Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: InfoSec Handlers Diary Blog - Internet Storm Center Diary 2006-07-01 InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Reports of web forums running Invision Power Board being compromised

Published: 2006-07-01
Last Updated: 2006-07-01 23:02:03 UTC
by Toby Kohlenberg (Version: 2)
0 comment(s)

We've had a couple reports of forums that are running on Invision Power Board being hacked and used to push adware onto visitors' systems. At this point we don't have much information, if anyone has details or can confirm or correct our current info please let us know.


Update:
One of our readers kindly sent us this:
"Back in april, one of the developers forums that I am active on and which uses Invision Power Board was compromised with an injected javascript placed within one of IPB's external javascript files... Not sure if this is the same problem that is being reported today, but back in april I could not find anything about this exploit on the net... However, you can follow  the below link where we not only discussed this exploit but the underlying code was unencrypted/unobfuscated and taken apart to show what it was trying to do...
http://forum.weborum.com/index.php?showtopic=4709  "


Thanks Willy!

:)

Keywords:
0 comment(s)

Strange file names being requested from a web server

Published: 2006-07-01
Last Updated: 2006-07-01 22:57:53 UTC
by Toby Kohlenberg (Version: 1)
0 comment(s)

We just got a report of odd web page requests showing up in the logs of an apache server. The sources mostly look like DSL links or something similar and the strings don't fit typical URLs for the site being hit.

(the full path was cut out at the submitter's request).

[Fri Jun 30 19:52:42 2006] [error] [client 63.230.137.101] File does not exist: /public_html/316209509
[Fri Jun 30 19:52:47 2006] [error] [client 70.115.235.218] File does not exist: /public_html/316313362
[Fri Jun 30 19:53:51 2006] [error] [client 63.204.72.205] File does not exist: /public_html/317383671
[Fri Jun 30 19:53:57 2006] [error] [client 24.92.224.252] File does not exist: /public_html/317496937
[Fri Jun 30 19:56:38 2006] [error] [client 63.230.137.101] File does not exist: /public_html/320167344
[Fri Jun 30 19:56:50 2006] [error] [client 12.32.40.253] File does not exist: /public_html/320276720
[Fri Jun 30 19:57:56 2006] [error] [client 24.231.167.90] File does not exist: /public_html/321469620
[Fri Jun 30 19:58:16 2006] [error] [client 72.64.214.35] File does not exist: /public_html/321817318
[Fri Jun 30 19:58:40 2006] [error] [client 72.64.214.35] File does not exist: /public_html/321817318
[Fri Jun 30 19:58:58 2006] [error] [client 72.64.214.35] File does not exist: /public_html/322533383
[Fri Jun 30 19:59:09 2006] [error] [client 72.64.214.35] File does not exist: /public_html/322533383
[Fri Jun 30 20:00:55 2006] [error] [client 72.129.232.207] File does not exist: /public_html/324479048
[Fri Jun 30 20:01:11 2006] [error] [client 72.129.232.207] File does not exist: /public_html/324479048
[Fri Jun 30 20:01:20 2006] [error] [client 72.129.232.207] File does not exist: /public_html/324912765
[Fri Jun 30 20:01:41 2006] [error] [client 72.129.232.207] File does not exist: /public_html/324912765
[Fri Jun 30 20:02:43 2006] [error] [client 65.100.221.52] File does not exist: /public_html/326279398
[Fri Jun 30 20:03:09 2006] [error] [client 68.99.45.129] File does not exist: /public_html/326739763
[Fri Jun 30 20:04:48 2006] [error] [client 69.223.48.249] File does not exist: /public_html/328395301
[Fri Jun 30 20:10:58 2006] [error] [client 208.54.95.1] File does not exist: /public_html/334568052
[Fri Jun 30 20:12:33 2006] [error] [client 71.127.242.247] File does not exist: /public_html/336151271
[Fri Jun 30 20:14:09 2006] [error] [client 71.34.69.7] File does not exist: /public_html/337773022
[Fri Jun 30 20:14:17 2006] [error] [client 67.62.241.29] File does not exist: /public_html/337900488
[Fri Jun 30 20:15:56 2006] [error] [client 68.231.92.62] File does not exist: /public_html/339520509
[Fri Jun 30 20:16:31 2006] [error] [client 68.231.92.62] File does not exist: /public_html/339520509
[Fri Jun 30 20:18:32 2006] [error] [client 24.223.159.32] File does not exist: /public_html/342191087
[Fri Jun 30 20:20:07 2006] [error] [client 66.168.7.125] File does not exist: /public_html/343749240
[Fri Jun 30 20:25:26 2006] [error] [client 24.130.205.8] File does not exist: /public_html/349055506
[Fri Jun 30 20:25:54 2006] [error] [client 66.24.6.177] File does not exist: /public_html/349499852
[Fri Jun 30 20:26:38 2006] [error] [client 68.83.182.31] File does not exist: /public_html/350201707
[Fri Jun 30 20:27:37 2006] [error] [client 24.97.11.74] File does not exist: /public_html/351119708
[Fri Jun 30 20:28:28 2006] [error] [client 68.44.34.183] File does not exist: /public_html/351971861
[Fri Jun 30 20:28:52 2006] [error] [client 69.160.4.159] File does not exist: /public_html/352345333
[Fri Jun 30 20:29:03 2006] [error] [client 136.2.1.101] File does not exist: /public_html/352525757
[Fri Jun 30 20:30:36 2006] [error] [client 64.20.97.210] File does not exist: /public_html/354045978
[Fri Jun 30 20:31:08 2006] [error] [client 24.177.57.67] File does not exist: /public_html/354601534
[Fri Jun 30 20:31:35 2006] [error] [client 64.12.116.130] File does not exist: /public_html/355048072
[Fri Jun 30 20:32:03 2006] [error] [client 66.23.224.119] File does not exist: /public_html/355482168
[Fri Jun 30 20:32:27 2006] [error] [client 64.30.118.199] File does not exist: /public_html/355909769
[Fri Jun 30 20:35:22 2006] [error] [client 65.26.203.130] File does not exist: /public_html/358776005
[Fri Jun 30 21:03:10 2006] [error] [client 66.56.66.106] File does not exist: /public_html/386018581
[Fri Jun 30 21:03:11 2006] [error] [client 66.56.66.106] File does not exist: /public_html/386018581


If anyone has thoughts on what the requests might be looking for, let us know.

Keywords:
0 comment(s)
Diary Archives