Newsgroup: it.comp.sicurezza.varie
Titolo: Ma possibile che nessuno dica o faccia nulla ?

Da mesi (6 o 7) ogni 30 secondi al mio server arriva sta cosa:
[paste]
date: 2008-01-02
time: 10:42:08
cs-method: GET
cs-uri-stem: /sibbs3/admin/board/prx.php
cs-uri-query: 
p=q1w2e3r4t5y6u7i8o9p0*a-b?hash=A975A7C433C6289DD98558500050AEE84BAC57B67CFE
s-port: 80
c-ip: 222.216.28.135
cs(User-Agent): Mozilla/4.0+(compatible;+MSIE+6.0;+Windows+NT+5.0)
sc-status: 404 Not Found (client err)
sc-bytes: 1819
cs-bytes: 307
[/paste]
Non trova nulla, non fa nulla, probabilmente l'exploit è stato già 
corretto... Tutto quello che si vuole... Ma da mezzo anno un bot ogni 30 
secondi manda mer#a in giro per la rete e nessuno fa nulla?
-> GbC|
www.gbcweb.com
www.chiappori.com
 

 30 secondi manda mer#a in giro per la rete e nessuno fa nulla?
Benvenuto su internet.
-- 
Windows mi da' quella sensazione di Indiana Jones che Linux non penso 
mi dara' mai, l'oscura impressione di avere una legione di thugs alle 
calcagna e di non sapere se riusciro' a portare a casa la pelle.
                                                            Leonardo 
Serni

 secondi manda mer#a in giro per la rete e nessuno fa nulla?
Vuoi vedere la lista di "ragazzacci discoli" messi in quarantena dal 
nostro firewall primario da stamattina?
(mer 2. gen 12:47:52 2008)
Items: 217.17.34.10, Type: Hosts to any, Expiration: 16.39.30 (3h 51m 
39s)
Items: 213.234.192.1, Type: Hosts to any, Expiration: 20.07.29 (7h 19m 
38s)
Items: 213.156.32.144, Type: Hosts to any, Expiration: 15.32.57 (2h 45m 
6s)
Items: 212.24.164.1, Type: Hosts to any, Expiration: 19.18.57 (6h 31m 
6s)
Items: 212.24.160.1, Type: Hosts to any, Expiration: 19.18.53 (6h 31m 
2s)
Items: 209.244.7.133, Type: Hosts to any, Expiration: Tomorrow at 
1.24.38 (12h 36m 47s)
Items: 209.244.7.132, Type: Hosts to any, Expiration: 21.02.00 (8h 14m 
9s)
Items: 209.244.7.56, Type: Hosts to any, Expiration: Tomorrow at 
1.30.45 (12h 42m 54s)
Items: 209.244.7.54, Type: Hosts to any, Expiration: Tomorrow at 
8.16.25 (19h 28m 34s)
Items: 209.244.7.53, Type: Hosts to any, Expiration: Tomorrow at 
8.16.34 (19h 28m 43s)
Items: 209.244.7.42, Type: Hosts to any, Expiration: 19.05.30 (6h 17m 
39s)
Items: 209.244.7.41, Type: Hosts to any, Expiration: Tomorrow at 
7.15.59 (18h 28m 8s)
Items: 209.244.7.40, Type: Hosts to any, Expiration: Tomorrow at 
6.49.22 (18h 1m 31s)
Items: 209.244.7.36, Type: Hosts to any, Expiration: 14.28.18 (1h 40m 
27s)
Items: 209.244.5.147, Type: Hosts to any, Expiration: 21.22.41 (8h 34m 
50s)
Items: 209.244.5.115, Type: Hosts to any, Expiration: 22.15.13 (9h 27m 
22s)
Items: 209.244.5.114, Type: Hosts to any, Expiration: 22.15.11 (9h 27m 
20s)
Items: 209.244.4.167, Type: Hosts to any, Expiration: 20.07.00 (7h 19m 
9s)
Items: 209.244.4.160, Type: Hosts to any, Expiration: Tomorrow at 
8.53.37 (20h 5m 46s)
Items: 209.244.4.31, Type: Hosts to any, Expiration: Tomorrow at 
3.43.16 (14h 55m 25s)
Items: 209.244.4.25, Type: Hosts to any, Expiration: 22.41.25 (9h 53m 
34s)
Items: 209.244.4.24, Type: Hosts to any, Expiration: 22.41.24 (9h 53m 
33s)
Items: 209.181.12.1, Type: Hosts to any, Expiration: 23.39.48 (10h 51m 
57s)
Items: 208.69.32.13, Type: Hosts to any, Expiration: Tomorrow at 
12.18.13 (23h 30m 22s)
Items: 205.244.194.35, Type: Hosts to any, Expiration: 23.14.11 (10h 
26m 20s)
Items: 205.171.13.251, Type: Hosts to any, Expiration: 17.54.57 (5h 7m 
6s)
Items: 205.171.13.249, Type: Hosts to any, Expiration: 17.55.03 (5h 7m 
12s)
Items: 204.127.203.193, Type: Hosts to any, Expiration: 20.58.18 (8h 
10m 27s)
Items: 204.127.194.102, Type: Hosts to any, Expiration: 20.58.14 (8h 
10m 23s)
Items: 200.35.65.3, Type: Hosts to any, Expiration: 20.14.32 (7h 26m 
41s)
Items: 198.36.160.1, Type: Hosts to any, Expiration: 22.59.34 (10h 11m 
42s)
Items: 193.162.153.171, Type: Hosts to any, Expiration: 18.58.10 (6h 
10m 18s)
Items: 193.162.153.162, Type: Hosts to any, Expiration: 18.57.29 (6h 9m 
37s)
Items: 156.17.5.2, Type: Hosts to any, Expiration: 15.56.03 (3h 8m 11s)
Items: 129.132.128.196, Type: Hosts to any, Expiration: 21.58.03 (9h 
10m 11s)
Items: 85.18.190.196, Type: Hosts to any, Expiration: 12.47.20 (7101w 
3d 6h 27m 44s)
Items: 84.232.1.100, Type: Hosts to any, Expiration: 13.29.16 (41m 24s)
Items: 81.208.98.62, Type: Hosts to any, Expiration: 14.36.34 (1h 48m 
42s)
Items: 81.72.196.38, Type: Hosts to any, Expiration: Tomorrow at 
9.01.40 (20h 13m 48s)
Items: 80.202.5.135, Type: Hosts to any, Expiration: 17.32.21 (4h 44m 
29s)
Items: 80.202.4.135, Type: Hosts to any, Expiration: 17.32.28 (4h 44m 
36s)
Items: 80.202.4.134, Type: Hosts to any, Expiration: 17.32.20 (4h 44m 
28s)
Items: 80.69.98.252, Type: Hosts to any, Expiration: 22.21.52 (9h 34m)
Items: 80.69.98.250, Type: Hosts to any, Expiration: 22.01.41 (9h 13m 
49s)
Items: 76.7.255.186, Type: Hosts to any, Expiration: 23.53.59 (11h 6m 
7s)
Items: 75.125.232.210, Type: Hosts to any, Expiration: 21.43.38 (8h 55m 
46s)
Items: 70.84.160.17, Type: Hosts to any, Expiration: 20.06.03 (7h 18m 
11s)
Items: 70.84.160.16, Type: Hosts to any, Expiration: 17.48.43 (5h 51s)
Items: 62.149.128.191, Type: Hosts to any, Expiration: Tomorrow at 
12.07.54 (23h 20m 2s)
Items: 38.112.17.142, Type: Hosts to any, Expiration: 16.03.06 (3h 15m 
14s)
Items: 38.112.17.138, Type: Hosts to any, Expiration: 16.03.01 (3h 15m 
9s)
Items: 24.217.201.69, Type: Hosts to any, Expiration: 15.54.30 (3h 6m 
38s)
Items: 24.217.0.8, Type: Hosts to any, Expiration: 15.54.35 (3h 6m 43s)
Items: 5.138.147.188, Type: Hosts to any, Expiration: Tomorrow at 
11.29.28 (22h 41m 36s)
Items: 4.68.25.4, Type: Hosts to any, Expiration: Tomorrow at 6.42.42 
(17h 54m 50s)
Items: 4.68.25.3, Type: Hosts to any, Expiration: Tomorrow at 4.55.28 
(16h 7m 36s)
Items: 4.68.25.2, Type: Hosts to any, Expiration: Tomorrow at 4.46.25 
(15h 58m 33s)
Items: 1.253.128.38, Type: Hosts to any, Expiration: 14.36.38 (1h 48m 
46s)
Items: 1.253.128.35, Type: Hosts to any, Expiration: 15.32.58 (2h 45m 
6s)
Items: 1.253.128.30, Type: Hosts to any, Expiration: 22.20.16 (9h 32m 
24s)
:-)
Ciao
Luca
-- 
Luca Sasdelli
Microsoft MVP - Server, Security

