0

Revising the file access.log in a server I've noticed the classic attacks, requesting for login.php, membersHandler.ashx, etc. but this is strange to me:

198.51.100.22 - - [02/Oct/2018:02:20:20] "V\x00Y\x00z\x005\x00z\x00V\x00\x06\x00!\x00V\x00\xE9\x00W\x00W\x00\xEA\x00\xEB\x00\xCC\x00\xCC\x00\xCC\x00\xA5\x00\xCC\x00\xE9\x00\xB0\x00!\x00\xE9\x00\xCC\x00{\x00z\x00Y\x00|\x00(\x00W\x00|\x00!\x00\xE9\x00\xA5\x00\xE9\x00\xB0\x00!\x00{\x00|\x00(\x00\xE9\x00(\x00{\x00(\x00\xE9\x00Y\x00(\x00\xA5\x00\xA5\x00\xA5\x005\x00\xB0\x00\xB0\x00Y\x00\xEA\x00|\x00!\x00W\x00\xEB\x00V\x00\xCC\x00{\x00\xA5\x00\xCC\x00V\x00\xCC\x00W\x00\xCC\x00|\x00V\x00|\x00{\x00!\x00\x06\x00\xCC\x00|\x005\x00(\x00\xB0\x00{\x00\xEB\x00\xCC\x00W\x00\xEA\x00\xCC\x00\xEB\x00V\x00\x06\x00|\x00\xE9\x00{\x00\xE9\x00\x06\x00\xEB\x00Y\x00\xE9\x00Y\x00\xB0\x00\xCC\x00Y\x00\xCC\x00\xEA\x00V\x00\xB0\x00!\x00\xEA\x00\xA5\x00\xE9\x00{\x00\x06\x005\x00\xEA\x00\xB0\x00|\x00(\x00\x06\x00\xEB\x00!\x00|\x00Y\x00!\x005\x00Y\x00\xA5\x00\xB0\x00W\x00\xEA\x00W\x00\xA5\x005\x00\x06\x00\xE9\x00{\x00{\x00z\x00\x06\x00{\x005\x00|\x00z\x00\xE9\x00z\x00W\x00\xB0\x00!\x00|\x00\xB0\x00(\x00\xB0\x00\xE9\x00\xEA\x00{\x00\xEB\x00\xA5\x00\xEA\x00\xEA\x00{\x00|\x00\xA5\x00z\x00\xA5\x00V\x00\xA5\x00!\x00\xA5\x00\xEB\x00V\x00W\x00\xEB\x00\xEA\x00z\x00\xEB\x00V\x00!\x00{\x00W\x00\xA5\x00\x06\x00W\x00V\x00\xCC\x005\x00Y\x00z\x005\x005\x00\xEB\x005\x00\xCC\x00z\x00\x06\x00\xCC\x00\xEA\x00Y\x00V\x00V\x00\xE9\x00\x06\x00|\x00\xA5\x00\x06\x00Y\x00\xEA\x00\xA5\x00|\x00\xB0\x00\xB0\x00V\x00z\x00z\x00{\x00\xEB\x00W\x00\xEB\x00Y\x00(\x00|\x005\x00W\x00\x06\x00W\x00z\x005\x00z\x00\x06\x00W\x00\xEA\x005\x005\x00\xEB\x00!\x00\xEB\x00\xB0\x00\xB0\x00(\x005\x00|\x00\xCC\x00W\x00{\x00Y\x005\x00(\x00\xB0\x00V\x00\xEB\x005\x00|\x00V\x00\xEA\x00\xB0\x00\xCC\x00\xEA\x00(\x00{\x00!\x00\xEB\x00(\x00\x06\x00z\x00z\x00(\x00!\x00\xCC\x00\xB0\x00\xEA\x005\x00\x06\x00W\x00\xA5\x00\xE9\x00|\x00\xB0\x00\x06\x00{\x00Y\x00\xA5\x00|\x00V\x00{\x00\xEA\x00\x06\x00\xEB\x00\xEB\x00W\x00!\x00|\x00\xEB\x00\x06\x00\xEA\x00W\x00\xE9\x00\xE9\x00W\x00(\x00|\x00!\x00!\x00V\x00|\x00\x06\x00W\x00\xCC\x00z\x00Y\x00\xA5\x00z\x00Y\x00(\x00(\x00\x06\x00\xE9\x00!\x00\xB0\x00\xE9\x00\xCC\x00Y\x00!\x00|\x00Y\x00Y\x00z\x00Y\x00V\x00(\x00\xEB\x00\xB0\x00|\x00W\x00Y\x00\xCC\x00{\x00\xCA\x00" 400 166 "-" "-"

