Reading Application Logs
The lines below are five minutes of the online bookstore's web server log from a night last spring, before its search box was rebuilt, one line per request. Each gives the time, the address the request came from, and what was asked for. Then come the status code the server answered with, where 200 means it served the request and 500 means the program failed, and the number of bytes it sent back.
21:40:07 192.0.2.57 GET /search?q=piranesi 200 13880
21:40:31 192.0.2.57 GET /books/piranesi 200 14388
21:41:02 198.51.100.83 GET /search?q=x'+OR+'a'='a'-- 200 96204
21:41:40 198.51.100.83 GET /fonts/../../shop/settings.yml 200 1207
21:42:15 192.0.2.140 POST /checkout/gift-note 200 512
21:42:16 192.0.2.140 GET /order/confirm 200 6630
21:43:09 198.51.100.83 GET /search?q=AAAAAAAA...(2,410 chars) 500 311
21:44:52 192.0.2.211 GET /books/the-hobbit 200 15022
Four addresses are at work. Pick out the lines that don't look like a shopper.
Every line from 198.51.100.83 is something other than shopping, and each one is a different attack. The rest are what they look like: a search, a book page, a gift note at checkout and the confirmation, another book page.
SQL injection in a search
The third line searched for a title made of a quote mark, a test that every row passes, and two dashes. A shopper doesn't type that. The size gives the result away too: 96,204 bytes against 13,880 for an ordinary search, about seven times the page, as if every book had matched.
The gift note was sent with POST, which carries what was typed in the body of the request instead of in the URL, so its text isn't in this log at all; the server records only the path it was sent to. That is one reason the shop software also logs what arrives in its input fields. Looked up there, the note reads "Happy birthday, Sam!". If it had held a
<script>...</script> tag, the shop would have stored it and shown it on the order page.Directory traversal
The fourth line started in the folder that holds the site's fonts, then climbed two folders with
../../ and named the shop's settings file. The status is 200 and the size is small, 1,207 bytes, which is about what a settings file weighs and nothing like a font file. The server handed it over.That line is the most serious of the evening, since the settings file holds the database password. The bookstore changes that password the same night and has its software company fix the program so a request path can't leave the folder it serves files from.
Buffer overflow attempts
The seventh line is shortened above, and the length is the point: a search of 2,410 characters, where no title runs past a hundred or so. The server answered 500, so the program failed while handling it. What gives that line away?
No title runs to 2,410 characters, and a request far longer than the program expects is the mark of a buffer overflow attempt. Somebody sent far more data than the search box was built for, hoping it would spill past the space set aside for it. The failure doesn't show whether anything more than a crash happened, so the bookstore asks its software company to check the search program.
Code Red, 2001
An unchecked buffer in IIS, Microsoft's web server software, in the part that answers requests for files ending in .ida, had a fix from Microsoft on June 18, 2001. About a month later a worm, a program that copies itself from computer to computer, arrived to use the flaw. A new version released on July 19 infected 359,104 servers in about 13 hours. That is the count of CAIDA, a network research center, which saw more than 2,000 new infections a minute at the peak.
Buffer overflows were an old way in by then. The Morris worm of 1988 had spread partly through one. After the worm, the Defense Department asked Carnegie Mellon University to set up CERT, a center that tracks attacks and warns the public about them.
Each infected server sent the same request to address after address, and it reached servers of every kind, because the worm didn't check what software it was talking to. The request asked for /default.ida? followed by a long run of the letter N and then a block of encoded data. CERT's advisory printed it as servers logged it, wrapped onto six lines:
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
NNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%
u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531
b%u53ff%u0078%u0000%u00=a
Read that by this lesson's rules: which indicator does it carry, and what does finding it in a log prove?
It carries the length indicator of a buffer overflow, a URL hundreds of characters long where a real request for that file is short. Finding it proves only that the server was tried. Servers running other software had no .ida handler to overflow. They logged the same line by the thousand that summer and were never at risk. Only the status code and a check of the server's own software could say more.
On infected servers whose default language was English, every page the server sent out was replaced with "HELLO! Welcome to http://www.worm[.]com! Hacked By Chinese!", a change made only in memory, so a restart erased it along with the worm. From the 20th of each month the worm was set to flood the White House website at a fixed numeric address. The site was given a neighboring address before the flood came, so the traffic hit nothing. Two researchers at eEye Digital Security, who had analyzed it, named the worm after the Code Red Mountain Dew they drank while working. A consulting firm estimated the cleanup and lost work at about 2.6 billion dollars. Every infected server had been running software whose fix was at least a month old.
Sources: Microsoft Security Bulletin MS01-033 (June 18, 2001); CERT Advisory CA-2001-19, "Code Red" Worm Exploiting Buffer Overflow in IIS Indexing Service DLL (July 19, 2001); CAIDA, "The Spread of the Code-Red Worm (CRv2)" (2001); Out-Law, "Code Red cost 2.6 billion dollars worldwide" (September 5, 2001).