[32491] in bugtraq
Router Worm?
daemon@ATHENA.MIT.EDU (Chris Strom)
Wed Nov 19 17:43:26 2003
Date: 19 Nov 2003 14:54:09 -0000
Message-ID: <20031119145409.17782.qmail@sf-www3-symnsj.securityfocus.com>
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
From: Chris Strom <cstrom@cos.com>
To: bugtraq@securityfocus.com
I've received a strange HTTP request on my web site from two different sources. The request is logged as:
SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02
\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02
\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02
\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02
\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02
\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02
\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02
\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02
\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02
The request continues for a total of 32732 characters long (not shown). I was able to access one of the sites on port 80, here's the server response.
Date: Tue, 15 Mar 1966 05:03:04 GMT
Server: Allegro-Software-RomPager/2.10
Content-Type: text/html
Last-Modified: Mon, 25 May 1998 00:00:00 GMT
Client-Date: Wed, 19 Nov 2003 14:07:57 GMT
Client-Peer: xxx.xxx.xxx.xxx:80
Client-Response-Num: 1
Title: Netopia Router (192.168.1.1)
Apologies if this is a known issue or if this is the wrong forum for this information.
Chris
