default.ida?xxxxxxxxxxxxxxxxxxxxx

[hayathuk]

hi,
somebody trying to access default.ida?xxxxxxxxxxxxxx
at my server. i think this is an hacking attempt.
if so, can anyone tell me how to protect that.

thank you.

 

[Newposter]

This is the famous Code Red/NIMDA attack, which works on IIS servers, but to which Apache is immune. If you run IIS, implement the latest patches; if you run Apache, ignore it and periodically clean out the logs.

If successful, it allows takeover of your machine.

I get dozens of these per day, mostly from ATTBI (Comcast users). Many of them are probably unintentional, from infected PCs.

Newposter
"Good judgment comes from experience. Experience comes from bad judgment."

 

[pwesson]

I neat little trick I found on the net was to create a zero byte "default.ida" file on the root of my web server (i.e. /var/

http://www/html).

This will cut down on how much data is sent back to the client... i.e. no error page is returned and you save that many bytes.

Paul Wesson, Programmer/Analyst

http://www.ipaw.net

 

[Newposter]

I tried that, but it still took up the same space in my logs, generated just as many lines.

Newposter
"Good judgment comes from experience. Experience comes from bad judgment."

 

[pwesson]

It is not the space in your logs that this helps, but the amount of data transmitted over your net connection.

If your ISP bills you or restricts the amount of data you can transmit, then it is a big help.

Paul Wesson, Programmer/Analyst

http://www.ipaw.net