Daniel Cid @dcid@noc.social

Remember. If you want your profile to be public here:

https://noc.social/explore

You need to go to Preferences->Profile and check "List this account in the directory".

Otherwise it won't show.

My 7yo: "When I grow up, I want to be just like my daddy. He doesn't work and just spends his day at the computer doing nothing."

Seeing quite a few scans for /.aws/credential

Trying to get the keys used by the AWS CLI tool. Check your logs and that you do not have them exposed.

You do not want that surprise AWS bill because your account got compromised.

https://trunc.org/learning/aws-credentials-scan

The unfamous user agent: Mozlila/5.0 (notice the typo, not Mozilla)

It is on everyone's web logs as part of many web attack campaigns.

Grep for it and you will confirm:

$ grep Mozlila /var/log/apache2/*log

$ grep Mozlila /var/log/nginx/*log

More details about it here:

https://trunc.org/learning/the-mozlila-user-agent-bot

A PHP backdoor on a compromised #WordPress site being used to start #DDoS attacks:

while(true)
{
$fp=fsockopen($trh2,$trp,$aaa1,$aaa2,1);
fwrite($fp,$spdat);
}

https://noc.org/articles/php-backdoor-analysis-how-are-attackers-doing-ddos

Did you know that when your filesystem is full and nginx can't write to the log file, it will log that it was unable to log to the log file?

[alert] write() to "/var/log/nginx/access.log" failed (28: No space left on device) while logging request...

https://trunc.org/learning/everything-you-dont-need-to-know-about-nginx-error-logs

There are logs and there are LOGS (all uppercase).

Some logs can be noisy and pretty useless while others might indicate a serious issue that you have to respond right away.

Today critical log: PHP Fatal errors:

https://trunc.org/learning/php-fatal-errors?phperrors

My main source of morning news ( https://news.ycombinator.com/ ) has been down since the morning.

5+ hours now.

Their IP is not even pinging, so it looks like the server is having a bad day...

Now twitter is blocking "search.noc.social" from being shared there.

Just gives this random error of "something went wrong".

If it could not get any worse...

Lesson of the day:

1- Never block one of the CDN IP addresses on your server.

https://search.noc.social should be back online properly now.

🤦 🤦 🤦

Analysis of a HTTP-based DDoS.

-7,000 different attacking IP addresses.

-20,000+ requests per second.

-DDoS-for-hire?

https://trunc.org/learning/http-flood-attack-ddos-analyzed

Did you know that if you are using Signal to share a link with someone, it will use the "WhatsApp" user agent?

More on HTTP user agents here:

https://trunc.org/learning/http-user-agents