Re: AltaVista_Traversal attack from mod-pubsub.org?

I also thought it strange that my firewall would report incoming requests
from mod-pubsub.org.
It could very well be some weird Symantec firewall mis-reporting of outbound
traffic.
The 'attacked port' is different each time.

10/05/2003 10:15:04PM
      Details: Attempted Intrusion "AltaVista_Traversal" against your
machine was detected and blocked
      Intruder: 64.161.22.235(9000)
      Risk Level: High
      Protocol: TCP
      Attacked IP: nautilus(207.202.171.254).
      Attacked Port: 2800

      Click on the address to trace the attacker
      You can get detailed information about this attack at Symantec
Security Response


10/05/2003 10:02:53PM
      Details: Attempted Intrusion "AltaVista_Traversal" against your
machine was detected and blocked
      Intruder: 64.161.22.235(9000)
      Risk Level: High
      Protocol: TCP
      Attacked IP: nautilus(207.202.171.254).
      Attacked Port: 2753

      Click on the address to trace the attacker
      You can get detailed information about this attack at Symantec
Security Response


(also one from 2003-10-03T21:02:17 and some on 2003-10-04)

----- Original Message ----- 
From: "Ben Sittler" <[email protected]>
To: "S. Mike Dierken" <[email protected]>; "Adam Rifkin" <[email protected]>
Cc: <[email protected]>
Sent: Monday, October 06, 2003 2:18 PM
Subject: RE: [Mod-pubsub-developer] AltaVista_Traversal attack from
mod-pubsub.org?


Hi Mike,

I may misunderstand, but I believe the "spurious" request is not actually
coming back to the client IP -- rather the firewall is detecting this in the
*outgoing* direction, as part of a hidden form submission (or other client
library request.) If you have reason to believe mod-pubsub.org is opening
sockets into your client machine, do let us know the details!

The python pubsub server (at the moment the only pubsub server really in use
at mod-pubsub.org) *should be* incapable of opening an outbound socket
connection -- it relies entirely on client-initiated sockets for all
communication.

Looking forward to more details...

-Ben

-----Original Message-----
From: S. Mike Dierken [mailto:[email protected]]
Sent: Sun 10/5/2003 5:58 PM
To: Ben Sittler; Adam Rifkin
Cc: [email protected]
Subject: Re: [Mod-pubsub-developer] AltaVista_Traversal attack from
mod-pubsub.org?
I don't know if ".." is supported in URI, but form data should be okay.
Either one is fine by me, I'm just curious why a request would come back to
the client IP address?

----- Original Message ----- 
From: "Ben Sittler" <[email protected]>
To: "S. Mike Dierken" <[email protected]>; "Adam Rifkin" <[email protected]>
Cc: <[email protected]>
Sent: Sunday, October 05, 2003 4:43 PM
Subject: RE: [Mod-pubsub-developer] AltaVista_Traversal attack from
mod-pubsub.org?


Apparently this means we sometimes submit form data with "../" in it. I
regard this as correct behavior (we don't use that to circumvent security,)
and see no reason to change our data format to work around this particularly
harmful firewall heuristic. Your thoughts?

-Ben

-----Original Message-----
From: [email protected] on behalf of S. Mike
Dierken
Sent: Sat 10/4/2003 9:20 PM
To: Adam Rifkin
Cc: [email protected]
Subject: [Mod-pubsub-developer] AltaVista_Traversal attack from
mod-pubsub.org?
I'm seeing Norton Internet Firewall detect an attack sourced at
mod-pubsub.org whenever I connect to the chat server there. It claims an
attack similar to the AltaVista_Traversal is ocurring. Different incoming
ports are reported.

Does anybody know what this means?



-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Mod-pubsub-developer mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-pubsub-developer









-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf