Comments on The Security Shoggoth: Another Odd SQL Injection Attack

It is just hex represenation of ascii characters.....

2009-04-16T18:06:00.000-04:00

It is just hex represenation of ascii characters...

See http://home2.paulschou.net/tools/xlate/ for several conversion options...

I found your post while attempting to decipher my ...

2009-04-16T17:34:00.000-04:00

I found your post while attempting to decipher my own attacks and was wondering if you could help me by pointing me towards a converter that can help me decipher the input, for example: 0x27,0x7c,0x5f,0x7c ?

Any help would be appreciated.

thanks,
json

Scott, I'm also convinced its from a botnet, if n...

2009-03-16T10:27:00.000-04:00

Scott,

I'm also convinced its from a botnet, if nothing else from the sheer number of hits I got. I didn't post it but we got hit with another. I attempted to block the hosts via IPTables, but as soon as I'd block 10, 10 more would hit us. Definitely a botnet.

It was definitely not successful on our site, but as you can see from various Google searches it did work on others.

Lately there has been some discussion at SecureSta...

2009-03-13T13:37:00.000-04:00

Lately there has been some discussion at SecureState around these attacks...one approach was using game theory, and less technical analysis...with that being said, I'm fairly confident that we can point this to bot nets, and here is why:

Assume "::xeQ-1-ted::" to be a variation of a handle or screen name...

With that, do some google searches:

http://www.google.com/search?hl=en&safe=off&q=%22xeQted%22&btnG=Search

and

http://www.google.com/search?hl=en&safe=off&rlz=1G1GGLQ_ENUS318&q=%22xeQter%22+-xecuter&btnG=Search

and reveal lots of info like:

http://74.125.95.132/search?q=cache:xWUW4Dg3e6oJ:putih.web.id/forum/viewtopic.php%3Fid%3D483+%22xeQted%22&cd=3&hl=en&ct=clnk&gl=us

http://74.125.95.132/search?q=cache:k3m_IWEtEEAJ:spl0itz.net/board/viewtopic.php%3Ff%3D20%26t%3D341+%22xeQted%22&cd=4&hl=en&ct=clnk&gl=us

http://osdir.com/ml/org.user-groups.linux.twincling/2007-11/msg00051.html

http://www.mail-archive.com/botnets@whitestar.linuxbox.org/msg00800.html

etc.

As far as the attacks being successful or not is a different story, but I think the source may be a little more understood.

Thoughts?

Wow...great point! In the Google searches I found...

2009-03-10T22:04:00.000-04:00

Wow...great point! In the Google searches I found that is exactly what it looks like.

With that sql, an atacker can easily identify whic...

2009-03-10T13:23:00.000-04:00

With that sql, an atacker can easily identify which query has been successfully executed (after executing many incrementing the number of parameters), by simply look at the result page and searching for those strange names. They are indeed strange because they need to be easily noticed on that result page.