantly trying a huge number of possible resources in the hope of exploiting something. They'll try a lot of ...
- 353
5
votes
Should I respond to an "ethical hacker" who's requesting a bounty?
Bug bounties work the other way round!
How do they work:
A service provider or software vendor announces "bug bounty program" beforehand.
A more or less ethical hacker finds a bug. They ...
- 624
4
votes
How safe is IPtables whitelisting?
When you set your default policy to DROP and ACCEPT only what you need, this is clearly more secure than allowing everything by default and selectively DROP unwanted traffic types.
This at least ...
- 36.9k
4
votes
Weird SSH, Server security, I might have been hacked
I tried to log in through SSH and it wouldn't accept my password. Root login is disabled so I went to rescue and turned root login on and was able to log in as root. As root, I tried to change the ...
- 870
4
votes
Accepted
MySQL hacked on AWS AMI: 'Pay to get data back' - how could this be possible and how to avoid it next time?
Security group rules show that you opened 3306 for everyone and it is dangerous.
Don't allow traffic to 3306 from everywhere.
Restrict 3306 access to known ip,s and better option is to restrict it ...
- 204
Only top scored, non community-wiki answers of a minimum length are eligible