Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

For many years, my personal web site receives numerous pairs of hits that look like this, every day:

202.xx.xx.xx - - [22/Apr/2013:12:02:26 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04"
202.xx.xx.xx - - [22/Apr/2013:12:02:27 +0000] "GET / HTTP/1.1" 200 5923 "-" "Java/1.4.1_04"

The only thing the requests have in common is the "GET / HTTP/1.1" query, the Java user agent, and the fact that they come in pairs. Forensic logs don't reveal any other distinguishing qualities. The Java versions vary all over the map, as do the source IP addresses. I suspect that someone very antisocial has coded a semi-popular Java app that pings my site in this way, just to annoy.

No matter what response I send (2xx, 3xx, 4xx, 5xx, responses with images, responses with a thousand nested <div>s, etc.) the behavior from the clients is identical. Some of the client IP's seem to be servers, while others are residential connections. An email campaign attempting to notify/query the holders of the more identifiable addresses did not produce any useful clues as to the identity of the application.

This abuse isn't exactly a strain on my servers, but it's annoying. How can I identify the Java program that is responsible?

share|improve this question
    
Just to add a detail - the specific user-agent is listed on various "slightly dodgy" websites as both a JavaScript exploit payload bot and a data scraper. –  Sébastien Renauld Apr 24 '13 at 19:58
add comment

4 Answers

The "user agent" is a string sent by whoever connects to your system -- the antisocial individual. Therefore, you cannot really trust it. Which means that you cannot assume that this client really uses Java. Actually, if the Java version is "all over the map", then this is a strong indication that the client is not using Java. A real Java-based standard HTTP client will return the version of the employed JDK; 1.4.1_04 is really old, and might not work anymore with a recent operating system.

So my opinion is that you can strike out the "Java" keyword in your search. These requests are probably the works of a botnet which tries to spread; the infected machines send these HTTP requests in order to get some information on random Web servers (e.g. server software version), and they disguise as "Java requests" in order to avoid some poorly-configured firewalls and filters.

This is not done to annoy you. It actually annoys everybody. All publicly available servers will receive requests such as yours; replicating botnets just use random IP addresses, and you cannot evade randomness. I get some on my own server, too.

share|improve this answer
    
"The infected machines send these HTTP requests in order to get some information on random Web servers." Can you elaborate on this? What is the purpose of that behavior? –  ruief Apr 24 '13 at 15:00
    
The infected machines try to locate other machines which could be infected, by virtue of sporting server software versions with known remotely exploitable holes. If a server, contacted by an infected machine, returns "foobar v42.17" and the botnet software knows how to infect servers which use "foobar v42.17", then the infected machine will automatically proceed to infect that server and make it join the botnet. –  Tom Leek Apr 24 '13 at 15:08
    
Sounds plausible, but I don't understand why it would be banging on my site for years, while the ~100 other sites I host have never seen this pattern of requests. –  ruief Apr 24 '13 at 15:35
    
Your personal web site is not, by any chance, the default server vhost of that machine, is it? If someone connected to the machine by IP instead of by hostname, it wouldn't appear in your personal website's logs, or would it? –  lserni Apr 24 '13 at 16:04
    
@lserni No it's not. The request contains a Host header with the name of the site. Good question though. –  ruief Apr 24 '13 at 16:24
add comment

You could try to sting them. Setup some type of account that you can trace access to. Then let them steal some fake information from you that grants them access. When they try to access it maybe they won't be so careful and give themselves away.

Of course it just sounds like just a typical broadcasted ping. So probably not worth all the trouble.

share|improve this answer
add comment

Have you tried sending 404, 503, or even 301 redirects to that IP when it sends requests? I wonder if sending a 301 redirect for a month would make it go bug Google instead? Far-fetched, but might be worth a shot.

share|improve this answer
    
Well, it is an answer of a kind. Another possibility would be to tarpit the connections, either gracefully (haproxy?), or brusquely (iptables), leaving the resource load on the client's side. That Java string is a natural for the string match module. –  lserni Apr 24 '13 at 16:51
    
I have tried all kinds of responses. They have no effect on the behavior of the client, as far as I can tell. It doesn't follow redirects, doesn't fetch page requisites, or anything like that. –  ruief Apr 24 '13 at 18:22
add comment

I have info on this that may help people out. I recently registered three web sites with "Web of Trust" (WOT), a company that is based in Helsinki, Finland. They completely down-rated my sites stating a reason that my domain name showed up as a 'hidden registrant'. The treatment I got seems highly unethical, yet they claim it to be ethical. I cannot get them to undo the damage. Norton SafeWeb in the meantime had no problems giving my sites an OK rating.

