This letter was posted today....and it could have been sent to our management. (It's not.) Many of the points echo exactly what is happening here. I would say, the biggest excuse I hear is that management does not want to disrupt the corporate culture in implementing security controls.
I fear that a breach or severe incident will be the catalyst for change and implementing controls. Yes, I've had many small wins, but there is lots to do.
Thursday, April 17, 2014
Wednesday, April 16, 2014
humans.txt Appearing in our Firewall Logs
This morning I came in to work figuring I would continue working on analysis of our infrastructure for the Heartbleed bug. We seem to be fine...this is a case where fortunately, we get lucky because we have been using such an old version of OpenSSL. Which means we're probably vulnerable to a whole host of other vulnerabilities. But, we appear to be not vulnerable to Heartbleed. Which is a good thing.
Early, a co-worker came to me asking if I had seen the note from our DDoS mitigation provider. It was the first such email to provide a source address for the attack. The "attack" only lasted four minutes, and to me, was not much to worry about. However, there was at least an indicator to look for in the logs. I popped the source address into our firewall logs, and was presented 134 records back; all targeting various servers of ours.
And here was the unique finding. Every request string looked something like:
The best I can come up with is that this is some kind of remote file inclusion attack and the attacker is looking for vulnerable php servers.
I found a great site that had a little more info here, but their mitigation was in using .htaccess; we use our firewall. I did not find much more information, so anyone that wants to shed a little more light on the subject, feel free to leave a comment.
Early, a co-worker came to me asking if I had seen the note from our DDoS mitigation provider. It was the first such email to provide a source address for the attack. The "attack" only lasted four minutes, and to me, was not much to worry about. However, there was at least an indicator to look for in the logs. I popped the source address into our firewall logs, and was presented 134 records back; all targeting various servers of ours.
And here was the unique finding. Every request string looked something like:
http://ourserver/some_bogus_directory/some_bogus_file.php?php121dir=http://www.google.com/humans.txtI fully admit, I had never heard of a humans.txt file; I knew about robots.txt, but not humans.txt. So I looked it up. We don't use it. Next, I fetched Google's human.txt file to see what was in there. Nothing untoward.
The best I can come up with is that this is some kind of remote file inclusion attack and the attacker is looking for vulnerable php servers.
I found a great site that had a little more info here, but their mitigation was in using .htaccess; we use our firewall. I did not find much more information, so anyone that wants to shed a little more light on the subject, feel free to leave a comment.
Subscribe to:
Posts (Atom)
