Slashdot Mirror

Unlikely. I suspect that the admins are too busy responding to the requests for advice that have been pouring in lately :P .

So they moved it over to an MS platform. According to my scanner, it's running IIS 5.0.
[64.4.53.7:80] World Wide Web HTTP
HTTP/1.1 302 Redirected..Server: Microsoft-IIS/5.0..Date: Thu, 09 Aug 2001 14:48:33 GMT..Location: http://lc2.law5.hotmail.passport.com

WinNT/IIS-4.0 with URL Redirection Still Vulnerable After Patch http://www.incidents.org/diary/diary.php#801

I submitted this as an article this morning, but as it is still pending, and both my home and work servers are still under constant annoyance, I figured I'd pass it on here as well. If you are running a Windows NT server, kindly do us all a favor and just turn it off for a few months.

According to yesterday's Handler's Diary on www.incidents.org, "Microsoft has confirmed that if an IIS 4.0 webserver is using URL redirection, it is still vulnerable to Code Red even if the Microsoft patch is installed". The only known solution is to remove all URL redirections from NT servers running IIS 4.0.

-Tommy

I submitted this as an article this morning, but as it is still pending, and both my home and work servers are still under constant annoyance, I figured I'd pass it on here as well. If you are running a Windows NT server, kindly do us all a favor and just turn it off for a few months.

According to yesterday's Handler's Diary on www.incidents.org, "Microsoft has confirmed that if an IIS 4.0 webserver is using URL redirection, it is still vulnerable to Code Red even if the Microsoft patch is installed". The only known solution is to remove all URL redirections from NT servers running IIS 4.0.

-Tommy

Actually, the MS provided patch doesn't work against Code Red if you have URL forwarding on your server. I bet they have it enabled, and so they were left open...

AT&T's residential broadband division (MediaOne) has cut off port 80 across their network to try and halt the spread of the worm

I don't really see how this will help either. If you're running an unpatched IIS connected to the net, you'd been scanned and rooted a couple of thousand times by now. If you look at the graphs on incidents.org, you'll see the worm isn't really spreading any more. It's just flooding.

Umm, I hate to be the damper in evil plans for Code Red ...

... but according to incidents.org and other virus websites, Code Red uses non-blocking socket connections "uses a nonblocking socket to connect to each target. Specifically this means that if one thread is stuck waiting for a slow connection to a particular target, the wait will not slow down the rest of the threads from continuing their scanning function."

Any servers which "wait" are just wasting their own processor and memory.

Scott.

Are here.

Frustrated by the lack of any current stats on this from DShield, or Incidents short of the update on the 4th, I collected some stats that might give some indication of where this thing is going. Peak times at 1300 and 1400 MST. Not sure what this means, but seems consistent.

Check out this heise.de article (in German, sorry)!!! Somebody apparently programmed a little Linux tool that may be able to slow the spread of the worm down a little. The idea was first introduced in the incidents.org forum. May be worth a look.

I sent this in as an anonymous story, but it looks like this one got posted instead. According to www.incidents.org there is a new variant of Code Red (of which this would be the third version). This one installs a backdoor. As someone else posted here, the tell tell sign is that the buffer overwrite payload is now a string of 'X's and not 'N's as in the previous two versions of Code Red. The stakes have been raised folks.

First, see here for how to telnet into the back door left by all CR2 infections. Second, write a script to telnet to all infected hosts which probe you on port 80 and shut down the offending machine. Third, run this script on your web server so that all hosts probing your site get shut down.

If everyone did this, then CR2 would disappear off the net within 24 hours, and we could all rest easy!

What gives? How are they getting 150,000+?

They describe it in broad terms, but it boils down to log entries and unique source IP's.

OTOH, when Incidents isn't Slashdotted, it looks like the curve is flattening out at around 25% of the total infected last time - about 60,000 +/- 5000 is my guess. The question is, is that enough infected hosts to cause enough ARP floods to impact global connectivity. So far connectivity has been patchy for me - jobserve was down all afternoon, a couple of other sites were patchy, everything else was OK. Same as normal, in other words.

It'll start out small, but it doesn't take long to become a Real Big Problem at this rate.

I'm not sure if we're the only ones, but I still say Screw It ! Incidents.Org is reporting expotential growth, it's a warm 80 degrees out, with a mild breeze. Let's go fishin !

incidents.org is tracking the spread. It still looks to be on its exponental path to death and destruction of the Internet (sarcasm included.) As of this post, incidents reports 22,000 infected (up from ~13500 an hour earlier.) It's too early yet to tell how this will pan out.

Look, it's not going to destroy the internet. It's not going to be a tempest in a teacup either. incidents.org reports 22,000 infections at this point. I've recorded 4 hits so far this morning (though I got nearly 30 the last time around).

For the media to go nuts, it took press conferences and press releases from the FBI and Microsoft. Those big organizations aren't making the same noise about Sircam (or Sklyarov, or...).

Well, if you look at the graphs available at incidents.org you can see that this outbreak has been growing slowly, but the growth rate is substantial. It may not be the end of the Internet, but it's certainly something to keep an eye on.

Andrew

Wrong question. Things like this don't happen because people carefully aim their shotguns at their own feet, they happen because they don't think through the consequences of their actions and end up shooting themselves in the foot anyways. They said "block the world!" and it did. DHCP, too.

No one should block ANYTHING in a non-emergency situation without getting complete network captures for a week. Or more. And then understanding each and every packet, even if their conclusion on some of the packets is simply "I have no clue where that came from or why!"

But no: here, buy this, install it, and set it to 'Paranoid' mode, and then start spamming the contacts at Fortune 50 companies when you can't figure out why you got a RST/ACK from port 80 on the web server to which you were talking. And yes, I DO have to reply to such people. I try to be nice, I really do, because I know how frightened and overwhelmed they must feel.

Earth to all BlackIce and ZoneAlarm users: Read SANS' Internet Storm Watch for a week or two before you send me ANY more mail. Please?

GIAC has a similar system already at incidents.org. They assign a "handler" to be on duty at any given time, and all incident reports are filtered through the handler. Someone might submit falsified logs, but unless a lot of sources report the same incidents they problably won't get much mention.

Incidents.org is run by the Global Incidents Analysis Center which is associated with the SANS institute. It's be operating for a while and the "current detects" section is very valueable for those of us who have to address day-to-day security issues.

GIAC assigns a "handler" to be on-duty at any given time. All the reported incidents are filtered through the handler.