weird user agent is obviously a hack...ban the IP?

sneakyimp

I've seen several thousand errors in my error log, all of which have a user-agent which is the same -- and very different from a real user agent. It's a short alphanumeric sequence and in each case it appears to be an attempt at SQL injection which, fortunately, is screened by my input validation code.

The remote IP is different every single time.

I'm thinking this is a bot. Should I ban each IP address from which it comes? Seems to me this might be a good way to screen out the botnet from attacking my site. On the other hand, I worry about screening legit users OR suffering poor performance because I've banned several thousand remote IP addresses.

Just wondering what folks might think.

Krik

You may want to hop over to www.projecthoneypot.org and see what they have to say about it or if nothing else they will want to know about it.

They like tracking bots and spammers and then giving web developers tools they can use to prevent problems.

sneakyimp

Thanks for the tip. I'm currently screening this user thusly:

$banned_user_agents = array('blah', 'blah blah', 'blah blah blah');
if (in_array($_SERVER['HTTP_USER_AGENT'], $banned_user_agents)) {
	die('Banned User Agent');
}

I'm wondering if I should also send an HTTP response code. 500 'internal error' ? 410 'gone' ? 406 'not acceptable' ? 402 'payment required' ? 418 'I'm a teapot' ?

Krik

To add on to your idea you can use the robot.txt to bait them with the Disallow. Many malicious bots look for disallowed pages and when they access the disallowed page log the user agent and then you can use that list with that code.

sneakyimp

I like your thinking Krik.

There's one particular issue I'm really confused about. A visitor that is supposedly the googlebot is visiting pages and providing screwy query strings. I tried to look up the ip and it seems legit, but it is visiting pages and supplying invalid values for query string params. I don't know if I have a broken link on my site somewhere or what. These googlebot errors account for about 30% of all my errors and I can't pin them down.

Maybe I can catch them with disallow and a user agent logger.

Krik

Went over to Goggle to refresh my memory on how their bot operates http://www.google.com/support/webmasters/bin/answer.py?answer=182072

At the end of that info is some information on validating that it is googlebot that is accessing your site. They recommend using a reverse DNS lookup and have a link to more info there.

I like your thinking Krik.

I have had to deal with a lot of malicious bots and spammers on a site I designed. I just looked at the logs and better than half the bots coming to the site are malicious bots. I have several different kinds of traps set for them. And I am always looking for new kinds of traps. That Project Honey Pot is one of the resources I tracked down early on in dealing with the problem.

The day it is legal to drop a virus on a malicious bots server, I suspect within a week I might be able to take out half of the malicious bots world wide. Of course doing that will never be legal. So till then I do everything else I can make their lives miserable.

sneakyimp

Thanks for the google info and link.

Krik;10961224 wrote:
The day it is legal to drop a virus on a malicious bots server, I suspect within a week I might be able to take out half of the malicious bots world wide. Of course doing that will never be legal. So till then I do everything else I can make their lives miserable.

It may not be legal here, but it could very well be legal somewhere else.

Krik

It may not be legal here, but it could very well be legal somewhere else.

Hmm!!! 😉

sneakyimp

Another possibility is something like SETI@home or Folding@home wherein users can opt to ping a variety of spam servers to check if they're still online. Constructed properly, it might have the effect of DDOS on these machines. You wouldn't be dropping a virus on anyone, and responsbility would be spread across all users of the application.

jerseyzz

Montreal Canadiens #8 Mike Komisarek Red NHL Jerseys .Mike Komisarek Montreal Canadiens Name and Number ice hockey jerseys, made by Reebok the official authentic on-field producers of NHL apparel and jerseys. Mike Komisarek and 8 are printed on the back in authentic font. Officially licensed NHL National Hockey League.NHL Hologram Sticker Adult Sizing.

jerseyzz

Alexei Kovalev is a Russian professional right winger currently playing for the Ottawa Senators of the National Hockey League (NHL). He has previously played for the Montreal Canadiens #27 Alexei Kovalev Red NHL Jerseys, the Pittsburgh Penguins, and the New York Rangers, with whom he was originally drafted and won a Stanley Cup in 1994. His nicknames among fans include Kovy, AK-27, and l'Artiste.Alexei Kovalev was drafted by the New York Rangers in the 1991 NHL Entry Draft, first round, 15th overall, becoming the first Russian player to be drafted in the first round.

Krik

Now I like the way your thinking.

So I get a server in Uganda (or some other 3rd world country). I then mirror one of my busier sites servers with that server and when bots land on pages, that no one else should know about, and if when try to maliciously harvest info they get more info than they bargained for. And all the while I use that site or other sites to cause the users, of those sites, to ping the malicious serves causing a DDOS attack that can not be tracked.

:evilgrin: :evilgrin: :evilgrin: :evilgrin: :evilgrin:

Something tells me "someone" would be knocking on my door in few days, and it won't be the neighbor, and it won't be a friendly knock.

Just contemplating doing it has me that close to going over to Google and starting to search for a server in some other country that I could use.

Even if we can't shove our fist down the throat of spammer and malicious bot programmers, we can still dream about the day we should get a chance to.

sneakyimp

My suggestion was not that you obtain a server yourself as it would always be traceable to you. My suggestion was that you might want to distribute a tool to the anti-spam community which someone can run on their desktop when their machine goes into screen saver mode--like folding@home does.

Merely constructing such a tool does not constitute a crime. The tool might acquire a list of servers to ping from honey pot. Running the tool would be a voluntary decision for any concerned member of the anti-spam community. Any given instance of the tool would not itself perfrom a DDOS attack on any given machine. It would, however occasionally ping one of the 73 million machines on the honey pot black list -- or any blacklist of your choosing i supposed. Or perhaps it performs a port scan on each of those machines for the purpose of gathering information.

Nothing illegal about a port scan.

Krik

A few pings here a few pings there and an occasional port scan. And we can all rest easy. Its all fun until someone looses and eye, like a malicious bot. And then it's even more fun. 😃