Boston Linux & Unix (BLU) Home | Calendar | Mail Lists | List Archives | Desktop SIG | Hardware Hacking SIG
Wiki | Flickr | PicasaWeb | Video | Maps & Directions | Installfests | Keysignings
Linux Cafe | Meeting Notes | Blog | Linux Links | Bling | About BLU

BLU Discuss list archive


[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Anyone familiar with "2rand[0,1,1]" ?



On 08/28/2010 01:41 PM, jc-8FIgwK2HfyJMuWfdjsoA/w at public.gmane.org wrote:
> Lately some CGI programs I'm responsible for have been called  a  lot
> by  what  looks  like  link  spammers  with  various  params  set  to
> "2rand[0,1,1]".  It's usually accompanied by URLs in other params, as
> if  the client is trying to get my CGI programs to reference them, in
> typical link spammer style.  The links usually point to pharm or porn
> sites, but that's probably not relevant to the puzzle.
> 
> I did a bit of googling, and found zillions of hits  that  look  like
> random  text  with  various relatives of "2rand[0,1,1]" inserted here
> and there.  But I didn't find any explanation of this odd expression.
> Sometimes  it's  "2rand  0  1  1",  sometimes  it  has other kinds of
> punctuation, the sort of stuff that you'd expect  rendering  software
> to rewrite it as if it's not understood, and it never has any obvious
> relation to the text it's inserted in.
> 
> Anyone know what the origin of this expression is? I've added code to
> recognize it, of course, and drop the  requests.   But  it  could  be
> interesting  to  know  if it says anything that could be used to good
> use in harrassing these clients.

Wow!  If you google that phrase it is truly impressive how many sites
have had it inflicted on their comments and posts.  I went quite a few
pages deep in the search and never found a page that talked about it as
opposed to being infected by it.  It's like Doctor Who's "Bad Wolf".

I couldn't find any references to it in my logs, and lord knows I have
my hack attempts.  This smells like the web-equivalent of SQL injection,
where some CMS or blog software that doesn't scrub its input right will
evaluate this as some sort of macro that will redirect the user to one
of the other pages.

I also tried googling 2rand and several web language names with no luck.






BLU is a member of BostonUserGroups
BLU is a member of BostonUserGroups
We also thank MIT for the use of their facilities.

Valid HTML 4.01! Valid CSS!



Boston Linux & Unix / webmaster@blu.org