Massachusetts Law Enforcement Network

Massachusetts Police News, Information and Discussions on MassCops

Posted by: SOT

[web:bcca521931]http://news.netcraft.com/archives/2004/12/21/santy_worm_spreads_through_phpbb_forums.html[/web:bcca521931]

---

Posted by: Gil

Yes and the worms are still working their way around the net. Just a few minutes ago I installed a little extra security that protects against this worm and within 5 minutes I already had hits in the log...


Here is the log...

http://www.masscops.com/phpBB2/ctrack.txt

One of the worms victims...

http://217.199.170.98/

---

Posted by: KozmoKramer

Gil - do you log the IP's of registered users?
If so, can you compare the IP of the hacks to see if a members PC is being used stealthily?

Network Security isn’t my specialty, but I know these little assholes
frequently relay off an unsuspecting host. It’s just a thought.

---

Posted by: Gil

Quote:

Originally Posted by KozmoKramer";p=&quot Gil - do you log the IP's of registered users? If so, can you compare the IP of the hacks to see if a members PC is being used stealthily? Network Security isn’t my specialty, but I know these little assholes frequently relay off an unsuspecting host. It’s just a thought.

Yes the IP's are logged but the log in the previous post is from infected phpBB's sending out the worm not personal computers

---

Posted by: Gil

This is getting ridiculous, I am getting 20,000 visits a day from infected phpBB boards trying to inject mysql statements!

---

Posted by: SOT

How can you tell? Can you see it in cpanel?

Quote:

Originally Posted by Gil";p=&quot This is getting ridiculous, I am getting 20,000 visits a day from infected phpBB boards trying to inject mysql statements!

---

Posted by: Gil

I'm not sure about cpanel but the log posted above has been cleaned out twice already because of it's size. Each line is a visit and when I open it up in a text editor it is showing 20,000 plus lines of logged information.

An interesting note on the stats though I noticed that they have jumped in the past few days, I don't know what it is but here is a sample....

I went from an average of 1,700 visits a day to over 16,000 visits yesterday.

An average of 30,000 page views a day to over 68,000 yesterday.

Unique visitors usually is around 7,000 per month so far this month I am at 13,000+

But I don't see any increase in referring URLS so either MassCops hit the press somewhere or this worm is fuc&ing with my stats.

---

vBulletin Copyright ©2000 - 2008, Jelsoft Enterprises Limited.
vB Easy Archive Final ©2000 - 2008 - Created by Stefan "Xenon" Kaeser