How Do I Handle a Brute-force Attack Alarm?

Mind Map for Troubleshooting

The following mind map describes how to handle a brute-force attack alarm.

Figure 1 Troubleshooting

Handling the Alarm of a Successful Brute-force Attack

If you received an alarm notification indicating that your account had been cracked, you are advised to harden your servers as soon as possible.

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > Host Security Service.
3. Check whether the IP address that triggered the alarm is valid.
   Choose Intrusions > Events. In the Events area, click Abnormal login and check the login IP address.

   • If the IP address is from a normal user (for example, who entered incorrect password for multiple times but logged in before their account is blocked), your server is not intruded. In this case, you can click Handle and ignore the event.
   • If the IP address is invalid, your server may have been intruded.

     In this case, mark this event as handled, log in to the intruded server, and change its password to a stronger one. For details, see How Do I Set a Secure Password?

   Figure 2 Abnormal logins
   

4. Check for and eliminate malicious programs.
   Click Malicious program (cloud scan) and check alarm events.

   • If you find malicious programs implanted in your servers, locate them based on their process paths, users running them, and startup time.

     To kill a malicious program in an alarm event, click Handle in the row of this event and select Isolate and kill.

   • If you have confirmed that all the malicious program alarms are false, go to Step 5.

   Figure 3 Malicious program (cloud scan)
   

5. Check for and delete suspicious accounts.

   Choose Scans > Assets and click the Account Information tab. Delete suspicious accounts to prevent attackers from creating accounts or escalating account permissions (for example, adding login permissions to an account). For details, see Managing Account Information.

6. Check and enhance unsafe accounts.

   Choose Intrusions > Events. In the Events area, click Unsafe account. For details, see Handling Suggestion.

7. Check for and fix unsafe settings.

   Check for and fix weak password complexity policies and unsafe software settings on your servers. For details, see Suggestions on Fixing Unsafe Settings.

8. Harden your servers.
   • For more information, see Hardening Security for SSH Logins to Linux ECSs.
   • You can also enhance the defense against brute-force attacks by following the instructions provided in How Do I Defend Against Brute-force Attacks?

Handling the Alarm of a Blocked Brute-force Attack

Check whether blocked IP addresses can be trusted. HSS will block an IP address if it has five or more brute-force attack attempts detected within 30 seconds, or 15 or more brute-force attack attempts detected within 3600 seconds.

Procedure

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > Host Security Service.
3. Choose Intrusions > Events. In the Events area, click Brute-force attack.
   Brute-force attack alarms will be generated if:

   • The system uses weak passwords, is under brute-force attacks, and attacker IP addresses are blocked.
   • Users fail to log in after several incorrect password attempts, and their IP addresses are blocked.
   Figure 4 Brute-force attacks
   

4. Check whether the login IP address triggering the alarm is valid.
   • If the IP address is valid,
     • To handle a false alarm, click Handle in the row of the alarm event. Ignore or whitelist the IP address.

       This does not unblock the IP address.

     • To unblock the IP address, click Blocked IP Address in the Alarm Statistics area, select the IP address, and unblock it. Alternatively, you can just wait for it to be automatically unblocked when its blocking duration expires.

       By default, suspicious SSH attackers are blocked for 12 hours. Other types of suspicious attackers are blocked for 24 hours.

   • If the source IP address is invalid or unknown,

     Mark this event as handled.

     Immediately log in to your server and change your password to a stronger one. You can also enhance the defense against brute-force attacks by following the instructions provided in How Do I Defend Against Brute-force Attacks?

Helpful Links

• How Does HSS Block Brute-Force Attacks?
• How Do I Unblock an IP Address?