Re: Strange Apache logs - maybe DDOS?

From: Axel Beckert (abe@fsinfo.cs.uni-sb.de)
Date: 01/19/03

  • Next message: Tino Didriksen: "mIRC Zombie, port 445" 
    Date: Sun, 19 Jan 2003 08:37:42 +0100
From: Axel Beckert <abe@fsinfo.cs.uni-sb.de>
To: incidents@securityfocus.com

    Hi!

    We had the same problem, too, on a box hanging on a ADSL line. It took
    us about 7h to find out...

    Christian Schwede <cschwede@delphi-gmbh.de> wrote at Nov 15 2002 9:31AM:
    > I have a little problem with our apache server. This is
    > what my logs show me:
    >
    > [CLIENT_IP_ADDR] - - [13/Nov/2002:12:39:28 +0100] "\xe3I" 501 -
    > [...]

    a) Nearly all requesting IPs were dial-up systems (regarding to whois
       and host names). They came mainly from Europe whereas Germany was
       the biggest bunch.

    b) They showed up for exactly 24h. They started after we got a new IP
       and ended when we got a new IP. Neither before nor after that, we
       noticed such traffic.

    c) We spent a lot of time at Google. Ever heard of that ubiquitous HP
       XE3 Omnibook?

    d) We were wasting a lot of time thinking about unicode, buffer
       overflows, backdoors, etc.

    e) On the Apache Users Germany (remember that most IPs were from
       Germany) mailinglist we found the following posting and reply:

       http://marc.theaimsgroup.com/?l=apache-httpd-users-de&m=104054617332113&w=2

       There is mentioned an URL where you can get a tcpdump from the
       causing traffic. (We weren't logged in when it happened, so we were
       glad about finding a complete tcpdump on the web.) Analysing it
       with 'strings' quickly reveals that the traffic seems only caused
       by clients of a peer-to-peer network:

            emule.dyndns.org
            emule.dyndns.org 0
            hubi [emule.de]
            eMule v0.23b [Tar
            anti[emule.de]
            http://emule-proj
            Der Dude[emule.de

       emule is a popular edonkey client.

    f) http://hitech.dk/donkeyprotocol.html confirms, that each edonkey
       packet starts with 0xE3 (search for "packet format") and a long int
       following denoting the packet length. The characters we found
       after \xe3 were only one byte values ranging from about 60 to 100.
       We suspect the remaining bytes were NULL, so Apache (or whichever
       web server runs on port 80) regards the third byte as end of input,
       answers to it with either 501, 405 or--if PHP4 is installed--with
       200 OK and the home page. (See http://bugs.php.net/bug.php?id=19113
       regarding this issue...)

    g) It's now about 8am localtime. We'll now go home, sleeping well and
       knowning that there was no DDoS nor exploit and that P2P file
       sharing on port 80 is evil. ;-)

                    Regards, Axel and Bruno. 

    -- 
/~\                                   | Axel Beckert
\ /  ASCII Ribbon Campaign            | 
 X   Say No to HTML in EMail and News | abe@fsinfo.cs.uni-sb.de
/ \                                   | http://abe.home.pages.de/
----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com

    Relevant Pages

    • Hacker problem...Takes down apache?
      ... It seems to be doing *something* to break Apache in an attempt ... When connecting to port 80 on the web server with a web browser a "page ... However sockstat still shows httpd listening on port ...
      (freebsd-questions)
    • Re: File permissions for a wiki-like site
      ... to a single web server went out with browsers that don't understand ... Actually you can, and often do, have multiple instances of Apache listening on port 80.. ...
      (comp.lang.php)
    • Re: File permissions for a wiki-like site
      ... to a single web server went out with browsers that don't understand ... Actually you can, and often do, have multiple instances of Apache listening on port 80.. ...
      (comp.lang.php)
    • Re: Error 49, socket problem?
      ... I doubt it's a DoS attack, however it could very well be. ... apache runs on port 80 and 81. ... I've ruled out that it's a problem with the MySQL server in this case, ...
      (freebsd-net)
    • RE: possible ssh hack
      ... What version of SSHD were you running, ... Apache and we can help you out. ... Subject: possible ssh hack ... port 4207 ...
      (Incidents)
    • Quantcast