Slashdot Mirror
Hotmail Servers Shut Down by Code Red
An Anonymous Coward writes: "SF Gate has this story about Code Red taking down some of Microsoft's Hotmail servers. That's funny." So is Code Red a problem yet? Meanwhile my sircams have stopped, except for 2 people who mail me a hundred or more a day. Thank god for filters, but if I had a monthly bandwidth cap, I'd be pissed.
Even more damning - Apache has the lead in number of web servers deployed, so if anything we should by all rights expect to be awash in Apache-related exploits simply due to their marketshare. The fact that the exploits are still coming mostly from IIS makes the difference in design philosophy and just generally giving a damn about your product all the more evident.
Your right to not believe: Americans United for Separation of Church and
Did anyone read the Dilbert comic where MS had mis-spelled a word in MS Word? I can imagine the Admin(s) in question to be put into a similar situation
.. At our Comdex booth
MS Admin: We got the virus we've been teaching people to prevent.
Bill: Great, so what are you going to do about it?
MS Admin: Kill myself as an example to others?
Bill:
Yahoo! Mail's POP3 service still exists. You just have to accept occasional commercial emails from them. Click Options, then POP access and forwarding.
Don't want ads in your inbox? Then do what I do - leave POP3 access off until the mailbox gets filled up, then turn on POP3 access, use you favorite mail client to download all your email, and finally turn POP3 access off again.
This
It will infect NT machines that it finds, but due to a bug in the worm, it won't spread from them.
Aww geez... now I'm infected just reading your post....
That's CANCER to you.
--Uncle Bill
Don't they _want_ to render the existing Internet unworkable so they can sell people an 'upgrade' solution based entirely on proprietary protocols that tie in with .NET?
Don't they _need_ the current Internet to grind to a halt with as much damage as possible so their stuff looks good by comparison?
I'm sorry, but Code Red may turn out to be their baby all along. If that is true, then they _meant_ it to cripple the Internet. With .NET coming along, Microsoft desperately want and NEED to cripple the internet. Otherwise, who will buy .NET?
11) Pick a platform which would get you the sack if management had a clue
Shouldn't that be COST you YOUR sack? For male admins, anyway.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
Would you buy from a company that begrudgingly admits to flaws in its products, and has to release fixes for the defects, and then doesn't apply them to their own components?
.NET is entirely different code, etc, what matters is if they properly manage the service. Given that they can't do it for Hotmail, what makes you think they can do it for .NET?
Not I.
Doesn't matter if
Really?
You get to reimplement Win2k badly?
You could learn from the Linux project (reimplementing Unix-1989 badly for almost ten years now).
Has any mass media (NBC or CNN) hit Microsoft about their crappy design? I would also like to know if Microsoft would ever consider writing a fixing worm.
Click here or here.
Please tell me that this is not an isolated incident. A capitalist monolith of a corporation is having to spend millions of dollars because of a little communist worm? I'm no communist, but anything that's bad for big business is good for me.
I find it amazing that they didn't take every precaution to protect what might be their highest-profile property. If MSDN went down, they could cover it - Most of their other servers, too. But Hotmail? That's so closely associated with Passport and, by association, dot-net, that I think they would do absolutely everything in their power to keep it spotless in the minds of the users.
Good luck to them. They'll need it.
I got two unsolicited calls asking how to set up Apache on a Windows 2000 server. These were people who had never seen a need to switch before. If I convert their servers for them, I'll probably set up a Linux box or two, 'just for backup purposes'.
Heh heh.
Cheers,
Jim in Tokyo
-- My Weblog.
Well then...that screws up their press release claiming that only 2 boxen were hit. I've got logs from two other machines...anyone else?
I have it on good authority that Hotmail is actually running on a cluster of hacked -up Audreys.
Evil is the money of root.
mod this one up :-)
My server
Wouldn't be the first time, eh?
At first I thought this service was great, but after just a couple of weeks I noticed that my e-mails were being delayed by several hours, and some of them didn't even arrive! I still have an account in there that, to this day (and several "support" e-mails later) can't receive anything...
What does .NET and Passport have to do with CodeRed?
At the same time MS was switching Hotmail to run Linux, OSDN was switching their jobs site to run IIS. Nutty!
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
Is there a Sourceforge project to develop:
Code Red?
Thank you and have a spam-free weekend.
I just queried Netcraft What's That Site Running and it answers:
... I'm laughing as much as everyone!
