Security Incidents mailing list archives
Re: DDoS Attack
From: "Tim Greer" <chatmaster () charter net>
Date: Thu, 22 May 2003 13:05:01 -0700
This attack is launched from infected IRC installs on Windows systems (of course Windows). You may need to null route the IP and buy some time. You could set up something to filter the headers or requests and have it automatically firewall them out and drop the connections, but then it'll probably just hit harder and faster anyway. I'm not sure what to suggest at the moment, sorry. -- Regards, Tim Greer chatmaster () charter net Server administration, security, programming, consulting. ----- Original Message ----- From: "Steven Shepherd" <steven () valueweb com> To: <incidents () securityfocus com> Sent: Thursday, May 22, 2003 10:13 AM Subject: DDoS Attack
Our parent company is experiencing a very odd/severe DDoS attack coming from all over the place. For the most part, the attack is occuring at the Apache level. Log files show this request: [Tue May 20 09:13:33 2003] [error] [client 194.xxx.xxx.xxx] request failed: erroneous characters after protocol string: -nb GET
!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!!@#%!^ @)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!!@#%!^@)&!^& !*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!-nb
GET
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@-nb
GET
!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!!@#%!^ @)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!!@#%!^@)&!^& !*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!^&!*&!%&!%!@#%!^@)&!-nb
GET +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +\x01TH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ + +ATH0+ Scans of some of the attacking IP's show BackOrifice installations. Has anyone had this sort of attack and what would be the best way to combat it? Not much luck from the upstream(s) thus far. --------------------------------------------------------------------------
--
*** Wireless LAN Policies for Security & Management - NEW White Paper *** Just like wired networks, wireless LANs require network security policies that are enforced to protect WLANs from known vulnerabilities and threats. Learn to design, implement and enforce WLAN security policies to lockdown
enterprise WLANs.
To get your FREE white paper visit us at: http://www.securityfocus.com/AirDefense-incidents --------------------------------------------------------------------------
--
---------------------------------------------------------------------------- *** Wireless LAN Policies for Security & Management - NEW White Paper *** Just like wired networks, wireless LANs require network security policies that are enforced to protect WLANs from known vulnerabilities and threats. Learn to design, implement and enforce WLAN security policies to lockdown enterprise WLANs. To get your FREE white paper visit us at: http://www.securityfocus.com/AirDefense-incidents ----------------------------------------------------------------------------
Current thread:
- DDoS Attack Steven Shepherd (May 22)
- Re: DDoS Attack Sebastian Jaenicke (May 23)
- Re: DDoS Attack lists (May 23)
- RE: DDoS Attack Jonathan A. Zdziarski (May 23)
- Re: DDoS Attack Tim Greer (May 23)
- Re: DDoS Attack Angelz (May 23)
- <Possible follow-ups>
- RE: DDoS Attack Whiteside, Larry [contractor] (May 23)
- Re: DDoS Attack Justin Pryzby (May 23)
- Re: DDoS Attack Andrew Anderson (May 23)
- Re: DDoS Attack Justin Pryzby (May 25)
- Re: DDoS Attack Justin Pryzby (May 29)
- RE: DDoS Attack David Gillett (May 29)