Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I administrate a public server that receives about a 100 csh HTTP shell shock per day from different sources. It is an HTTP GET Method that that requests the /cgi-bin/authLogin.cgi URI.
Knowing that the requested URI does not exist in my server is it normal to receive much attack attempts from the internet ? Does that mean that my server is compromised ?
Edit
Can anyone with networks auditing experience tell me if receiving that much attacks from the internet is normal or not?
Based on the URL being requested it seems that these are attempts to exploit a shellshock vulnerability in QNAP Network Attached Storage (NAS) devices. If this is not a QNAP NAS, and you know that your servers have the shellshock vulnerability patched, then you probably don't need to worry.
The fact that you are repeatedly getting requests for a URL that doesn't exist suggests that these attacks are not targeted toward you specifically, but are instead coming from automated bots that scan tons of online servers looking for ones that have a specific vulnerability. Unfortunately these bots are extremely common, so 100 requests a day isn't all that unusual for a small to medium sized website. It's all just a part of running a server on the Internet. As long as you are not vulnerable to the specific things they're looking for, they shouldn't cause a problem.
Receiving many attack attempts does not necessarily mean that you are compromised, but it could be an indication that attackers are actively exploiting the vulnerability. You definitely want to make sure that the shellshock vulnerability is patched on all your assets or else you are probably compromised since you are receiving these attempts. If the vulnerability is patched on all your assets, then you should be fine in regards to these attempts. It could be that if you have unpatched assets that attackers are actively exploiting the shellshock vulnerability.
I don't know if "is it normal" to receive this many attempts from the internet, and I leave this part of the question for another person to answer.