The site www.hotmail.com is running Microsoft-IIS/5.0 on Windows 2000
I also tried the SSL Port 443 and it's also hosted on IIS5/Win2K. Hope this clears up any confusion *grin*
One thing to consider here folks: this is a classic case of Security Process falling down. It just so happens it's an Win2K hole in this instance. If Hotmail still ran BSD and there was a root exploit discovered, someone still needs to follow the process and plug the hole.
NB: I'm not excusing MS here
What I did is just gave Yahoo my Hotmail account (which I never check) as my primary email account. That way all the Yahoo spam goes to Hotmail and I get POP3 access.
Well, here we have a gold-plated example of a fatal flaw in a piece of commercial software, coupled to a lax attitude towards fixing it, that has without question resulted in the loss of Actual Money by a great deal of people. One would think then, that IS Managers across the world would be queuing up to sue Microsoft and recover their costs.
Sue Microsoft because your sysadmin is too lax to install a security patch that came out almost two months ago?
Yeah, that'll work.
NO CARRIER
That's it. The name was in my SANS email this morning. :)
"I can't give you a brain, so I'll give you a diploma" - The Great Oz (blatently stolen sig)
And Bill Gates is pauper I suppose? Please, how did your post get a 5?
Microsoft has just reported on its website that the hotmail/passport servers will be down indefinitely because the programmers and technicians who are supposed to fix them can't log into their passport accounts to access their tools to fix the problem.
More on this at 11.
Best. Comment. Ever. Enjoy!
They knew what they were talking about when referring to those lazy sysadmins.
Ask me about my vow of silence!
For some reason, everyone seems to think that every virus is an Outlook virus.
this only works if a) you have your own (sub)domain (not difficult) and b) you team up with a few friends to secondary MX for each other otherwise.
it's something I've been meaning to do but haven;t got round to yet... one day
dave
I Don't understand why dont they apply their own patches to their own servers ?
I bet they do have their own mailing lists where they are talking about this.
Or possibly they are not interested in it ?
The device you are attempting to access is either read only or just another user.
some fatal flaw that resulted in Actual Money being lost, the corporation could go after a commercial software house in the courts in an attempt to recover costs. have you read any EULA? I mean ANY? You cant do that, open source or not. Period...when you click "Yes", F8, or any other key saying you agree to their policies - you cant sue. Thats like that first line in these things too...
So don't use a four letter hotmail ID, how hard is that? Also, if you want to only accept email from people in your address book, unless you're expecting it, it's quite easy to automatically send bulk mail into the bulk mail folder. I currently have 25 messages sitting there right now. You don't get alerts for your bulk mail folder, and the mails get deleted after a certain amount of time, so you don't have to do anything to support it.
I must admit that hotmail isn't very good for mailing lists and signing up for sites, but I have a seperate account and email address for that. Admittedly that gets tons of spam, but I don't read it unless I'm changing my password anyway. For mailing lists, well, I don't read any any more, but you can always make a new account for each mailing list, or use an outlook express filter. Mailing lists via email is a stupid idea for the most part anyway.
I don't know, I'm sick of people complaining about spam. I don't get any in my personal mail, simply by only giving my email to real live humans and using hotmail's spam filter. I contend that if you get a lot of spam it's probably your own fault.
ok then your [sic] infringing on my copyright! Could you as [sic] me next time before STEALING my comments for your own?
It's a wonder that the recommended correction isn't to upgrade to a newer IIS or a newer OS. The virus was probably written under the guidance of Microsoft's Marketing Department.
Yes, you're right, they just moved the front end servers to Win2K and IIS. Event then they are running some software to emulate a FreeBSD environment so that their cgi scripts etc still work.
Unfortunately, the whole point of Sircam is to attack the web front end servers, so the back end is irrelevant.
More seriously, people say "just apply the patch" but for a site like Hotmail that is a non-trivial exercise. You have to test the patch extensively in your environment to make sure it doesn't break anything. Can you imagine the smugness of the Slashdot community if they had applied the patch and some subtle bug in it brought down every web server in Hotmail?
All I want is a secure system where it's easy to do anything I want. Is that too much to ask ~~ Randall Munroe
I work at Intel. All our internal port 80's are blocked right now, and servers (non-windows) are having problems due to connections going up and down because of the DDOS natur of Code RED II. It keeps tying up all our net bandwidth and is also wrecking havoc with shitty cisco routers that keep crashing. (requiring a power cycle). I've been unable to get ANY real work done for the last 2 days because of the network outages. It IS costing billions. I'm an EE and I make a shitload of money. If I'm sitting there for 2 days doing nothing, and Intel's paying me for it, that's a lot of money x 70,000 employees.
