Which kind of attack?

Hello,
when I tried to visit the URL which was written in the following post
I was warned about a security risk.
http://groups.google.se/group/soc.cu...e=source&hl=sv
Do you know what the writer was trying to do?
--
Luigi Donatello Asero
https://www.scaiecat-spa-gigi.com/it/svezia.html
谢谢ä½* Ñ�паÑ�ибо

Luigi Donatello Asero

Luigi Donatello Asero wrote:

> Hello,
> when I tried to visit the URL which was written in the following post
> I was warned about a security risk.

By whom? What specifically?

Well, I got a warning about a certificate error on the https:// link
because I explicitly distrust Equifax Global eBusiness Class 1, but that's
it.

> http://groups.google.se/group/soc.cu...e=source&hl=sv
> Do you know what the writer was trying to do?

Eh... nothing?

Sebastian Gottschalk

"Sebastian Gottschalk" <> skrev i meddelandet
news:...
> Luigi Donatello Asero wrote:
>
> > Hello,
> > when I tried to visit the URL which was written in the following post
> > I was warned about a security risk.
>
> By whom?
J.Venning
(see the link)

What specifically?
>
> Well, I got a warning about a certificate error on the https:// link
> because I explicitly distrust Equifax Global eBusiness Class 1, but that's
> it.
>
> >
http://groups.google.se/group/soc.cu...e=source&hl=sv
> > Do you know what the writer was trying to do?
>
> Eh... nothing?

I have Internet Security and I got a message which, translated said more or
less
that a computer with the adress 127.0.0.1 sent information which was similar
to the information in the attack
HTTP MS IIS ASP Source disclosure.
What does that mean?
--
Luigi Donatello Asero
https://www.scaiecat-spa-gigi.com/it/svezia.html
谢谢ä½* Ñ�паÑ�ибо

Luigi Donatello Asero

"Sebastian Gottschalk" <> skrev i meddelandet
news:...
> Luigi Donatello Asero wrote:
>
> > Hello,
> > when I tried to visit the URL which was written in the following post
> > I was warned about a security risk.
>
> By whom? What specifically?
>
> Well, I got a warning about a certificate error on the https:// link
> because I explicitly distrust Equifax Global eBusiness Class 1, but that's
> it.
>
> >
http://groups.google.se/group/soc.cu...e=source&hl=sv
> > Do you know what the writer was trying to do?
>
> Eh... nothing?

I answered at alt.computer.security

--
Luigi Donatello Asero
https://www.scaiecat-spa-gigi.com/
谢谢ä½* Ñ�паÑ�ибо

Luigi Donatello Asero

Luigi Donatello Asero wrote:

> I have Internet Security and I got a message which, translated said more or
> less that a computer with the adress 127.0.0.1 sent information which was similar
> to the information in the attack
> HTTP MS IIS ASP Source disclosure.
> What does that mean?

Nothing. Your network error simulation software simulated a network error.

Sebastian Gottschalk

"Sebastian Gottschalk" <> skrev i meddelandet
news:...
> Luigi Donatello Asero wrote:
>
> > I have Internet Security and I got a message which, translated said more
or
> > less that a computer with the adress 127.0.0.1 sent information which
was similar
> > to the information in the attack
> > HTTP MS IIS ASP Source disclosure.
> > What does that mean?
>
> Nothing. Your network error simulation software simulated a network error.

Thank you.
Is that a kind of behaviour which is normal for Symantec Norton Internet
Security?

--
Luigi Donatello Asero
https://www.scaiecat-spa-gigi.com/
谢谢ä½* Ñ�паÑ�ибо

Luigi Donatello Asero

Luigi Donatello Asero wrote:

>
> "Sebastian Gottschalk" <> skrev i meddelandet
> news:...
> > Luigi Donatello Asero wrote:
> >
> > > I have Internet Security and I got a message which, translated said more
> or
> > > less that a computer with the adress 127.0.0.1 sent information which
> was similar
> > > to the information in the attack
> > > HTTP MS IIS ASP Source disclosure.
> > > What does that mean?
> >
> > Nothing. Your network error simulation software simulated a network error.
>
> Thank you.
> Is that a kind of behaviour which is normal for Symantec Norton Internet
> Security?

Of course not. You've fallen victim to Gottschalk's adolescent
substitute for "wit".

Source disclosure is a form of attack that tries to gain access to
information that wouldn't normally be given to others. Typically CGI
scripts, and normally to find vulnerabilities in those scripts. Known
and unknown. If you're not serving content then it's a good chance you
stumbled across a nefarious site that probes visitors for
vulnerabilities. If you do serve content you're more than likely seeing
a visitor who is "scanning" sites for vulnerabilities. Three's also an
outside chance it's coincidental, that NIS false alarmed on something
innocuous that just looked like an attack. the slogan "nothing is
perfect" applies.

Sad as it is this sort of activity is commonplace on the net. Probes
and scans are so prevalent it's impossible to keep up with them all, and
most people ignore them. The fact that NIS alerted you to something odd
should be reassuring in fact. You know it's working. IT pros know that
when you see no more breaking attempts you should start to get
paranoid. It's a good indication you've been compromised and someone is
scrubbing your logs to hide their activity.

anonymous

Luigi Donatello Asero wrote:

>> Nothing. Your network error simulation software simulated a network error.
>
> Thank you.
> Is that a kind of behaviour which is normal for Symantec Norton Internet
> Security?

Randomly yelling messages full of uncorrelated bullshit? Yes. Obviously.

Sebastian Gottschalk

anonymous wrote:

> Three's also an outside chance it's coincidental, that NIS false alarmed on
> something innocuous that just looked like an attack. the slogan "nothing is
> perfect" applies.

Sorry, but the related attack doesn't even particularly coincide with the
stated website. It simply is random garbage.

> Sad as it is this sort of activity is commonplace on the net. Probes
> and scans are so prevalent it's impossible to keep up with them all, and
> most people ignore them. The fact that NIS alerted you to something odd
> should be reassuring in fact.

What a nonsense. NIS complaining about exactly nothing doesn't even
particularly prove that this nothing is something relevant. Just that NIS
is dumb.

Sebastian Gottschalk