What Is a Local Attack? How to Defend Against It Effectively

Over time, there have been many attacks on the internet every day, mostly security incidents that directly affect and cause serious damage to companies, businesses and corporations of all sizes, in Vietnam and abroad. How to eliminate them for good is a hard problem that researchers worry about day and night, because every hacker's methods differ. They always find ways, finding “holes” to get in and steal information, causing major harm.

In addition, about 80% of the reason they get in so easily is that many of us still do not know how to secure our own systems as safely as possible. One of the most common attack types hackers use today is the Local Attack. So what exactly is a local attack, and why is it so powerful? And how do you defend against it effectively? Let's find out with us walk you through it in this article.

What is a local attack?

A local attack is a fairly common way of attacking websites that share the same server. Attackers use exploit code written in programming languages such as: PHP, ASP.Net, Python,…

Each piece of such code is called a shell. When a shell file is uploaded to a hosting account on the server, the hacker can run exploit commands to get into other accounts on the same server for malicious purposes. You need to pay particular attention to this if you plan to build a business website, website in the education sector or a site with payments, fields that need strong security.

A common risk that leads to local attacks is using rented Web Hosting . Most of these hosting plans serve many other websites too. So if one of the websites on your server is attacked, the other websites will likely have their information stolen as well, or even worse, all their data destroyed.

That is why you should not choose cheap hosting. Choose a reputable provider, or a company that offers both website design service and hosting, like Mona Media. That is the most effective solution because you get code support and server support from one place and can quickly handle urgent problems, without juggling several vendors.

Common types of attack

The first thing a local attack hacker does is learn every detail about the target. They run a quick scan of the domainand the IP of the hosting you use. Then they look at what source code your website runs on and whether any plugin or code has a flaw that is easy to exploit. If your site has flaws such as SQL Injection or XSS, or other common ones, they can attack it directly.

On the other hand, if the first check shows no exploitable flaw on your site, they move on to a Reverse IP lookup of your hosting. This term means scanning all the websites running on the same server IP as you. The number of sites a server runs at once depends on how it was set up. Once they have the list, they check again to see how many of your “neighbor websites” have flaws they can use to upload a shell.

If one of those sites has an SQL Injection or other flaw, they exploit it to take over admin access and upload a shell. That becomes the stepping stone for the hacker to get into your website.

Brute Force

Another method, less elegant and less common but still quite dangerous, is Brute Force, which means guessing passwords. It sounds absurd, but in reality many website admins keep the default username and password after installation, or reset passwords to ones that are far too easy to guess, such as 123456789, 123456abc, admin, and so on.

From there they can upload a shell file to that hosting account and run commands to take information from your website and do damage.

Effective ways to defend against local attacks

This may sound complicated, but on the other hand Local Attack there are still ways to fully prevent it, and solid security keeps a shell from running locally. Based on developers' experience, the following measures help defend against local attacks effectively:

• Never use source code of unknown origin. It may contain many bugs or have malicious code planted in it.
• Keep updating to the newest versions of your open-source platforms to patch vulnerabilities
• Do not set passwords that are easy to guess. Make a habit of using passwords that combine uppercase letters, numbers and special characters.
• Do not reuse one password for different accounts. If one is lost, you may lose the others too.
• CHMOD 400 for files that contain sensitive information, and 101 for folders
• Using VPS instead of using ordinary hosting, to rule out being hacked through a local attack
• Frequently back up your data and scan the code for malware

Preventing local attacks on CentOS

Open the file /etc/php.ini and follow the instructions below

• Disable the following functions

Code:

PASSTHRU, SYSTEM, SHELL_EXEC, EXEC, VIRTUAL, SOCKET_ACCEPT, SOCKET_BIND, SOCKET_CLEAR_ERR, SOCKET_CLOSE, SOCKET_CONNECT, SOCKET_CREATE_LISTE, PROC_TERMINATE, PCNTL_EXEC, PUTENV, PROC_CLOSE, PROC_GET_STATUS, PROC_NICE, PROC_OPEN, POPEN, PCLOSE, SET_TIME_LIMIT, ESCAPESHELLCMD, ESCAPESHELLARG, DL, SHOW_SOURCE,INI_ALTER, OPENLOG, POSIX_GETPWUID, SYMLINK, INI_RESTORE, CHROOT, CHOWN, CHGRP, POSIX_SETEGID, POSIX_SETEUID, POSIX_SETGID, POSIX_SETPGID, POSIX_SETSID, POSIX_SETUID, POSIX_KILL, SYSLOG, APACHE_CHILD_TERMINATE, APACHE_SETENV, DEFINE_SYSLOG_VARIABLES, OPENLOG, PHP_UNAME, PHP_MKDIR, FOPEN, FCLOSE, BASE64_DECODE, GZINFLATE

• Turn on Safe Mode

Code:

SAFE_MODE = ON

See more:

• Website security and what you need to know to optimize it
• WordPress website security methods and plugins

Ways to reduce local attacks in WordPress

Hide the wp-config.php file

Normally a website's files sit in the public_html folder, and the path is usually /home/username/public_html/wp-config.php.

