[Xitami] hack attack or just ignorance?

[Jay Moore]

>      It is either a script to try and hack vulnerable systems or a denial
of service attack on
> someone else.  If it is a denial of service attack your IP would of been
picked out by a IP
> port scanner.  You and your bandwidth (as well as many others) are are now
the
> unwilling participant of a denial of service attack against someone else.

Your PC can't be used in DOS if it's locked down.

>
>      In basic form a hacker/worm sends out a packet with a "faked" IP that
makes it's way
> to your web server (notice the IP in your log is most likely the victim's
IP) .  Your server
> thinking someone is trying to connect sends back a response.  The victims
IP cannot
> respond so all servers used as relays sends out 4 packets to the victims
IP for every 1
> faked packet they get.  Denial of service attacks are becoming more and
more common
> as "kits" begin to spread and new changes are made in windows.

If this were true..you'd see a LOT more than the random occurance and those
simply aren't DOS type attacks..they're not even attacks.
>
>      There is only two ways of stopping this that I know of (aside from
fixing MS security
> flaws).  The best solution would be ISP's block non originating "faked" IP
packets.  This
> would kill a mountain of abuse over night.  But it may have to get even
worse before the
> major ISP's are forced to change.  The other alternative is to have your
server stop
> sending to a IP for say an hour to any server that can't be contacted on
initial contact or
> after 3 contacts (or whatever tries).  There may be better ways around
this problem.  I
> don't know if the new Xitami can shield itself from this kind of abuse.
But it would be a
> nice feature.

There really is no way you can stop this. I have this on my server. It
happens when someone on your subnet is infected with Nimdia/Code Red (not
just servers, remember, regular users can get infected and spread it too).

This does no harm to your system, runs the amounts of hits up, but other
than that, no harm whatsoever. Don't freak out over it, you'll be fine.

The good thing is that it's only done on IP's and not domains. Weather
Xitami could shield itself, you could BAN people who do this..but then you
pose a lot of problems. All you can do is not worry about. All sysadmins get
it, we're running Xitami, it doesn't affect us.