LinuxQuestions.org
LinuxAnswers - the LQ Linux tutorial section.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 04-26-2004, 09:56 PM   #1
GarroteYou
LQ Newbie
 
Registered: Feb 2003
Location: Bay Area
Distribution: RH 8.0
Posts: 10

Rep: Reputation: 0
Apache Log file question.


Hello,

I have a question regarding some odd log entries:

They go like this:

66.131.198.154 - - [22/Apr/2004:02:44:04 -0400] "SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1 \x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1

* snip *

\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90 \x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90" 414 339

Can anyone please explain to me what this user was trying to accomplish?
 
Old 04-26-2004, 10:06 PM   #2
Inexactitude
Member
 
Registered: Oct 2003
Distribution: Slackware 12.2, Ubuntu 9.04
Posts: 477

Rep: Reputation: 30
These are various exploits (though their exact names I don't know). I think these are iis or other server exploits. I get these a lot and they seem to have no effect at all. You'll have to get used to log entries like these, becuase a lot of worms like nimba and code red are still scanning the internet, and generate log entries that look like this.
 
Old 04-26-2004, 11:03 PM   #3
GarroteYou
LQ Newbie
 
Registered: Feb 2003
Location: Bay Area
Distribution: RH 8.0
Posts: 10

Original Poster
Rep: Reputation: 0
That is what I thought, but what about the 'SEARCH' query. This is not specified in the http 1.0 or 1.1 RFC's. Is this some kind of stupid Microsoft thing?
 
Old 04-27-2004, 03:27 PM   #4
Inexactitude
Member
 
Registered: Oct 2003
Distribution: Slackware 12.2, Ubuntu 9.04
Posts: 477

Rep: Reputation: 30
To tell you the truth, I have no idea where that one is from, I see it a lot too. I'll do a little research on it and see exactly what it is.
 
Old 04-28-2004, 12:41 AM   #5
GarroteYou
LQ Newbie
 
Registered: Feb 2003
Location: Bay Area
Distribution: RH 8.0
Posts: 10

Original Poster
Rep: Reputation: 0
Thanks for all of the help, I think I found what I was looking for:

http://mail.nessus.org/pipermail/nes...er/000023.html
 
Old 04-28-2004, 03:04 PM   #6
Inexactitude
Member
 
Registered: Oct 2003
Distribution: Slackware 12.2, Ubuntu 9.04
Posts: 477

Rep: Reputation: 30
Okay, looks like a an iis exploit. Wow, what a suprise.
 
Old 05-12-2004, 01:33 AM   #7
e1000
Member
 
Registered: Oct 2003
Location: California
Distribution: Ubuntu
Posts: 582

Rep: Reputation: 30
I have decided to send a polite but informative email to the apropriate email address informing the ISP about one of their customers attempting to attack me.

I know that one person cant make a difference, but if everyone wrote one email a day reguarding these attacks, ill bet that the hackers would eventually loose their ISP accounts due to repeated complaints.

granted, its not prison time, but better than just sitting back and waiting till they download that brand new apache exploit that all their hacker buddies are talking about.
 
Old 05-13-2004, 06:55 PM   #8
Inexactitude
Member
 
Registered: Oct 2003
Distribution: Slackware 12.2, Ubuntu 9.04
Posts: 477

Rep: Reputation: 30
Well, the problem with that is that the attack probably is coming from somebody with the intent to do an attack. Chances are it's just some kind of Windows worm that somebody on a cbale modem got. You really can't expect isps to shut people down just because they're too stupid to keep their machines secure.
 
Old 10-24-2004, 06:51 AM   #9
RWallett
Member
 
Registered: Jan 2002
Location: Anchorage, AK
Distribution: Gentoo, Ubuntu and Slackware
Posts: 38

Rep: Reputation: 15
quote: You really can't expect isps to shut people down just because they're too stupid to keep their machines secure.

Uhhh....yes, you most certainly can. I am an abuse administrator at an ISP in Alaska, and that is *exactly* what I do when I run across users that can't/won't secure their computers. In general, however, after contacting the user a few times to advise them that they have a problem and that they need to fix it or risk losing their accounts--and giving a few helpful pointers to get them on their way--my users eventually either get their computer locked down or replace it with a new one. While some of them will eventually get the new computer infected, etc. a number of them learn a bit about basic security (firewall, anti-virus, anti-spyware, patching the OS, etc.), and cause no more problems.

I *really* wish ISP's could/would communicate better with PC repair shops, however. I can't tell you how many customers I have contacted where there has absolutely, positively been a problem on the customer's machine (typically, malware installed by a trojan for relaying UCE elsewhere), but the PC shop ran a quick A/V, called the computer clean, charged the customer $150 and told them they found nothing...at which point the customer calls in screaming at me because they just spent $150 on a computer that "had nothing wrong with it." And then they get *REALLY* upset when I suspend them again because they are still relaying spam... (Hint for PC repair shop employees: nmap and ethereal are your friends!)

--Mike
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Question about Apache Log File ? jerryjerryjerry Red Hat 0 04-18-2004 06:44 PM
Apache log question--What is this? grizzly Linux - Security 4 09-02-2003 03:18 PM
newb apache log question spooge Linux - Security 1 03-08-2003 08:14 PM
Apache log Question kobe Linux - General 11 09-05-2002 11:53 AM
Apache Log file (httpd.access_log) question eallen Linux - Networking 2 07-02-2002 11:29 AM


All times are GMT -5. The time now is 07:48 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration