2

I have been having some fun messing around with Apache running on an Ubuntu Server. It is set up as a global web server and shares some files that I can access anywhere. I am also using it to connect to my music and play it via my Android phone when away from my house. It also houses shares that are only visible to my local network.

I set logwatch up a few weeks ago and have logs sent to me every morning via email. Every now and then I am seeing this in my logs (or something very similar).

Attempts to use known hacks by 1 hosts were logged 3 time(s) from:
   <Routers local IP Address>: 3 Time(s)

Logwatch shows no successful attempts were made and I am pretty sure I am not really being hacked. But what would cause my routers local IP address to show up in logwatch as a threat?

Is it secretly out to ruin me O-o?

Just some other tidbits about the network:

  1. My Router hides my home network behind a NAT
  2. I do develop on Android and make connections to it via the emulator in Eclipse as well as from my phone.
  3. My phone as well as home PCs connect to the web share to stream music and download files (globally and locally)

I can't seem to pinpoint exactly what is causing this..

  • Bad android code?
  • The fact that the server shares locally and globally?
  • Accessed from a cell network?

EDIT: More about my architecture

My home network is behind my routers NAT (router local IP is .1). I have a laptop and a desktop both who have static IPs. My desktop can connect wireless and wired. I also have a Wii that connects when it needs to go online etc. The below is the table from my router showing what has connected.

.2    <MAC ADDRESS>   expired (This is my Desktops Wireless Conn.)
.3    <MAC ADDRESS>   Forever (This is my laptop)
.4    <MAC ADDRESS>   Forever (This is my Desktop Wired Conn.)
.8    <MAC ADDRESS>   Forever (This is my Wii)
.5    <MAC ADDRESS>   Forever (This is my phone)

I matched all of the MAC addresses to a device in my home.

I have also looked at the logs the router records (to long to post) but the only IPs there are that of devices in my house.

Edit: More Router info

  • EnGenius ESR9850
  • NAT is enabled
  • Router firewall is enabled
  • The router supplies two different SSIDs(but this shouldn't be causing a problem)
  • The router has port forwarding and forwards port 80 to a higher number port and forwards it to the server at .6)
  • The router is set to only allow IPs from .2 - .10 to make a connection.
  • The router and each SSID are password protected (all different passwords)

Edit: Received another hack attempt

Today I received the following

Attempts to use known hacks by 1 hosts were logged 1 time(s) from:
X.X.X.X: times(1)

A total of 1 sites probed the server
X.X.X.X

The IP listed is clearly a global IP address and not that of my router.

From the answers below it seemed that I would only be seeing the routers IP as the "hacker". How come in this case it shows a global IP.

Note: This global IP is not the global IP of my NAT nor is it the global IP of my smart phone.

1 Answer 1

6
+150

As your server is open to the Internet it is also open to attacks, which is what I believe is happening. Your router's external IP address is in an address segment of the Internet that is being scanned by one or more infected computers that are using known exploits.

The attacks on your computer seem to come from the router, because the router stands between you and the Internet :

image

The attacks are coming over TCP/UDP ports that you have forwarded in the router to your computer, such that any connection attempt on these opened ports to your router's external IP address, is actually transformed into a connection attempt by the router to your computer, the router acting in this case as an agent for the external attacker.

As you are being attacked, it would be a good idea to upgrade your security.

See the LQ Security references for an overwhelming list of possible measures for hardening your Linux box. Of special interest for you is the SSH section at the end.

There are many other articles on the Internet on this subject. Some that would be useful:

10 Tips to Secure Your Apache Web Server on UNIX / Linux
Security Tips - Apache HTTP Server

19
  • Thanks for the links I have already used them. I should have mentioned I have hardened the server before I posted the question. But why would the attacker show up as my local IP address (the router) and not anohter global IP address? Also this is the only data that is showing regarding the "hack attempt". +1 for responding! Thanks!
    – sealz
    Feb 25, 2012 at 19:09
  • For your phone to connect with your computer via Internet, you must have forwarded a port, which opened it to attack from the Internet. Your computer has the impression that it's coming from the router, because the router's doing NAT means that it is handling 2 connections: to the ISP using your external IP, and to your computer using its own internal IP, and transferring the data back and forth from one to the other. So Internet connections arrive to your computer on the opened port with the router's IP.
    – harrymc
    Feb 25, 2012 at 19:30
  • ... Which also means that products such as Fail2Ban are useless for you. Whatever blacklisting there is to do has to be done in the router.
    – harrymc
    Feb 25, 2012 at 19:43
  • Yes I am forwarding the port. When i look at the IPs that have made a connection to the router the only IPs present are ones from my home PCs, and the one that is linked with my phone. Could my phone for some reason be considered bad to the router?
    – sealz
    Feb 25, 2012 at 21:20
  • Could you include some more info about your architecture and the IPs that you see. All I really have are guesses.
    – harrymc
    Feb 25, 2012 at 22:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .