Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Over the last six months or so (after publishing a certain article) my site has being pestered with a number of requests URIs that follow this pattern:

/warning.php++++++++++++++++++++++++++++++++++Result:+chosen+nickname+%22doudounemonclerfemmez.webs.comoV%22;+success;

The Requester IP-address and the quoted chosen nickname is different in each request, otherwise the pattern is the same.

The page requested (warning.php) is a real page on my site that mentions a specific hacker group (not "anonymous" btw.) in non-flattering terms. The fact that this specific page is targeted may indicate that they may be irritated - or it may just be a coincidence.

The hacker group in question is (IMHO) an obnoxious bunch of criminals, but they are also quite good at what they do. However, I don't see this as a compentent attack. To me, it looks more like a script-kiddie thing than something a real hacker would try. I really don't understand what padding a legitimate page request with a lot of spaces and some random "chosen nickname" is supposed to accomplish. To me, it does not look like an injection attack. The requests are persistent, but only 40-60 per day - so it is not even some sort of DoS attack.

I've googled for this pattern, but only found this: http://en.forums.wordpress.com/topic/hacked-by-f34rl355-i-guess - which suggests that this is script-kiddie work. However, the fact that whoever doing this has at his disposal at vast number of IP-addresses points in the opposite direction. I've discounted the theory of multiple script-kiddies, since I know of no "script" that have this "thing" as a component, and since all requests are for the same specific page.

What make me a bit concerned is that 1) whoever is doing this is persistant; 2) it targets a specific page on my site.

My specific questions here are:

  1. Can anyone see what the person doing this is trying to accomplish?
  2. Should I be concerned?
share|improve this question
    
Hmm, not sure then, don't know much about their makeup. –  AJ Henderson Jan 7 '13 at 15:29
    
I don't think this is especially targeted at you or your article. It's a pattern I see repeatedly in links embedded into comment spam hitting spamfilters. So this shows signs of beeing a bot(-net?) running wild. –  Nicktar Jan 7 '13 at 15:33

5 Answers 5

up vote 15 down vote accepted

Your initial reaction is correct - this is a malicious request. The attack seems to be attempting to leverage an authentication bypass bug in a plugin, but I can't find which one. The attack seems to have been reasonably successful, since a large number of sites that show up on Google are now displaying pharma spam. I'd imagine the attacker is using a botnet or Tor to perform the attacks.

As far as mitigation goes, just block the requests with a firewall or WAF that supports pattern-based blocking. If you can do a regex pattern block, this will work as long as case sensitivity is disabled:

^\/warning\.php\+*Result:\+chosen\+nickname\+.*success;$
share|improve this answer
    
Thanks for the quick reply, that makes sense (I already block these). However, the site in question is static HTML. No WordPress, no plugins. Shouldn't a competent hacker be able to figure that out, and understand that this exploit is useless against my site? –  Free Radical Jan 7 '13 at 9:39
1  
It's probably automated. They'll be using a Google Dork or a similar pattern-based search that is likely just throwing a false positive on your site. Either way, they're clearly not very smart. –  Polynomial Jan 7 '13 at 9:40

I use the following code in .htaccess:

# Removes hacking attempts from url, such as: /RK=0/RS=AYp9kgWwyL1Te5LIMYeMtv4cBVQ-
RewriteRule ^(.*)RK= /$1 [L,NC,R=301]
# Removes author attempts from url, such as: /author
RewriteRule ^(.*)author /$1 [L,NC,R=301]
# Removes trackback attempts from url, such as: /trackback
RewriteRule ^(.*)trackback /$1 [L,NC,R=301]
# Removes hacking attempts from url, such as: +Result:+chosen+nickname+"acqqicny06";+success+(from+first+page);
RewriteRule ^(.*)\+Result:\+chosen /$1 [L,NC,R=301]
share|improve this answer
    
This doesn't answer the question, which is 'what is the attack trying to do, and should the OP be concerned' not 'how do I fix it' –  Rory Alsop May 22 at 10:27
    
You are right, but in this case, having the right answer will not do anything to prevent the hacking attempt. That code in .htaccess prevents the hacking attempt (without needing to know attack specifics), and without blocking the IP address, in case there are legitimate users at the same IP. I am sure it is not the ideal solution, but it does prevent the hacking attempt. I only posted because I thought another reader might find it helpful. Thanks. –  ovtorne May 26 at 17:12

Right now, I'm encountering a very similar attack on our OpenWGA site with a different nickname. However, I think it is a try to post automated spam comments on some kind of PHP blog/forum software

I googled the "extra data" of the URI and found some log about wrong CAPTCHA attempts (might be short-lived) that had this data in its referrer URL. The request data is logged there. Excerpt:

[REQUEST_URI]     /forum_p/forum_p.php
[HTTP_REFERER]    http://www.vpi-sa.de/forum_p/forum_p.php?
                  msg=78+++++++++++++++++++Result:+chosen+nickname+%22Sareambimbkaw%22;+success;+Result:+chosen+nickname+%22teetlyHyday%22;+success;+Result:+chosen+nickname+%22infetEtig%22;+success;+Result:+chosen+nickname+%22AlbertOn%22;+success;
[HTTP_USER_AGENT] Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

The message is some HTML spam text for an online outlet store, which I don't want to repeat here.

share|improve this answer

It's not an attack per se, it's an attempt to leave a "success signature" by XRumer spam software.

share|improve this answer

There are literally hundreds of "exploit" kits that scan for vulnerable software and attempt to exploit the servers that host them. Some of the more primitive exploit kits will not confirm if a specific product or version of software is running before firing the payload. In your case it seems this is the case and as you say your site is static you should have nothing to worry about in terms of the application being exploited.

Well done being vigilant though, check the whois record for the domains, it may be worth reporting them as the owner may not know they have been a victim of an attack.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.