Home Alone
Customer
I went live with the shop addon and enabled the steal function. Some users created a bot that when it found someone with a high amount of credits it kept stealing from them in rapid fashion until all of their credits were gone. The result of this was a DOS like attack on the server that kept resulting in Nginx gateway errors. When I investigated I saw hundreds of these mysql processes running at once:
# User@Host: newlsa[newlsa] @ [192.168.0.72]
# Thread_id: 19575537 Schema: newlsa QC_hit: No
# Query_time: 1.211768 Lock_time: 0.000010 Rows_sent: 5 Rows_examined: 391458
# Rows_affected: 0 Bytes_sent: 36818
SET timestamp=1616974924;
SELECT
FROM
WHERE (
ORDER BY
LIMIT 5;
# Time: 210328 18:42:05
# User@Host: newlsa[newlsa] @ [192.168.0.72]
# Thread_id: 19575593 Schema: newlsa QC_hit: No
# Query_time: 1.268547 Lock_time: 0.000009 Rows_sent: 5 Rows_examined: 391458
# Rows_affected: 0 Bytes_sent: 36818
SET timestamp=1616974925;
SELECT
FROM
WHERE (
ORDER BY
LIMIT 5;
I had to shut the webservers down to allow the MySQL server to catch up.
Is there a way to throttle the steal function? Is there a way to limit the number of steal attempts allowed in one day?
# User@Host: newlsa[newlsa] @ [192.168.0.72]
# Thread_id: 19575537 Schema: newlsa QC_hit: No
# Query_time: 1.211768 Lock_time: 0.000010 Rows_sent: 5 Rows_examined: 391458
# Rows_affected: 0 Bytes_sent: 36818
SET timestamp=1616974924;
SELECT
xf_user.*FROM
xf_userWHERE (
xf_user.is_banned = 0) AND (xf_user.user_state = 'valid')ORDER BY
xf_user.dbtech_credits_credits DESCLIMIT 5;
# Time: 210328 18:42:05
# User@Host: newlsa[newlsa] @ [192.168.0.72]
# Thread_id: 19575593 Schema: newlsa QC_hit: No
# Query_time: 1.268547 Lock_time: 0.000009 Rows_sent: 5 Rows_examined: 391458
# Rows_affected: 0 Bytes_sent: 36818
SET timestamp=1616974925;
SELECT
xf_user.*FROM
xf_userWHERE (
xf_user.is_banned = 0) AND (xf_user.user_state = 'valid')ORDER BY
xf_user.dbtech_credits_credits DESCLIMIT 5;
I had to shut the webservers down to allow the MySQL server to catch up.
Is there a way to throttle the steal function? Is there a way to limit the number of steal attempts allowed in one day?
