ARRRGH - muieblackcat

In case any missed the muieblackcat information, you need it

[knonymouse]

First, ARRRRGHH.

Thanks. I needed that.

These should be required reading for anyone trying to defend their server... (I just read them.)

Hackers Use MIT Server to Hack 100,000 Sites:

[dailytech.com...]

Advice on dealing with the robots invoved:

[securityweek.com...]

Now I've read them I find I have part of the answer to a couple of my prior questions.

It doesn't matter how small your site is, it just matters if you have a vulnerability. The tireless robots will find you. Some, by robodialing your IP number, even if you have no DNS entry or search engine visibility.

I've seen everything in the articles come through in my logs recently.

So. Now I know... don't trust an *.edu .. be worried by // ... keep a sharp eye for a muieblackcat directory ... setup, scripts myphpadmin, login, register ... even any random filename can refer to a an attempt to folloe up on a previously successful write deep inside your directory tree, in ANY directory (the more obscure, the better). And some images hotlinked to scraper sites. And so on.

A couple of years ago, a careless support person left a backup directory created with write permissions, none of which I was aware of until the effects of the malicious files a robot placed there came to light weeks later. Seconds later, the robot had spammed hundreds (if not thousands) of vulnerable forums and galleries with dozens of links back to those files. It still makes me sick to think of the grief all that caused.

A different attack, that happened I know not how took months of effort involved to stomp out the last infection.

As far as I know, those trials by fire are keeping me more alert. I hope by now my defense is better than the robot attacks.

Pardon excuse me, while I go outside and scream again.

[lucy24]

Using mod-rewrite in HTACCESS can filter these scans, redirecting them to your main domain or elsewhere, such as a 403 page.

RewriteCond %{REQUEST_URI} ^(.*)//+(.*)$

RewriteRule / http: //www.example.com/%1/%2 [R=301,L]

Uhmm..... Better scream a little louder. I may need you to drown out g1smd :)

Yes indeed. I see lots of muieblackcat requests. Blocked just because a 403 is more viscerally satisfying than the 404 they would otherwise get. Same goes for anything .php since I don't use it. Had no idea MIT was involved, though.

But "Don't trust .edu" is still the wrong message. For most of what ails you, "Don't trust German server farms" will do fine.

[knonymouse]

Even more satisfying, though exhausting and time-consuming, is to send them to a page that sends me an email with their IP and target. Then I put an explicit ban on that IP in htaccess so their next knock-knock for anything gets nowhere, even if it's a ruse I don't know. I don't want them to find a vulnerability I didn't know about.

Yes, I'll quit that amount of effort shortly. The futility is like swatting gnats with a cat's whisker. But meanwhile I'm learning more precisely first-hand just how much robot activity there is and from where. Fascinating, though in a soul-destroying way.

[knonymouse]

The code that boots "//" finds some examples that I don't think are threats when I review them in the log. Anyone adding the rewrite to snag the "//" needs to monitor the results for a while.

[lucy24]

You can get double // from a human if they cut & paste into the browser's address bar and don't notice that they came out with two slashes. Browsers ignore the duplicate, so if the requested file otherwise exists, it will be served up. Just recently I found a pretty dramatic illustration in logs. The main file had a leading // and since it was a picture book it was followed by 50 or 60 requests for //blahblah/images etc. Everything came through loud and clear.

Quick check of recent raw logs reveals that just about everyone asking for illicit // was blocked anyway. And if they weren't before, they are now ;)

Wish they wouldn't keep asking for "tiny_mce". It sounds like a name I would really use. But then, so does "muieblackcat" :) And I guess there must really exist something called /fck/ in some CMS or other, or there wouldn't be so many robots asking for it. The first time I saw it in a real filename on a real site, I did a severe doubletake. ("Are you sure you want to include that name in your URL?")

[keyplyr]

@lucy24 - Drupal can replace textarea fields with the FCKeditor (a WYSIWYG html editor.) I just block "edit" and that seems to do the job.