To make matters worse, Microsoft claims that they discovered the infection on Wednesday. I notified them on Monday that I was logging Code Red scans from their internal network. Apparently I was ignored...
How can you forget a bunch of servers.
It wouldn't be the first time someone has forgotten a server. (I can't see this happening to a Windows box, though.)
Of course only Microsoft has to do this because they don't want to pitch into Symantec's coffers for pcAnywhere or have to use dirty open source software like VNC.
No slow downs on the slowest web-mail system.. hhmm How would you tell if it was slow???
We also dont know how much information was lost because it was running on MS servers.
!net
Friends don't help friends install M$ junk.
They let you set up a limited number of filters - filter the stuff they send you. I have a college account that forwards to my "private" Yahoo box, and by default, anything that isn't to or from the [mycollege].edu domain goes to a "spamfilter" folder that I clean out once a week (the small group of people who have the "private" address don't get filtered out, though...they do let you have mroe than one filter, after all). That lets me use Balsa for convenient POP3 access all the time, and not worry about spam.
It just amazed me the couple of times I have turned it off in order to harvest an email address (it's weird how many people don't know what their email address really is) how much spam I recieved in a few hours. I've been told that there are bulk mail programs that just guess email addresses at hotmail and send mail to everyone in a range like a@hotmail.com to zzzzzzzzzzzz_zzzzzzzzzzz@hotmail.com. Therefor with only four letters in my ID, I recieve all of these. However they go right into the not read by anyone folder.
I already have several hotmail id's including a couple for spam traps. For personal messages I find that the coolness of a four letter ID outweighs the occsional inconvience. and it sure is a lot easier to tell to some one over the phone than I_Wanted_a_different_ID_but_it_was_already_taken_1 9853@hotmail.com
I haven't heard of a hit crew sent out to kill the authors of 'Undocumented Windows NT' or anything.
Of course you wouldn't have heard of them. What do you think they are, amateurs?
.....lot more critical data THAN your little account......
Ok, I'll bite. Let's go through the list.:
1) Pick a platform that is difficult to administer remotely
Since most admins administer UNIX via command prompts and vi I'd say that UNIX is much easier to administer remotely. With SSH loaded I can get all the same interface at home through a dial up 14.4k connection that I get at work.
(2) Pick a platform that is insecure
I don't really I have to say anything here. If you have ever in your life looked at the stats available at attrition.org then you know.
3) Pick a platform that can't handle the amount of customers you have
Platform wise this really comes down to hardware, not OS and CERTAINLY not admin, which is what we are discussing here.
4) Pick a platform that costs a tonne of money
Here you might have been right. Depending on the installation, the software cost may be marginalized. Or it may not. Think of buying 1000 file servers. There the OS cost is a signifigant factor. Putting in a large scale distributed application? not so much, fewer servers and most of your cost is in development and implamentation.
5) Pick a platform that requires a person with a dodgy qualification to run it, who doesn't know left from right, and demands more money than they are worth
I can speak with some authority on this one. The MCSE cirriculum, unless they have added it recently, does NOT mention hot fix patches. At all. It tells you how to set up Microsoft's replication service that fails 20% of the time for no reason, but it does not mention the first thing about hot fixes.
6) Pick a platform that is proprietary
NT is about as proprietary as it gets. With the commercial UNIXs you at least get regular published APIs and system calls. With Linux and *BSD, you get the source. Hard to get less proprietary than that.
7) Pick a platform that runs on low-end server hardware or worse only
see my above point about platform
8) Pick a platform that you will have to lease by the year or per billion processor cycles within the next 3 years
AFAIK, MS is the only company to even suggest the rent the OS idea.
9) Pick a platform with a database server that "loses" data given certain queries
This shouldn't have been included. Funny, but off topic.
10) Pick a platform that is forever morphing, changing technology, and has a history of instability
That's NT. It would be an accolade but for the instability part, and the fact that most of the changes don't work and aren't wanted or used by the users.
11) Pick a platform which would get you the sack if management had a clue
I would fire someone for picking a Microsoft solution when an alternative existed. Wouldn't you? What's the good side of picking Microsoft?
