2

My client is who is running a recent version of vBulletin is getting lots strange activity and I'm at a loss to explain what the attacker is trying to accomplish.

The attacker registers a fake user account in the forum with clearly made up personal details. Then we start getting hundreds of hits on the member page of this fake user. The hits all come from the same IP address and feature REFERRER field in the header that appears to be doubly redirected through two different 3rd party websites that have open redirect vulnerabilities. (that is, with a specially crafted URL, will generate a redirect to another site)

The httpd log entries all look like this. These have been rendered anonymous, but you get the idea. www.cccccc.ccc is my client's site. openredirect.aaaa, openredirect.bbbb, etc are various websites around the world. There are hundreds of different ones used.

77.97.xxx.xxx - - [12/Dec/2014:09:18:11 -0500] "GET /forums/member.php?SomeUser HTTP/1.1" 200 8974 
"http://www.openredirect.zzz/exit/?url=http://openredirect.yyyy/away.php?to=http://www.cccccc.ccccc/forums/member.php?u=SomeUser" 
"Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.16"

77.97.xxx.xxx - - [12/Dec/2014:09:18:12 -0500] "GET /forums/member.php?u=SomeUser HTTP/1.1" 301 - 
"http://www.openredirect.aaa/jsps//recommend.jsp?url=http://openredirect.bbbb/forum/visit.php?url=http://www.cccccc.cccc/forums/member.php?u=SomeUser" 
"Opera/9.80 (Windows NT 6.2; Win64; x64) Presto/2.12.388 Version/12.16"

repeat above 100's of times within a short interval, all from the same source IP, all to the same member profile page, but with different sets of redirections in the REFERRER field.

There's nothing of interest on the member's profile page that's being requested. Just some made up personal details. No embedded script, etc. I've checked the forum code and it doesn't seem to be doing anything with the REFERRER field that I can see (such as trying to ping it back or anything).

One strange thing I've noted is that some requests have a 200 result code and others have a 301, but I can't figure out what's the difference.

A few days ago I searched extensively for info about any kind of attack like this, but came up empty.

The main threat to our site is that the requests all come rather quickly and sometimes overload our server causing a partial denial of service eventually. (but I can think of far more effective ways of causing DOS if that was the end goal, so I don't think it is). Right now we're playing whack-a-mole, blocking one new source IP address every few days.

While various techniques may be used to stop this from happening and we'll eventually figure out the best approach to block this, my primary question here is what is the attacker trying to accomplish?

  • I could be wrong but this seems to me not like an attack but rather like probing your site for vulnerabilities on your authentication mechanism or your CSRF validation mechanism – Kotzu Dec 12 '14 at 20:34
1

It looks like some kind of negative SEO technique, but I don't think it has been proven that it can really impact your ranking.

See:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.