IPO Cloud Powered By - hack ? 1

[vladcbv]

Hi All,

Yesterday I want to log into IPO using my Administrator credentials and I get : Password has been disabled.
I can log onto Linux so only the Administrator account on IPO is affected. Using Manager or Webadmin has no use. Tryng to access security settings in Manager is imposible.
Whe looking at the SyslogEventViewer in Linux admin web interface I get these messages:

"2018-07-16 11:33:23 92.87.251.17 AUD ipoffice ATR|ServiceAccess|Administrator||0.0.0.0|00-00-00-00-00-00|Failure||.....|
2018-07-16 11:33:23 92.87.251.17 OP ipoffice TRP|Access to Web Service failed due to incorrect credentials. Web Service: /ws/security/authenticate. Username: Administrator. Client IP Address: 173.212.222.176
2018-07-16 11:33:20 92.87.251.17 AUD ipoffice ATR|ServiceAccess|Administrator||0.0.0.0|00-00-00-00-00-00|Failure||.....|
2018-07-16 11:33:20 92.87.251.17 AUD ipoffice ATR|SecurityLogin|Administrator||0.0.0.0|00-00-00-00-00-00|Failure||.....|
2018-07-16 11:33:20 92.87.251.17 OP ipoffice TRP|Access to Web Service failed due to incorrect credentials. Web Service: /ws/security/authenticate. Username: Administrator. Client IP Address: 173.212.222.176
2018-07-16 11:33:17 92.87.251.17 AUD ipoffice ATR|ServiceAccess|Administrator||0.0.0.0|00-00-00-00-00-00|Failure||.....|
2018-07-16 11:33:17 92.87.251.17 OP ipoffice TRP|Access to Web Service failed due to incorrect credentials. Web Service: /ws/security/authenticate. Username: Administrator. Client IP Address: 173.212.222.176"
It is strange because if I refresh the page the messages keep on coming. so I have inifite requests from that IP ..

This is new to me, what can I do - I tried blocking IP from Linux but for that I need root.
PS: IPO Isn't yet behind an SBC, I know this is crappy, but this IPO is for lab tests so its directly connected to public (not at all best practice, I know...)

Anyway, is there a way to access IPO using another Admin account..

 

[tlpeter]

https://www.abuseipdb.com/check/173.212.222.176

Report it and block it if you can.

BAZINGA!

I'm not insane, my mother had me tested!

 

[TomMills]

Tryng to access security settings in Manager is imposible." Even with the security account?

APSS/ACIS/ACSS-SME
not arrogant, just succinct.

 

[janni78]

Just reinstall it then if it's lab, who knows what has been done with it if it's on public IP.
At least put a firewall in front of it.

"Trying is the first step to failure..." - Homer

 

[vladcbv]

So I had to reinstall IPO..
Unfortunetly I don't have control over the cloud environment (only to poweroff, reboot, suspend). So I cannot add the firewall.

Anyway, good thing it was lab environment.

 

[IPGuru]

Certainly shows you what you can expect if you put an IPO on the internet without any protection.

I suggest you escalate this requirement to management, remember if they can access the IPO they can also access the underlying Linux server & that could be used for anything.


Do things on the cheap & it will cost you dear

 

[vladcbv]

Hi,

I will ask for more protection from their end, at least a firewall..

Now coming back to my problem, I have resetup IPO and I can use webmanager to login with Administrator, but when using manager i get this : Failed to login to IP Office. Cause(Locked - Password). I want to change all default security settings but I can't..
Is this error coming from Manager ?

Last Edit:
So now I have the same problem.
2018-07-17 04:26:24 92.87.251.17 AUD ipoffice ATR|ServiceAccess|Administrator||0.0.0.0|00-00-00-00-00-00|Failure||.....|
2018-07-17 04:26:24 92.87.251.17 AUD ipoffice ATR|SecurityLogin|Administrator||0.0.0.0|00-00-00-00-00-00|Failure||.....|
2018-07-17 04:26:24 92.87.251.17 AUD ipoffice ATR|SecurityLogin|Administrator||0.0.0.0|00-00-00-00-00-00|AccountActive||.....|
2018-07-17 04:26:24 92.87.251.17 OP ipoffice TRP|Access to Web Service failed due to incorrect credentials. Web Service: /ws/security/authenticate. Username: Administrator. Client IP Address: 173.212.222.176

It seems like the fact that that IP addr tries to access the Admin page blocks my access - gives me Password has been disabled error in Webmanager.
I think I can chage the port 7070 to something else untill i get to the bottom of this.
Definetly needing a firewall..

 

[daveinwearside]

I always disable as many of the default accounts as possible and create new ones, at least create a new user to replace the Administrator then disable it



ACSS SME
APSS SME

A word to the wise ain't necessary - it's the stupid ones that need the advice.

 

[amriddle01]

Just use IP Routes to only respond to your IP/range, works great

 

[vladcbv]

Hi,

Good ideea with the IP Routes.

Thank you all for your advices.

 

[IPGuru]

Just use IP Routes to only respond to your IP/range, works great

Not if the Router is performing NAT as then the IPO simply sees it as a connection form its own internal LAN subnet


Do things on the cheap & it will cost you dear

 

[amriddle01]

No it doesn't, the original source address is passed, it isn't NATd both ways...