I'm failing to see much in this post that indicates that a good admin has a whole lot of control. Yes they can patch servers, but as has been noted, the patch doesn't always work in this case. Also, Microsoft patches are well known to de-stabalize the system, or bring back old bugs, or chrash server applications, or cause any other host of problems. Yes, the admin is important, but you're trying to say that Michael Schumacher could win while driving a stock Yugo, based strictly on his qualifications as a driver. The tool DOES matter.
Politics, Culture, Food?
Make a modified version of CodeRed called, say, CodeNap. Include in the payload an MP3 by Metallica. Wait 48 hours until it's everywhere. Now sue Microsoft because they are making money of a system that is being used to make illegal copies of copyrighted works!
324006
Everything I've read about Code Red II says that each infected machine is only supposed to try to infect new machines for 24 hours. Considering that CRII exploded Sunday evening and judging from the number of hits I've gotten on my @HOME machine, everyone should have been infected within an hour.
My machine seems to be getting hit just as hard as ever. Surely these can't be recent infections? Do we really have to wait until October 1 for this storm to pass?
The vast majority of freebsd machines are now running w2k.
Heh. Taken out of context, that sounds pretty funny. It sort of reminds me of the "*BSD is Dying" troll.
I get to reimplement the same solution with four times the hardware and none of the worm protection.
...in this Computerworld story.
It actually names MicroSoft as being negligent, or at least somewhat responsible. Maybe this one will open eyes despite the huge media machine?
---
slashdot: A failed experiment.
ya, that is why they want to offer subscriptions to software, to force you to upgrade when they want you to, and to force you to pay for it.
They won't change their model they'll force you to assimilate to theirs.
Microsoft: This is where you want to go today.
http://monkeyserver.com --- weeeeee
June 18. Nowhere near 6 months ago.
Internet time, baby. Geez, Dillon. You're still using Julian measurements? That's so last year!
Microsoft has a long history of poor security in their software. They have made progress in this area, but they are still far behind the curve.
I'm a little out of my realm of knowledge here, but it seems like IIS also has a lot of features that other web servers don't have. If you have more features, you also have a lot more likelyhood for bugs and exploits. It's much easier to secure a simple product than a more feature rich one. I've heard many people state that the cost off running MS software is much higher than running other competing software. I'm sure that that's true in many cases, especially when those users aren't utilizing the extra features that IIS may offer them. However, if those features meet their needs better than Apache for example, then maybe IIS is worth the cost and the security rick for them. Regardless of who's software they use, they need to keep up on the security patches. There was a patch for this. The problem was heavilly advertised. People, including many in Microsoft itself, didn't apply the patch.
Another reason why there may be more security exploits hitting IIS than Apache is that IS people who are properly concerned with security, and properly apply patches are more likely to be running Apache than IIS. I hate to fuel the UNIX has smarter admins fire, but there seems to be a lot of truth to it in a very general sense. Note, I said in a general sense. I'm quite sure there are brilliant NT adins, and stupid UNIX admins, I've actually met a few of each.
Dave Farber's mailing list passed along Microsoft's Hotmail Is Red Hot From Worm from Newsbytes
-foxxz
I bet Microsoft is wishing they left those hotmail servers on BSD. If I remember correctly, they started moving from BSD to Windows 2000 just about this time last year...of course that was after an unsuccessful try in about the 97/98 time frame....
Crewd
That Microsoft didn't download and install their own patch!
Microsoft is using a Beta version of the new IIS software for their hotmail servers that come with the worm already bundled with it.
I submitted this as an article this morning, but as it is still pending, and both my home and work servers are still under constant annoyance, I figured I'd pass it on here as well. If you are running a Windows NT server, kindly do us all a favor and just turn it off for a few months.
According to yesterday's Handler's Diary on www.incidents.org, "Microsoft has confirmed that if an IIS 4.0 webserver is using URL redirection, it is still vulnerable to Code Red even if the Microsoft patch is installed". The only known solution is to remove all URL redirections from NT servers running IIS 4.0.
-Tommy
"I got a half gallon of Jack, and 2 dozen Ant Traps. I'm about to get wild." -me
They have said that Hotmail should not be trusted to store valuable mail (and that I should use outlook instead -- the damn software responsible for SirCam in the first place).
Hrmm, lets see, a free service with multi-millions of accounts running IIS, I wouldn't trust it to store my valuables, why do you?
They think this is my problem, and I should upgrade my anti-virus software (I've repeatedly assured them that I've been WinDoh's free for four years -- I can't find McAfee's Linux download site).
