0

This night my server got put in an "anti-hack" mode where I could only use a read-only FTP to download my data.

They told me that I was being a threat to the network, and that these were the logs that led to the alert:

Attack detail : 82Kpps/25Mbps
dateTime                   srcIp:srcPort           dstIp:dstPort           protocol flags       bytes reason
2016.04.24 03:04:13 CEST   MY_IP:44530     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:35962     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:18864     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:16468     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:2619      8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:62047     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:7871      8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:12277     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:8326      8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:20403     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:18801     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:19608     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:35276     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:43425     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:43856     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:41362     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:1385      8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:38576     8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:1623      8.8.8.8:53              TCP      RST            40 ATTACK:DNS
2016.04.24 03:04:13 CEST   MY_IP:54750     8.8.8.8:53              TCP      RST            40 ATTACK:DNS

Where MY_IP is obviously my server's IP address.

  1. What is it happening?
  2. Am I attacking someone?
  3. Am I getting attacked?
  4. Isn't 8.8.8.8 google's DNS?
3

This looks like your server is being used in a DNS amplification attack[1][2][3].

This means that your server is bombarding Google's DNS server with queries, so yes your server is being used to attack Google.

You are not being attacked, your server has been compromised and being used to attack someone else, in this case it looks like that it is Google.

8.8.8.8 is Google's publicly available DNS service

Is/was your server fully patched? Where all your ports locked down except the ones you need? Do you have any weak passwords?

  1. https://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack/
  2. http://whatis.techtarget.com/definition/DNS-amplification-attack
  3. https://en.wikipedia.org/wiki/Reflection_attack

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.