3

This afternoon I got a flood of request (400+ within 10 minutes) to one of my web applications, from the same IP address, for non-existent URI.

All of the requests were GET with a path the matches the following format

^((\/[A-F0-9]{8}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{4}-[A-F0-9]{12}){2})\/from\?get\&nocache=[a-z0-9]{5}$

an example of one of the requests

/F834D4AE-7C9D-D641-9AAF-F069F547BC8C/FA4E1A87-5808-B342-BCDE-713371F499F9/from?get&nocache=1d8a4

Are these requests something to be concerned with, what could be generating the requests, and is there something they are trying to do?

4
  • 1
    Most probably looking for some kind of known vulnerability. If your site is not susceptible to such a request (ie. it simply generates a 404 and consumes minimal resources) then it's really a non-issue. [A-Z0-9] - GUIDs are hex, which is consistent with the example URL posted. ie. [A-F0-9] (or [A-F\d]). Or you could just match \w (any word character) for a shorter regex and use a quantifier to match 2 x GUIDs.
    – MrWhite
    Aug 19 '20 at 15:56
  • thanks @MrWhite for the response and Regex simplification. Since this came from someone that is claiming to want to partner with us, I am a bit hesitant to just trust the 404 I've been responding with.
    – Tezyn
    Aug 19 '20 at 17:04
  • "this came from someone that is claiming to want to partner with us" - that's weird! So, you "know" them? Are they perhaps trying to run their own pen-tests on your app before they commit?!
    – MrWhite
    Aug 20 '20 at 0:26
  • Ya. I would like to be able to approach them with more than my gut feelings, but can't seem to figure out what they're up to to actually approach them about it.
    – Tezyn
    Aug 20 '20 at 1:27
3

I've experienced a similar "attack". I think it's unintentional and caused by a bug or malfunction in Kaspersky Antivirus. We saw the exact same request you mention, but only one, followed by hundreds of thousands of POST requests to this path:

/{GUID}/{GUID}/logerr

Searching the internets I think it looks related to Kasperskys Antivirus JavaScript Injection which injects this snippet in the head of all pages you visit:

<script type="text/javascript"
        src="http://gc.kis.scr.kaspersky-labs.com/{GUID}/main.js"
        charset="UTF-8">
</script>

The suspicion is that this script have gone bananas and started directing requests to the main site instead of the gc.kis.scr.kaspersky-labs.com host (which resolves to a local non-routable 127-address where I suspect there sits a local HTTP-listener serving the script and receiving metrics/logs if you've installed Kasperskys). My guess is that the first GUID you see in the requests is the same as the GUID in the script path above, which apparently is some sort of identifier/representation of the Kaspersky license key.

The difference in behavior after the first request could maybe be caused by the fact that we in this case responded to 404's with 200.

2
  • I feel like this only partially answers the question. Are these requests something that OP should be concerned with? Can you point to any documentation about Kaspersky's script going "bananas"? If it turns out to not Kaspersky, what else could it be? Sep 11 at 16:34
  • 1
    @mike-ciffone, this question has been sitting here for 13 months, and apart from a few blog posts in Chinese and Japanese that gives away this URL in screenshots from traffic snoops discussing the Kaspersky Antivirus Javascript Injection privacy debacle a couple of years ago, the internet is pretty much blank. As I suggested, I don't think the OP is actively targeted, but we all need to think of how our sites behave should they be flooded with traffic, regardless of source/intention. No I don't have any evidence, but it's not a beginners guess, and it's the only explanation I can come up with. Sep 11 at 19:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.