New to the community? Start here

[Defender Pro] Defender was unable to stop user-agent attack

Hello,

So this morning my site was either completely unresponsive, throwing database errors, or showing 502 errors.

After contacting live support, who recommended I upgrade my hosting, and that 40 plugins and woocommerce needed more resources – I insisted that the site was fine (it’s on a gold plan), and after complaining we found that the site was under attack from two user-agents: “Mozilla/5.0 (compatible; Seekport Crawler; http://seekport.com/)” and “Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)” the foremost consistingly hitting the homepage and admin, with 7,715 hits on /wp-admin/admin-post.php – the UAs and IPs responsible are banned now, but I have no idea if the attackers would be able to return again at somepoint?

Now, apparently the reason why this attack was allowed was because the seekport bot is not considered malicious? And so is not on the blocklist followed by defender? After being told this I asked why defender wouldn’t monitor UA requests/hits… Apparently it does but for some reason this one user agent was able to attack the site regardless? 

So I’m not sure if there’s some new vulnerability? I’ve not seen just one bot be able to take down a site before… Though another one of my sites have recieved a distrubuted denial of service attack from many bots.

If anyone is able to give me any information on how this happened, if I can prevent it from happening again or even if defender can be updated to prevent this type of attack?

Thanks!

Thu, 15 Jul 2021 11:15:11
More Defender Pro discussions
Defender Pro
  • Adam Czajczyk
    • Support Gorilla

    Hi Zena

    I hope you’re well today!

    I’ll respond slightly “out of order”. I hope that’s fine, I just believe this way I’ll be able to better explain the issue.

    Let me start with this:

    So I’m not sure if there’s some new vulnerability? I’ve not seen just one bot be able to take down a site before…

    It’s not really a “new vulnerability” and let me assure you that such “bot attacks” are taking thousands of various (unrelated in any way – different hosts, different networks, different technology powering the site, not only WordPress) daily. I’ve seen it with my own eyes too many times throughout all these years, including long time before I was even working here. It’s nothing new at all.

    So, as for “how and why” then…

    There are two major problems that can lead to such “site down” as a result of such attacks:

    1. A security plugin may theoretically slightly help but only if site performs already very well before such attack starts and it’s really a super-low scale attack; and the plugin already has related bots and/or IPs added to block lists; But it would be very little help and in reality inefficient.

    Problem with “real time” analysis of such traffic to attempt to “dynamically detect and prevent” such attack attempts is that it takes a lot of resources and would have to happen during the attack which at the same time causes very increased resource usage (so limiting what would be available for the plugin scripts to perform such analysis). it’s kind of a vicious circle which makes it nearly impossible to do such “dynamic detection and prevention”.

    Furthermore, even trying to implement something like that would in most cases be pretty pointles because no plugin (and I’m not referring to Defender only – I’m referring to all the plugins of that type, regardless of what they “claim” to be able to do) can provide efficient and reliable protection against such kind of attacks because… plugin works “within attack environment”.

    Such attack is aimed at webserver which goes down before any plugin is able to do anything.

    Let me put it this way:

    – imagine you’re a highly-trained and very skilled and efficient troop of elite solders
    – your only job is to protect a prisoner that is transported on a ship
    – you were put around the prison cell on that ship to fight any attack

    – if enemy (who wants to get rid of that prisoner before he reaches destination) sends their troops on that ship and they attack you, you – thanks to your skills – may be able to protect the prisoner

    So far so good.

    But instead the enemy can just put a heavy fire on the ship from every side and just sink entire ship – not caring about everything else.

    So such bot attack is that blind, heavy fire massively hitting your ship (server) from every direction while the soldiers (security plugin) are on that ship. They can protect the prisoner (the site) but if enemy fire just destroys the ship, they also get destroyed and can’t do anything.

    I hope that makes sense, so let me move on :)

    2. The other problem is detection of such bots.

    There are some well known user-agent strings and/or IPs that can easily be blocked by tools such as WAF (you got WAF available on our hosting and it’s not a script running inside the site but a proper web application firewall at server level – think of it more like an armour around the ship, if we’ll stick to the earlier example) but… the thing is that it’s very easy to “spoof” (fake) both. Bots can easily pretend they are legitimate visitors/crawlers, they keep changing user-agent strings/IPs and it’s not easy (if possible) to detect that automatically in real time.

    That said, the only efficient protection against such attacks is an “external protection” in addition to “reactive” (rather than “proactive”) WAF usage and using security plugin (such as Defender) to secure other aspects of site and “minimize damage” (so it can and does deal with some of such traffic that “slips through”).

    What I can suggest here is then:

    1. Keep Defender as is as it really adds a lot to overall security; but don’t assume or trust that any plugin whatsoever (including some well known competitors) can fully prevent and stop such bot attacks

    2. Keep WAF enabled on server (as you already have) but then if you notice any signs that may suggest that similar attack is starting to happen, check WAF log and Access Log (you’ll find them both in Hub in Hosting section for your site) and try to identify user-agen/IP strings that may be “abusing” site; a look into 3rd-party traffic stats can also be helpful as Google Analytics and similar stats have very “sophisticated” bot detection tools – so they may help identify bots like that.

    Then immediately add them to WAF block lists. If your site is still up and running, you can add them via “WAF” section in Defender (which is only an interface for WAF on server; it’s not script in Defender plugin but just “configuration page” – like the WAF settings page in Hub) or via Hosting Hub.

