Re: Weird 'script' in Username column in audit log file

Thanks for the responses on/off list. Good to know what this is about.

Patricia Farnan  | Application Administrator, Discovery Services
University Library  | St Teresa’s Library

Telephone: +61 8 9433 0707 | Email: [email protected]<mailto:[email protected]>

I respect and acknowledge the Nyungar Elders and the Wadjuk Nyungar people as the Traditional Owners and Custodians of this country on which I work.

From: Andrew Anderson <[email protected]>
Sent: Monday, 2 December 2019 1:21 PM
To: Patricia Farnan <[email protected]>
Cc: [email protected]
Subject: Re: [EZPROXY-L] Weird 'script' in Username column in audit log file

This message originated from outside your organisation
________________________________
Someone is rattling the proverbial door knob on your proxy server to check to see if they can perform javascript injection via your login page.

On Sun, Dec 1, 2019 at 8:40 PM Patricia Farnan <[email protected]<mailto:[email protected]>> wrote:
Hello,

Has anyone ever seen this sort of thing before?

2019-11-28 13:57:24 Login.Failure 178.165.72.177<http://178.165.72.177> </script>"><script>prompt(1)</script>
2019-11-28 13:57:39 Login.Failure 23.129.64.190<http://23.129.64.190> <script>alert(1)</script>
2019-11-28 13:57:48 Login.Failure 109.70.100.28<http://109.70.100.28> "><script>alert(1)</script>
2019-11-28 13:58:07 Login.Failure 185.220.101.70<http://185.220.101.70> '><script>alert(1)</script>

When I was pasting my log contents into the audit check spreadsheet we use this morning, this particular file’s contents wouldn’t paste full – it would stop at these entries and didn’t include the last row of data either, as if the script stuff had prevented the rest from pasting in.

Does anyone know what this means? I’ve never seen it before in our logs.

Thanks,

Patricia Farnan  | Application Administrator, Discovery Services
University Library  | St Teresa’s Library

The University of Notre Dame Australia
19 Mouat Street (PO Box 1225)
Fremantle WA 6959
Telephone: +61 8 9433 0707 | Email: [email protected]<mailto:[email protected]>
nd.edu.au<http://nd.edu.au> | CRICOS Provider:  01032F

Library<http://library.nd.edu.au/> | AskUs<http://askus.library.nd.edu.au/>

I respect and acknowledge the Nyungar Elders and the Wadjuk Nyungar people as the Traditional Owners and Custodians of this country on which I work.



Disclaimer

IMPORTANT: This e-mail and any attachments may be confidential. If you are not the intended recipient you should not disclose, copy, disseminate or otherwise use the information contained in it. If you have received this e-mail in error, please notify us immediately by return e-mail and delete or destroy the document. Confidential and legal privilege are not waived or lost by reason of mistaken delivery to you. The University of Notre Dame Australia is not responsible for any changes made to a document other than those made by the University. Before opening or using attachments please check them for viruses and defects. Our liability is limited to re-supplying any affected attachments.

________________________________

To unsubscribe from the EZPROXY-L list, click the following link:
http://listserv.oclclists.org/scripts/wa.exe?SUBED1=EZPROXY-L&A=1<http://listserv.oclclists.org/scripts/wa.exe?SUBED1=EZPROXY-L&A=1>


--

Andrew Anderson
President & CEO
[email protected]<mailto:[email protected]>

t: +1 (727) 536-0214 x100
f: +1 (727) 530-3126
w: www.lirn.net<https://www.lirn.net/>

Library & Information Resources Network
25400 US Hwy 19 North, Ste. #220
Clearwater, FL 33763

LinkedIn<http://www.linkedin.com/company/library-and-information-resources-network-inc-> | Facebook<http://www.facebook.com/LIRNnotes> | Twitter<http://www.twitter.com/LIRNNotes> | YouTube<http://www.youtube.com/user/LIRNnotes>



********************************************************************
If you wish to stop receiving messages from EZPROXY-L or otherwise amend your preferences,
you can do so <a href="https://www.oclc.org/forms/internet-subscription.en.html">here</a>.
Or email [email protected] including the relevant text below in the body of the email:
• To unsubscribe: "unsubscribe EZPROXY-L"
• To receive EZPROXY-L in digest form: "set EZPROXY-L digest"
• To set your options to no mail: "set EZPROXY-L nomail"
• To receive these messages in the future "set EZPROXY-L mail"
To contact the list owners directly please send your message to [email protected].
If you unsubscribe from EZPROXY-L, you will no longer be able to participate in any of its features, including the public forum.
To unsubscribe from all OCLC marketing email communications
(including all OCLC listervs, OCLC Connect emails, OCLC event notifications, product/service/cooperative updates and newsletters),
please email us at [email protected].