This is your problem, see quote number one above.
They say their anti-virus protection is sufficient -- yet I rec'd two more SirCam laced spams today. They won't let me download the contents (even though it won't hurt my Linux system).
This is the kind of protection I, and the rest of the world, would like. Able to see the email, not able to infect myself with the crappy attachment, oh, it's SirCam, .
If you've been running Linux for 4 years you should surely know by now how to use mutt, pine, or even evolution if you so desire. I would suggest not trusting valuable information to free - error prone - services and start downloading your email straight to your computer via that pop3/imap account your ISP gives you.
-- iCEBaLM
When did the hotmail servers go down? I havn't noticed any downtime at all and I'm constantly checking my mail (cuz I suck).
The Stone Age did not end for lack of stones, and when the oil age ends it will not be for lack of oil. --Bjorn Lomberg
What about those 5-nines reliability ads for Win2K Microsoft's been buying? The boxes stay up, but the servers they run fail. Hmmm, too bad Microsoft's the main one around with the money and the mentality for lawsuits... sounds like false advertising to me.
I found out that a couple of the servers were infected by code red.. not taken down. It even states that it caused no slow down accessing hotmail. The only news here is that MS doesn't care enough about hotmail to patch a few servers. Woo.
I Don't understand why dont they apply their own patches to their own servers ?
Probably for the same reason many people don't install the patches. They have the server up and running and are afraid of what the patch will break.
As x approaches total apathy I couldn't care less.
Are you a suicide victim after you kill yourself? M$ brought this on themselves through their software quality (or lack thereof) and their failure to apply the fixes that supposedly fix the problem after laying the blame for this at the feet of all those who didn't. "Victim" just doesn't seem to fit.
Of course, how much of this whole discussion is Schadenfreude? (Of which I am gleefully participating in.)
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
but how can MS promote it's whole .NET/Passport philosophy if the very same services are proven to be insecure. And why hasnt MS been made accountable at all? Is it simply their huge media machine they have working for them, or are people truly that blind to the insecurities and downfalls of MS software?
I lost my concept of community when my community lost all concept of me.
The only thing better would be if Microsoft's server that has the patch to download was infected...
Looking for any old 8-bit Heathkit/Zenith software/hardware - http://heathkit.garlanger.com
You are correct. However, "slashdrones" as you put it also:
1. Have the ability to think independent thought.
2. Will research issues to solve problems
3. Don't purchase products based on marketing
4. Believe that their is NO One software or hardware package that solves every need.
5. Are not afraid to take chances.
6. Will stand up to management to do what they believe is correct.
7. Understand that the cost of software and hardware effects the companies bottom line.
Ahhh, but sadly, they are out numbered by a factor of 1,000 to 1 by the M$clones. So for every "slashdrone" you read about on this site, there are easily 1,000 M$clones who do the following.
1. Purchase a software not to get fired.
2. Believe that even if another software or hardware is better, the bigest company will eventually fix their product and crush out anyone else.
3. Tell everyone that their product is the best without ever learning anything else about other products.
Lastly, and the worst of all:
4. They are just implementers of software and do whatever their upper level management tells them to do. However, they talk to everyone like they make all the decisions for their company, and that those decisions are the ONLY Logical way for people to go with technology.
Steve Michael
smichael@netcapade.net
Network Architect
Performance Strategies
Indianapolis Indiana
Redirect gone /default.ida
in your conf. Will make it return a "410 Gone" message which is like a "stronger" 404, and it won't log in the error log. This will return a default error page (few hundred bytes); much like the 404 error.
Liberty in your lifetime
We all do it, that is, create a throw-away HotMail account for those times we need to register online somewhere with an e-mail address. I even go so far as to turn on the SPAM Filtering and limit the use of the account for said registrations.
Even so, these accounts always manage to get overrun by a flood of SPAM. I've even set up one account to throw away EVERYTHING. Then again, that's the account I used to sign up with SpamCop
So I'm thinking, perhaps it's not a bad thing for all those nasty SPAM'rs to get hundreds, if not thousands of messages bounced back (not like they don't already). One can only hope that their stupid harversters removed bounced addresses from their lists.
At least in this way, maybe CodeRed will have done us a favor. Even for a short while.
healyourchurchwebsite.com - WWJB?
Who causes this mess?
