So the Climategate investigation is closed. We are told it was a “sophisticated and carefully orchestrated attack on the CRU\u00e2\u20ac\u2122s data files, carried out remotely via the internet”<\/p>\n
So, today, I saw something that made me wonder if The Blackboard is currently the focus of a “sophisticated and carefully orchestrated attack on [its] data files, carried out remotely via the internet”. Here’s a connection my software blocked today:<\/p>\n
As happens on a nearly daily basis, something emanating from a suspicious server in Moldova got blocked. I think: “What the heck is WhatWeb\/0.4.7? ” <\/p>\n So I googled to find their self description:<\/a><\/p>\n Next generation web scanner. Identify what websites are running. Introduction<\/p>\n WhatWeb identifies websites. Its goal is to answer the question, \u00e2\u20ac\u0153What is that Website?\u00e2\u20ac\u009d. WhatWeb recognises web technologies including content management systems (CMS), blogging platforms, statistic\/analytics packages, JavaScript libraries, web servers, and embedded devices. WhatWeb has over 900 plugins, each to recognise something different. WhatWeb also identifies version numbers, email addresses, account IDs, web framework modules, SQL errors, and more.<\/p>\n WhatWeb can be stealthy and fast, or thorough but slow. WhatWeb supports an aggression level to control the trade off between speed and reliability. When you visit a website in your browser, the transaction includes many hints of what web technologies are powering that website. Sometimes a single webpage visit contains enough information to identify a website but when it does not, WhatWeb can interrogate the website further. The default level of aggression, called \u00e2\u20ac\u02dcpassive\u00e2\u20ac\u2122, is the fastest and requires only one HTTP request of a website. This is suitable for scanning public websites. More aggressive modes were developed for in penetration tests.<\/p><\/blockquote>\n It continues…. For another discussion of “webapplication fingerprinting” you can go here<\/a>:<\/p>\n Usage of Web Application Finger Printing<\/p>\n Web Application finger printing is a quintessential part of Information Gathering phase [4] of (ethical) hacking. It allows narrowing \/ drilling down on specifics instead of looking for all clues. Also an Accurately identified application can help us in quickly pinpointing known vulnerabilities and then moving ahead with remains aspects.<\/em> This Step is also essential to allow pen tester to customize its payload or exploitation techniques based on the identification and to increase the chances of successful intrusion.<\/em> <\/p><\/blockquote>\n Remember: I<\/I> didn’t order this. So, it’s up to you to try to decide how one would “move ahead” after discovering known vulnerabilities. <\/p>\n It’s also your guess whether a person running using available software to scan my site for vulnerabilities is “sophisticated” or whether this type of thing could be done by almost any motivated computer literate high school student. I suspect that the Norfolk Police would categorize it as the former. I suspect it’s the latter. Both are just my guesses. <\/p>\n","protected":false},"excerpt":{"rendered":" So the Climategate investigation is closed. We are told it was a “sophisticated and carefully orchestrated attack on the CRU\u00e2\u20ac\u2122s data files, carried out remotely via the internet” So, today, I saw something that made me wonder if The Blackboard is currently the focus of a “sophisticated and carefully orchestrated attack on [its] data files, … Continue reading Sophisticated and carefully orchestrated attack? Or?<\/span>
\n#: 77327 @: Fri, 20 Jul 2012 00:51:24 -0700 Running: 0.4.10a1
\nHost: 95-65-87-21.starnet.md
\nIP: 95.65.87.21
\nScore: 1
\nViolation count: 1
\nWhy blocked: Bothost and\/or Server Farm (credit: eclecticdjs.com). ( 0 ); c= MD
\nQuery:
\nReferer:
\nUser Agent: WhatWeb\/0.4.7
\nReconstructed URL: http:\/\/ rankexploits.com \/
\n<\/code><\/p>\n
\nDownload whatweb-0.4.7.tar.gz
\nLatest Version 0.4.7, 5th April 2011
\nLicense GPLv2
\nAuthor urbanadventurer aka Andrew Horton from Security-Assessment.com
\nWiki The WhatWeb Wiki
\nDevelopment Version WhatWeb on GitHub<\/p>\n
\nFor those wondering what I think this looks like:
\nSince I’m<\/i> not running the scan, it looks like it could be someone running a scan to figure out how to hack my blog. More creatively, it could be someone who wants me to learn of the existence of their software hoping I will see this in my logs, visit their site and then buy the software.<\/p>\n