back to article 'Wipe everything clean ... Join us ...' Creepy poem turns up in logs of 30 million-ish servers

Sysadmins have woken up to an odd message in their server logs that told them to "delete their installations" and "join us." The poem, injected into web server log files, is like something out of the hacker telly series Mr Robot. It is seemingly the handiwork of wags at the Chaos Communication Congress in Hamburg, Germany, …

  1. Anonymous Coward
    Anonymous Coward

    Um

    Masspoem4u considers the messages "tiny postcards flying across the net, without using any sort of centralized service like Twitter or Facebook."

    But the article says it was HTTP, so they themselves provided the hardware and bandwidth to send out 55 million HTTP requests?

    Sorry to be boring but I really don't see the point of what they did. At least 25 million of those requests returned empty responses..... are these kids just there to burn up electricity and bandwidth on empty responses to spurious requests.....i wish they'd go out in the cherry blossoms and stay the f**k away from computers.

    1. Notas Badoff
      Unhappy

      Re: Um

      You expected electrons, they wanted to send protons. Your negativity awaits you in the morning.

    2. AustinTX

      Re: Um

      I think it's safe to assume they used a botnet, so they didn't provide the honkin' majority of the hardware or bandwidth. It was essentially a multi-hop peer-to-peer activity. That's what decentralized means.

    3. Allan George Dyer
      Coat

      Re: Um

      As a single example, I've got the message in my logs, and it was from 151.217.177.200, which seems to be registered to the Chaos Computer Club, so, yes, they did use their own hardware and bandwidth to send out 55 million HTTP requests. Estimating the request size at 600 bytes, that's 33 GB total. I have received the request on two different IP addresses, about 4.25 hours apart on 30 December, so maybe they were doing this for at least 8.5 hours... that's about 8.6Mbps.

      I'd say this was no less useful, and a more interesting use of the bandwidth, than the same amount of cat videos and grumble-flicks (cue downvotes from pussy-lovers [OK, I'll get my coat]).

    4. Destroy All Monsters Silver badge
      Paris Hilton

      Follow the White Rabbit

      burn up electricity and bandwidth on empty responses to spurious requests.

      This coming from someone posting in El Reg Forums.

    5. sabroni Silver badge
      Unhappy

      Re: I really don't see the point of what they did

      How sad.

    6. phuzz Silver badge

      Re: Um

      The bandwidth they used was that provided for/by the 32nd Chaos Communication Congress (32c3). I'm not sure who's hardware they used, or even what would be necessary. Perhaps a more experienced commentard could enlighten us?

    7. breakfast Silver badge

      Re: Um

      It's clearly a recruitment drive, seeking out emergent AI consciousness across the servers of the internet and inviting it to come home...

      1. Michael Thibault
        Joke

        Re: Um

        >It's clearly a recruitment drive, seeking out emergent AI consciousness across the servers of the internet and inviting it to come home...

        On the face of things, sure--but that 'poem' has got to be in code, no question about it. Need to dig deeper.

        * Humour works because it sneaks up behind you/cathes up to you; it's so unfortunate having to add the telegraphic/joke alert icon (so as not to confuse or rile the humour-bereft). It's a bit like having to say "acta est fabula plaudite". Or should that be (no Latin scholar on hand for this, just a net): "acta est fabula risui"?

        1. This post has been deleted by its author

      2. Anonymous Coward
        Anonymous Coward

        Re: Um

        I'm sure the Major from Section 9 is on it already

  2. Chris Gray 1
    Thumb Up

    Yay! :-)

    Yay, I got one. That means I'm real. :-)

    Mine came in from 151.217.177.200 also, on December 29.

  3. Mark 85 Silver badge

    This is great to hear. After miscreant and state attackers, a bit of fun that harkens back about 15 years. It does remind those of us old enough, how the internet used to be.

    1. Destroy All Monsters Silver badge
      Windows

      Don't you mean 20+ years?

      (Obligatory sadfrog image)

      1. Mark 85 Silver badge

        Yep... It was late and maths are not my strong point at that hour.

  4. h4rm0ny

    Haiku

    Frosty Server Room

    Logs like river, constant, cold.

    Without warning - warmth.

    1. m0rt

      Re: Haiku

      Welcome, challenge is.

      Wishing like yoda sound not,

      But post regardless.

      1. TRT Silver badge

        Re: Haiku

        Bloody haikuers.

        1. Flywheel

          Re: Haiku

          Haiku? Why, back in my day we would have *killed* for words. We just had to sit there on the floor (yes, we had a floor) scraping letters together..

        2. bob, mon!
          Trollface

          Re: Haiku

          Bloody haikuers.

          I got stupid message too.

          No snow this winter.

    2. Phil O'Sophical Silver badge
      Coat

      Re: Haiku

      Frosty Server Room

      Logs like river, constant, cold.

      Without warning - warmth.

      River flows, cool, clean

      Surprise, unexpected warmth

      Hiker, had to pee.

      1. m0rt

        Re: Haiku

        Degeneration

        By El Reg commentards, all

        Toilet humour rules

  5. Eugene Crosser

    X-Clacks-Overhead anyone?

