{"id":7731,"date":"2016-04-15T11:50:29","date_gmt":"2016-04-15T15:50:29","guid":{"rendered":"https:\/\/spinor.info\/weblog\/?p=7731"},"modified":"2016-04-15T11:50:29","modified_gmt":"2016-04-15T15:50:29","slug":"bleeping-script-kiddies","status":"publish","type":"post","link":"https:\/\/spinor.info\/weblog\/?p=7731","title":{"rendered":"Bleeping script kiddies"},"content":{"rendered":"

Not for the first time, one of my Joomla! sites was attacked by a script kiddie using a botnet.<\/p>\n

The attack is a primitive brute force attack, trying to guess the administrator password of the site.<\/p>\n

The frustrating thing is that the kiddie uses a botnet, accessing the site from several hundred remote computers at once.<\/p>\n

A standard, run-of-the-mill defense mechanism that I installed works, as it counts failed password attempts and blocks the offending IP address after a predetermined number of consecutive failures.<\/p>\n

Unfortunately, it all consumes significant resources. The Joomla! system wakes up, consults the MySQL database, renders the login page and then later, the rejection page from PHP… when several hundred such requests arrive simultaneously, they bring my little server to its knees.<\/p>\n

\"\"<\/p>\n

I tried as a solution a network-level block on the offending IP addresses, but\u00a0there were just too many: the requests kept coming, and I became concerned that I’d have an excessively large kernel table that might break the server in other ways.<\/p>\n

So now I implemented something I’ve been meaning to do for some time: ensuring that administrative content is only accessible from my internal network. Anyone accessing it from the outside just gets a static error page, which\u00a0can be sent with minimal resource consumption.<\/p>\n

Now my server is happy. If only I didn’t need to waste several hours of an otherwise fine morning because of this nonsense. I swear, one of these days I’ll find one of these script kiddies in person and break his nose or something.<\/p>\n<\/fb:like>","protected":false},"excerpt":{"rendered":"

Not for the first time, one of my Joomla! sites was attacked by a script kiddie using a botnet. The attack is a primitive brute force attack, trying to guess the administrator password of the site. The frustrating thing is that the kiddie uses a botnet, accessing the site from several hundred remote computers at […]<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[51,6,35],"tags":[],"class_list":["post-7731","post","type-post","status-publish","format-standard","hentry","category-computer-security","category-internet","category-personal","category-51-id","category-6-id","category-35-id","post-seq-1","post-parity-odd","meta-position-corners","fix"],"_links":{"self":[{"href":"https:\/\/spinor.info\/weblog\/index.php?rest_route=\/wp\/v2\/posts\/7731","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/spinor.info\/weblog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/spinor.info\/weblog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/spinor.info\/weblog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/spinor.info\/weblog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7731"}],"version-history":[{"count":1,"href":"https:\/\/spinor.info\/weblog\/index.php?rest_route=\/wp\/v2\/posts\/7731\/revisions"}],"predecessor-version":[{"id":7733,"href":"https:\/\/spinor.info\/weblog\/index.php?rest_route=\/wp\/v2\/posts\/7731\/revisions\/7733"}],"wp:attachment":[{"href":"https:\/\/spinor.info\/weblog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7731"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/spinor.info\/weblog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7731"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/spinor.info\/weblog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7731"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}