On Sun, Feb 11, 2001 at 12:44:40PM -0500, John Young wrote:

We have from time to time phantom "accesses" from odd addresses such as yesterday:

http://161/1.035

an http:whatever is probably from the Referrer line. It's not meaningful as a name of the machine that's accessing a page. That would be a machine name or IP address. Here's a line from an actual log file: 213-99-180-52.uc.nombres.ttd.es - - [11/Feb/2001:18:07:28 +0000] "GET / HTTP/1.1" 200 2146 "http://buscador.ya.com/scripts/busqueda?item=laura&cat=internet&offset=40&palabras=all" "Mozilla/4.0 (compatible; MSIE 5.0; Windows 98; DigExt)" The first field 213-99-180-52.uc.nombres.ttd.es is the address of the machine that sent the request. The first field in quotes, starting with GET, is the HTTP request that 213-99-180-52.uc.nombres.ttd.es sent. The next two fields (200 2146) is the code that the web server returned, and the size of the data returned. The next part in quotes (http://buscador.ya.com....) is the Referrer field, which is what 213-99-180-52.uc.nombres.ttd.es sent as the last site that they'd visited, i.e. the one that linked to us. There's nothing that says that the Referrer tag has to be correct, or even present. (well, the HTTP spec probably says that it should be correct, but there's no way to enforce that).

These accesses and addresses do not show up in the log files but are listed in summaries of accesses produced by Analog on our dedicated server. When we run Analog of what should be the same log file on our machine the addresses do not appear.

There's probably a bug in the copy of Analog that your ISP is using. A look at the log file would tell. Another cause could be someone sending ASCII control characters in HTTP fields, which confuse Analog but which are translated into something else when you retreive the log files.

The odd addresses change, none repeat, and do not appear every day.

Got any ideas what such entries indicate? Machine camouflage, snoops by spooks, spoofs, debris, taunts?

Most likely software bugs. -- Eric Murray Consulting Security Architect SecureDesign LLC http://www.securedesignllc.com PGP keyid:E03F65E5

On Sun, Feb 11, 2001 at 12:44:40PM -0500, John Young wrote:

We have from time to time phantom "accesses" from odd addresses such as yesterday:

http://161/1.035

These accesses and addresses do not show up in the log files but are listed in summaries of accesses produced by Analog on our dedicated server. When we run Analog of what should be the same log file on our machine the addresses do not appear.

Interesting- the message below just showed up on bugtraq:

From: Stephen Turner Subject: Security advisory for analog To: BUGTRAQ@SECURITYFOCUS.COM

SECURITY ADVISORY 13th February 2001 ---------------------------------------------------------------------- Program: analog (logfile analysis program) Versions: all versions except 4.16 and 4.90beta3 Operating systems: all ---------------------------------------------------------------------- There is a buffer overflow bug in all versions of analog released prior to today. A malicious user could use an ALIAS command to construct very long strings which were not checked for length.

This bug is particularly dangerous if the form interface (which allows unknown users to run the program via a CGI script) has been installed.

This bug was discovered by the program author, and there is no known exploit. However, users are advised to upgrade to one of the two safe versions immediately, especially if they have installed the form interface. The URL is http://www.analog.cx/

I apologise for the inconvenience. Stephen Turner

-- Stephen Turner http://www.statslab.cam.ac.uk/~sret1/ Statistical Laboratory, Wilberforce Road, Cambridge, CB3 0WB, England "Your account can only be used for a single internet session at any one time and for no more than 24 hours in any one day." (NTL terms of use)

-- Eric Murray Consulting Security Architect SecureDesign LLC http://www.securedesignllc.com PGP keyid:E03F65E5