Multiple Attempts to Access My HS Server

[tikt4u]

Somebody is trying like heck to login to my HS server. What should I do about it if anything? This is just a partial clip from last night and it has occurred a few times over the last few days.


6/27/2008 1:30:16 PM Info Web Server login failed from: 203.156.255.51 User:
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User:
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User:
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User:
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User: admin
6/27/2008 1:30:17 PM Info Web Server login failed from: 203.156.255.51 User:
6/27/2008 1:30:17 PM Info

[jasv]

I've had that happen a few times. I use Jon00's whois (who is visiting) script to see who is login in and from where. I get a lot of tries from spain and a few from other places.

[tikt4u]

This traces back to Asia. Is there anything to worry about? Is there some kind of setting or script that would lock them out for a period of time?

[jon00]

I've been getting lots of this too, always from a Chinese IP address (which your IP address posted is BTW). I'm personally not concerned, however It must be a script kiddie etc using code to try and log on.

23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:15 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:16 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:17 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin
23/06/2008 07:13:18 ~!~Info~!~ Web Server login failed from: 218.61.37.204 User: admin

[jon00]

This traces back to Asia. Is there anything to worry about? Is there some kind of setting or script that would lock them out for a period of time?

That would have to be configured in your router or firewall

[Wadenut]

I believe you can generally report such abuse to the ISP of the offender. Sometimes... it'll help.
However, these both seem to originate in China, so I'd doubt it.

Were it me, I think I'd rename the Admin account as it seems to be the target.

[jackpod]

How secure is your network? do you have a hardware firewall? do you have ports open? are you using an ssl cert for remote HS login?

Go out to Gibson Research and run Shields Up, it will do a port scan and report common holes

https://www.grc.com/x/ne.dll?bh0bkyd2

[tikt4u]

I believe you can generally report such abuse to the ISP of the offender. Sometimes... it'll help.
However, these both seem to originate in China, so I'd doubt it.

Were it me, I think I'd rename the Admin account as it seems to be the target.

That seems easy enough. I'll rename the account and see what happens.

Thanks

[tikt4u]

How secure is your network? do you have a hardware firewall? do you have ports open? are you using an ssl cert for remote HS login?

Go out to Gibson Research and run Shields Up, it will do a port scan and report common holes

https://www.grc.com/x/ne.dll?bh0bkyd2

According to Gibson Research, my network is very secure.

I have a router which I guess qualifies as a hardware firewall. I have a software firewall also.

The port to access HS is obviously open although Shields Up didn't find it. Everything else passed.

SSL cert? Umm, no. Not sure how to go about that. I think I saw it in one of the tutorials. I'll have to look into that.

Thanks

[bdickhaus]

The SSL cert won't help with the login attempts, they will still try. Renaming the admin account to something not so common should be all you need to do.

SSL gives you peace of mind that any legitimate access to your site is encrypted and can't be intercepted.

Bill

[jackpod]

Check this out, instructions how to create your own cert

http://board.homeseer.com/showthread.php?t=108130

Bill, true but in my webserver logs I notice the bots don't even mess with port 443

[jon00]

My HS server is being attacked on a daily basis now . Because I'm on port 8080, I think it is an attempt for IIS vulnerabilities.

It's interesting the user names they are trying:

21/07/2008 21:50:07 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: admin
21/07/2008 21:50:07 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: admin
21/07/2008 21:50:07 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: admin
21/07/2008 21:50:07 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: tomcat
21/07/2008 21:50:07 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: tomcat
21/07/2008 21:50:07 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: tomcat
.
many more entries here
.
21/07/2008 21:50:15 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: manager
21/07/2008 21:50:15 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: manager
21/07/2008 21:50:15 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: manager

I believe both Tomcat and Manager are used with IIS

This is normally about 100 login attempts within 20 seconds. There have been 4 different IP addresses all from different countries but using the same user names.

May need to change my port soon if this goes on for much longer

[Ultrajones]

My HS server is being attacked on a daily basis now . Because I'm on port 8080, I think it is an attempt for IIS vulnerabilities.

It's interesting the user names they are trying:

21/07/2008 21:50:07 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: admin
21/07/2008 21:50:07 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: admin
21/07/2008 21:50:07 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: admin
21/07/2008 21:50:07 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: tomcat
21/07/2008 21:50:07 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: tomcat
21/07/2008 21:50:07 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: tomcat
.
many more entries here
.
21/07/2008 21:50:15 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: manager
21/07/2008 21:50:15 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: manager
21/07/2008 21:50:15 ~!~Info~!~ Web Server login failed from: 85.255.195.25 User: manager

I believe both Tomcat and Manager are used with IIS

This is normally about 100 login attempts within 20 seconds. There have been 4 different IP addresses all from different countries but using the same user names.

May need to change my port soon if this goes on for much longer

Wow. The HomeSeer web server doesn't have an account lockout after n tries?

[Rupp]

No it doesn't lock out in all the years I've been using HomeSeer I've only heard of one breach and it was on HomeSeer 1.7.

[Ultrajones]

No it doesn't lock out in all the years I've been using HomeSeer I've only heard of one breach and it was on HomeSeer 1.7.

If I breached your HomeSeer system, I would make sure you never knew I was there. HomeSeer should still lock out the account after n tries (or provide an API for us to disable an account via script.)