Slashdot Mirror
Code Red Worm Spreading, Set To Flood Whitehouse
Slow Internet service due to all those extra packets of malice may not be the worst effect: As sp1n writes: "It appears that due to the way the worm formats its HTTP request and the semi-random way it seeks out vulnerable systems, it is also causing Cisco 67x DSL routers, widely deployed by Qwest, using firmware prior to 2.4.1, as well as some others, such as 3Com LanModems, to crash -- recoverable only by a power cycle. I have yet to see any news outlet cover the affect this is having on DSL service. Qwest's Interprise networking department confirmed they are receiving reports from all 14 states in their territory. Some routers running pre-2.4.1 firmware are crashing even though the web admin is disabled. This has become a huge support nightmare for every ISP in the region."
Which begs the question -- is it "right" to create a sploit that connects back to the attacking machines and "patches" their system so that it is fixed.
It's a conspiracy. Everyone will hit the whitehouse.gov site to see if the alleged worm affected it, and in doing so, we have all been duped into participating in a DDoS attack on the site. Rather clever, actually. Proclaim the effect to create the cause.
Almost any integer, eh?
None of my int's are good enough.
; -- the corruption of government starts with its secrets. a truly free people keep no secrets. --
http://www.qwest.com/dsl/customerservice/csco675up s.html
p s.html
http://www.qwest.com/dsl/customerservice/csco678u
hmm... could these dialup victims be using Win98's 'Personal Web Server'? It's just IIS 3.x.
Wonder if that's vulnerable.
well, well, I just checked my logs. I have been scanned by lamers for this heh.
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 273
This showed up in my logs. I'm pasting it unadulterated seeing as I've found like 20 copies of it anyways so the script kiddies already have it.
207.68.188.44 - - [19/Jul/2001:15:15:30 -0400] "GET
Tempting, but I block cookies whenever I can. If you bring some beer and steak, I'm there.
Visit me on #weirdness on the Galaxynet.
This is acutally the "Press DOS attack." You get some security expert to claim that a worm is spreading all over the internet and will attack X site at 5pm. Then everyone who reads the story will go see if the site is down at 5pm. And of course since everyone is hitting reload to see when it is down, the site gets flooded and goes down while the virus/worm never exsisted!
-- Virtual Windows Project
Cnet now says 100,000 servers infected.
At my company (small midwest ISP), I could feel the effects at around 10am CDT. A couple servers run by customers were infected and were sending out a *constant* stream of requests to random servers trying to infect others.
Oof.
FOR THE LOVE OF GOD, FIND GET YOUR Tee Ball at the White House INFORMATION BEFORE IT'S TOO LATE!!!
Karma: Excer..ex...excellahhh...realll good (mostly affected by drinking not done in moderation)
The government cannot take down Microsoft, but Microsoft can take down the government...
*ponder*
Right, so, who wants to build a space station with me and leave this BS behind? I'll bring cookies.
You cannot apply a technological solution to a sociological problem. (Edwards' Law)
scared me at first.. reboot fixes it.. but it comes back..t .asp?url=/technet/security/bulletin/MS01-033.asp) patch.. should clear it up.. I hope, anyway. (-:
upgrade your service packs/critical updates and then run this (http://www.microsoft.com/technet/treeview/defaul
So that's why my DSL router was crapping out every 10 minutes or so this afternoon, after several months of continuous uptime. I knew it couldn't be a configuration problem (there's only so much configuratin' one can do to those things.)
After reading about the trouble Slashdot ran into with their Cisco routers, and the tongue lashing they got for rebooting it without understanding the problem, I'm glad I powercycled it anyway. It did solve the problem, until I got hit again.
While I was rebooting the "turtle," as we call it, my girlfriend, Anne, for some reason got really upset, started crying and moved out. Really odd.
I don't need large brains to have a good time.
I don't run IIS, but I've been seeing odd things in my logs. It took me a sec to check security focus and learn what it was. Here is an except of a log file so you if see similar you know what's up.
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 323 "-" "-"
65.201.146.103 - - [19/Jul/2001:17:58:49 -0400] "GET
The thing on security focus indicating that "default.ida" thing is IIS probes (and/or possibly already compromised systems rescanning is here.
Wheeeee
The guys at Eeye have a good overview here.
This is basically just the usual buffer overflow attack that's had a patch available for a month, and by following best practices shouldn't be an issue at all. The really interesting thing is where the guns being gathered are pointed: at whitehouse.gov. Should be an interesting night!
Jason
Dick Cheney: SOMEONE SET UP US THE WORM!
George Bush: MAIN SCREEN TURN ON!
George Bush: IT'S YOU!!
Li Peng: YOU HAVE NO CHANCE. MAKE YOUR TIME.
