Kazaa related hacks ?

Rafi · **on:** October 31, 2003, 08:40:09 PM

Here is a log I am getting often when running Kazaa SW. Can anybody tell what does it mean ? As fas as I know P2P software do not use HTTP protocol :?

------------------------------------------------------HFS LOG ------------>

31/10/03 22:17:21 194.81.215.16:1988 GET /.hash=fb92fb3d97341f9e6ccdd8d5f0cd0939029480f2 HTTP/1.1
31/10/03 22:17:21 194.81.215.16:1988 Host: XXX.XXX.48.236:80
31/10/03 22:17:21 194.81.215.16:1988 UserAgent: KazaaClient Nov 3 2002 20:29:03
31/10/03 22:17:21 194.81.215.16:1988 X-Kazaa-Username: Egerejr
31/10/03 22:17:21 194.81.215.16:1988 X-Kazaa-Network: KaZaA
31/10/03 22:17:21 194.81.215.16:1988 X-Kazaa-IP: 172.25.24.200:1261
31/10/03 22:17:21 194.81.215.16:1988 X-Kazaa-SupernodeIP: 128.119.23.194:80
31/10/03 22:17:21 194.81.215.16:1988 Range: bytes=8126078-10661649
31/10/03 22:17:21 194.81.215.16:1988 Connection: close
31/10/03 22:17:22 194.81.215.16:1988 X-Kazaa-XferId: 14827338
31/10/03 22:17:22 194.81.215.16:1988 X-Kazaa-XferUid: T88pjh3uuAZ7HrXUb7Aiil2NsnKdKg9GZZeVpRkWOmU=
31/10/03 22:17:22 194.81.215.16:1988 Requested GET/.hash=fb92fb3d97341f9e6ccdd8d5f0cd0939029480f2

rejetto · **Reply #1 on:** November 01, 2003, 08:24:37 PM

i don't know kazaa, but i can try to guess: it has an http subsystem to run also when you are behind firewalls allowing only http

Rafi · **Reply #2 on:** November 01, 2003, 09:07:49 PM

Quote from: "rejetto"

i don't know kazaa, but i can try to guess: it has an http subsystem to run also when you are behind firewalls allowing only http

Yes, probably for ADWARE. I'll try to block Kazaa 's TCP output to port 80 with the firewall...