CLEO network down

[browolf]

seems to be working fully now.

[jhothersall]

Back up at Bowland High

[HappyAdmin]

Whew. What a thing that was. I set up access for our staff network via my 4G phone USB tethered to a linux laptop running iptables to route the traffic as a temporary measure. We got through about 10GB of data in under 2 days, but it kept people running. Our CLEO connection has been excellent for the previous year - let's hope this doesn't re-occur any time soon.

Best theory I've seen is that this was a "live fire" exercise, testing's someone's DDoS weapon. I guess ransom demands from whoever owns it would come with some weight, now. Anyone got any better intel/ideas on why this attack was carried out?

Let's hope normality is now stable...

[SimpleSi]

I set up access for our staff network via my 4G phone USB tethered to a linux laptop running iptables to route the traffic as a temporary measure.

Could you do a bit of documentation on that - prob don't need step by step but a set of bullet points (wtih a few google links ) would be very handy

 

Simon

[HappyAdmin]

Hi,

 

Well, I documented it for myself in case I ever have to do it again, so here it is copied and pasted. I've just obscured IPs.

 

---

 

• Make sure power saving is off on the laptop.
   
  
• Connect Android phone to Ubuntu laptop via USB.
   
  
• Turn on USB tethering on the phone, in settings.
   
  
• Connect in Network Manager in Ubuntu to the usb tethered connection. (This actually required no action - it automatically connected, although I did rename the connection for clarity.)
   
  
• Plug the laptop into the Admin network with an ethernet cable. Configure the connection eth0 (via network manager) to:
   
  
  • IP - a free address on your internal network, let's call it
     
    
  • default route as the IP of usb0, the tethered connection, found from ifconfig, lets call it
     
    
  • DNS 8.8.8.8 and 8.8.4.4 (Google’s public DNS)
    

   

  [*]Set up iptables to forward traffic, as per the relevant parts of http://ubuntuforums.org/showthread.php?t=2179393

   

  • sudo iptables -A FORWARD -o usb0 -i eth0 -s /24 -m conntrack --ctstate NEW -j ACCEPT
     
    
  • sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
     
    
  • sudo iptables -t nat -F POSTROUTING
     
    
  • sudo iptables -t nat -A POSTROUTING -o usb0 -j MASQUERADE
     
    
  • The first rule allows forwarded packets (initial ones). The second rule allows forwarding of established connection packets (and those related to ones that started). The third rule does the NAT.
     
    
  • Save the iptables:
     
    
  • sudo iptables-save | sudo tee /etc/iptables.sav
     
    
  • To make this permanent you could:
     
    
  • Edit /etc/rc.local and add the following lines before the "exit 0" line: iptables-restore < /etc/iptables.sav
     
    
  • but I haven’t at the moment, but the above line could be manually applied.
     
    
  • Enable routing would be done by:
     
    
  • sudo sh -c "echo 1 > /proc/sys/net/ipv4/ip_forward"
     
    
  • but this was already set (I checked using cat /proc/sys/net/ipv4/ip_forward).
    

   

  [*]This was then tested by setting one PC manually to use as default gateway, with google’s DNS set above - worked fine.

   

  [*]Server changes then made (after recording original values):

   

  • Set default route ("003 Router") to
     
    
  • Set DNS forwarders to 8.8.8.8 and 8.8.4.4
     
    
  • Change DHCP to give out a default gateway of
     
    
  • (NB: do not change DNS in DHCP - this must remain pointed at the server, or the domain will break.)
    

   

  [*]Network DHCP refresh

   

  • Reboot PCs, or just run ipconfig /renew
    

   

  [*]TO CHANGE SERVER BACK TO NORMAL

   

  • Change default route back to what it was before you started
     
    
  • Set DNS forwarders back to what they were before you started
     
    
  • Change DHCP to give out a default gateway of what it was before you started
    

   

  [*]Then DHCP refresh clients.

 

-----

I can't fully take credit for the iptables commands - I only basically understand them, and it would have taken me ages to work them out from scratch, but Google was my friend.

 

Who knows, might help someone some time.

 

Ben

[jhothersall]

Just seen this - https://www.jisc.ac.uk/news/former-student-sentenced-for-cyber-attack-on-the-janet-network-20-dec-2017?utm_content=bufferba6cc&utm_medium=social&utm_source=twitter.com&utm_campaign=buffer

 

Saw it on Twitter First -

 

This has to be that attack, same dates - Dec 2015

 

And on the Register - https://www.theregister.co.uk/2017/12/20/stockport_ddoser_given_suspended_sentence/

Edited December 22, 2017 by jhothersall