 nessuno fa nulla?
Di cosa ti stupisci? La rete è piena di bots..
Non devi aspettarti che gli altri facciano qualcosa: sarebbe un'illusione, 
comincia
a proteggerti tu, innanzitutto..
-- 
C'è un solo peccato. Il furto. Ogni altro peccato può essere ricondotto al 
furto.
Se uccidi un uomo, gli rubi la vita. Rubi il diritto di sua moglie ad avere 
un marito,
derubi i suoi figli del padre. Se dici una bugia a qualcuno, gli rubi il 
diritto alla verità.
Se imbrogli, quello alla lealtà.Capisci? (K. Hosseini) 

 a proteggerti tu, innanzitutto..
Io capisco uno che controlla una botnet...
Ma appurato che in quel server non c'è nulla (neanche php) che sprechi 
banda a fare?
È assurdamente illogico...
-> GbC|
www.gbcweb.com
www.chiappori.com
 


[cut]
Capisco uno che controlla una botnet...
E anche chi scanna a caso cercando porte e servizi exploitabili...
Ma appurato che in quel server non c'č nulla (neanche php) che sprechi 
banda a fare?
Č assurdamente illogico...
-> GbC|
www.gbcweb.com
www.chiappori.com
 

 Č assurdamente illogico...
Ma forse anche no:
- gli script girano da soli, non serve farli girare a mano
- se li fai girare su risorse non tue, puoi farli girare quanto ti pare
che non ti costa nulla.
Anzi, costa di piů capire che lě non beccano nulla e configurarli per
saltare quell'IP/server/rete...
Tanto illogico alla fine non č....

banda a fare?
E' un bot orfano, incapace di auto-upgradarsi :-)
Fra lui e la vittima infetta, direi che si son trovati.
Leonardo
-- 
While ordinarily valid that being widespread does not make a statement
true, I feel that the diffusion of anti-evolutionary beliefs does pose
a strong argument for Darwin having been, indeed, sorely mistaken.