Skip to main content
February 24, 2011
Question

Was I hacked??

  • February 24, 2011
  • 1 reply
  • 1160 views

Hello all, i received a disturbing log entry via my OSSEC application this morning....

My Adobe FMS server v 3.5 running on Centos 5.x is is behind a firewall/loadbalancer.

I have no clue how this log entry got there.... its kind of unsettling..

What do i do now, what do i check? This is a production server.

Thanks in advance...

edge.00.log:2011-02-24  00:16:53        20385   (e)2631029      Bad network data; terminating connection : (Adaptor: _defaultRoot_, VHost: Unknown, IP: , App: , Protocol: tunnel) : m e t h o d = p u t + d o c u m e n t % 3 a 4 % 2 e 0 % 2 e 2 % 2 e 4 7 1 5 & s e r v i c e % 5 f n a m e = & d o c u m e n t = % 5 b d o c u m e n t % 5 f n a m e % 3 d i n d e x % 2 e h t m l % 3 b m e t a % 5 f i n f o % 3 d % 5 b % 5 d % 5 d & p u t % 5 f o p t i o n = o v e r w r i t e & c o m m e n t = & k e e p % 5 f c h e c k e d % 5 f o u t = f a l s e 0A B r a z i l i a n s   D e f a c e r s   O w n z   Y o u   B y   H a c k i n h o 0A      -

    This topic has been closed for replies.

    1 reply

    Graeme Bull
    Community Expert
    Community Expert
    February 24, 2011

    > Bad network data; terminating connection

    FMS catches that kind of garbage and thinks nothing of it. The log is just showing what connection came through with some query values. Nothing to worry about I don't think.

    February 24, 2011

    I've seen the exact same message in the logs on a number of my clients FMS servers as well. Looks like some sort of bot hitting IP's randomly looking for a hole to crawl into.

    February 24, 2011

    Ok, understood, but should i be worried or tighten down anything, and how were they able to insert or send that message?

    Thanks for the quick replies guys...