<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<TITLE>Message</TITLE>
<META content="MSHTML 6.00.2800.1226" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Tahoma size=2><SPAN
class=297231919-24092003>[</SPAN></FONT><FONT face=Tahoma size=2> Juan
Lorenzana<SPAN class=297231919-24092003><FONT face=Arial
color=#0000ff> ]</FONT></SPAN></FONT></DIV>
<DIV><FONT face=Tahoma><SPAN class=297231919-24092003></SPAN></FONT><SPAN
class=297231919-24092003><FONT face=Arial color=#0000ff
size=2> </FONT></SPAN></DIV>
<DIV><SPAN class=297231919-24092003> </SPAN>Tom, </DIV>
<BLOCKQUOTE dir=ltr
style="PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #0000ff 2px solid; MARGIN-RIGHT: 0px">
<P>So do you think this is a DoS attack? I have seen DoS attacks before
but I have never seen one that uses over 2,000 machines. I do not think
that the packets are spoffed, because 1) I can ping them, 2) They appear to
primarily originate from about 8 different countries only, 3) If I stop the
server (I did that for one full day), they keep going even after a day-
most DoS attacks stop when the system crashes or stops responding. <SPAN
class=297231919-24092003><FONT face=Arial color=#0000ff
size=2> </FONT></SPAN><SPAN class=297231919-24092003> </SPAN>
<P>Anyway, if it not related to zope, what do you think this flood is related
to? And why from all over the world. The attack started September
15 and the customer has no idea why they would single out his site. Pretty low
volume site. This system is on a shared hosting machine, and the attacks
are only focused on this one customer and not the whole machine.
<P>Any thoughts?
<P>We thought that there might be a database in a CMF servers and all of
sudden, someone put this customers site down as one of them and all zope users
started trying to access it. We do not use CMF and I had never heard of
it before so please excuse my ignorance as to what it actually does.
Like you mentioned,it probably has nothing to do with CMF. The only
reference in google that we could fine was to zope, so we thought there might
be a link.
<P>I am thinking about calling CERT to see if this is from a virus, but wanted
to make sure I understood the cause more before notifying CERT.
<P>P.S. If zope@zope.org is a mailling list,please let me know so that I do
not bore everyone with our problem. Thanks. <BR>
<P>Juan <BR>
<P>"Passin, Tom" wrote:
<BLOCKQUOTE TYPE="CITE">[ Juan Lorenzana] <BR>> My name is Juan Lorenzana
and I am a system administrator for <BR>> an ISP in <BR>>
Brazil. They offer virtual servers and virtual hosting. The
reason I <BR>> am sending you this email is that one of our virtual
hosting <BR>> customer's <BR>> web site is being flooded with requests
that appear to be related to <BR>> zope. An excerpt of the log
files appear below: <BR>> <BR>> <BR>> Access Log file: <BR>>
168.226.70.160 - - [24/Sep/2003:11:34:50 -0600] "GET <BR>>
/put?ver=01&task=newzad&first=1 HTTP/1.1" 404 285 <BR>>
216.244.197.250 - - [24/Sep/2003:11:35:55 -0600] "GET <BR>>
/put?ver=01&task=newzad&first=1 HTTP/1.0" 404 273 <BR>>
200.63.144.150 - - [24/Sep/2003:11:36:10 -0600] "GET <BR>>
/put?ver=01&task=newzad&first=1 HTTP/1.0" 404 273
<P>The same thing has also been seen in a php context, so it is probably
<BR>nothing to do with Zope -
<P>"The server farm is being hit by about 30,000 of these per minute
<BR>along with all of your valid requests :
<P>from <A
href="http://forum.mydomain.com/viewtopic.php?t=2241&start=15">http://forum.mydomain.com/viewtopic.php?t=2241&start=15</A>
-
<P>-- begin log snip --
<P>4.35.208.254 [27/Aug/2003:14:13:46 -0700]
<BR>"\x87\x92\xdc\xecf\xaa\xb8,i\x99?\xd7\xe1\xff\xe3\xabi\x9a\xb9tl\xba\"#\
<BR>xe7\
<BR>xf5\xaa\x1fp\x1b0\xe0xmH\xb9\xcd\t\xdd\xf5b\xa9\x1b&S\x8d\x8b\xba$\xb6\x
<BR>80\xcfJU\xb3I\xec\x83*!\xea2^\xff\x1fd\x9c\x0c\xe3\x9b\xac\x01\xd4\x90\x
<BR>b1\x8\xd7'P\xb5Y\xa3\x14\x04\xdb\x16\x11E\xad\x1c\xc8\x06\xf9\xc9K
<BR>\x04\xe0\xa2\x8c\xb1FlxG\xb6\xc9\x9as\xb5x\xc5\x91\xc9=\xba'\xe6\x86@\xb
<BR>2)Mw\xa6\xc9@i" 400 371
<P>200.67.219.5 www.Gustavo.com [27/Aug/2003:14:13:46 -0700] "GET <BR><A
href="http://www.instituto.com.br/attackDoS.php?ver=01&task=newzad&first=1">http://www.instituto.com.br/attackDoS.php?ver=01&task=newzad&first=1</A>
<BR>HTTP/1.1" 404 5
<P>-- end log snip -- "
<P>There are other php examples too.
<P>The Zope Hot Patch does not look like the query string. the only
part <BR>that has a name starting with "z" is this -
<P>from zLOG import LOG, INFO
<P>I doubt that this has anything to do with zope per se, given the above.
<P>Anyone else know anything more concrete than speculation?
<P>Cheers,
<P>Tom P</P></BLOCKQUOTE></BLOCKQUOTE></BODY></HTML>