Progressive Download used to hack?

JohnM · - Joined: 17 Apr 2006 Posts: 6

Hey guys, I was just being access spammed by someone for about 30 minutes before I denied acces to the IP.

I had written a GIMP tutorial a few days ago and put all the images into a tutorial folder in my root dir. For some reason, this person was grabbing the same image for 30 minutes using a progressive download. Can anyone look at a chunk of my access log and tell me if I was being hacked or any malicious activity was taking place or even what was going on?

Anonymoose · - Joined: 09 Sep 2003 Posts: 2192

Looks like it's a very badly configured (or written!) download manager just misbehaving, not doing any harm.

It's clearly only requesting the same file over and over, not any other files on your system - 412 error code isn't very common, but I assume it's the download manager doing something wierd. Aprelium may be able to give you a better idea of why that might have happened.

In short - just ignore it for now, unless they start to become a problem, then block the IP. It's not a hack attempt.
_________________

"Invent an idiot proof webserver and they'll invent a better idiot..."

JohnM · - Joined: 17 Apr 2006 Posts: 6

So, that means, they were trying to download the image directly from my server? If you navigate a browser to the location of the image it just displays the image, no attempt to download it.

The IP has already been blocked. There was no reason that this person should have requested my image in this manner and continue to leave whatever download manager, they were using, spamming my server for almost 30 minutes.

Anyways, Thanks for the info, I will look more into the 412 error, this is interesting.

AbyssUnderground · - Joined: 31 Dec 2004 Posts: 3855

ozzy214 · - Joined: 31 Mar 2006 Posts: 66

And as long as you can view the photo...you can right click it and save it. Sometimes even punch the url into a download manager like flashget and d/l it that way. No way to prevent it.....

Tom Chapman · - Joined: 09 Jul 2005 Posts: 933 Location: Australia

Aprelium will sure have an answer to your Q but so do I! I think it might be right to for once lol...

http://www2.mrwiseone.com/HTTP_Error_Codes.php#400_range

AbyssUnderground · - Joined: 31 Dec 2004 Posts: 3855

There was no need to post all of those... A link would have sufficed...
_________________
Andy (AbyssUnderground) (previously The Inquisitor)
www.abyssunderground.co.uk

Tom Chapman · - Joined: 09 Jul 2005 Posts: 933 Location: Australia

It was on my harddrive and um I ah sought of agree :D

JohnM · - Joined: 17 Apr 2006 Posts: 6

Tom Chapman · - Joined: 09 Jul 2005 Posts: 933 Location: Australia

lol I didn't even remember it was on my harddrive! I saved it years ago. Evreyone has something to learn from it and I'm so happy I've actually contributed positively to this forum for once. :)

aprelium · - Joined: 22 Mar 2002 Posts: 6800

JohnM,

Actually, error 412 means that the request contained a "If-Unmodified-Since" header which was referencing a date prior to the requested file last modification date. The fact that the download manager "insisted" on resending the same sequence of requests suggests that the computer on which it is running has its clock set to a wrong date and time.
_________________
Support Team
Aprelium - http://www.aprelium.com

JohnM · - Joined: 17 Apr 2006 Posts: 6

Interesting, I tracked the IP and this person is from North Korea. Could this of been the broblem?

Tom Chapman · - Joined: 09 Jul 2005 Posts: 933 Location: Australia

Aprelium, Are some of your error codes different to other welly known servers?

aprelium · - Joined: 22 Mar 2002 Posts: 6800