|
Every morning when I check my email I perfunctorily delete a
message containing the solitary word "done!". This is the result of a
simple perl script that I wrote for the express purpose of checking my
Raq server hosted at Datapipe. If the script emails me
"done" I know that all's well with my Raq; if I do not see a message
or if there is anything else in the message I know that something is
wrong. Last Tuesday was one of the few days when I did not see a
message.
Pinging the machine revealed that it was up and reachable. However,
I could not login in ssh nor contact the web server. I tried valiantly
for a while but soon realized that there was nothing I could do but
get it rebooted by the Datapipe support person. While that ws
happening I pondered on what could have caused the machine that had
been running for months to stop responding. An attack, perhaps?
As soon as the machine was up I connected with ssh and ran fcheck
to see if any of the important files had been modified. Nothing
suspicious there. A quick check of the servers showed that they were
all responding as expected. After starting top I returned to my other
work.
Every 10 minutes I glanced at the output of top. A few hours later
I could see that the number of httpd (apache) processes were
rising. Netstat showed more connections than usual. Alarmingly, the
swap space was approaching the limit. The idle time was
down. Uh-oh. The machine was thrashing. I copied the output of netstat
onto my local machine. I watched as the Raq was rapidly brought to its
knees. Top no longer updated the screen and the web servers were not
responding anymore. This time I was positive that I was under attack.
There was nothing I could do other than to call the Datapipe
support and get the machine rebooted. This time, as soon as the
machine was up, I stopped the apache web server. I had read the CERT
advisory about the 'chunk
encoding' vulnerability that had recently been
discovered. Fortunately, NT and FreeBSD were the platforms that the
vulnerability could give the attacker access to the machine. I got my
raq updated with a patch. After bringing up apache I monitored it for
a while. Nothing suspicious showed up the whole day. Nor the day
after. It's been more than a week hence and the machine is purring
away.
The output of netstat had given me a list of IP addresses that were
not reverse resolvable. However, with traceroute I could get determine
the rough region of the machine. They all turned out to be in
Korea. Some of them were academic institutions in that country. I have
not alerted any authorities nor have I seen anyone else complaining of
attcks from that quarter.
| 