Li Peng: HAHAHAHAHA
There is common belief that disabling the web interface will prevent this. It's not true; mine's been disabled every since this was first reported a year ago and I still got hit. The problem is that "set web disable" prevents the web server from fiddling the router config, but doesn't actually stop the server from parsing input from port 80, which is what locks up the box.
An improved workaround is to disable the web-admin interface and change its port number with "set web port 53496" (replace with some random port number). At least that'll stop it for the near term.
Long term you need to get updated firmware, but of course Cisco won't distribute firmware directly to customers, even though they have public announcements of the existence of bugs and bugfixes. To actually get the firmware you have to get it from your DSL line provider (Qwest, in my case), and Qwest couldn't care less about security with respect to home users, so they've never bothered to offer fixed versions of CBOS.
--
314-15-9265
Perhaps this is why the patch is not on windows update. Fixed now though.
There have been quite a lot of posts on NANOG about this already, and depletion of memory on Cisco routers causing them to crash.
--
Smegma.
GET /default.ida?NNNNNNNNNNNNNNNNNNNNNN ...
There are tons of N's (can you say buffer overflow?) and then stuff after the N's. I've left that out to make it harder for script kiddies.
-ted
... but really, what would have been helpful to many IT readers would have been the link to the Microsoft bulletin and patch download in the /. article.
Ceci n'est pas une sig.
While I don't disagree with your bug report, I want to point out that at 5PM PST, it offically becomes July 20th on GMT. Unless the attack begins on the 21st, I'm still assuming whitehouse.gov will be inaccessable tonight :-)
Doh!
It's not the RIAA or MPAA, but you might like these IPs:
207.46.123.13
207.46.152.122
207.46.153.9
207.46.171.237
207.46.171.61
207.46.171.68
207.46.173.25
207.46.175.96
207.46.186.252
207.46.187.123
207.46.196.55
207.46.196.58
207.46.203.39
207.46.227.38
207.46.230.64
207.46.239.116
207.46.239.117
207.46.239.44
207.46.252.139
207.46.28.158
Each of them has hit default.ida on one server I'm watching. From what I can tell from whois -a, 207.46 is all Microsoft corp! They can't even keep up with their patches.
(btw, on this same server I'm seeing a new unique IP default.ida hit every second)
Run task manager. Select 'processes.' Open the view menu. Select 'choose columns.' Activate 'thread count.' Then look for a process with 100 threads. At least, from what I've read about the worm. My firewall's been turning these away left, right, and centre.
Vintage computer games and RPG books available. Email me if you're interested.
it attacks 198.137.240.92 not www.whitehouse.gov
that is, it doesn't need to reference the dns server (i was hoping to just add an entry for whitehouse.gov to our dns server since i dont have access to the router side of things)
-f
-f
www.blackant.net
....can't it be the RIAA's and MPAA's webservers?
Sigh. Windows IIS: It's like walking around with a handfull of twenties and giving a loaded gun to any criminal you meet.
We have been dealing with this all day at my job (colo/hosting). Apprently, it's totally memory resident, so a reboot should clear it. However, its really spreading like wildfire. Also will hang Cisco 675s and 678s, so if you have one of those routers (cable/dsl), disable web access. Also is hanging HP printers with web frontends. The traffic alone is choking some of our smaller routers. The patch is availible here.
SealBeater
-- Its survival of the fittest...and we got the fucking guns!!!
Microsoft Outlook: Making the Goodtimes virus real.
The information about the whitehouse.gov attack was wrong. (Well - its still up :)) In fact the attack is going to start tommorrow, july 20th.
Here is the snippet from bugtraq:
Thanks to Eric from Symantec for tossing us a note about the worm being Date
based and not Time based.
We made an error in our last analysis and said the worm would start
attacking whitehouse.gov based on a certain time. In reality its based on a
date (the 20th UTC) which is tomorrow.
If the worm infects your system between the 1st and the 19th it will attempt
to deface the infected servers web page or try to propogate itself to other
systems. On the 20th all infected threads will attempt to attack
www.whitehouse.gov. This seems to continue until the worm is removed from
the infected system.
Any new infection that happens between the 20th and 28th will most likely be
someone "hand infecting" your system as all other worms should be attacking
whitehouse.gov. If for some reason you are infected between the 20th and the
28th then the worm will begin attacking whitehouse.gov without trying to
infect other systems. This attack will continue indefinitly.
The following are rough numbers, but we felt that it was important to
illustrate the affects this worm can _possibly_ have.
The worm has a timeline like this:
day of the month:
1-19: infect other hosts using the worm
20-27: attack whitehouse.gov forever
28-end of month: eternal sleep
Presumably, this could restart at any point in a new month again.
Also, some stats for the attack:
Each infection has 100 threads
Each thread is going to send about 100k, a byte at a time, which means you
have a (40 for ip + 1 for each byte) which means you have 4.1 megs of data
per thread
100 threads * 4.1megs = 410 Megabytes
This will be repeated again every 4.5 hours or so
Remember, each host can be infected multiple times, meaning that a single
host can send 410MB * # of infections.
