Subject: [Dev] Blocking MTD's

From: [email-masked]
Date: Thu, 28 Feb 2002 13:29:07 -0500

MTD = Microsoft Transmitted Diseases

I run my own webserver.  It's a pentium 90mhz with 48 megs of ram, and
1.5 gigs of disk.

I am quite tired of seeing a line like the following in my apache log
files:

66.20.67.210 - - [28/Feb/2002:05:44:58 -0500] "GET
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 224

Sure I can ignore those lines, or write a cron job to remove them from
the log file all together, but it's the principle involved; the waste
of bandwidth, firing up my disk every few minutes, etc. etc.

I can add the following command to never see packets from that IP
again:

iptables -A INPUT -s 66.20.67.210  -j DROP

( I don't care if whoever is at that address can't access my page,
chances are it's some script kiddie, or an infected server, and even if
it is someone I know, and I can just remove that line from
my firewall config to grant them access again. )

Right now I have a script that reads the log file, and automatically
DROP's the packets from whomever looks like an MTD spreader.  This is
little better than the problem though, as it fires up my harddisk every
few minutes.  (I'll be happy to share this perl script if anyone wants
to see it. ) Also, by the time I drop them, I've already got 10+ entries in
the log file from that IP, and I will only be blocking future packets
from that IP.  In other words... the annoyance has already happend. ( Is
that a word? )

Is it possible to have the firewall ( iptables v1.2.1a on RH7.2 )
inspect the contents of each packet for signatures of MTD's?

If not, is there a way to have apache log it's ouput to both a file and
a program?  That way, my perl script would only cause disk activity by
writing a new rule to the firewall.

Any questions or comments would be greatly appreciated.
My apologies if this does not fit the usual forum topic parameters.

Thank you for your time,

Nathan Harrington

---

From: [email-masked] (John Beimler)
Date: Thu, 28 Feb 2002 14:21:42 -0500

quotation from nathan <[email-masked]> [on 020228 13:36]:

> [...]
Check out snort - http://www.snort.org/

Peace.

john

---

From: James Manning <[email-masked]>
Date: Thu, 28 Feb 2002 15:45:11 -0500

[John Beimler]
> Check out snort - http://www.snort.org/

A friend of mine also went the route of dropping 80 traffic and popping
his httpd up to 8080 - being able to ignore port 80 traffic altogether's
kind of nice, but that may not be an option.

Oh, yeah, binding to a non-priv port (never needing root) is cool too.
-- 
James Manning <[email-masked]>
GPG Key fingerprint = B913 2FBD 14A9 CE18 B2B7  9C8E A0BF B026 EEBB F6E4

---

From: Mike Johnson <[email-masked]>
Date: Thu, 28 Feb 2002 16:00:13 -0500

First, not to get in another 'list war', you'd get better responses
for this from the main TriLUG list.

That said...

[email-masked] [[email-masked]] wrote:
 
> XX.XX.XX.XXX - - [28/Feb/2002:05:44:58 -0500] "GET

A couple things.

That's going to be Nimda or CodeRed, almost certainly.  Second,
given that this is likely Nimda or CodeRed, you've just posted
the IP address of a system that's easily compromised to a public
list.  Congratulations.
 
> from that IP.  In other words... the annoyance has already happend. ( Is

So, you just want the log entries to go away?  Check out:
http://online.securityfocus.com/archive/75/215203

By using that, your disk is never fired up and you can get rid
of the log entries.

If you really want to automatically set drop rules, look at:
http://www.keyslapper.org/Nimda/

And modify it so that rather than sending an e-mail, it 
adds a new drop entry.
 
> inspect the contents of each packet for signatures of MTD's?

There is a patch to netfilter that allows for string matching,
but it's really not very robust.  If you want to look into it,
you'll need to fetch the latest netfilter from:
http://www.netfilter.org/downloads.html
and compile with string matching support.

You could also look at Hogwash (http://hogwash.sourceforge.net/)
which can do blocking based on packet contents.  It's based
on snort, but snort does not do any blocking (and will just
create more data to sift through, if you don't care).
 
> writing a new rule to the firewall.

Look at the rewrite rules from the securityfocus link, or the
Nimda mod_perl module (linked above).
 
> My apologies if this does not fit the usual forum topic parameters.

Again, you can post here all ya want, but you'll get -better-
answers on the main trilug discuss list.

Mike
-- 
"Let the power of Ponch compel you!  Let the power of Ponch compel you!"
   -- Zorak on Space Ghost

GNUPG Key fingerprint = ACD2 2F2F C151 FB35 B3AF  C821 89C4 DF9A 5DDD 95D1
GNUPG Key = http://www.enoch.org/mike/mike.pubkey.asc

---

From: Jon Carnes <[email-masked]>
Date: Thu, 28 Feb 2002 21:43:11 -0500

A little radical, but how about creating a RAM disk and mounting it for your 
log files.  You'll still get the errors, but they won't spin up your hd...
As part of your shutdown script you can copy the log from RAM to your hd.

Jon

 --- Original Message: Thursday 28 February 2002 01:29 pm ---
> _______________________________________________
> Dev mailing list
> [email-masked]
> http://www.trilug.org/mailman/listinfo/dev

---

From: [email-masked]
Date: Fri, 1 Mar 2002 07:13:21 -0500

> the IP address of a system that's easily compromised to a public

I'm embarrassed at my own ignorance.  I will be very careful not to do
this again, however, a polite answer would have been just as effective
at altering my behaviour as a sardonic one.

With that said, thank you for the comprehensive answer to my questions.
I really appreciate you taking the time to address my concerns. 

> And modify it so that rather than sending an e-mail, it

I think I will go with this approach, it seems well suited to what I
want to accomplish.

> answers on the main trilug discuss list.

I will keep that in mind.

Again, thanks.

Nate