Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My website keeps getting hit by odd requests with the following user-agent string:

Mozilla/4.0 (compatible; Synapse)

Using our friendly tool Google I was able to determine this is the hallmark calling-card of our friendly neighborhood Apache Synapse. A 'Lightweight ESB (Enterprise Service Bus)'.

Now, based on this information I was able to gather, I still have no clue what this tool is used for. All I can tell is that is has something to do with Web-Services, and supports a variety of protocols. The Info page only leads me to conclude it has something to do with proxies, and web-services.

The problem I've run into is that while normally I wouldn't care, we're getting hit quite a bit by Russian IPs (not that russian's are bad, but our site is pretty regionally specific), and when they do they're shoving wierd (not xss/malicious at least not yet) values into our query string parameters.

Things like &PageNum=-1 or &Brand=25/5/2010 9:04:52 PM.

Before I go ahead and block these ips/useragent from our site, I'd like some help understanding just what is going on.

Any help would be greatly appreciated :)

share|improve this question
2  
An enterprising user over here (goo.gl/baHJn) took a look at the source for Apache Synapse. The UA header it uses doesn't match what your logs show. Further digging on his part turned up Ararat Synapse which DOES use that header. –  Doug Wilson Mar 12 '13 at 14:35
    
See related question and commentary on this other stackexchange site, security.stackexchange.com/questions/18652/… –  Funka Apr 18 '13 at 19:02
    
Whenever I google on this user agent, I come across this post so thought I should share some of my findings in case someone is looking for it. btpro.net/blog/2013/05/black-revolution-botnet-trojan This a mostly a botnet attack and has nothing (or very little) to do with Apache Synapse project. –  i.net Sep 19 '13 at 10:06

6 Answers 6

up vote 11 down vote accepted

Are all the IPs from a specific range? Is that range assigned to a specific company? If it is, just lookup who the range is assigned to and contact the Technical Contact listed.

The most likely thing I can think of is that they are scraping content from your webpage or programming something which will scrape content (which explains the weird boundary conditions as arguments).

It could be something a little less innocent, I don't know what data you are trying to protect (it could be worth something). They could be trying to expose an error page which can dump sensative debug info. If that is the case then I would suggest setting up a web app firewall. They are made to prevent this kind of sensitive error messages and other abuses from happening.

You could just try banning the IP ranges and see who complains... although that's your last resort.

share|improve this answer
    
All site-errors are presented with a nice little "Site Error" page. If they're just scraping us, I don't care, it's that currently any time a user generates an exception that's unhanded it's logged to e-mail. I get 100+ a day from this guy alone. Of course the simple solution is to handle more errors, but this engine it seemed pretty fishy when i looked into it so i was concerned. –  Aren B May 27 '10 at 23:10

I am pretty sure that this is not Apache Synapse, it's some tool build with Ararat Synapse, this is a Delphi TCP/IP library. I downloaded source code from both projects, and as far I can see Apache Synapse have a configurable user-agent, and default is :

enter image description here

on the other hand Ararat Synapse have default user agent :

enter image description here

Just like one you have in your logs, and I have exactly same user agent probing various SQL Injection attacks, probably attackers are using some tool build in Delphi with Ararat Synapse.

Since bad guys didn't change default user-agent I thinks it's safe to block user agent:

Mozilla/4.0 (compatible; Synapse)

not partially because you can block some legitimate tool running on Apache Synapse, and I believe that any legitimate bot or project would define user-agent and not hide with default.

There is no point blocking IPs because it seems that atttack is comming from various IP adresses around the world, probably some botnet.

share|improve this answer

I've come here after searching for this user agent. A different IP (91.127.90.220) but the same approach - every field from a form replaced in turn by -1[quote].

It's the only time I've ever seen it used, so I agree that banning it is the way forward.

share|improve this answer
    
For what it's worth, 'Apache Synapse' doesn't to this behavior. The tool being used has a similar agent string. I suggest you read the other answers for more information. –  Aren B Sep 12 '13 at 21:20

I have checked my database with over 75 million requests gathered by our security application and only found that user agent without any referrer URL.

Also, I can see that they hit various subdomains within less then a minute and a normal visitor couldn't navigate so quickly.

I count only 23 requests for that user agent so I've blocked the guys. Here the IP addresses from my sites:

189.250.204.153
190.31.58.52
113.23.76.219
94.142.131.77
190.86.161.245
186.2.144.165
189.170.129.68
188.84.39.160
92.131.184.129
189.12.36.143
94.110.73.38
189.162.86.23
94.43.231.90
217.77.28.170
190.138.185.135
188.169.196.13
200.153.252.1
41.235.79.86
186.129.128.94
share|improve this answer
2  
It's probably using a botnet. I don't think banning those IPs would help anyone a whole lot. –  Aren B Nov 1 '10 at 16:03
2  
Except that all the addresses are dynamic IPs and you are blocking eventually paying customers... –  ZaB Mar 9 '12 at 12:18

Same person trying to inject -1 into the viewstate:

finder-query: -1'

It's probably an automated SQL injection tester tool.

share|improve this answer
    
I'd even say, inject -1' (apostrophe is important) –  billy Feb 12 '13 at 20:39

I have recently seen this User-Agent coming from one IP:

217.35.nn.nn - - [21/Feb/2012:07:01:22 +0000] "GET /view/pubcal.php?event=17' HTTP/1.0" 200 405 "-" "Mozilla/4.0 (compatible; Synapse)"
217.35.nn.nn - - [21/Feb/2012:08:06:31 +0000] "GET /view/pubcal.php?event=16' HTTP/1.0" 200 405 "-" "Mozilla/4.0 (compatible; Synapse)"

It was fairly shortly followed by a definitely malicious user agent (Havij):

217.35.nn.nn - - [21/Feb/2012:10:44:26 +0000] "GET /view/pubcal.php?event=1 HTTP/1.1" 200 6627 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Havij"
217.35.nn.nn - - [21/Feb/2012:10:44:26 +0000] "GET /view/pubcal.php?event=999999.9 HTTP/1.1" 200 2235 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727) Havij"

This was followed by several attempts at SQL injection.

Synapse isn't malicious in and of itself, but it does appear to be being used to probe data-driven websites. If your website does not offer an API to anyone, I'd block this User Agent. Maybe use the apache-badbots filter in fail2ban to block traffic from IP addresses which try to use this agent string. And stick 'Havij' in there, too while you're at it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.