But keeping that as a related note and coming more to the point, I started getting the Java1.4.1_04 entries in my logs shortly after registering the new sites with WOT. All of the bad actor accesses originated from European sources, Norway, Sweden, Spain, England, etc. I also looked up some IPs on ip lookup:

whatismyipaddress

and found some disturbing stuff, all of which began occurring after registering my web sites with web of trust.

whatismyipaddress reported these sites as being reported by users, hundreds of times, as "Possible Forum Spammers".

It would seem from my horrible experience, that Web of Trust cannot be trusted. You must judge for yourself, however. Their forum moderators are US based to handle english language and seem to be inflexible and ego-blown, power-trippers.

Here are links to show what they did to my sites:

http://www.mywot.com/en/scorecard/avenuesplus.com http://www.mywot.com/en/scorecard/circanova.com

I am only allowed to post 2 URLs here; there is a third site that was badly rated as well.

Here are links to Norton SafeWeb for same sites:

Sorry, this site won't let me post the other links, as I am new to security stack exhange. But you can look up my sites, AVenuesPlus, CircaNova and VeteransAssembly on SafeWeb.

At the time of this posting, SafeWeb has yet to test circanova, but it should be fine when they do.

Based on my recent experiences with WOT and the bad actor traffic my websites have received after signing up my sites with WOT, I advise extreme caution, should you consider registering for the WOT service, EXTREME CAUTION.

WOT apparently has set themselves up as the LAW when defining what is trustworthy on the net. It is so egregious how they have treated me, that I have been compelled to write Senator Barbara Boxer for help regarding this issue requiring attention related to Telecom/Broadcast legislation.

Beware.

If you are getting your Java1.4.1_04 problems after registering with WOT, confirm so at this site and other security related sites, so that others may be alerted and be able to avoid risks.

------ Additional edits added 08/14/2013

If you are a site owner and have started seeing these things in your logs, enter the ip addresses in your .htaccess file

deny from ipaddreass

You'll likely have a growing list of such deny directives.

You'll see more than just Java1.4.1_04 Also things like Java/1.6.0_30 and others.

It's easy for me to see these bad entries right now because my sites are new with low traffic.

After signing up with Web of Trust (WOT), I also see things like this ...

/wp-login.php?action=register

There is of course, no such php file in my applications, but these clowns try what they may have broken somewhere else for say, a WordPress site. My site is NOT WordPress, wp-login?

Add IPs that do this sort of thing to .htaccess as well.

Not many people who have had their sites defamed by WOT are aware that the defamation is only the visible part of the problem. The hidden part of the myWOT cyber-criminal activity is only revealed in their logs and they need to pay attention to them.

My site was defamed because of 'hidden registrant'. It is now obvious to me that the WOT criminals wanted me to show my email and address data in whois, for god knows what evil intent.

Again, BE EXTREMELY CAUTIOUS about considering registering your sites on Web of Trust.

share|improve this answer
    
Maybe malicious web scanners used the WOT database as a data source? This 'answer' is completely inappropriate, rambling, and not related to the OP's question. –  schroeder Aug 15 '13 at 15:03
    
This answer is meant to help others avoid the WOT trap. It is an important security issue to prevent web applications from being defamed and maligned for no good reason. If you want to take the risk, go sign up your sites with WOT and find out the hard way. I'd take heed; do some research and avoid. –  Brian Donat Aug 16 '13 at 15:14
    
But again, this has NOTHING to do with the question at hand. –  schroeder Aug 16 '13 at 21:33
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.