Obviously not Msft, since their FU's are protected by the EULA; society seems to want to blame the virus authors who exploit the holes, but I think the blame belongs to: people who take the path of least resistance and buy Msft licenses. Yes, people should be FIRED , sacked, terminated, let go, finito', by company's for recommending Msft Exchange/Outlook/IIS when they get a plague of viruses. And I mean TOP IT mgmt should get the old heave-ho onto the street from the suits when there's a major business disruption. After they dump the McSE fakirs and the "40 Billion Dollar RipOff Goliath" they should look around for some credible, broad computer business information systems experience willing to look at alternatives other than a simple minded 'single source' from budget sucking vendor lock in thieves leading them further down the primrose path to madness, mayhem & self destruction.
Thank you.
try { do() || do_not(); } catch (JediException err) { yoda(err); }
Actually, EULAs would be less binding on businesses because they tend to employ lawyers who would instruct them of this.
However, businesses tend to sign paper contracts that spell out everything in the EULA, as part of their bulk-purchase agreements. And in that fashion, being open and before-sale, it's perfectly legal and binding.
If you had to sign your name to an EULA when you bought software at a store, it's be more binding. Especially if you had to sign BEFORE purchase.
But if a business (or consumer) goes to the store, buys a package, takes it home, installs it, and clicks-through the EULA, they are NOT bound by it. Even if they knew it was there, they also knew that it is invalid. EULAs, no matter how you look at it, are not binding to ANYONE.
Thus the UCITA. I mean, if a business can't forbid people commenting on the quality of a product, writing reviews, distributing anything made with the software without royalties, and cripple it in the name of piracy provention... how do we expect them to make billions of dollars and oppress us?!? Support your local billionaire, buy him a politician.
Ah, i see.
I'd say this solution actually works on ALL memory-resident worms and viruses.
:-)
However only accepting email from people in my address book has cut the spam down. It's kind of inconvient however as I have to turn it off when ever I'm expecting mail from the wild.
code red infect's IIS 4 and 5 which tends to be installed on NT4 server and w2k server boxen *by default I think).
so yes, NT 4 can be easily infected
dave
Can anyone write a new napster using this "protocol". Then we just have to set up NT servers and wait for the files to arive. First it spread itself to any boxes on the net then start transfering files on off Your HD. Everyday when you come home from work you got 2gb of fresh pron. Should keep you busy for the rest of the evening.
It is refreshing to see the beginnings of a "main-stream" media move towards at least pointing out that these things are more often than not soley M$-related problems... Who knows, maybe they might even start to hold M$ accountable for stupid server tricks... But don't hold your breath.
Actually clicking a button after launch is now considered a "signature". The federal law is silly, who knew you'd be signing your life away by clicking the silly and stupid little check box when the program starts up. Sucks doesn't?
They do protect against the dictionary attacks, that's what the spam filter is for.
code red II doesn't infect NT I think.
How perfectly goddamn delightful it all is, to be sure. - Charles Crumb
I assume this patch is mandatory one. Bill just need to send everybody @ M$oft mail with subject :
Install @#$%.. patch NOW!
:))
The device you are attempting to access is either read only or just another user.
So after Microsoft who do they sue next? SUN? They've had security bugs that have caused problems for customers. How about Apache? They've also had to patch security holes. How many companies that make server software haven't had security holes at one point or another? More viruses/trujans/worms are made to attack MS OSs because they have a larger market share (in the desktop market at least), and they're probably more despised by the crackers writing the viruses/trojans/worms.
The real story here is that a lot of people running Microsoft OSs don't take applying security patches seriously enough. The fact that some of them are at Hotmail which is owned by Microsoft makes the news both funnier and more depressing.
System administrators and computer users in general need to be more concerned with the costs of not applying security patches. A more serious effort also has to be made to convince crackers that there will be serious penalties for releasing these viruses/trojans/worms. It's past time to accept excuses like I didn't mean to cause that much harm, or I was just doing it to show the hole existed. Is it necessary to throw a brick through a car window to prove that a car alarm won't stom you from steaning someones stuff out of the car? These crackers are causing serious finicial harm. They should be held responsible for their actions, and not get a slap on the wrist.
I mean, it's nice and all that they've got a page explaining that they had someone else build their site, but why? Is it too complex an application? Are open source databases not robust enough? What's up with that?
And last I'd heard, jobs.osdn.com was sporting a slew of long-since-patched vulnerabilities as well as an open SQL*Server port on it; for a website that likes to preach about security and knowing who's working for you to make sure they do things right and all that jazz, they sure don't keep their own house in order.
