Odd log entries signifying an attack?

  • Resolved The Hack Repair Guy

    (@tvcnet)


    12 years, 3 months ago

    Hi folks,
    Awake today to see my site loading really slow, so I was checking logs and ran into this:

    Jan 27 08:50:05 vm14n suhosin[6747]: ALERT - script tried to increase memory_limit to 268435456 bytes which is above the allowed value (attacker '50.192.165.126', file '/home/style/public_html/wp-content/plugins/updraftplus/updraftplus.php', line 247)
Jan 27 08:50:06 vm14n suhosin[6760]: ALERT - script tried to increase memory_limit to 268435456 bytes which is above the allowed value (attacker '50.192.165.126', file '/home/style/public_html/wp-content/plugins/updraftplus/updraftplus.php', line 247)
Jan 27 08:50:07 vm14n suhosin[6772]: ALERT - script tried to increase memory_limit to 268435456 bytes which is above the allowed value (attacker '50.192.165.126', file '/home/style/public_html/wp-content/plugins/updraftplus/updraftplus.php', line 247)
Jan 27 08:50:10 vm14n suhosin[6787]: ALERT - script tried to increase memory_limit to 268435456 bytes which is above the allowed value (attacker '207.81.163.43', file '/home/style/public_html/wp-content/plugins/updraftplus/updraftplus.php', line 247)
Jan 27 08:50:11 vm14n suhosin[6793]: ALERT - script tried to increase memory_limit to 268435456 bytes which is above the allowed value (attacker '207.81.163.43', file '/home/style/public_html/wp-content/plugins/updraftplus/updraftplus.php', line 247)
Jan 27 08:50:11 vm14n suhosin[6799]: ALERT - script tried to increase memory_limit to 268435456 bytes which is above the allowed value (attacker '207.81.163.43', file '/home/style/public_html/wp-content/plugins/updraftplus/updraftplus.php', line 247)
Jan 27 08:50:28 vm14n suhosin[6904]: ALERT - script tried to increase memory_limit to 268435456 bytes which is above the allowed value (attacker '207.81.163.43', file '/home/style/public_html/wp-content/plugins/updraftplus/updraftplus.php', line 247)
Jan 27 08:50:28 vm14n suhosin[6910]: ALERT - script tried to increase memory_limit to 268435456 bytes which is above the allowed value (attacker '207.81.163.43', file '/home/style/public_html/wp-content/plugins/updraftplus/updraftplus.php', line 247)
Jan 27 08:50:29 vm14n suhosin[6916]: ALERT - script tried to increase memory_limit to 268435456 bytes which is above the allowed value (attacker '207.81.163.43', file '/home/style/public_html/wp-content/plugins/updraftplus/updraftplus.php', line 247)

Then checked for repeating IP connections and see this:

        101 84.0.7.14
        102 121.219.127.62
        103 54.196.153.120
        105 99.225.188.12
        109 72.68.97.236
        110 99.16.100.209
        113 208.43.243.244
        119 208.43.251.180
        120 108.20.153.31
        120 99.20.249.144
        122 76.113.188.128
        131 64.246.147.185
        139 66.249.74.105
        170 50.128.200.242
        176 207.189.226.216
        214 66.249.74.167
        248 66.249.74.139
        284 76.184.78.134
        311 50.192.165.126
        972 66.249.74.84
        1276 97.101.196.136

    [Moderator Note: Please post log files between backticks or use the code button.]

    This look at all familiar or ideas about this Updraft plus folk?

    http://wordpress.org/plugins/updraftplus/

Viewing 3 replies - 1 through 3 (of 3 total)
  • Thread Starter The Hack Repair Guy

    (@tvcnet)

    12 years, 3 months ago

    Same situation today.

    I observed similar attack like connections this morning, which brought the server down at one point.

    I have since deleted the plugin.
    Though authors of this script really need to review this, as it may be some form of zero day exploit against the plugin.

    More examples. Log of IP connections:
    https://dl.dropboxusercontent.com/u/30619687/updraftplus.txt

    Plugin Author David Anderson / Team Updraft

    (@davidanderson)

    12 years, 3 months ago

    Hi,

    Those log messages are normal. UD contains PHP code that requests the memory ceiling to be raised (to give backups maximum chance of succeeding – since backups need to deal with big zip files). The code respects the setting of WP_MAX_MEMORY_LIMIT, so, if you don’t want the memory ceiling to be raised, then set that in your wp-config.php.

    i.e. The messages are being logged because your WP_MAX_MEMORY_LIMIT is set to one thing (possibly the default), but your Suhosin configuration is set to something different.

    David

    Thread Starter The Hack Repair Guy

    (@tvcnet)

    12 years, 3 months ago

    Excellent reply as usual. Thanks!

Viewing 3 replies - 1 through 3 (of 3 total)

The topic ‘Odd log entries signifying an attack?’ is closed to new replies.