Magento – Possible Magento Hack ? Server load very high, with MySQL server has gone away end

MySQLSecurityserver

Short story, this is what happens :

  1. This guy gets on my site like 5-6 times a day, with a different IP
    each time.
  2. He starts browsing alot of pages,adding products to cart,
    adding to compare and so on, that he creates alot of processes on
    the server.

Here's a part of the log:

supergeneratoare.ro:80 GET /putere?dir=desc&limit=all&order=price HTTP/1.1
supergeneratoare.ro:80 GET /catalog/product_compare/remove/product/401/uenc/aHR0cDovL3
supergeneratoare.ro:80 GET /catalog/product_compare/remove/product/362/uenc/aHR0cDovL3
supergeneratoare.ro:80 GET /checkout/cart/add/uenc/aHR0cDovL3d3dy5zdXBlcmdlbmVyYXRvYXJ
supergeneratoare.ro:80 GET /catalog/product_compare/remove/product/406/uenc/aHR0cDovL3
supergeneratoare.ro:80 GET /checkout/cart/ajaxDelete/id/3833/uenc/aHR0cDovL3d3dy5zdXBl
supergeneratoare.ro:80 GET /catalog/product_compare/remove/product/375/uenc/aHR0cDovL3

86.121.192.249 supergeneratoare.ro:80 GET /checkout/cart/add/uenc/aHR0cDovL3d3dy5zdXBlcmdlbmVyYXRvYXJ
86.121.192.249 supergeneratoare.ro:80 GET /checkout/cart/add/uenc/aHR0cDovL3d3dy5zdXBlcmdlbmVyYXRvYXJ
86.121.192.249 supergeneratoare.ro:80 GET /review/product/list/id/330/category/7/ HTTP/1.1
86.121.192.249 supergeneratoare.ro:80 GET /checkout/cart/add/uenc/aHR0cDovL3d3dy5zdXBlcmdlbmVyYXRvYXJ 
86.121.192.249 supergeneratoare.ro:80 GET /catalogsearch/result/index/?mode=list&q=ect+7000 HTTP/1.1
86.121.192.249 supergeneratoare.ro:80 GET /sendfriend/product/send/id/319/cat_id/55/ HTTP/1.1
86.121.192.249 supergeneratoare.ro:80 GET /carcasa-insonorizata-24?dir=asc&limit=all&order=price HTTP
86.121.192.249 supergeneratoare.ro:80 GET /checkout/cart/add/uenc/aHR0cDovL3d3dy5zdXBlcmdlbmVyYXRvYXJ
86.121.192.249 supergeneratoare.ro:80 GET /catalogsearch/result/index/?limit=36&q=7+kva HTTP/1.1
86.121.192.249 supergeneratoare.ro:80 GET /catalogsearch/result/index/?dir=asc&limit=all&order=name&q
86.121.192.249 supergeneratoare.ro:80 GET /catalogsearch/result/index/?dir=asc&limit=36&order=name&q=
86.121.192.249 supergeneratoare.ro:80 GET /catalogsearch/result/index/?dir=desc&order=name&q=kde+100+
86.121.192.249 supergeneratoare.ro:80 GET /generatoare-curent-trifazate?limit=24&mode=grid&p=2 HTTP/1

92.114.94.101 supergeneratoare.ro:80 GET /endress?dir=asc&order=position&p=4 HTTP/1.1
92.114.94.101 supergeneratoare.ro:80 GET /checkout/cart/add/uenc/aHR0cDovL3d3dy5zdXBlcmdlbmVyYXRvYXJ
92.114.94.101 supergeneratoare.ro:80 GET /generatoare-electrice-cu-automatizare?dir=desc&limit=12&or
92.114.94.101 supergeneratoare.ro:80 GET /generatoare-sudura?dir=asc&order=price HTTP/1.1
92.114.94.101 supergeneratoare.ro:80 GET /pramac?limit=36&mode=grid HTTP/1.1
92.114.94.101 supergeneratoare.ro:80 GET /generatoare-sudura?dir=asc&limit=24&order=price HTTP/1.1
92.114.94.101 supergeneratoare.ro:80 GET /701-3000-kva?dir=asc&limit=36&order=position HTTP/1.1
92.114.94.101 supergeneratoare.ro:80 GET /tunuri-lumina?dir=desc&limit=24&order=price HTTP/1.1

What happens is the server load increases and then i get the MySQL has gone away error.
Before you tell me to read similar situations i'm telling you I HAVE, i've been reading each and every single post with this error. I have put max_allowed_packet and wait_timeout correctly, every answer is for a situation when only one error occurs, but nobody has a lunatic on their website starting 20 processes at the same time and feeding them queries until the site goes dead.

I even upgraded my VPS to quad core and 6gb of ram, it should be enough to run a 230 products Magento Website.

Please help me with this, i am willing to hire somebody for the job as long as one can fix this ..

later edit : Please advise me where to start, or what logs to check to see the malicious activity. Probably it's a bot doing all the bad stuff.

I get the feeling that there are 2 guys monitoring the website, both of them using Iphone :
– One guy has Platform iOS 8.1.2 with user agent "Mozilla/5.0 (iPhone; CPU iPhone OS 8_1_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B440 Safari/600.1.4"
– Second guy has Platform iOS 8.3 with user agent "Mozilla/5.0 (iPhone; CPU iPhone OS 8_3 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12F70 Safari/600.1.4"

Whenever one or the other shows up on the site, another ip comes along and site goes down. Each user has more than 30 pages viewed, i have this from opentracker installed.

At the IPs mentioned above in the log , when i find them in opentracker, i see alot of pages visited, products added to compare, and so on.

Running 1.9.0

Best Answer

Lets see, there are multiple places you need to improve to endure such a "attack".

MySql gone away probably means, your webserver is able to handle a lot more requests then your MySql, or if you have both on the same Server, the number of requests affects to much the MySql, like stealing all the CPU or IO time.

Reducing the number of accepted php connections can help a bit, even if this means, users get earlier rejected.

You need to improve your generel performance on the website. There are more complete lists what to do for this, but a few points:

disable visitor logging

Thats one of the most costly parts of a normal website request, as it writes into the databse even on a simple product view. You can disable this by disabling specific observers. I collected once some, so look what each observer I disable here ( https://github.com/Cotya/magento_performance_fixes/blob/master/src/app/code/community/Cotya/PerformanceFixes/etc/config.xml ) does and disable them in your project, if you think you dont need this feature.

An own observer I added there, is for the following

remove category/product ID specific Layout Handles

This Increases the cache sharing a lot, which helps if you get requests on a lot of different URLs. And most people dont write ID specific rules into their layout.xml files. If you did, products and categories allow specifi own layout xml via fields in the admin area.

Increase Product List caching

One of my favorite optimizations, you cache every element(/product) on the list as own entry. Thats a lot of additional cache entries, but means, if the same product gets shown on another category, or people change sort/filter, the single product is still cached and you need less additional querys per product. An example for this is here: https://gist.github.com/Flyingmana/510cee6c7c2668e279ae/revisions

deactivate some functionality

You may have to think if you really need the compare functionality, it can be very performance heavy, and if not much people make use of it at your site, maybe just deactivate it. You absolutely should deactivate the sendfriend functionality, as it allows to send emails to others.

Its not easy to block them, if you cant define a clear pattern how they do requests on your site. But when you can, there is the fail2ban tool, which can automatically block their IPs (even for limited time) if a defined behaviour is detected.