Path: csiph.com!usenet.pasdenom.info!gegeweb.org!de-l.enfer-du-nord.net!feeder1.enfer-du-nord.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From: Sandman <mr@sandman.net>
Newsgroups: comp.os.linux.networking,comp.os.linux.security,comp.infosystems.www.servers.unix
Subject: Re: wpad.dat attack on Linux Apache server
Date: Fri, 24 May 2013 16:23:13 +0200
Lines: 34
Message-ID: <mr-36EE0D.16231324052013@News.Individual.NET>
References: <mr-983E88.11221424052013@News.Individual.NET> <87vc68ra57.fsf@araminta.anjou.terraraq.org.uk> <mr-05E7DC.11442724052013@News.Individual.NET> <87ppwgr8wz.fsf@araminta.anjou.terraraq.org.uk> <mr-794073.12134024052013@News.Individual.NET> <87k3mor85j.fsf@araminta.anjou.terraraq.org.uk> <mr-17CDE1.12235424052013@News.Individual.NET> <knnhma$50u$4@dont-email.me> <mr-011092.14433624052013@News.Individual.NET> <519f6593$0$15954$e4fe514c@news2.news.xs4all.nl> <mr-D7D3D2.15141924052013@News.Individual.NET> <knnqit$ib6$1@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-Trace: individual.net eSTLoVyyx1mWr2AKFnCWywNjmkPCgaG19ke85ejFEPN9LGIYk=
X-Orig-Path: mr
Cancel-Lock: sha1:lJvZ/wjxNi+6/5hhn4hhVlabqi8=
User-Agent: MT-NewsWatcher/3.5.2 (Intel Mac OS X)
X-Face: $@,Vfa$,)%=Qa7L]y)&oZj_\EiHc}}A<Y3TvbI2&|e"bE9zc[o<ThMgB4%*L$b1YsNl!/ <lHO$>f0Bei"4a_%)"c6TQ+P/:53>;PNGuWUmkqyeN-qM65foJ[;T_(k;>]&G\T4Lhm:2 ujye2_,iUJFE;NZn>y;.|-hl7g~bIOF1qG\o<?]4mXkW*mT3]{Bn&VwP7(M0uYnGA!V!? {"y?BkBDW6e-.=I5
X-Killfiled: yttrx, gallopinginsanity.com, Mark Kent, Maverick, NRen2, weedhopper, PC Guy, nospam@nospam.com, Oxford, Jim Lee Jr., Mocassin Joe, Chance Furlong, XX, Uncle Max, Joe Pain, Redjak, isquat@gmail.com, Robert Whelan, jt2002a@hotmail.com
Xref: csiph.com comp.os.linux.networking:2146 comp.os.linux.security:300 comp.infosystems.www.servers.unix:183

In article <knnqit$ib6$1@dont-email.me>,
 Joe Beanfish <joebeanfish@nospam.duh> wrote:

> >> Well, you shouldn't have done that.
> > 
> > Fair enough, but I still don't know how that messed this up. I just
> > can't wrap my head around it.
> 
> Wildcard DNS is asking for issues unless you fully understand all the
> ramifications. Best not to use it unless you really really need it and
> fully understand it.

Fair enough. 

> You have no entry for "wpad" so your wildcard is used.

Yes, that's how wildcards works - but not only do I not understand why 
thousands of hosts from all over the swedish internet would start to 
request wpad.* on my server, some of the up to thirty times per second - 
per host!

I am also not hosting any of their domains, so why would would they ever 
come to me to ask for this?

> Get people off your server by creating a wpad entry in your dns that 
> points to a nonexistent host or a host you want to handle that 
> discovery traffic, even if only to reject it.

I did that yesterday, didn't change a single thing... :(



-- 
Sandman[.net]