[32493] in bugtraq
Re: Router Worm?
daemon@ATHENA.MIT.EDU (Niels Bakker)
Wed Nov 19 18:23:16 2003
Date: Wed, 19 Nov 2003 23:02:17 +0100
From: Niels Bakker <niels=bugtraq@bakker.net>
To: Chris Strom <cstrom@cos.com>
Cc: bugtraq@securityfocus.com
Message-ID: <20031119220217.GX842@snowcrash.tpb.net>
Mail-Followup-To: Niels Bakker <niels=bugtraq@bakker.net>,
Chris Strom <cstrom@cos.com>, bugtraq@securityfocus.com
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20031119145409.17782.qmail@sf-www3-symnsj.securityfocus.com>
* cstrom@cos.com (Chris Strom) [Wed 19 Nov 2003, 22:45 CET]:
>
> I've received a strange HTTP request on my web site from two different sources. The request is logged as:
>
> SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02
> \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02
[..]
>
> The request continues for a total of 32732 characters long (not shown). I was able to access one of the sites on port 80, here's the server response.
>
> Date: Tue, 15 Mar 1966 05:03:04 GMT
> Server: Allegro-Software-RomPager/2.10
> Content-Type: text/html
> Last-Modified: Mon, 25 May 1998 00:00:00 GMT
> Client-Date: Wed, 19 Nov 2003 14:07:57 GMT
> Client-Peer: xxx.xxx.xxx.xxx:80
> Client-Response-Num: 1
> Title: Netopia Router (192.168.1.1)
>
> Apologies if this is a known issue or if this is the wrong forum for this information.
The host behind this NAT device is probably infected with some windows worm.
-- Niels.
