Bugtraq mailing list archives
Router Worm?
From: Chris Strom <cstrom () cos com>
Date: 19 Nov 2003 14:54:09 -0000
I've received a strange HTTP request on my web site from two different sources. The request is logged as: SEARCH /\x90\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 \xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02\xb1\x02 The request continues for a total of 32732 characters long (not shown). I was able to access one of the sites on port 80, here's the server response. Date: Tue, 15 Mar 1966 05:03:04 GMT Server: Allegro-Software-RomPager/2.10 Content-Type: text/html Last-Modified: Mon, 25 May 1998 00:00:00 GMT Client-Date: Wed, 19 Nov 2003 14:07:57 GMT Client-Peer: xxx.xxx.xxx.xxx:80 Client-Response-Num: 1 Title: Netopia Router (192.168.1.1) Apologies if this is a known issue or if this is the wrong forum for this information. Chris
Current thread:
- Router Worm? Chris Strom (Nov 19)
- Re: Router Worm? Fred Laxton (Nov 19)
- Re: Router Worm? Niels Bakker (Nov 19)
- Re: Router Worm? Jay Jacobson (Nov 19)
- <Possible follow-ups>
- RE: Router Worm? BugTrap (Nov 20)