Slashdot Mirror
Slashback: Exactitude, Fortitude, Picnic
You mean we have to reprint all the invitations? Reader Ian Cowley wrote with a slight correction about the end of an era:
"Your article on slashdot.org about the billionth second of the epoch is sort of (but not entirely) flawed.Yes, UNIX systems will report 1000000000 seconds at 01:46:40 on 9th September. Which of course means the 1 billionth number will be 01:46:39.
But, these systems do not account for leap seconds. According to TAI (international atomic time), the 1 billionth second since the beginning of January 1st 1970 will occur at 01:46:17 on 9th September 2001, as 22 leap seconds have been inserted since 1970 (the first was 1972, the last 1999).
So celebrations of the 1000000000th second should be at 01:46:17, whilst 01:46:40 can be reserved for celebrating 1000000000 displayed on UNIX system clocks."
Errr ... thanks. We'll just have to start at "Unix Day, Observed."
What price the capture and humiliation of virus spreaders? JayHerrick writes: "We have posted a small bit of JSP that reports the number of times our server has been queried for a 'default.ida' page. It's stylish, it's cool, and it'll probably get Pepsi all mad at us because we ripped the Code Red logo off one of the bottles." Equally stylish, despite the name, is a small tool named codeRedNeck, described by reader mindriot thus: "As CodeRed probes port 80 of a machine, CodeRedNeck first answers on that port and then goes silent, thus forcing the worm to wait until the connection times out." He advises: "Read the original idea by Tom Liston. Heise also has more on this."
Even More Auspicious dates. No matter which date you choose to mark it, Linus' little kernel-that-could is about to mark its tenth birthday. ikluft writes:
"The "Linux10" Linux 10th anniversary picnic and BBQ will be held on Saturday, August 25 from 11AM to 6PM at Sunnyvale Baylands Park in Sunnyvale, California. Details and directions can be found at Linux10.org. If you can attend, please use the RSVP form so the organizers know how much food and soft drinks to provide (only provided if you RSVP.)Reader big_drew adds: "The event is free (food, softdrinks, cds -- sorry, no free beer, but byo is ok)" and says "If you can't make it out to CA, you can still get the t-shirt (profits will be used to fund the picnic)."Linux10 is being organized as a family event -- bring the kids. In support of that goal, it is also a no-media event. Linux and Open Source enthusiasts who work for the media may attend and participate while off-duty.
Linux10 will gladly link to other Linux 10th anniversary events. Let us know the URLs for those events."
Anyone want to organize a picnic in the vicinity of Knoxville, TN? :) I can bring some pasta salad and watermelon.
Ten candles all around here, too. Simon Spero writes: "As noted in http://www.w3.org/History.html, today, August 6th, is the 10th anniversary of the first public release of the CERN Web Software."
People, the word is "timer". Sheesh, just update the statistics every few minutes...then it doesn't matter if people are hammering your server. Anyway, is PHP compiled down to anything? Because JSPs/Servlets are pretty damn fast.
It's 10 PM. Do you know if you're un-American?
Why bother writing your own caching code when you can just let your Webserver do it for you?
With Roxen's cache tag, I just threw <cache minutes=15> </cache> tags around the cpu intensive parts of mine and let Roxen handle the rest.
I do have a cron job that parses the logs every 15 minutes, and updates the backend database. (I could have done that from the web page as well, but then my samples wouldn't be taken every 15 minutes).
Considering the number of Simpsons fans here, maybe be it should have been DUF (Declination, Unmasking, Food) which is also reverse of FUD...
Phillip.
Property for sale in Nice, France
They may be nonblocking, but each open connection will tie up system resources until timeout. There's only so much connection a machine can initate/accept.
I doubt that CR will ever reach the OS-imposed limit, but IANAE.
But it requires admin/power user privs and the rootshells spawned run under webserver user privs, which is to say you can call it but it won't do much.
Word on the street has it that the first Code Red worm contained a buffer overflow of its own: querying a default.ida with an overflow string of 64K of garbage would crash it out. Doubt the newer varieties have the same problem, but then again, k1dd10t5 aren't known for their innovative coding style...
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
> post a message to /var/log/messages
Holy crap. It's affecting *nixes now?
Come on. Your average NT admin won't bother looking at the webserver logs, much less the event logs: the fact that their web servers are completely owned by the worm yet they're not doing anything is proof enough of this. Maybe a post to the _desktop_ would get through, but not likely. Log the IP and the attack and contact their ISP.
That's all I've been doing. Anything more and you can look forward to explaining to a bunch of lawyers why your eally weren't a Bad Guy.
Never forget that lawyers and plaintiffs have neither a sense of common decency nor common sense.
