Many Bogus user-agent signatures

I’ve been seeing lots of these too. I assume this is a new rule that has been added to tackle spoofing i.e. the disguising of the IP address:

10/Dec/15 15:24:57  #6339409  medium     306  23.95.82.106     GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
10/Dec/15 15:24:57  #3810643  medium     306  23.95.82.106     GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
10/Dec/15 18:10:24  #4641539  medium     306  66.117.9.22      GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
10/Dec/15 18:10:25  #1663699  medium     306  66.117.9.22      GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
10/Dec/15 18:10:25  #1704070  medium     306  66.117.9.22      GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
10/Dec/15 18:10:25  #7374045  medium     306  66.117.9.22      GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
10/Dec/15 23:22:46  #3275285  medium     306  23.95.82.106     GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
10/Dec/15 23:22:47  #5205910  medium     306  23.95.82.106     GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
10/Dec/15 23:22:47  #4423446  medium     306  23.95.82.106     GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
10/Dec/15 23:22:47  #1628803  medium     306  23.95.82.106     GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
11/Dec/15 02:43:30  #7656179  medium     306  23.95.82.106     GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
11/Dec/15 02:43:30  #3586553  medium     306  23.95.82.106     GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
11/Dec/15 02:43:31  #5410584  medium     306  23.95.82.106     GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
11/Dec/15 02:43:31  #1013219  medium     306  23.95.82.106     GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
11/Dec/15 03:22:33  #6131982  medium     306  185.10.107.69    GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2]
11/Dec/15 03:50:53  #5391289  medium     306  66.117.9.22      GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
11/Dec/15 03:50:53  #6958027  medium     306  66.117.9.22      GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
11/Dec/15 03:50:54  #5750948  medium     306  66.117.9.22      GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
11/Dec/15 03:50:54  #1280116  medium     306  66.117.9.22      GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en) Opera 8.50]
11/Dec/15 03:56:02  #5959415  medium     306  185.10.107.69    GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2]
11/Dec/15 08:12:27  #3824645  medium     306  185.10.107.69    GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2]
11/Dec/15 09:26:23  #3952198  medium     306  185.10.107.69    GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2]
11/Dec/15 17:12:07  #3663117  medium     306  185.10.107.69    GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/5.0 (Windows NT 5.1; rv:6.0.2) Gecko/20100101 Firefox/6.0.2]
11/Dec/15 20:23:56  #7538681  medium     306  174.129.114.203  GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 GTB6 (.NET CLR 3.5.30729)]

Hi

Since last update, the firewall is taken a more aggressive/proactive approach toward bots: rather than blocking them when they try to do something bad, it blocks them immediately.

Did you download your HTTP log and look for those IPs? Many of them are likely referrer spam, bots harvesting email and hacking attempts.

For instance, this one pretends to be running Firefox 3.6.13 on top of Ubuntu 10.04, which were both released in 2010:

(X11; U; Linux i686; en-US; rv:1.9.2.13) Gecko/20101206 Ubuntu/10.04 (lucid) Firefox/3.6.13]

And that one, Firefox 5 (released in 2011) on top of Windows XP (released in 2001):

(Windows NT 5.1; rv:5.0) Gecko/20100101 Firefox/5.0]

That one is a false positive:

11/Dec/15 14:16:54  #7061505  medium     306  IP      GET /index.php - Bogus user-agent signature - [SERVER:HTTP_USER_AGENT = Mozilla/5.0 (Windows NT 6.1; rv:6.0) Gecko/20110814 Firefox/6.0 Google Favicon]

It is used by Google to download your favicon for some of its services like Google+ etc. Although it uses a bogus signature too, we whitelisted its IP range 66.249.64.0 – 66.249.95.255 yesterday in the latest security rules update (2015-12-11.1) so it won’t be blocked anymore.

This website is in a developing country and many computers are very old. I suspect the same thing for the software. I can imagine someone has a computer with Windows XP and Firefox 5 on it. Wouldn’t that be many false positives if it’s only based on the years that software has been released?

I’ll check the access logs again to find out again whether these are the bad guys or the people we’d like to keep.

Thanks for the info.

We only had 3 false positives in two weeks of testing: the Google Favicon bot, MainWP plugin and a Baidu bot running in ‘stealth mode’.
Even in a developing country, there aren’t a lot of persons still using those softwares (they are full of vulnerabilities).

You can still run NinjaFirewall in debugging mode, then check the firewall log to see what they are doing.

Yeah, I’ll do that. See what happens.

Thanks

it’s also blocking the google share,when the plugin enable no one can share a post to goole+

Bogus user-agent signature – [SERVER:HTTP_USER_AGENT = Mozilla/5.0 (Windows NT 6.1; rv:6.0) Gecko/20110814 Firefox/6.0 Google (+https://developers.google.com/+/web/snippet/)

It’s totally off topic and I just tested mine and didn’t have any problems with the Google+ share button.

Fixed in the latest security rules update (20151214.1).

it’s also blocking the google share,when the plugin enable no one can share a post to goole+

I would consider this a good thing ??

I’m experiencing bogus user agent string blocking on several of my sites that are managed with MainWP. NinjaFirewall is blocking the MainWP control panel from going out to child sites (that use ninjafirewall) and syncing which allows up to do remote updates to WP and plugins. This never happened before. How can I whitelist the MainWp server IP on the child sites in ninjafirewall?

I’ve disabled 3 settings in “HTTP_USER_AGENT server variable” section and it didn’t help.

Bogus user-agent signature

This was fixed when we released a new set of rules a week ago, but it looks like you did not enable the security rules auto-update option in NinjaFirewall. Enabling it would solve the issue.
MainWP author made changes too and released a beta version of their plugin.
Another possibility would be to download the ‘wp-content/plugins/mainwp/class/class-mainwp-utility.php’ script from your main site and to look for this user-agent signature:

$agent = 'Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)';

And to replace the 6 occurrences with:

$agent = 'Mozilla/5.0 (compatible; MainWP/2.0.30; +https://mainwp.com)';

Removing and replacing the mainwp dashboard plugin isn’t an option as I would have to reset many sites and backups.

Looks like editing plugin code for this time will have to do.