15

Over the last six months or so (after publishing a certain article) my site has being pestered with a number of requests URIs that follow this pattern:

/warning.php++++++++++++++++++++++++++++++++++Result:+chosen+nickname+%22doudounemonclerfemmez.webs.comoV%22;+success;

The Requester IP-address and the quoted chosen nickname is different in each request, otherwise the pattern is the same.

The page requested (warning.php) is a real page on my site that mentions a specific hacker group (not "anonymous" btw.) in non-flattering terms. The fact that this specific page is targeted may indicate that they may be irritated - or it may just be a coincidence.

The hacker group in question is (IMHO) an obnoxious bunch of criminals, but they are also quite good at what they do. However, I don't see this as a compentent attack. To me, it looks more like a script-kiddie thing than something a real hacker would try. I really don't understand what padding a legitimate page request with a lot of spaces and some random "chosen nickname" is supposed to accomplish. To me, it does not look like an injection attack. The requests are persistent, but only 40-60 per day - so it is not even some sort of DoS attack.

I've googled for this pattern, but only found this: http://en.forums.wordpress.com/topic/hacked-by-f34rl355-i-guess - which suggests that this is script-kiddie work. However, the fact that whoever doing this has at his disposal at vast number of IP-addresses points in the opposite direction. I've discounted the theory of multiple script-kiddies, since I know of no "script" that have this "thing" as a component, and since all requests are for the same specific page.

What make me a bit concerned is that 1) whoever is doing this is persistant; 2) it targets a specific page on my site.

My specific questions here are:

  1. Can anyone see what the person doing this is trying to accomplish?
  2. Should I be concerned?
2
  • Hmm, not sure then, don't know much about their makeup. Jan 7, 2013 at 15:29
  • I don't think this is especially targeted at you or your article. It's a pattern I see repeatedly in links embedded into comment spam hitting spamfilters. So this shows signs of beeing a bot(-net?) running wild.
    – Nicktar
    Jan 7, 2013 at 15:33

5 Answers 5

16

Your initial reaction is correct - this is a malicious request. The attack seems to be attempting to leverage an authentication bypass bug in a plugin, but I can't find which one. The attack seems to have been reasonably successful, since a large number of sites that show up on Google are now displaying pharma spam. I'd imagine the attacker is using a botnet or Tor to perform the attacks.

As far as mitigation goes, just block the requests with a firewall or WAF that supports pattern-based blocking. If you can do a regex pattern block, this will work as long as case sensitivity is disabled:

^\/warning\.php\+*Result:\+chosen\+nickname\+.*success;$
2
  • 1
    Thanks for the quick reply, that makes sense (I already block these). However, the site in question is static HTML. No WordPress, no plugins. Shouldn't a competent hacker be able to figure that out, and understand that this exploit is useless against my site? Jan 7, 2013 at 9:39
  • 1
    It's probably automated. They'll be using a Google Dork or a similar pattern-based search that is likely just throwing a false positive on your site. Either way, they're clearly not very smart.
    – Polynomial
    Jan 7, 2013 at 9:40
1

There are literally hundreds of "exploit" kits that scan for vulnerable software and attempt to exploit the servers that host them. Some of the more primitive exploit kits will not confirm if a specific product or version of software is running before firing the payload. In your case it seems this is the case and as you say your site is static you should have nothing to worry about in terms of the application being exploited.

Well done being vigilant though, check the whois record for the domains, it may be worth reporting them as the owner may not know they have been a victim of an attack.

1

I use the following code in .htaccess:

# Removes hacking attempts from url, such as: /RK=0/RS=AYp9kgWwyL1Te5LIMYeMtv4cBVQ-
RewriteRule ^(.*)RK= /$1 [L,NC,R=301]
# Removes author attempts from url, such as: /author
RewriteRule ^(.*)author /$1 [L,NC,R=301]
# Removes trackback attempts from url, such as: /trackback
RewriteRule ^(.*)trackback /$1 [L,NC,R=301]
# Removes hacking attempts from url, such as: +Result:+chosen+nickname+"acqqicny06";+success+(from+first+page);
RewriteRule ^(.*)\+Result:\+chosen /$1 [L,NC,R=301]
2
  • 1
    This doesn't answer the question, which is 'what is the attack trying to do, and should the OP be concerned' not 'how do I fix it'
    – Rory Alsop
    May 22, 2014 at 10:27
  • 1
    You are right, but in this case, having the right answer will not do anything to prevent the hacking attempt. That code in .htaccess prevents the hacking attempt (without needing to know attack specifics), and without blocking the IP address, in case there are legitimate users at the same IP. I am sure it is not the ideal solution, but it does prevent the hacking attempt. I only posted because I thought another reader might find it helpful. Thanks.
    – ovtorne
    May 26, 2014 at 17:12
0

It's not an attack per se, it's an attempt to leave a "success signature" by XRumer spam software.

2
  • Care to elaborate?
    – Navin
    Jan 26, 2016 at 1:57
  • 1
    XRumer is a forum spamming software that - among other things - finds permissive forums by attempting to post this string and then checking if it appeared in the forum. If it succeeds, the forum will be added to its library of spam-friendly forums and use for spam in subsequent runs.
    – kravietz
    Feb 16, 2016 at 21:46
0

Right now, I'm encountering a very similar attack on our OpenWGA site with a different nickname. However, I think it is a try to post automated spam comments on some kind of PHP blog/forum software

I googled the "extra data" of the URI and found some log about wrong CAPTCHA attempts (might be short-lived) that had this data in its referrer URL. The request data is logged there. Excerpt:

[REQUEST_URI]     /forum_p/forum_p.php
[HTTP_REFERER]    http://www.vpi-sa.de/forum_p/forum_p.php?
                  msg=78+++++++++++++++++++Result:+chosen+nickname+%22Sareambimbkaw%22;+success;+Result:+chosen+nickname+%22teetlyHyday%22;+success;+Result:+chosen+nickname+%22infetEtig%22;+success;+Result:+chosen+nickname+%22AlbertOn%22;+success;
[HTTP_USER_AGENT] Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

The message is some HTML spam text for an online outlet store, which I don't want to repeat here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .