tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From David kerber <>
Subject Re: Tomcat access log reveals hack attempt: "HEAD /manager/html HTTP/1.0" 404
Date Tue, 16 Apr 2013 17:18:11 GMT
On 4/16/2013 12:57 PM, chris derham wrote:
>> Or, another way of looking at this would be that for every 40 servers
>> scanned without a 404 delay, the same bot infrastructure within the same
>> time would only be able to scan 1 server if a 1 s 404 delay was implemented
>> by 50% of the webservers.
> This assumes that the scanning software makes sequential requests.
> Assuming your suggestion was rolled out (which I think is a good idea
> in principal), wouldn't the scanners be updated to make concurrent
> async requests? At which point, you only end up adding 1 second to the
> total original time? Which kind of defeats it.

They might go parallel async, but that would require more sophistication 
on the part of the hacker, and more hardware and bandwidth as well, 
again reducing the economic return of such scans.

> Again I'd like to state that I think you are onto a good idea, but the
> other important point is that some (most?) of these scans are run from
> botnets. These have zero cost (well for the bot farmers anyway). My
> point is even if the proposal worked, they don't care if their herd is
> held up a little longer - they are abusing other people
> computers/connections so it doesn't cost them anything directly.

Except time.  And slowing down the rate at which they can find 
vulnerable hosts helps every honest web host, as well as the ones which 
actually implement this.

> Sorry but those are my thoughts
> Chris
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:
> For additional commands, e-mail:

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message