About: Richard Ziegler

Thanks, I will chat with them a bit and see what they have to say about it and maybe I can get more information about the type of attack and how to prevent it. I think you are correct, there is some terminology confusion going on here.

It may have started as brute force, but I think S2member locked it out, and the repeated attempts during the lockout bogged the server down and that’s when they took whatever action they did. I’m reading between the lines but I think they took my site offline during the attack, honestly I don’t have a huge problem with that. Best way to thwart an attack is to remove the target. It was only down for a few hours and they restored it immediately after talking with me.

I know they have since banned the IP the attack came from so hopefully the hacker will move on to a softer target. I appreciate the help and thanks for doing your best to answer my questions even if they did stray a bit from the S2member side of the equation. I do believe we have this resolved now and I’m glad I invested in S2member because it’s already protected my installation once! Hopefully it won’t be a regular occurrence. Thanks again.

Rich

It is currently set to punish after 3 login attempts, it was set to defaults prior to the attack, punishing for 30 minutes after 5 failed login attempts. I verified this while on the phone with tech support right after they restored the account to active service.

I tested this myself this afternoon with a mobile hotspot. I deliberately gave the wrong password 3 times and it locked me out, I verified I was locked out by ensuring I used the correct password and username and I still couldn’t gain access to the admin area due to the 30 minute punishment window.

So new question, is it possible that S2member was working perfectly, and locked the hacker out, but his continued attempts to submit password and username combos was putting stress on the server? The login form is still available, you can still submit a user/pw combo even when locked out, might that have been what was bogging down the server?

They took my whole site offline when their server CPU usage spiked from the brute force attack. The tech on the phone verified that the hacker was trying multiple combos per second. That stressed the server, and it either took my account offline automatically or one of the techs was alerted to the attack and did it manually. Either way, the server was apparently still taking a pretty heavy resources hit.

Is that normal even if they are locked out? Or should the strain on the server have been averted when the hacker was locked out after hitting the limit for failed login attempts?