Domain: websoup.net
Stories and comments across the archive that link to websoup.net.
Comments · 7
-
Re:Anybody notice the drop off time
The MS graph looked steady until May of 2002 them something drastic happened.
According to my charts generated from my logs, the rash of worms started with CodeRed around September of 2001. Nimda followed a month or so later.
Unless you're thinking of a different rash of worms. -
Still kicking
If anybody is interested, I've developed WormScan last year, which is a Java-based program (GPL) which can analyze your Apache log files for pretty much anything you want (just plug in your regular expressions). It detects Nimda and CR1+2 out of the box. It's easy to add your own entries to scan for.
According to my logs (please be gentle), I've been hit 650 times yesterday.
Shameless plug, yes. But it does the job and the users of WormScan seem to be pretty happy with it, judging from the emails I've gotten so far. -
Re:76 Code Red hits in 2 months
My home server, running WormScan:
Nimda - 319242 attacks
CodeRed 2 - 15488 attacks
CodeRed - 359 attacks
All from 5777 unique hosts. -
The REAL killer app
Being on the @home broadband network, I can tell you that the REAL killer apps are still the Nimda and CodeRed worms which continue to run loose on many machines. Talk about a bandwidth siphon! I can't think of anything else that's sucked as much bandwidth as these guys.
My generated report indicates over 152,000 attacks since June!
That report was generated with WormScan, a neat tool for analyzing your Apache logs. I should probably disclose that I'm the author of WormScan - feel free to give it a go against your logs. -
MIRROR
I've managed to grab copies of the software just as their site got
/.d.
Please be nice, because I'm only on cable. Grab the files here. -
Re:Sounds good... [Blatant plug]
I have just released my tool which can be used to generate reports about these worms by examining your Apache logs. Very configurable, lots of options, written in Java, released under the GPL.
Please check it out at http://www.websoup.net/wormscan/. I'm looking forward to some feedback. -
My stats
My report on this shows that I'm getting hammered quite a bit. Over 2500 attempted attacks, which is eating quite a bit of bandwidth. And yes, I'm on cable.
My thanks, once again, to the author of the wonderful Perl program which generated this (link available on site).