6

So I cleaned up some malicious PHP scripts from a client's site and I've been monitoring for follow up connections to the scripts. Of course, I've found a LOT of IPs requesting the files. Too many to try and blacklist and too many different netblocks to block at a high level.

I'm thinking about redirecting all subsequent requests for the files to some kind of blackhole/tarpit/honeypot/bad guy reporting system, but I'm not sure if such a thing exists for HTTP traffic.

Ideally, I could redirect these IPs to the Internet police and they would be subject to investigation and stern talking to's, but I doubt a system like that exists due to it's potential for abuse

Improve this question
9
  • 5
    Keep in mind that these people may be scanning for easy backdoors. It may not be human action. A 404 message is enough to get them to move along!
    – Ohnana
    Commented Jan 23, 2015 at 15:12
  • 1
    @Ohnana I hear ya, but these are globally dispersed IP's all using the same bogus UA and POSTing to only a single file
    – Creek
    Commented Jan 23, 2015 at 16:35
  • 1
    They probably figured out how to use tor. Maybe redirect to google.com?
    – Ohnana
    Commented Jan 23, 2015 at 17:06
  • 1
    @Ohnana Ahh good point, I didn't think about tor...
    – Creek
    Commented Jan 23, 2015 at 19:44
  • 5
    if the box had malicious scripts installed on it somehow, you should highly consider paving the box and starting fresh. there's no telling what else may have been done to the local system.
    – SnakeDoc
    Commented Jan 23, 2015 at 21:21

2 Answers 2

Reset to default
11

I'm afraid all those IPs are nothing but victims clicking on phished/malicious links.

Your client was hacked and malicious scripts were hosted on their server in order to infect inconspicuous victims. Whether you like it or not, your client contributed to spread malware.

The next step for you is to just serve a 404 Not Found on those requests and make sure your customer doesn't help spreading malware again. If you like you could just setup a 301 or a 302 pointing to a law enforcement site or serve a static page telling your visitors that they probably just clicked on a phishing/malicious email link.

As per your initial question, any tarpit (e.g. keeping TCP sessions open) you setup on a webserver will only slow your server down more than those guys. Seriously, there's no point on doing that.

Improve this answer
4
  • 3
    404 is probably the best tactic. That's probably what the Sucuri, Google SafeBrowsing, etc are waiting to see from the page in order to deem it remediation
    – Creek
    Commented Jan 23, 2015 at 19:42
  • 9
    Or maybe a 410: w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.11 "The 410 response is primarily intended to assist the task of web maintenance by notifying the recipient that the resource is intentionally unavailable and that the server owners desire that remote links to that resource be removed." 404 is acceptable as well.
    – Ajedi32
    Commented Jan 23, 2015 at 20:03
  • 2
    Make that a static page with an explanation and a 410 as its HTTP status code, so that both security scanning software and unwitting victims know what's going on.
    – Brilliand
    Commented Jan 23, 2015 at 22:16
  • Do security scanning software/browsers even respond to the 410 response? Most browsers just pass thru the response back to the users.
    – munchkin
    Commented Jan 24, 2015 at 9:40
3

It is probably the same tool/malware and yes, it is also probably an automated botnet. You were once in the infected hosts list, so they could probing to learn if the disconnection was due to disinfection, WAF blocking or proxies along the way...

Well, it depends on your network structure. If you control the front-facing firewall, if you are able to deploy a WAF, if you have a cache proxy like varnish... Even Apache mod_rewrite may be able to help to an extent by always redirecting to a 404 error page.

But i really don't know a internet-police like service to whom you could report these access attempts. Does anyone here know something like that?

Improve this answer
2
  • 1
    Agreed on the botnet
    – Creek
    Commented Jan 23, 2015 at 19:43
  • 2
    You could always file a complaint with the internet police: internetpolice.us ;-P
    – SnakeDoc
    Commented Jan 23, 2015 at 21:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .