Admin Tools for WordPress

Saturday, 17 September 2022 15:41 CDT

techgal

Hi, I am hoping you can give some insights into the strangeness that just happened on this site.

I am fearing it has been hacked, but not sure how.

I think it might be a Siteground issue, but hoping you can help me pinpoint it.

On Friday, 9/16, Siteground sent me a message that northmooracreshoa.org was using too many CPU seconds, and if it continued, would be over the limit for the month.

I found in the WPNinja FluentSMTP logs that over 1000 emails had been sent in the past few days.

I contacted Siteground and they indicated that it was the internal WP cron job that was causing the issue, and if I just made it a Siteground cron job, all would be well.

That sort of helped, but this morning I log in and find that another 900+ emails have gone out.
I looked at the IP Blocked list and saw that the two IP's that kept coming up again and again in the FluentSMTP log were supposed blocked. Those two IP's are 173.201.191.163 and
162.55.54.35. I have added two screenshots of the FluentSMTP log, so you can see.

Thinking that the FluentSMTP software might be the problem, I told it to stop any sending emails at all. That's when the weird thing happened. It started sending emails noted at "simulated". That is one of the screenshots.

Then I deactivated FluentSMTP plugin altogether, which meant I couldn't view the log anymore. But there was still activity in the Siteground error log.

As a last resort, I added those two offending IP addresses to the Siteground Blocked IP List and the problem stopped.

But my puzzlement is to why Admin Tools was not stopping the problem. I also noticed that the graphs in Admin Tools stopped updating on 9/4/22.
I would appreciate any insights as to what I should do next. I think there is still an underlying problem.

Sincerely,
Carolyn

Carolyn Breninger
Radical Designs, LLC - Marketing Works

Saturday, 17 September 2022 15:43 CDT

System Task

system

The ticket information has been edited by Carolyn Breninger (techgal).

Sunday, 18 September 2022 14:17 CDT

nicholas

As long as the Admin Tools system plugin is enabled it protects all WordPress entry point files which do load third party plugins, including the wp-admin/wp-ajax.php file which is what is used by WordPress' own CRON.

However, your screenshots actually say something different than what you are telling me. It's not those two IP addresses sending emails, it's your own site, namely Admin Tools sending you emails. You have configured Admin Tools to send you an email every time there is a blocked request —including access from blocked IPs— which is both beating the purpose and can cause the problems you are experiencing. This is a feature meant to be used when setting up Admin Tools and running it for the first few days just to make sure you are not blocking legitimate requests (and if you do, let you know so you can refine your configuration).

Go to Admin Tools, Web Application Firewall, Configure WAF and find the “Email this address on security exceptions” option. Remove your email from it. Scroll all the way down and click on Save Changes.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Sunday, 18 September 2022 18:06 CDT

techgal

Thank you for taking the time to sort this out for me.

I am very glad we had this conversation. Apparently I missed the part about the email only being used for a few days. I have taken it out of the WAF. I am puzzled what might have triggered it?

I was thinking the email needed to be in there for security notices to be sent. Thank you for correcting me on that.

I do have one other question, if I may - I did an outside scan with Sucuri sitecheck and it reported that it could not find a WAF in place. (Report attached). Is that a good thing?

The ins and outs of web security is not my strong suit. I really appreciate Akeeba Backup/Admin Tools and I tell people about them any time the question arises as to what security tools to use. :)

Thank you for your time.

Carolyn Breninger
Radical Designs, LLC - Marketing Works

Monday, 19 September 2022 01:24 CDT

nicholas

> I am puzzled what might have triggered it?

There is another option which tells Admin Tools which blocked reasons to not send an email for. If nothing is selected there it will email you about everything, including your site being accessed by a blocked IP address. This is what was happening.

> I was thinking the email needed to be in there for security notices to be sent. Thank you for correcting me on that.

It is there to receive an email about everything that is blocked. It does NOT have to be there for anything to be blocked and for everything blocked to be logged, though :) I would have already removed this feature but there are many people who use it to troubleshoot their Admin Tools configuration, especially when they first set it up or when they make big changes. I guess emails are easier to peruse than trying to go through the blocked requests log.

> I do have one other question, if I may - I did an outside scan with Sucuri sitecheck and it reported that it could not find a WAF in place. (Report attached). Is that a good thing?

I don't know how they are checking. I suspect they are either looking for specific plugins or they run some generic requests which are meant to be caught by a server-level WAF such as mod_security2 in Apache.

I really don't like that security tools running heuristics to detect a condition have very strongly affirmative messages which do not match the probabilistic nature of what they are doing. A better message from Sucuri would be that they could not detect a WAF they know of or a server-level WAF, depending on what they are actually checking for. Saying "you do not have a WAF" is misleading.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

Monday, 19 September 2022 16:24 CDT

techgal

Now that I know I was creating (unintentionally) my own problem, I feel more equipped to check my other installations to prevent the same from happening again.

Yes, I think Sucuri is trying to sell their own "cloud based" services and I was somewhat skeptical of their results.

Thank you so much for your explanations. :)

Carolyn Breninger
Radical Designs, LLC - Marketing Works

Support