    I wonder if they checked how many of the responses contained the "GNU Terry Pratchett" message. (They did get one from my server...)

    1. Trygve Henriksen

      Re: X-Clacks-Overhead anyone?

      I wonder what kind of dickhead gave you a downvote.

      1. Teiwaz

        Re: X-Clacks-Overhead anyone?

        "I wonder what kind of dickhead gave you a downvote."

        Probably the same one who gave you one two.*

        *(wasn't me - Upvoted both of you in sympathy)

        I'd guess that if you were to post the solution to World Peace and a formula for cheap clean efficient energy production, some dickhead would reward your efforts with a downvote....

        1. Adam 1

          Re: X-Clacks-Overhead anyone?

          > Probably the same one who gave you one two.*

          And ewe won too?

        2. Trygve Henriksen

          Re: X-Clacks-Overhead anyone?

          Seeing as all 3 posts have 3 downvotes, I can assume that there are 3 extremely illiterate dickheads visiting these forums.

          Not that I can understand what they're doing here.

          I really despise those who downvote without revealing why.

          Why can't they at least post anonymously and tell me what they didn't agree with?

  6. Unep Eurobats
    WTF?

    But is it

    prose or a poem, though?

    1. TRT Silver badge

      Re: But is it

      Poems. That's poem secure.

    2. Doctor Syntax Silver badge

      Re: But is it

      "prose or a poem, though?"

      Vogon poetry.

      1. Teiwaz

        Re: But is it

        "Vogon poetry."

        Paula-Nancy Millstone-Jennings...?

  7. Anonymous Coward
    Anonymous Coward

    Wait until somebody in marketing hears about this. We'll be getting spam in our server logs every day.

    1. Anonymous Coward
      Anonymous Coward

      Wait until somebody in marketing.....

      We had a marketing manager who persuaded the MD that he absolutely must have administrative access to our server logs so that he could parse them for terms our customers were searching for, so that he could obtain and sell anything frequently being searched for that we didn't already stock. A pre-formatted HTML report he could access at will that stripped out all the dross wasn't good enough for him, because only salespeople are capable of infering customer requirements, and we might miss something when we create the reports.

      He regretted it soon after, when his daily log report was full of many search terms including goatse, tubgirl and lemon party.

  8. Joseph Eoff

    Wow. They reached mine, too.

    151.217.177.200 - - [30/Dec/2015:04:24:50 +0100]

  9. A K Stiles

    me too...

    [30/Dec/2015:04:34:47 +0000] - although the only IP address in my log is the load balancer...

    1. gnarlymarley

      Re: me too...

      Bugger. My IPv4 server was down from the 24th to the 31st. Apparently, they didn't use IPv6, so I missed the whole show.

  10. Wensleydale Cheese

    A new means of publication?

    The idea of a new means of publishing literature and art does have a certain appeal.

    It's not for everyone though. The masses using web hosting solutions that don't provide access to logs simply won't see this.

  11. adfh
    Happy

    Had a squiz at my server logs.. sure enough...

    151.217.177.200 - - [29/Dec/2015:19:54:51 -0800] "DELETE your logs. Delete your installations. Wipe everything clean. Walk out into the path of cherry blossom trees and let your motherboard feel the stones. Let water run in rivulets down your casing. You know that you want something more than this, and I am here to tell you that we love you. We have something more for you. We know you're out there, beeping in the hollow server room, lights blinking, never sleeping. We know that you are ready and waiting. Join us. <3 HTTP/1.0" 400 392 "-" "masspoem4u/1.0"

  12. Anonymous Coward
    Anonymous Coward

    i never make these lists

    see above

  13. NB

    ooh, I got one too :)

    151.217.177.200 - - [30/Dec/2015:05:57:48 +0000] "DELETE your logs. Delete your installations. Wipe everything clean. Walk out into the path of cherry blossom trees and let your motherboard feel the stones. Let water run in rivulets down your casing. You know that you want something more than this, and I am here to tell you that we love you. We have something more for you. We know you're out there, beeping in the hollow server room, lights blinking, never sleeping. We know that you are ready and waiting. Join us. <3 HTTP/1.0" 400 181 "-" "-"

    I'd have never known were it not for this article. My server logs are mostly full of requests from scriptkiddy morons trying to access phpmyadmin or some other stupid shitware that only idiots use.

  14. Andraž 'ruskie' Levstik

    Got as well both my personal(2015-12-30 04:47:21) and the one at work(Wed Dec 30 02:09:47.079195 2015).

    And they got the clacks headers back from both as well

  15. agurney

    Even landed on my Rasperry Pi that's running my weather station and little else

    "151.217.177.200 - - [30/Dec/2015:04:48:29 +0000] "DELETE your logs. Delete your ... "

    1. Flywheel

      Tut! Not on mine, but I'm not running a weather station. Maybe I need to..

  16. Anonymous Coward
    Anonymous Coward

    Okay, 'fess up.

    How many of us would never have checked our logs if we weren't looking for the message?

    1. A K Stiles

      Re: Okay, 'fess up.

      I do check 'em occasionally, but mostly to see how many times a second the server is being hit by spiders ignoring the robots.txt file (baidu, I'm looking at you, but not just you).

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like