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
The payload is a random file from their computer, with the virus tacked onto the front. Remove the first however many (about 128K) bytes, and you get a peek into the world of an idiot that clicks on everything they are sent via email.
Sadly, nothing I've been sent by SirCam has been interesting.
-- Help Digitise the Public Domain at DP.
Yes, you are. It's a big cold dark lonely universe out there. :)
"I will take the Ring," he said, "though I do not know the way."
nevermind that the pages are overwritten with "hacked by chinese".
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
timezones
Crack one IIS box, and you're a felon. Crack a million, and you're... some anonymous virus-writing guy that will never be brought to justice.
Anyone planning a celibration in the DC Metro area? Being disabled, I will not be able to make anything that more than an hour away from me.
--
If I actually could spell I'd have spelled it right in the first place.
Please explain, then think twice whether you've ever http:ed to an IP without asking permission beforehand ... umm ... come to think of it, I've never asked the Slashdot crew for permission to GET an index file here ...
it's in my head
Hey, this calls for a new DSW measurement.
That's dick-size war, for those of you not in the know.
The new measurement will involve finding approximately when you started using Unix, then determining what the number of seconds was at that time, and divide by 100000000, and ignore everything beyond the tenths.
Using June '93 as an example, that yields a 7.4.
Anyone starting in on it now would be a 9.9.
shit, i woulda said that about the netscape one, but the browser "comingling" in KDE is sweet. I have always used GNome cuz thats what we have to program in at school, but KDE has some nice features (its fast as hell too) - if it would support half life, I would move everything there.
________________________________________________
Can anyone explain why, when doing a grep -c for default.ida, I get exactly twice the number of reported results in my access_log than I do in my error_log?
I knew we should've listened to Steve Gibson on the dangers of non-blocking sockets!
Anonymous cowards couldn't hit the broad side of a barn.
'Cheese Doodles' are a brand. Like 'Band-Aid's or 'Kleenex'
Maybe he just needs an excuse to get a faster system. Everything else is being blamed on Code Red...
...start 500 lawsuits against the people who, by means of gross administrative irresponsibility, have machines which are running automated scripts which are attempting to gain unauthorized access to my machine...
One lawyer would do. And it might be interesting to try this. They did, after all, attack your system. Call it a reverse class-action.
PHP suxxxxxx
Hell, I'm still waiting for the class action suit against M$ for being the main reason/propagator of this Worm.
Jaysyn
There is a war going on for your mind.
Too complicated. And mod_perl is fir wussies anyway.:-) Who needs logfiles? Real men write their own modules in assembly embedded in the web server using self modifying code.
I'm a loser baby, so why don't you kill me.
Hypothetically, Couldn't a "virus" be writen in such a way as to disable the original and replace it with a server that sends thid "Fix" to anyone attemption to reinfect it? Sort of like a anti-Code Red worm?
Strive to make your client happy, not necessarly give them what they ask for
Yeah, no one would ever mistake 139800 for 139800.
I see even classic Slashdot is now pretty much unusable on dial up anymore.
600 if you're running a Chinese NT installation; not that you're not being a good Samaritan, but best case, you're tying up 1/300th of what it's trying to do for a while. Extrapolate this to a few hundred "chatty" Code Red boxes sending off a few hundred threads apiece (if you're on a broadband line, this is not so outlandish) and you're looking at potentially DoSing yourself.
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
Moe: didn't they stop making that after a bunch of hillbillies went blind?
Call me a karma whore if you want, but I think it's good to see a slahdot mainstay responding to comments about him.....
I say we take off and nuke it from orbit. It's the only way to be sure...
And you didn't even notice the problem of "I are begging" (although that's kind of on-topic, considering the entire Jar-Jar method of "speech")
Gimp.
I say we take off and nuke it from orbit. It's the only way to be sure...
Ummm... no.
... we'll all party at the same time, just different local times.
The event is the billionth second from 1/1/1970 UTC - which will occur at the same time around the planet.
So instead of everyone partying as the zero-hour passes their time zone (eg - New Years)
Go to sleep already...
Never mind....the 2x was a coincidence and threw me off....the original Code Red put a malformed header error in the error_log, whereas the new one throws a 404 and puts the default.ida in the error_log.
I'm still ingesting the first caffeine for the day...
I would love to get something together in Knoxville, but I'm not sure who posted it (big_drew or should be timothy because of the non-italics).
Either case please feel free to call me (Jeb) at 368-5322, email at (jebc at c4solutions.net), or get more contact info at my company's website.
Always love to hear from some slashdotters in the area, and if you ever get bored (or for the picnic) we have a kegerator (sp?) at our office that we are always at downtown.
