Hackin9

InfoSec News

For a while now, I got requests triggering our IDS, for their enormous cookie payload. The payload doesn't appear to be an attack, but includes tons of information, that appears to identify the user. These are not cookies we are setting, so some other site or tool is setting them. The content looks a bit like this may be used to pre-fill forms.
Please let me know if you have any idea what is sending all the data. I have no idea if this is legit, or just a denial of service agains the analyst. But so far, it looks like the data is real.
Over the last 10 days, I have seen 50 such requests for 13 different IPs. These are all HEAD requests and they hit various URLs on our site. Some have Google analytics utm strings appended to the URL indicating that they may come from Twitter related services. For example:
/podcast/podcast2671.mp3?utm_medium=twitterutm_source=twitterfeed

All use the same user agent string, implying that they use Apple Safari, but the user agent isn't quite correct for Apple's Safari browser:


User Agent: AppleWebKit/525.13 (KHTML, like Gecko) Safari/525.13.

I am quoting a typical entry below, but I replaced and shortened some of the data
_shuffler.web_session=xxxxxxx[long URL
jive.server.info=\serverName=scn.sap.com:serverPort=80:contextPath=:localName=localhost.localdomain:localPort=9001:localAddr=127.0.0.1\
derStandard%2Eat=MGUID=3507f291-5b32-4a36-8941-014aa483b475



------

Johannes B. Ullrich, Ph.D.

SANS Technology Institute

Twitter (c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
(c) SANS Internet Storm Center. http://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
 
The U.S. International Trade Commission has affirmed a prior ruling that an Eastman Kodak patent asserted in a complaint against Apple and Research In Motion is invalid, according to a notice issued late Friday.
 
Internet Storm Center Infocon Status