So the best way to hide the config file is to move the wp-config.php file out of the public_html folder, and you can also log into the host over FTP and create a new folder, with any name, at the same level as public_html. (In the example below I create a folder named leti)

Next, download the file wp-config.php in the public_html folder, then upload it into the new folder. The last step is to edit the wp-config.php file in the public_html folder as follows (see the link below):

<php

if ( !defined(‘ABSPATH’) )

define(‘ABSPATH’, dirname(__FILE__) . ‘/’);

require_once(ABSPATH . ‘../leti/wp-config.php’);

You need to replace leti with the name of the folder you created at the same level as public_html.

Note: This only works for websites whose installation files sit directly in the public_html folder; it does not support another layer of folders. You can also apply it to the www folder.

Change the database prefix

The default database prefix of WordPress is wp_, which unintentionally gives hackers the name of every table on your website if you don't change this prefix promptly.

Change the security keys

Open the file wp-config.php and find

define(‘AUTH_KEY’, ‘put your unique phrase here’);

define(‘SECURE_AUTH_KEY’, ‘put your unique phrase here’);

define(‘LOGGED_IN_KEY’, ‘put your unique phrase here’);

define(‘NONCE_KEY’, ‘put your unique phrase here’);

define(‘AUTH_SALT’, ‘put your unique phrase here’);

define(‘SECURE_AUTH_SALT’, ‘put your unique phrase here’);

define(‘LOGGED_IN_SALT’, ‘put your unique phrase here’);

define(‘NONCE_SALT’, ‘put your unique phrase here’);

• Then go to: https://api.wordpress.org/secret-key/1.1/salt/ to get new secret keys
• Replace the whole block of code above with the code provided.

Disable file editing (plugins, themes) in wp-admin

Add the following code to the bottom of the wp-config.php file

define( ‘DISALLOW_FILE_EDIT’, true );

Disable installing plugins and themes in wp-admin

At the bottom of the wp-config.php file, add the following code

define(‘DISALLOW_FILE_MODS’,true);

Chmod file wp-config.php

Set chmod to 400 or 404

Protect wp-config.php with .htaccess

Add the following code to the end of the .htaccess file

# protect wpconfig.php

<files wp-config.php>

order allow,deny

deny from all

</files>

Protect the wp-content folder

Create a .htaccess file and insert the following code

Order deny,allow

Deny from all

<Files ~ “.(xml|css|jpe?g|png|gif|js)$”>

Allow from all

</Files>

Note: If the wp-content folder contains other files related to the WordPress source, you must add their extension (for example woff) to the list above

Lock down the wp-admin path

The wp-admin folder and the wp-login.php file are the main and easiest targets if someone wants to log into your website. To be safe, block all access to these two areas except your own.
Create a .htaccess file in the wp-admin folder and insert the following.

<FilesMatch “.*”>

Order Deny,Allow

Deny from all

Allow from 123.456.789

</FilesMatch>

Here 123.456.789 is your own IP.

Use malware scanning plugins

At this step you may get lucky and learn which files are on your host so you can delete them or download them for study. Here are some of the best plugins you can use to scan your host for malware, completely free:

• Wordfence Scan
• Anti-Malware (Get Off Malicious Scripts)
• 6Scan Security

And if your budget allows, we recommend Sucuri Premium.

You know what your website is missing, but … you is never are not a website management expert and lack the skills for:

• Build a pixel-perfect design that looks exactly the way you want
• Build the features you need to attract users
• Speed and security optimization
• Meet every SEO requirement
• …

MONA Media offers website optimization and upgrade plans tailored to your needs so your website turns out exactly the way you want.

Conclusion:

That is everything we wanted to share to answer your questions about Local Attack and the ways to “vaccinate” your site and defend against local attacks effectively. We hope this knowledge gives you plenty of useful information. Good luck!