Descending! Descending! I guess not everyone pictures that exactly the same way ;)
When I said descending I was thinking as in: "sort the following nine digits in descending order."
But then many ./ers apparently took it to mean "getting smaller over time." Although the more accurate word for that would have been "decreasing" or maybe "diminishing".
Let's have fun with definitions straight outta my brain!
Anyway, I didn't mean to nitpick about the title. I just thought it was ironic that some folk complained about the title when it hadn't been mine.
Graham "Teach" Mitchell, computer science teacher, Leander HS
I use MRTG with a tiny Python script to count the number of attacks. The results are here.
Karma: none (due to not believing in reincarnation)
Don't you want to look for default.ida to cover more bases? For instance about half the default.ida entries in my log are followed by lots of XXXXX's and the other half are followed by lots of NNNNN's. Which wouldn't show if you just looked for XXXX's. Or perhaps the NNNN's don't matter? Not sure?
Why not? It could work in a country where burglars sue homeowners in slip-and-falls...
Expanding a vast wasteland since 1996.
Only the newer version of Code Red uses non-blocking socket connections, which means that waiting will still slow down the spread of the older variant of code red.
Correct me If I'm wrong ( and I know someone will) but, I think the only Code Red version that uses non-blocking sockets is the 'B' variant of version 2.
according to this article on the BBC News web site.
Hi!
HA,HA,HA!
THANKS for that, I needed a laugh tonight.
That one is the first in a (so far) three part "series", I've recieved tonight, how about you?
By the way...
Just WAHT is the payload of that loaded attachment anyhow? I just delete them, and move on.
If it don't GO... chrome it. ~ Frank Banks
Why are we celebrating 0x3b9aca00 seconds since the clock started?
This reminds me of a great way I though of to explain to people the difference between a million and a billion. Your billionth birth-second occurs when you are 31 years years old. Guess how old you are when you reach your millionth birth-second?
I think this event dictates a party with much beer.
GeneralKael -- Slacker Extraordinaire
i like omar from at the drive-in. first post. CHEERS
which time zone is this?
C:\WINDOWS>time Current time is 8:06:20.97p
Behold PHP:
/usr/local/apache/logs/access_log");
<p><b>This webserver has been attacked by CodeRed 2
<font color="#ff0000">
<? $cr=passthru("grep -c XXXXXXXX
echo $cr;
?>
</font> Times</b>
CC
How could you have a free Linux party without free beer? Or is this just another attempt to get people to understand what the "free" in Free Software really means?
--
"Karma can only be portioned out by the cosmos." - Homer Simpson [1F10]
"Does anybody really know what time it is?
Does anybody really care?"
Be part of the world's largest collaborative work of art: http://www.paintthemoon.org
Does anyone think that sending a shutdown command to an attacking machine is unreasonable? Any ideas on how to do it (my NT command line knowledge is minimal).
Hey, how's this sound: a Code Red IIa variant that patches the damned server and spawns only 1 thread to mail the admin what an idiot he is once a minute?
Anyone interested in a Melbourne, Australia, Linux 10th anniversary picnic and BBQ on Saturday, August 25.
Having used so many flimsy excuses for a piss up, I think it would be a shame to let this one go.
Get the Hell off my planet, you slimy mobster Bush!
I wonder if Linus will show up at the party?
And they better have alot of Soda, as most Linux geeks I know are wider than they are tall.
Anybody know if there's a problem with http://www.theregister.co.uk ? I haven't been able to get it to load for several hours now. Anybody know a different link for it?
I see even classic Slashdot is now pretty much unusable on dial up anymore.
That would *really* demonstrate the "freedom" part.
At www.waldo.net/misc/codered I set this up this afternoon. I've personally alerted the owners of several of these IPs, but I hope that the public viewing may lead to them disconnecting their machines. <fingers crossed>
:)
Oh, yeah, I did it in PHP, of course.
-Waldo
Just take the total and write it to a file that contains only the total. Every time that the page is loaded, have it check the timestamp. If it's less than n hours old, show the cache. Otherwise, re-grep the log and write the result to the cache and start anew.
That's how I do it, anyhow.
-Waldo
My first child is going to be born around when Linux turns 10. Cool.
Did anyone else read that as the Slashdot-endorsed opposite of Fear, Uncertainty, Doubt?
Or am I on drugs?
I'd love a little Windows app that listens on port 80 and responds to any attempt to connect with code designed to use CR2's backdoors to disable the IIS service on the infected machine. Disable as in stop it and turn off the service completely. Thoughts?
Um, no.
----
Please, I are begging you! To save Dmitry from teh jail!
Did I get my math right?
