Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How my Apache server became a malicious free internet proxy

blog.atrament.net

Post reply on HN
Print view View original

1–10 of 42 posts

Re: How my Apache server became a malicious free internet proxy

#2

Post by bognition »

This is a perfect example of why most people should not run their own hardware. Don't get me wrong its really fun to build and configure your own server and I openly encourage people to learn but I also remind them that its extremely difficult (for a novice) to do securely.

Additionally connecting a misconfigured server to the internet doesn't just hurt the server owner but the entire network is affected, as you are providing another piece of hardware that malicious actors can use to execute their attacks.

Re: How my Apache server became a malicious free internet proxy

#3

Post by burnte »

bognition wrote: post #2

This is a perfect example of why most people should not run their own hardware. Don't get me wrong its really fun to build and configure your own server and I openly encourage people to learn but I also remind them that its extremely difficult (for a novice) to do securely. Additionally connecting a misconfigured server to the internet doesn't just hurt the server owner but the entire network is affected, as you are…

I ran a machine in a colo for almost four years, public facing web server for a dedicated webapp. I managed to escape any attacks or infections, but I'm positive it was 80% of what I did and 20% that it's a low volume app that never got attention by malicious actors. And I've been in the industry for a long time, not a noob.

Re: How my Apache server became a malicious free internet proxy

#5

Post by Canada »

burnte wrote: post #3
bognition wrote: post #2

This is a perfect example of why most people should not run their own hardware. Don't get me wrong its really fun to build and configure your own server and I openly encourage people to learn but I also remind them that its extremely difficult (for a novice) to do securely. Additionally connecting a misconfigured server to the internet doesn't just hurt the server owner but the entire network is affected, as you are…

I ran a machine in a colo for almost four years, public facing web server for a dedicated webapp. I managed to escape any attacks or infections, but I'm positive it was 80% of what I did and 20% that it's a low volume app that never got attention by malicious actors. And I've been in the industry for a long time, not a noob.

Everything is attacked. It's all automated, not personal.

Re: How my Apache server became a malicious free internet proxy

#7

Post by rtehfm »

bognition wrote: post #2

This is a perfect example of why most people should not run their own hardware. Don't get me wrong its really fun to build and configure your own server and I openly encourage people to learn but I also remind them that its extremely difficult (for a novice) to do securely. Additionally connecting a misconfigured server to the internet doesn't just hurt the server owner but the entire network is affected, as you are…

Better question would be what, assumingly, LAMP stack configuration were they using.

Re: How my Apache server became a malicious free internet proxy

#8

Post by nostalgiac »

So you got to the end solution of... uninstalling fail2ban to fix it? You didn't bother to check WHY it was maxing out the cpu?

Glad you got the issue resolved though and didn't fork over the $10 because you would've just run into the same issue in the future if you didn't get to the root cause of it (misconfigured Apache).

Re: How my Apache server became a malicious free internet proxy

#9

Post by Sanddancer »

jawshie wrote: post #4

Any idea what the actual vulnerability was?

It's really, really easy to misconfigure mod_proxy and set yourself up as an open proxy. The ProxyRequests directive sounds like it should be needed for any sort of proxying, but is only really needed if you're allowing your apache instance to act as a forward proxy, not as a reverse proxy. For reverse proxying, which is what you want most of the time, you really want ProxyPass and ProxyPassReverse .
Post reply on HN