Groups > comp.os.linux.networking > #2160

Re: wpad.dat attack on Linux Apache server

From	Sandman <mr@sandman.net>
Newsgroups	comp.os.linux.networking, comp.os.linux.security, comp.infosystems.www.servers.unix
Subject	Re: wpad.dat attack on Linux Apache server
Date	2013-05-24 21:25 +0200
Message-ID	<mr-A33494.21252624052013@News.Individual.NET> (permalink)
References	(11 earlier) <8761y8qxcr.fsf@araminta.anjou.terraraq.org.uk> <mr-870DFD.16265624052013@News.Individual.NET> <519f999f$0$15903$e4fe514c@news2.news.xs4all.nl> <mr-C61E2B.18533924052013@News.Individual.NET> <op.wxlnuoipa3w0dxdave@hodgins.homeip.net>

Cross-posted to 3 groups.

Show all headers | View raw

In article <op.wxlnuoipa3w0dxdave@hodgins.homeip.net>,
 "David W. Hodgins" <dwhodgins@nomail.afraid.org> wrote:

> > No, that's the thing - "stadsnat.se" is not a domain I am
> > administering. It's one of my clients domains. They wouldn't wildcard
> > DNS and send ALL requests to me - only web requests (so www would
> > point to me).
> 
> If stadsnat.se is an isp

They aren't actually. The domain is owned by a client of miune, the 
citynet of Örebro, a swedish town. They use "www.stadsnat.se" to 
promote their citynet. None of my clients are ISP's...

> and stadsnat.se is a cname for your system,

Just to clarify - "stadsnat.se" can never be a CNAME, the top domain 
can only be pointed with an A record to an IP number. Their "www" 
subdomain is, however, CNAME:d to my "cluster.atlascms.se". 

> and their customers get dhcp addresses of the form ipaddr.stadsnat.se,
> then all of their customers will be going to stadsnat.se/yourssystem,
> to look for the wpad info.

Yes, all of what you say is true - if they would have been an ISP

> Workaround would require stadsnat.se to point to one of their own
> servers, and have www.stadsnat.se be the cname to your system, with
> there server redirecting stadsnat.se to www.stadsnat.se.

Which, coincidentally, is exactly how it is set up right now :)

> By blacklisting the ip addresses, the website for stadsnat.se will
> become unreachable by their customers.

Yes, this has been a concern for me. I did some checking, and of all 
the hundreds and thousands of IP addresses that are flooding me, I 
couldn't find any that was at the same time surfing the apache server 
normally.

So, these IP's seem to be normal user IP's and I am actively blocking 
almost 5000 of them by now, which must include some that sooner or 
later will want to surf one of the many web sites hosted by this 
machine.

Blocking them in the firewall is just a measure I'm taking in order to 
make my web server responsive again. It's hardly a long-term solution 
(where would it stop? 10k? 100k?)

-- 
Sandman[.net]

Back to comp.os.linux.networking | Previous | Next — Previous in thread | Next in thread | Find similar

Thread

wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 11:22 +0200
  Re: wpad.dat attack on Linux Apache server Richard Kettlewell <rjk@greenend.org.uk> - 2013-05-24 10:37 +0100
    Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 11:44 +0200
      Re: wpad.dat attack on Linux Apache server Richard Kettlewell <rjk@greenend.org.uk> - 2013-05-24 11:04 +0100
        Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 12:13 +0200
          Re: wpad.dat attack on Linux Apache server Richard Kettlewell <rjk@greenend.org.uk> - 2013-05-24 11:20 +0100
            Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 12:23 +0200
              Re: wpad.dat attack on Linux Apache server J G Miller <miller@yoyo.ORG> - 2013-05-24 11:07 +0000
                Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 14:43 +0200
                Re: wpad.dat attack on Linux Apache server Casper H.S. Dik <Casper.Dik@OrSPaMcle.COM> - 2013-05-24 13:05 +0000
                Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 15:14 +0200
                Re: wpad.dat attack on Linux Apache server Joe Beanfish <joebeanfish@nospam.duh> - 2013-05-24 13:39 +0000
                Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 16:23 +0200
                Re: wpad.dat attack on Linux Apache server Richard Kettlewell <rjk@greenend.org.uk> - 2013-05-24 15:13 +0100
                Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 16:26 +0200
                Re: wpad.dat attack on Linux Apache server Richard Kettlewell <rjk@greenend.org.uk> - 2013-05-24 17:38 +0100
                Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 19:02 +0200
                Re: wpad.dat attack on Linux Apache server Richard Kettlewell <rjk@greenend.org.uk> - 2013-05-24 18:45 +0100
                Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 21:12 +0200
                Re: wpad.dat attack on Linux Apache server Casper H.S. Dik <Casper.Dik@OrSPaMcle.COM> - 2013-05-24 16:47 +0000
                Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 18:53 +0200
                Re: wpad.dat attack on Linux Apache server J G Miller <miller@yoyo.ORG> - 2013-05-24 17:15 +0000
                Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 21:20 +0200
                Re: wpad.dat attack on Linux Apache server Richard Kettlewell <rjk@greenend.org.uk> - 2013-05-25 08:45 +0100
                Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-25 09:54 +0200
                Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-25 10:04 +0200
                Re: wpad.dat attack on Linux Apache server Casper H.S. Dik <Casper.Dik@OrSPaMcle.COM> - 2013-05-26 10:12 +0000
                Re: wpad.dat attack on Linux Apache server "David W. Hodgins" <dwhodgins@nomail.afraid.org> - 2013-05-24 13:50 -0400
                Re: wpad.dat attack on Linux Apache server Richard Kettlewell <rjk@greenend.org.uk> - 2013-05-24 19:10 +0100
                Re: wpad.dat attack on Linux Apache server Richard Kettlewell <rjk@greenend.org.uk> - 2013-05-24 19:15 +0100
                Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 21:33 +0200
                Re: wpad.dat attack on Linux Apache server Richard Kettlewell <rjk@greenend.org.uk> - 2013-05-25 08:38 +0100
                Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 21:25 +0200
                Re: wpad.dat attack on Linux Apache server Whiskers <catwheezel@operamail.com> - 2013-05-25 15:52 +0100
                Re: wpad.dat attack on Linux Apache server Roger <invalid@invalid.invalid> - 2013-05-25 17:19 +0100
                Re: wpad.dat attack on Linux Apache server J G Miller <miller@yoyo.ORG> - 2013-05-25 17:22 +0000
                Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-25 19:41 +0200
              Re: wpad.dat attack on Linux Apache server Chris Davies <chris-usenet@roaima.co.uk> - 2013-05-24 12:31 +0100
                Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 14:29 +0200
                Re: wpad.dat attack on Linux Apache server Chris Davies <chris-usenet@roaima.co.uk> - 2013-05-24 23:45 +0100
  Re: wpad.dat attack on Linux Apache server Sandman <mr@sandman.net> - 2013-05-24 14:49 +0200
  Re: wpad.dat attack on Linux Apache server jcharth@gmail.com - 2013-05-28 12:45 -0700

csiph-web