The IP and hour are ficticious, but I want to know what's the name of the attack to get more info, and how to protect the server against these attacks.

PS: The server is still not in production, it just has an "under construction" page.

  • 1
    What makes you think that this is an attack? Not everything which ends up in the log file is caused by explicit attacks, it can also be someone sending data accidentally to the wrong target. Also, if a server is properly handling input it will discard invalid input and there is no need to explicitly protect the server against this. – Steffen Ullrich Oct 3 '18 at 1:34
  • @SteffenUllrich, actually I think it's a bot rather than an direct attack, because there is no User-Agent string, even Lynx identifies itself. But I will follow your logic, and keep calm. – Alcides Oct 3 '18 at 3:49
  • 1
    If something sends non-HTTP data against the HTTP server and the server still tries to interpret the data in some way this is what you get. And of course there will be no user-agent HTTP header to be found to log. Apart from that, many bots have a user-agent header, sometimes claiming to be some browser in order to stay undetected as bots. – Steffen Ullrich Oct 3 '18 at 5:19
5

Everything there seems to indicate that someone tried to talk to your web server using the wrong protocol.

Lack of a user agent means no User-Agent header was sent. Assuming you're using a standard HTTP log format, it looks like you got no Host header either. That combination by itself is reasonably indicative of someone using the wrong protocol, and the 400 response code adds to this.

The actual request string is binary data. \x00 is C-style string escape code notation, indicating a byte with a hexadecimal value equal to the two characters after the \x. The request string looks like it might just be encoded in little-endian UTF-16 (based on the alternating null and non-null bytes, with the null bytes being second), but decoding it as such gives us:

VYz5zV\x06!VéWWêëÌÌÌ¥Ìé°!éÌ{zY|(W|!é¥é°!{|(é({(éY(¥¥¥5°°Yê|!WëVÌ{¥ÌVÌWÌ|V|{!\x06Ì|5(°{ëÌWêÌëV\x06|é{é\x06ëYéY°ÌYÌêV°!ê¥é{\x065ê°|(\x06ë!|Y!5Y¥°WêW¥5\x06é{{z\x06{5|zézW°!|°(°éê{ë¥êê{|¥z¥V¥!¥ëVWëêzëV!{W¥\x06WVÌ5Yz55ë5Ìz\x06ÌêYVVé\x06|¥\x06Yê¥|°°Vzz{ëWëY(|5W\x06Wz5z\x06Wê55ë!ë°°(5|ÌW{Y5(°Vë5|Vê°Ìê({!ë(\x06zz(!Ì°ê5\x06W¥é|°\x06{Y¥|V{ê\x06ëëW!|ë\x06êWééW(|!!V|\x06WÌzY¥zY((\x06é!°éÌY!|YYzYV(ë°|WYÌ{Ê

Which is pretty obviously not a request string, but does reinforce the fact that it's not just random data, but is somewhat structured. There's a slim possibility it could be some other encoding, but it's more likely it's just binary data.

Now, just because this happened doesn't automatically mean it's an attack, or even a bot. There's a lot of stuff that uses ports 80 and/or 443 simply because it lets them cross a vast majority of firewalls and NAT routers without issue. Simple misconfiguration of such a program can easily lead to it accidentally trying to talk to a web server. I don't recognize the request string as one of the more common protocols you're likely to see with this, but all that means is that I've never seen it before.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.