    3. Add another layer. The only efficient way to mitigate such attacks to stop them before such traffic can actually reach the target server. In other words – if it’s detected and blocked “between the bot and the target server”.

    For that, I would strongly recommend adding CloudFlare to the site. If you direct your domains through CloudFlare (which works on DNS level), all the requests will go through CloudFlare and their infrastructure is quite different and very specific – specialized to improve performance and prevent attacks to some degree.

    Even a free plan should help a lot and in the event of ongoing attack you can enable their “Under atack” mode which is specifically designed to mitigate such attacks.

    Nothing of that will give a “one hundred percent” guarantee to stop and prevent such issues in future but all together it would lower the risks and in most cases prevent the site from going down entirely.

    Kind regards,
    Adam

  • Adeline
    • Site Builder, Child of Zeus

    Hi Adam, Thanks for the response.

    Apologies if I misunderstand anything you’ve said above, my knowledge with web security isn’t brilliant.

    So you’re recommendation is to keep defender as is, and proactively ban attackers UAs and or IP’s when they attack, or going a further step and implementing cloud flare?

    If we’re assuming it’s a application-layer DDoS, I thought WAFs came with adaptive rate control, by monitoring and controlling the rate of requests against applications? If not, is there anyway to set request limits? Although, I was unsure if it was a distributed attack because I only had to ban 4 IPs and 2 UAs?

    Also, I had thought that digital ocean had their own load balance system that would prevent downtime incase of traffic surges/http floods/DNS query floods etc?

    Thanks again for the response and help.

  • Adam Czajczyk
    • Support Gorilla

    HI Zena

    Thanks for response and sorry for somewhat long reply post previously. I’ll try to keep things a bit more clear and short this time :)

    So you’re recommendation is to keep defender as is, and proactively ban attackers UAs and or IP’s when they attack, or going a further step and implementing cloud flare?

    Yes, keep Defender as is and proactively ban attackers UA and/or IPs when there seem to be an attack. As for CloudFlare, I’d say it’s not “or” but “and” – implement it anyway. It will be “on top” of everything else, as a “first line of defence”.

    If we’re assuming it’s a application-layer DDoS, I thought WAFs came with adaptive rate control, by monitoring and controlling the rate of requests against applications?

    WAF (as in Web Application Firewall) is a specific “type” (or “sub-type”) of firewall that’s meant mainly to prevent/stop “malicious requests” to/from site which mostly means e.g. attempts to inject code to site or DB, exploit vulnerable “parts” of the site etc. Mainly it’s about XSS, SQL Injection and similar attacks.

    Blocking well-know bots is an additional measure that helps achieve above goal and the fact that you can also add IPs/UAs to block lists can also be useful in preventing (D)DoS attacks but it doesn’t have much to do with “proactive/adaptive” monitoring and analysis of traffic sources and amount.

    It’s basically a set of rules/patterns that are defined and if a HTTP (as in HTTP protocol, not as in insecure http vs secure https) request hits the server it’s “filtered” by WAF through the set of such rules and rejected if matches any of such rules.

    Rate limiting/throttling, “adaptive rate control” and so on – it’s an entire other level of protection that surely also falls under “firewall” category but is not really a matter of WAF per se.

    Although, we do some rate-limiting for security but that for login and xml-rpc:

    https://wpmudev.com/docs/hosting/overview/#bruteforce-attack-protection

    Although, I was unsure if it was a distributed attack because I only had to ban 4 IPs and 2 UAs?

    Yeah, it doesn’t necessarily have to be “distributed”. It can be DDoS (distrubuted denial of service) or just DoS (dential of service). The goal and results are the same, the only difference is if it’s from single source or multiple sources. Although if it’s more than single IP, I’d consider it “distributed”.

    Also, I had thought that digital ocean had their own load balance system that would prevent downtime incase of traffic surges/http floods/DNS query floods etc?

    That’s a fair point but not exactly applicable. It’s not how such load balancer work. To start with – you host the site on a single droplet that’s like your own dedicated server, except virtual and fully managed by us (though built on the DO infrastructure). Granted, there are load balancers but that’s on a “lower” level, for their infrastructure protection.

    For you, as an “end client”, to have load balancing work like that you would need to have:

    – site mirrored to multiple separate servers (may it be at the same or different hosts)
    – have a – preferably cloud-based/networked – load balancers in front of that
    – and also have some additional enterprise-level firewall (usually that’d be a hardware solution) at the load balancing level.

    That’s a whole different level and category of hosting. Multiple servers at different locations and independent internet connections, industrial-grade hardware to do load-balancing and firewalling, a small army of professional admins to manage that for your needs… so that’s usually something that you either lease (as an enterprise level, highly dedicated custom solution) for thousands of dollars or built yourself for even more (making you essentially a hosting provider for yourself).

    But in most cases DO as infrastructure for hosting service (managed) like ours with additional security plugin (like Defender or similar) and WAF with CloudFlare on top of it to mitigate attacks would make a reasonable solution for most businesses.

    In fact, CloudFlare in such setups would work to some degree (reasonable) as such firewall and “traffic rate guard”, additionally keeping quite a lot of unwanted requests from even reaching your server (so WAF and Defender would have way less work to do; server as well).

    Best regards,
    Adam