Subject: Strange postings that lead to "infinite URLs" dynamic Web pages

From: Info Person <[email-masked]>
Date: Fri, 04 May 2007 20:24:49 -0400

To: Experts on Web attacks
From: David Harris, Palo Alto, California, working as [email-masked]
Subject: Strange postings that lead to "infinite URLs" dynamic Web pages

About a month ago I started seeing strange posting of Events at DarwinDay.org, the site for which I am the Web and database editor.  When these strange listings didn't stop, I began copying the database entries into a database table called "grafitti" and there I could see the pattern clearly.  They seem to be "infinite URL traps".  That is, they seem to contain URL's that lead to modified Web servers (start with Apache code and modify its code...) that deliver dynamic RANDOMLY generated material including OTHER URL's that when clicked on would lead to generation of still OTHER random page(s).  If a Web crawler tries to do a depth-first tree walk ("Web walk"?), the algorithm would just get stuck in endless fake URL's.  That would prevent the crawler from ever getting to the rest of a Web site, so that it effectively blocks the indexing of parts of a site.

To get a direct experience, do a Google search for "lk34v9x.info" and examine the entries that are indexed.   I deduced that these entries are computer generated in a repetitive pattern, using random domain names in the ".info" TLD.

I am awed at what seems to be going on here.  A possible intent is to make it impossible for robot Web crawlers to index Web sites that allow visitors to contribute material which is posted unaltered on the receiving site.  In my case, people register Darwin Day Events and the registered materials are instantly posted as part of a long listing that is dynamically generated.

When I used allwhois.com to see the WHOIS entries for these URL's, I found that they seem to have two little numbers by the Street1 name.

Are the WHOIS entries (registered domains) generated by a program taking advantage of the lack of immediate payment in registering a domain?  Do the registered domains lead to modified Apache Web servers that dynamically generate page after page after page of random fake URL's?

This requires very sophisticated and creative use of the central mechanisms of the Net, worthy of terrorists or America's cyberwarrior experts.

I also noticed the constant length stretches of hexadecimal numbers at the beginning and end of the messages/Events.  My first guess was that those were attempts to poke code into locations beyond the end of the inputting buffer space.  But I believe that buffers are now checked for length as a routine security practice.  I also considered them as possible cryptography keys.

I am sending this report only by e-mail for now, to experts in computer attacks.  I'd appreciate knowing if these things I'm seeing are already known, and what they are called.  For now I intend to delete them from my database frequently.

- David Harris, Palo Alto, California