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
You know, one lone *ssh*le with no social life decides to jam up the net, why? Simply because he can. Pathetic. Its amazing to me that anyone would do this. I certainly feel sometimes in the minority about treating my fellow man fairly. Its hurting the credibility of all computer coders... and although I might be out on a limb, OPEN SOURCE too. Some jerk decides to do this, and guess what? All of the precious freedoms that we have will slip away. Certainly all of the "freedom" net principles /.ers extoll so loud will disappear within cries of "look what they can do!!!" Don't think that for a second that some Gov't group is not watching this... taking notes... making policy. Viruses and their kind hurt open source. Make us look like outlaws. Forcing them to remove freedoms on the 'net. Don't laugh... regulations are coming. A few are destroying the whole movement. If you know a person that does this kind of virus crap, talk them out of it... or turn them in, this CODE RED bastard is TRULY a criminal. It is no less malicious than going to every major religious landmark in the world and spraying "BITCH" on it, or going to everyone's office and doing the same... these are our stomping grounds, churches, and our offices. Don't deride others for their server choices. GO after the pricks that made the virus.
Except that the EULA, any EULA, is absolute and total bullshit, except in Maryland and Virginia(?) who think UCITA makes sense.
You can't make addendums to a contract after the sale without agreement from both sides. Clicking a button or hitting a key does not constitute proof of agreement. That requires a signature. Please help spread the news that EULA's are bullshit until they are upheld in a court of law or supported by legislation. At the present, they are just some grandstanding bullshit from rich software companies with nothing more than threats from lawyers standing behind them.
BTW, did I mention that EULAs are BULLSHIT mumbo-jumbo legalese that don't have the force of spit.
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
The difference is that you purchase ISP service on a subscription plan. If they change their TOS or AUP in a way that you don't like, you're free to complain until they cancel your account and quit sending you a bill every month. Lucky thing is that there is still a small amount of competition in the ISP market and you really do have some choice in the matter.
I don't want free as in beer. I just want free beer.
The real question is why Hotmail doesn't pull their head out of their ass and protect against dictionary attacks. I have a very guessable Yahoo address that I've never distributed, and there's 0 spam in there.
you make it sound like its no big deal. what if one of the records it /just/ doesn't show was your account balance, so the software defaults it to 0? databases store a lot more critical data then your little account balance too, think about it a bit.
I'm still able to get my hotmail... *shrug*
------
Random, useless fact: I type in startx entirely with my left hand.
MSN Hotmail has a new look!
MSN Hotmail has a brand new face...and it's easier to use. You'll find it easier to create and manage your folders, see which of your Messenger buddies has been hacked by chinese, and quickly choose names from your Address Book when send document for to ask advice.
Promote proofreading. Don't mod up sloppy posts.
MS Admin: We got the virus we've been teaching people to prevent.
Bill: Great, so what are you going to do about it?
MS Admin: Kill myself as an example to others?
Bill:
Have him spray the booth in herring oil, then release the penguins...
Oh, that would be messy. :)
Fire and Meat. Yummy.
Two things:
They have said that Hotmail should not be trusted to store valuable mail: They're right. It's a free email service that you have no direct control over. If it's important, save a copy locally.
I've also told them that the correct solution is to bounce new incoming emails....They don't get it. They don't understand.: Keep in mind your probably corresponding with people who's sum technical knowledge comes from the troubleshooting-script book they have on their desk.
Who has losses that arise from code red?
ISP's and individuals/companies paying for bandwith used.
Who causes this mess?
People who haven't patched their software (gross negligence).
Who can sue who?
People who have losses because of gross negligence.
Micorosoft is shielded by a EULA that limits (or denies)liability (although this EULA might not be fully apllicable worldwide).
Hey, make a server system so user-friendly that an idiot can use it -- and only idiots will!
No, you are a moron, and yes I do know whats under the hood of my switch. It was built for this, and the CPU load is below always below 8%.
I guess you don't know much about using layer 4-7 switches for load balancing your website.
That would explain why I couldn't get to one of my hotmail accounts
I just assumed they migrated that server to Win 2000 from BSD
Oooohh, the total cost of ownership argument rears its ugly head again! :)
As I said, most MCSE's don't know left from right. They may be cheap, but there is a reason for that! You gets what you pays for.
Linux does get security holes, although a well configured install should have less opportunity. If the box is only running sshd, httpd and a database, then you cut down the options for attack immediately. If you run OpenBSD you will be pretty safe out of the box!