We have had reports between 15 thousand and 196 thousand unique hosts
infected with the "Code Red" worm. However, there has been cross infection
and we have heard reports of at least 300+ thousand infections/instances
(machines with multiple infections etc..) of this worm.
If there are 300 thousand infections then that means you have (300,000 * 410
megabytes) that is going to be attempted to be flooded against
whitehouse.gov every 4 and a half hours. If this is true and the worm "works
as advertised" then the fact that whitehouse.gov goes offline is only the
begining of what _can_ possibly happen...
It's been done.
(It's a link to information on RTM's worm, for those who don't feel like clicking the link.)
I got a little worried there for a sec!
I'm still worried!
Write your congressman. I want to see using a Microsoft server being treated as an act of criminal negligence, like drunk driving.
Haven't we all had enough of this bullspit?
My own webserver had been hit by several thousand of these attempts. When I got Slashdotted for putting up pictures of Bobo, it was bad. But this worm has been saturating my DSL with HTTP GET requests.
Fire and Meat. Yummy.
Microsoft doesn't put most security patches on Windows Update. They have a Corporate Windows Update (http://corporate.windowsupdate.microsoft.com), but it's basically just another download site... it doesn't automatically tell you what you need or install it for you.
n /notify.asp), but since they obviously have the Update technology down pat, I don't know why they don't have a version of Windows Update with *all* the hotfixes, not just the "consumer-friendly" ones. It would certainly make setting up new machines easier... instead of downloading and installing twenty files, you should be able to just go to their site and have it do the work for you.
Not that keeping up to date on patches is very difficult (subscribe to their Security Bulletin at http://www.microsoft.com/technet/security/bulleti
They haven't really changed Windows Update since it was introduced with Windows 98 - they've really dropped the ball... Redhat's up2date and Ximian's Red Carpet are both quite a bit better than the current implementation of Windows Update.
--
Convictions are more dangerous enemies of truth than lies.
Convictions are more dangerous enemies of truth than lies.
- Nietzsche
Yeah, but for each one you have to click through 3 times just to get the file. Which means:
a) it's really annoying, and lots of people just won't bother, and...
b) it's really easy to miss one or two
And there's no real way to check (there's a dinky little script available somewhere that'll check for IIS patches, but it's buggy and hard to find).
The Corporate Windows Update site makes them easier to download, but it takes weeks for patches to be put up on it after they've been released, and there's no real way to match them with the associated Bulletins (to know if they need to be re-downloaded, if you've missed any, etc.) And it doesn't allow searching by Service Pack.
In this case, Microsoft's system is just sloppy and unprofessional. There's absolutely no reason for this to be such a pain other than Microsoft isn't putting enough money and attention into its support structure.
Sure, they now allow Patches to be joined together so you only have to reboot once for multiple patches and they allow you to search by Service Pack, but those are baby steps that should've been done years ago... patches today should be instantly updated over the web and shouldn't require reboots in 99% of cases (for all IIS patches, it should just shut down IIS, update the files, and restart). Microsoft's behind the curve, and if I was a corporate system admin, I'd be tempted to switch to Red Hat just because they have a much better update structure.
(For instance, with Red Hat, you type up2date, it launches a graphical wizard which automatically tells you what you need updated, downloads, and installs them. It's like four mouse clicks to completely update your system to latest versions of everything on it.)
--
Convictions are more dangerous enemies of truth than lies.
Convictions are more dangerous enemies of truth than lies.
- Nietzsche
While I was working for the feds,
:-)
I met a worm they called Code Red...
And Code Red hit 100K hosts,
And every host had 3 infections
And every infection had 100 threads
And every thread sent 100k
And every k had a thousand bytes [*]
And every byte was sent in 1 packet
And every packet had a 40-byte header
Headers, packets,
Bytes, k,
Infections, hosts and threads...
Once every month, just to piss off the Feds.
[*] 1024 just doesn't scan well.
I'm a bloodsucking fiend! Look at my outfit!
Fortunately, a trace of the sources indicate that the servers involved are being shut down pretty quickly by their admins.
One alarming aspect is the number of these probes that are obviously coming from servers connected through PPP dial-up accounts.
I wonder how many people have installed IIS on PCs running IIS and don't even know it's running?
News With Attitude
a new Internet worm that takes advantage of a security flaw in Microsoft software
Is this even worth mentioning? I mean, really! Don't all worms take advantage of security flaws in Microsoft software? Why can't someone write a worm to take advantage of Apache for a change? All of these Microsoft servers being compromised are making me jealous. If only I could afford a license of Win2k Server, then I could participate in the excitement as well...
some day....
-Ryan, with the unoriginal sig
I thought that said whitehouse.com! I got a little worried there for a sec!
---
------
Sig