Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite
1

I recently found this request in the event log:

Client IP: 193.203.XX.XX
Port: 53080
User-Agent: Mozilla/4.0 (compatible; Synapse)
ViewState: -1'
Referer:

Now, the ViewState: -1' part combined with the origin of the IP address (Ukraine, we don't have clients there) makes it look suspicious to me. Is this a new kind of attack and should I be worried?

Update

Here's the log:

2012-08-14 10:13:17 GET /Gesloten.aspx - 80 - 193.203.XX.XX Mozilla/4.0+(compatible;+Synapse) 200 0 0 546
2012-08-14 10:13:17 POST /gesloten.aspx - 80 - 193.203.XX.XX Mozilla/4.0+(compatible;+Synapse) 500 0 0 218
share|improve this question
4  
Is this the only occurrence from this IP? For me the suspicious part is the " ' " character, which is often used for probing SQL injection vulnerabilities. – ephrack Aug 14 '12 at 11:57
I have the same thing in my logs. In the past 30 days I have hits from 40 different IPs with that User Agent. They range from a minimum of 6 hits to over 30. To me it seems like it's a naive probing attempt looking for some specific type of vulnerability. It's annoying as hell. More info here: goo.gl/baHJn – Hellfire Mar 12 at 14:39

4 Answers

up vote 3 down vote accepted

As long as you have taken all the usual security precautions, this isn't anything to worry about.

On a website I maintain, I have set it up so any uncaught errors are logged and emailed to me. I often open my inbox to find similar requests. The usual pattern in my experience is for the crawler to scan for all <input> tag names and set the value of each to -1' in turn.

This is normally accompanied by a poor attempt at spoofing the ViewState, which invariably fails because not only do they have no chance of generating a valid ViewState to match their fake request, they also seem to just put a load of random alphanumerics (rather than actually construct a valid Base-64 encoded string).

share|improve this answer
I too have been seeing these attempts at probing by setting different query parameters to -1, but here's the strange part: one of the query params being sent is the session GUID of another legitimate user surfing the site at the exact same time. (From a different IP.) The probes seem to come from a rotating set of IPs, no more than 5 or 6 requests from each, then a new IP with the same signature. The entire site is encrypted over HTTPS so I'm not sure how this attack-bot (or whatever we want to call it) is obtaining this. My guess? Malware on legitimate user's computer transmitting somewhere? – Funka Apr 18 at 18:58
up vote 6 down vote

Synapse is an Apache server designed for managing XML documents. It's highly unusual to see it in a user agent. The -1 doesn't look like a real attack, it's more likely a probe to work out what version of IIS you're using.

I found a similar question on ServerFault that mentioned the Synapse header, which resulted in a consensus that the traffic was not legitimate.

To be safe, I suggest blacklisting the IP address.

share|improve this answer
I would also disable Synapse if you are not using it. At the very least change the default configuration. – Ramhound Aug 14 '12 at 11:27
It's IIS and I guess Synapse is something Apache. – jao Aug 14 '12 at 12:48
1  
@Ramhound The Synapse text is in the request header, i.e. it's coming from the client. This is highly unusual. – Polynomial Aug 14 '12 at 12:50
1  
I would not blacklist it. If you have a security leak, some day someone is going to find it. Blacklisting a possible bad IP you happen to notice is not patching the leak, it's security through obscurity. The only reason to ever blacklist an IP is when they attempt to disrupt the service by overloading. – Luc Aug 14 '12 at 15:27
@Luc Patching takes time. In the meantime, a proactive block is worth doing. Then you can remove the block after it's all patched up. – Polynomial Aug 14 '12 at 15:49
show 3 more comments
up vote 3 down vote

According to user-agents.org it is Apache web service for processing XML documents.

The apache documentation can be found here. An excerpt of the documentation sais:

Synapse: A Web service Mediation Framework project

Synapse will be a robust, lightweight implementation of a highly scalable and distributed >service mediation framework on Web services specifications.

I have only seen this user-agent once over 10 years. I would pay extra attention to that IP address, but I would not neccessarily block it. Often there is a whole lot of wierd user-agents hitting public IP addresses, so this will probably not be the first. I would not treat it as an attack, but maybe as an intial probe in an reconnaissance.

share|improve this answer
In this case I believe user-agents.org is wrong. The UA header Apach Synapse sets is "Synapse-HttpComponents-NIO". There is more information here: webmasterworld.com/search_engine_spiders/4532904.htm – Hellfire Mar 12 at 14:32
up vote 2 down vote

Providing a ViewState of -1' will cause an exception on some systems. Based on the exception message I don't believe this issue is exploitable. However the attacker may be profiling your server for other attacks. I am almost certain other requests where sent by this IP address, without logs of these requests it will be very difficult (impossible) to figure out what the attacker is doing.

share|improve this answer
Thanks. See the update. – jao Aug 14 '12 at 15:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.