About a billion seconds ago, the first man walked on the moon. (~31 years)
About a billion minutes ago, the first man was said to have walked on water. (~1860 years, sorta close to the 0 CE mark)
About a billion hours ago, the first man walked through what we now call Europe. (~111600 years, homo sapiens in upper pleistocene)
About a billion days ago, the first man walks. (over 2.6 million years, a bit before the oldest known homo habilis)
About a billion years ago, the first multicelled animals form. (eukaryotes supplant prokaryotes)
About a billion decades ago, the Milky Way galaxy began to form.
[
The way I see it, the milestone being celebrated is that the epoch is rolling over to 1000000000, not that it's been 1000000000 seconds since the epoch started. If we were celebrating the latter then Ian would have a good point and we'd all have to modify our alarms accordingly. But I think the rollover point is a more significant milestone than the true count of seconds.
All this really means though is that we have two celebrations within 22 seconds of each other. I certainly don't have a problem with that ;-)
So it's Mel-Bourne again, right ?
I keep stats of more than just Code Red, using scanalyze and a small php script. Its sometimes fun to see what kind of activity your machine is getting.
Am I the only one that thinks that timothy's writing is incomprehensible? I don't know what it is, but I have read every slashback post about 3 times just to figure out what he is trying to say. Just wanted to know if I am alone.....
Is it too late to begin marketing solutions to the 'S1B' problem? There must be some dilbert-style manager out there who'd pay me a few grand to stay up till about 2:00 am and make sure all his machines survive the 'rollover'...
-db
Your article on slashdot.org about the billionth second of the epoch is sort of (but not entirely) flawed.
I was the slashdotter who submitted the original article. And just for the record, I never said anything about a billion seconds from 1970-01-01, I just pointed out that "soon the magic numbers will say all 9s".
At the time, I felt like a complete dork for even noticing the proximity of UNIX timestamp "987654321", but I felt like it'd be wrong of me not to share, so I did, and threw in the bit about UNIX timestamp "999999999" just for kicks. It was only the second story I'd ever submitted to /., and the only one to get accepted (the first was announcing the release of Mozilla M16, but I'd jumped the gun).
Now that I know that there's someone out there who cares enough to correct my back-of-an-envelope calculations by bringing in leap seconds makes me feel like less of a dork.
(By the way, my title as submitted was "descending unix timestamp"; it was Timothy who changed the title to "The Quickly Descending Unix Timestamp", which wrongly implies that the timestamp's value is getting smaller over time, IMHO.)
Anyway, maybe now that I can prove I'm not the biggest nerd out there I'll start getting dates again....
Graham "Teach" Mitchell, computer science teacher, Leander HS
Think of a big wooden stamp with all zeros written across it, each zero wet with red ink, slowly arcing toward a big piece of ricepaper, propelled by a large, unseen hand, ready to impress those Ohs in a clean straight line across the paper ...
;)
...
Descending! Descending! I guess not everyone pictures that exactly the same way
Mea culpa, mea maxima culpa. Rapidly *increasing* seemed wrong when about to hit so many zeros
cheers,
timothy
p.s. Happy teaching / new home.
jrnl: http://tinyurl.com/c2l8yr / foes: http://tinyurl.com/ckjno5
Umm, I hate to be the damper in evil plans for Code Red ...
Any servers which "wait" are just wasting their own processor and memory.
Scott.
Hi! How are you?
I send you this bill in order to have your advice.
See you later. Thanks.
Evil is the money of root.
The concept is simple. The attacker scans networks looking for a "live" connection. We give them that :-) and we use TCP/IP's stubbornness against
them. When the scanner attempts to make a connection to a port with a SYN
packet, we send them back a SYN/ACK and then simply ignore them. Because
they've "completed" a three-way handshake, their TCP/IP stack assumes that they
have a good connection and tenaciously attempts to hang onto it, retrying the
connection until they finally time out.
I'm sure it'll be modified to work as an all-purpose portscan-blocker in no time flat.
...Time is the best teacher, unfortunately it kills all of its students.
How about a script that automatically exploits the infected machine upon it's attemped connection to yours?
Unfortunately, this is hard to avoid. A lot of people email me (and the other editors) answers / reactions to various stories as if we were the ones who submitted them. (Ask Slashdots, particularly.)
...), and the plaintext is ours. Titles are our responsibility / fault, although many of them are the same words as the submitters'.
;)
Unless we've messed up the formatting for a particular story, though, reader-submitted text is always quoted and italic (except, say, for features
To be clear -- that "descending" title was my fault, and you can point anyone who complains to you about it to this comment
timothy
jrnl: http://tinyurl.com/c2l8yr / foes: http://tinyurl.com/ckjno5