Reply to: Those of you responsible running commercial websites

[silverlight1]

If you are running a Wordpress site always make sure you have the Sucuri plugin and iThemes Security (formerly Better WP Security) plugins

This allows you to block most automated bots from trying to hack sites

[stek]

Which is why I run sshd on a non-standard port, as well as use group permissions to restrict logins. It still gets attacked, but then fail2ban adds their IP to the firewall.

Me too...

[Contreras]

Check your server authlog and be amazed at the number of bots on Chinese IP's trying to guess the root password......

Which is why I run sshd on a non-standard port, as well as use group permissions to restrict logins. It still gets attacked, but then fail2ban adds their IP to the firewall.

[zazou]

Thanks chaps.

The system runs on Azure Web Sites (PaaS) so less worries about ports, security updates etc.

[stek]

I have no idea what you just wrote.

ntp = Network Time Protocol

aLom = Advanced Lights Out Management (i.e. remote access/power card running Linux Busybox)

Colo = Colocation - my box, their DC.

Simples!

[stek]

I think if they target you , there's nothing you can do . If they see they can milk you , or you upset them enough (visa, Sony etc)
Hasn't happened to me though

Just a port scanner found an unpatched hole - and Ddos'd from it, fixed a sec as soon as they told me.

[diseasex]

Somebody exploited an ntp hole on the aLom on my colo'd box, turned out I was the relay of a fair amount of havoc!

I think if they target you , there's nothing you can do . If they see they can milk you , or you upset them enough (visa, Sony etc)
Hasn't happened to me though

[meridian]

Somebody exploited an ntp hole on the aLom on my colo'd box, turned out I was the relay of a fair amount of havoc!

I have no idea what you just wrote.

[stek]

I have emails spamming me once every few weeks , saying something like yours, or trying to sell me seo or other bulltulip. even logging on website to use support to try to sell me something via internal mailing system. I have never replied to them , and nobody ever hacked my website either (or at least i dont know)

Somebody exploited an ntp hole on the aLom on my colo'd box, turned out I was the relay of a fair amount of havoc!

[diseasex]

I've just been forwarded this email.



Is this common chancer tactics?

I have emails spamming me once every few weeks , saying something like yours, or trying to sell me seo or other bulltulip. even logging on website to use support to try to sell me something via internal mailing system. I have never replied to them , and nobody ever hacked my website either (or at least i dont know)

[meridian]

I've had a simple Wordpress site live for two months or so, Jetpack reports that it's stopped over 2500 auth attempts already.

[stek]

Check your server authlog and be amazed at the number of bots on Chinese IP's trying to guess the root password......

[unixman]

Report it as a phishing attempt and then ignore. Don't reply as it only confirms to the sender the validity of your email address.

[Snarf]

I've just been forwarded this email.



Is this common chancer tactics?

Ignore it.
unless you have asked for someone to check your site its spam.

[BlasterBates]

The fact that you have a commercial website is a "fortunate" coincidence.