Need urgent help! SMF vulnerable to XML-RPC attack - must read!

[xJamie]

Hi,

Today someone DDoSed my forum and caused it to go Down. Someone used XMLRPC to attack my forum. XMLRPC is a layer7 pingback script which uses legitimate wordpress sites to attack Your website. It goes like this: Attacker > VPS/DEDICATED SERVER > WORDPRESS SITES > VICTIM.

Before my forum got attacked, I took a backup of my database. So basically my database went from 350Kb to 2MB. Please help me remove all these logs and errors and help me prevent these attacks.

Please see attachments for the logs of the attacks on Windows Server 2012.
NOTE: The IP address of my forum is not displayed. I am using CloudFlare and still my site went Down.

Please take a look at this issue and help me prevent this layer-7 attack.


The attacker who attacked my website is not only able to take my site offline, he is also able to take Down this forum as well.

I appreciate all Your help!



-edit-
Fixed caps...

[Arantor]

SMF is not vulnerable to any XMLRPC attacks seeing how there is no XMLRPC layer in SMF whatsoever. Tapatalk adds one, but SMF as it stands is not.

As for a DDOS, if you throw enough traffic at any server it's going to fall over, no matter how good it is.

[xJamie]

SMF is not vulnerable to any XMLRPC attacks seeing how there is no XMLRPC layer in SMF whatsoever. Tapatalk adds one, but SMF as it stands is not.

As for a DDOS, if you throw enough traffic at any server it's going to fall over, no matter how good it is.

Wanna bet?

SMF is vulnerable to XMLRPC.

[margarett]

I'm sorry but you're not making sense... You said:

Attacker > VPS/DEDICATED SERVER > WORDPRESS SITES > VICTIM

Where does SMF fit here? As the victim?

Every forum/software/etc out there, that runs in a web server, is susceptible to a DDoS attack... The protection can only be made on the server/firewall level. Clouldflare should help in that.

Also: 2Mb is a tiny database, I don't really think you got *that* much to worry about...

[xJamie]

I'm sorry but you're not making sense... You said:

Attacker > VPS/DEDICATED SERVER > WORDPRESS SITES > VICTIM

Where does SMF fit here? As the victim?

Every forum/software/etc out there, that runs in a web server, is susceptible to a DDoS attack... The protection can only be made on the server/firewall level. Clouldflare should help in that.

Also: 2Mb is a tiny database, I don't really think you got *that* much to worry about...

Please take a look at this log.

I couldn't upload it in attachments due to file size too big.

Here is the link: https://mega.co.nz/#!NpkmGLZb!0r0l-rmU0gq9unSwNK2uUsfaFqeTG2-ilZOOZ-tH8B8

[Arantor]

Right, so we just confirmed what I already guessed: that you have no understanding whatsoever about what XMLRPC is, or indeed what the actual vulnerability is here, not that it can be protected against anyway.

[margarett]

I did. There is *NOTHING* in that log that points to SMF. It's just a bunch of stuff thrown at your web server. It looks like a DDoS, yes, but I fail to understand how sure you are about SMF's vulnerability.

[xJamie]

I did. There is *NOTHING* in that log that points to SMF. It's just a bunch of stuff thrown at your web server. It looks like a DDoS, yes, but I fail to understand how sure you are about SMF's vulnerability.

Well,the attacker told me so..

I'm not sure if it is true or not, but that's just what he told me.

Anyway, I'm sorry if I overreacted it's just that I'm just upset and nervous, mainly because of the attack.

Do you guys have any advises/solutions on how to prevent these attacks? Thanks

[margarett]

The attacker told you? Man, you have some serious connections

There is no known vulnerability in SMF and that one that you point surely isn't the first. WP may be vulnerable, OK, but I don't know.
But there is nothing SMF can do about a DDoS... All it happens are dozens/hundreds of requests arriving at your server in a second. Of course it can't deal with all so it "collapses".

edit: http://blog.spiderlabs.com/2014/03/wordpress-xml-rpc-pingback-vulnerability-analysis.html (not sure if relevant here or not, but ok )

[LiroyvH]

To protect against DDoS attacks, you have to start looking at the server/network configurations; not at SMF.

[Herman's Mixen]

Yup! only thing i see wich is outdated is the theme /urban-rc5 from dzinerstudio, and maybe even SPortal wich is not realy developed any more can be the case....
its not SMF itself...

[xJamie]

Hmm, okay. Now I get a IIS error. Please, how do I fix this error? My website: http://pwnxile.cm

[Herman's Mixen]

IIS... o.0 thats a vulnerable point, when it comes in configurations.... bet you will find it there !!

[Arantor]

Without more details it's impossible to say. All that error tells us is that there's an error...

[xJamie]

Without more details it's impossible to say. All that error tells us is that there's an error...

What files and information do you need?

[butchs]

If your are worried have your host disable "allow_url_fopen" as recommended in the OWASP PHP Configuration Cheat Sheet.

Further reading is PHP top 5.

[xJamie]

Ok, everything is working nice now, thanks.

I have a question, should my forum be running on IIS, Xampp or Wamp?

Which alternative gives the best performance and stability?

Much appreciated, thanks.

[Arantor]

The fact you're asking means you didn't listen to what we told you last time.

[xJamie]

The fact you're asking means you didn't listen to what we told you last time.

Why do you have to make everything so complicated for me?

It's a simple question and answer.

My forum has 200+ people online and active every single day. I have a virtual private server which is running the operating system Windows Server 2008 R2 Datacenter. Now my question is as follows, should my forum be running on IIS, Xampp or Wamp?

I want a simple answer. I'm not going to scroll over the replies like last time.

If you can't provide a simple answer, this might be the wrong place for me to seek help.

[Arantor]

It's not a simple question and answer at all. Your lack of knowledge is frightening and likely to get you into trouble.

I will repeat myself then.

WampServer and Xampp are not, out of the box, set up to be secure on a public website. They're just not designed for public websites. They're designed for people to test websites on their local computer.

The fact you're asking means you don't understand the distinction which also means you're running the webserver yourself without the knowledge to secure it properly, which is a bad idea.

Find yourself a proper host.