Alibaba server mined
a new customer recently consulted with sine security company, saying that his server often fails to open the website of the card, and the remote connection to the server is extremely slow. Sometimes the Ping value reaches 300-500, and he often switches. After listening to the customer's words,
will generally judge that he has been attacked by CC + DDoS mixed traffic, It's strange to say that there is no traffic attack on the computer room. It's not a traffic attack, but it also causes the server card and website to fail to open. What kind of attack is this? In order to solve the problem of
client server card, we immediately arranged a security engineer to carry out security detection and deployment on his Linux server
{rrrrrrr}
mining Trojan horse is also designed. If the mining process is forced to stop by customers, it will automatically start to continue mining to achieve uninterrupted mining.
careful inspection shows that it is through setting the hourly task plan, remotely downloading shell mining Trojan horse, and then executing, Check whether the current process exists or not. If not, start the Trojan horse to mine
a detailed security inspection was carried out on the client's Linux server. It was found that fortunately, there was no encrypted server data, and the worm was infected with the disease through the security detection and analysis of our security engineers, we found that the server uses Apache Tomcat environment, the open architecture of the platform is JSP + Oracle database, and Apache Tomcat uses the version of 2016, which leads to the serious remote command execution vulnerability of Apache, Through this vulnerability, the intruder can directly invade the server and get the administrator permission of the server,
virus. If the data was encrypted, the loss would be great. The client was a platform, and the client's data was very important. After finding out the mining Trojan horse,
do customers need to know how the server is attacked? Was the Trojan horse uploaded? It can prevent the attack
in the later stage
sine security engineer immediately repairs the Apache vulnerability and clears the Trojan horse. So far, the problem has been solved, the client server
runs stably, and the network station opens normally
your situation should be that there are no better security measures when you are attacked. When the attack reaches a certain level, the staff will shut it down to prevent greater losses.
Distributed denial of service (DDoS) attack is a common network attack method, its English full name is distributed denial of service? In short, many DoS attack sources attack a server together to form a DDoS attack, thus doubling the power of denial of service attack
usually, the attacker installs the attacker on each "broiler" on the network through the agent, and the agent launches the attack when it receives the instruction
with the cost of DDoS attack getting lower and lower, many people use DDoS to achieve the "offline" function for a website or an article. An article may have a higher ranking in the search engine because of its good content quality. However, if the website cannot be accessed for a long time because of DDoS, the search engine will delete the article from the index and rece the weight of the website, Because it achieves the purpose of "offline" article
it's not easy to deal with DDoS. First of all, we need to find a reliable host supplier. I had a host supplier before. As soon as I found that an IP was blocked by DDoS, I took the initiative to block the IP for several days. In fact, it is a manifestation of insufficient hardware and technical capabilities
foreign host suppliers may not be reliable either. For example, once I was attacked by DDoS, I transferred my blog to Dreamhost space. The fact shows that Dreamhost's ability of anti DDoS is not flattering. After DDoS came, Dreamhost was rude to deal with DDoS and directly blocked all IP addresses in China
generally speaking, DDoS costs money and bandwidth, and it also costs money and bandwidth to solve DDoS. So, if the server is damaged by DDoS, what should we do
1. To ensure the security of the server system
first of all, it is necessary to ensure that there are no vulnerabilities in the server software to prevent attackers from invading. Ensure that the server is up-to-date with security patches. Delete unused services on the server and close unused ports. For the website running on the server, make sure that it has the latest patch and there is no security vulnerability
2. Hide the server's real IP address
do not resolve the domain name directly to the server's real IP address. Do not let the server's real IP leak. Add CDN to the front end of the server for transfer (free CDN can generally prevent about 5g DDoS). If you have sufficient funds, you can buy advanced defense shield machine to hide the server's real IP. Domain name resolution uses CDN's IP, All resolved subdomain names use the IP address of the CDN. In addition, other domain names deployed on the server can not be resolved by real IP, all of them are resolved by CDN
in short, as long as the real IP of the server is not leaked, the prevention of small traffic DDoS below 5g does not cost much, and the free CDN can cope with it. If the attack traffic exceeds 10g, then the free CDN may not be able to withstand. You need to buy some high defense charging CDN. Generally, high defense CDN is more expensive. For example, the 10g protection of Alibaba cloud and Tencent cloud is 781 years in a month. At present, the domestic recommendation with high cost performance is: network cloud acceleration, 10gddos protection package only takes 1190 years, which is cheaper for agents. Related links
bus route: Airport Express zengcuolong line, the whole journey is about 14.7 km
1. Walk about 10 meters from Xiamen Gaoqi International Airport To Airport Express Station of Terminal T3
2. Take zengcuolong line of Airport Express, pass 1 stop, and then arrive at South Zhanzhan Road Station
3. Walk about 590 meters to Xiamen International Convention and exhibition