1

I was looking at my homemade server running apache 2.2.10 on it and this is what I saw:

**.**.**.** - - [10/Nov/2010:07:05:14 +0200] ">\x03\xb6@\x1b\xbdg\x9e\xe9a)\x1a\xd8\x10U\x0f \xd2\xa4zj\x02q\xd9\xa8[\xbfy/" 400 226
**.**.**.** - - [10/Nov/2010:07:05:16 +0200] "\x1c \x10\x8f&" 400 226
**.**.**.** - - [09/Nov/2010:15:55:00 +0200] "\x1e\xcf" 200 654
**.**.**.** - - [06/Nov/2010:04:36:07 +0200] "\xce\x14\x1c`n\xeb\x8b)x\xee0}\xcbr\x88\xb9lE\x95\xd5\xd3E\x82\x9b\xe0\xb5w\xd2&\xa2>e\xdcn;\x1f\xd1\xdb\xa3" 200 654
**.**.**.** - - [08/Nov/2010:22:28:46 +0200] "\xaa\xc7P\x19h\x80\x96\x03\xd9<\x93\x8e3\x92\xb4\xf5B6;V\xb3\x9f=6s\xf8\xad\x0f\xa2^\xde/\xf5\x92\x95\x8d" 200 654
**.**.**.** - - [30/Oct/2010:03:24:39 +0300] "\x95\xdb\xdb\"\xac#\xac?\xcfQ\v(\x1c\x13\xfb\x8b\xfdq(<\xe6\x12\xff$eY1\xc9@l\x95\xbfe\x15\x84\r\r\xa1\xf1[" 400 226

There are similar logs all over the place.
Most probably someone or a bot is trying to find and exploit or a backdoor.

My question here is how can I read what's behind that code and how can I prevent such codes from being executed? Also can you apache gurus share your experience with apache attacks and what's the best way to protect it?

Thanks in advance for any help,
The Devil

1 Answer 1

2

So it looks like some type overflow attack at first glance.

It my systems, i regulary use an iDS,IPS (intrusion detection/protection system)

Attacks like this are usually mitagated by a good ruleset(similiar to antivirus).

It filters the traffic in realtime and checks for matches, finally if matched performs the specified operation (e.g DROP)

A suggestion of software would be snort, which is open source and maintains a comprehensive ruleset.

Keep in mind other technogies like rate limiting, and log scanning to catch on to foul play. However prevention is better than reaction, i would go with Snort :)

Hope this helps

1
  • 1
    Yep.. I also think that prevention is better than reaction. My firewall doesn't allow no other port than 80,443 and 60. The only way someone could break in is via apache or bind. I'll try what you've written and I'll give a feedback in a couple of days :) Thank you!
    – tftd
    Nov 14, 2010 at 5:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .