Website Under Attack

[THERADIOTUBBY]

Not sure how much info to put here

Running school website on iis on server 2003 - wwwdotsaccdotnottsdotschdotuk - only port 80 mapped through firewall

Website html with some asp, also runs moodle and sql forum

Tuesday this week notice all internet for school very slow- router pings very high.

Turns out webserver receiving massive traffic all to homepage - default.asp - literally millions of hits per day

iis log (massive) all of the form

2009-01-30 18:54:56 W3SVC1 WEBSITE 10.60.208.31 GET /Default.asp - 80 - 85.229.218.177 HTTP/1.0 - - - - 200 0 64 0 39 181

hits coming from paraguay, sweden, mexico etc

Learning about attacks very quickly.

Has anyone any advice?

Server currently offline will turn back on if needed

[kmount]

First of all, check whether it's infected by some kind of virus/malware which is attracting the hits.

Secondly, filter the list and obtain a list of IPs to send to your ISP for blocking at their end (useless blocking them at your end as you only have a small pipe and it will still be saturated).

You should be fine after that.

[PiqueABoo]

Secondly, filter the list and obtain a list of IPs to send to your ISP for blocking at their end

If that isn't small I'd get the ISP to blackhole all traffic aimed at the web-server IP for a while.. figure out whether there is anything wrong locally and if not (or when fixed) get the web server moved to another address.

[THERADIOTUBBY]

When reconnected after a day everything ok - thought i'd fixed it - until a fixed time when all attacks started again

Points to something on server attracting them

Looked at port activity, ran virus scans to no avail

Any ideas?

[danIT]

Which version of Moodle are you using?

Check you Moodle directory for any files which shouldnt be there, specifically look for any .php files which have been changed recently, or any files which were .html/.htm which are now .php

[THERADIOTUBBY]

moodle vers 1.914

[danIT]

Have you found any new php files, are files edited recently?

I would suggest deleting your moodle install directory, save config.php before doing this, then stick a fresh copy of moodle in its place and add your config.php and replace any cutom blocks or code you have added.

I've heard of similar attacks on moodle....

[danIT]

Google has cached your Moodle site and tells me its 1.8.1, so i 99% gurantee moodle is your problem!

[THERADIOTUBBY]

what exactly might these edits look like?????

[danIT]

I dont know exactly, without being able to look at your server /moodle directory, pm me ftp details and ill have a quick look if you like?.

Essentialy a number of .php files will either be added with similar names to existing Moodle files or existing files will be edited to include a line like below:

*/function tdo(){echo base64_decode('hu4fhr6jsbskai94

Can you do a grep for base64_decode?

[THERADIOTUBBY]

Tried all above all virus/malware/rootkit sweeps blank

Internet provider has been very helpful has blocked main culprits

Used wireshark to grab packets attacking port 80 literally millions

Loads containing text 'you've been owned'

I would greatly appreciate any views on the following options;

Move server to a new external ip - but what attracted them in the first place?

Wipe server and reinstall - but if code is in php/asp web pages when they are restored will it all start again

Any other suggestions?