[Xitami] hack attack or just ignorance?

[WhiteShepherd]

     It is either a script to try and hack vulnerable systems or a denial of service attack on 
someone else.  If it is a denial of service attack your IP would of been picked out by a IP 
port scanner.  You and your bandwidth (as well as many others) are are now the 
unwilling participant of a denial of service attack against someone else.  

     In basic form a hacker/worm sends out a packet with a "faked" IP that makes it's way 
to your web server (notice the IP in your log is most likely the victim's IP) .  Your server 
thinking someone is trying to connect sends back a response.  The victims IP cannot 
respond so all servers used as relays sends out 4 packets to the victims IP for every 1 
faked packet they get.  Denial of service attacks are becoming more and more common 
as "kits" begin to spread and new changes are made in windows.  

     There is only two ways of stopping this that I know of (aside from fixing MS security 
flaws).  The best solution would be ISP's block non originating "faked" IP packets.  This 
would kill a mountain of abuse over night.  But it may have to get even worse before the 
major ISP's are forced to change.  The other alternative is to have your server stop 
sending to a IP for say an hour to any server that can't be contacted on initial contact or 
after 3 contacts (or whatever tries).  There may be better ways around this problem.  I 
don't know if the new Xitami can shield itself from this kind of abuse.  But it would be a 
nice feature.

  WhiteShepherd (Gene Angel)  
 
On 11 Apr 2002 at 22:11, Michael Bronder wrote:

> I'm not a hard core user, and I just went to browse through my logs
> directory and found ALOT of lines like the ones below.  Now, the likely hood
> of anyone accessing my sight (archaetext.com) is very slight as I haven't
> told anyone about it.
> 
> These aren't malicious attempts are they?  Perl.exe mysteriously disappeared
> from my machine recently.
> 
> Am I missing a basic security setting or something?
> 
> Thanks,
> 
> mb
> 
> 24.128.19.74 - - [10/Apr/2002:23:54:53 -0500] "GET
> /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
> 24.128.19.74 - - [10/Apr/2002:23:54:57 -0500] "GET
> /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
> 24.128.19.74 - - [10/Apr/2002:23:54:58 -0500] "GET
> /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
> 24.128.19.74 - - [10/Apr/2002:23:55:02 -0500] "GET
> /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
> 24.128.19.74 - - [10/Apr/2002:23:55:03 -0500] "GET
> /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 0
> 
> 
> --
> Xitami Users Mailing List -- For Xitami support
> To unsubscribe: http://lists.xitami.org/mailman/listinfo/xitami