Windows appears to get a major security hole several times a year, and people just don't learn. This isn't about a webserver, it is about the future of your data and personal information, because that is what Microsoft wants to manage via Passport.
My post you quoted was a joke, although it got a couple of informatives (?!) as well. Code Red has proved that most admins for windows system don't patch their machines, possibly because MS patches tend to mess things up like Exchange so they don't work. So to use MS, you need a duplicate setup of your servers just to test out these patches and check they will work when used on production equipment. That is expensive, even if the hardware is old, the software needs licenses.
The fact that Code Red has infected so many home users suggests a big piracy problem to me. No wonder MS have WPA in XP. I bet that WPA won't make people buy Windows though, they will stick with what they have, and eventually be forced to check out an alternative OS.
Of course, for some applications, MS will be the right choice. .NET looks like it will be very good, however MS want to fix it up in patents to prevent interoperability and keep it to themselves and their friends. Linux/BSD/etc does not need a .NET clone, it needs its own system that works like .NET, but using open, free software and algorithms, all managable from a single command line and GUI tool. Easy to set up, easy to configure, cross platform and easy to interoperate with other vendors. I call it "The Unix Business Platform"... :)
Hmmm...Hotmail used to be a *fantastic* mail service until MS took it over (first, they added SSL which made accessing it from lynx impossible. Fortunately lynx-ssl made it possible again. Then, they added Javascript. Bastards. Javascript, for MAIL???)
Then Hotmail moved their cluster (several times, if memory serves) from trusty, reliable FreeBSD servers to MS products. We have seen the results of this changeover in the past, and now we're seeing what happens now with all the viruses floating around in MS-land.
I was happy enough to discover Yahoo Mail, which IS running on FreeBSD servers, and DOESN'T need SSL or Javascript to access. Haven't had a problem since then. :-)
Back in the Dark Ages of corporate acceptance of Free Software (circa '97 or so) a common pointy-haired manager complaint was "Who do we sue?"
IE, if the software contained some fatal flaw that resulted in Actual Money being lost, the corporation could go after a commercial software house in the courts in an attempt to recover costs.
Free Software, being provided as a community service with no sue-able corporation behind it, lacked this perceived accountability.
Well, here we have a gold-plated example of a fatal flaw in a piece of commercial software, coupled to a lax attitude towards fixing it, that has without question resulted in the loss of Actual Money by a great deal of people. One would think then, that IS Managers across the world would be queuing up to sue Microsoft and recover their costs.
Anybody seeing any evidence of this happening?
Want to learn about race cars? Read my Book
32 billion dollars in cash in the bank, increasing by a billion per month, and thats not very good at making money?!
Who by your standards is good at making money?
No, Thursday's out. How about never - is never good for you?
As far as i have seen, the performance of a Windoze server is inversely proportional to the time since a reinstall. Less the time between reinstalls, more the performance. Its that simple !
The statement below is true.
The statement above is false.
Either someone has hacked up Apache to report a different server string, or jobs.osdn.com is actually running IIS 5.0.
THAT is interesting!!
Fear: When you see B8 00 4C CD 21 and know what it means
Why, they can't even get their "amateur" services to work. What else can you call MSN, Passport and Hotmail but amateur (or should that be amateurish?)? Even PC Magazine rates MSN at the bottom of the list of ISP's along with AOL!
Aussie aussie aussie!
Not Meta-modding due to apathy.
I'm new here. Aren't all the email services you're discussing free services? Could there be a correlation between free and crappy? ~~ Paul
They are difficult to patch or upgrade or remotely configure or fix, or even publish to.
So...how, exactly, are these systems easy to use again?
I work for a small company that handles license production for a number of the software companies, most of the stuff for OEMs - one of them is Microsoft. (You know that little piece of paper with the cool hologram and bunch of numbers? We make them)
Now Microsoft is very critical about who gets access to the serial numbers and databases. They have there own servers, VLAN, and firewall at our plants for distribution of licenses. Think it would be pretty secure, right?
Well not really, they all got Code Red when it first came out. Now we were cleaning Code Red up on our own webserver (Yeah, I know, should have patched) Noticed that the MS server were infected, called up MS and told them what was up. They didn't believe us and told us the servers were already patched. Took a number of calls and yelling to get their boxes fixed.
I don't know if its really funny or really sad.
The world isn't run by weapons anymore, or energy, or money. It's run by little ones and zeroes, little bits of data.
NT's standard remote admin tools, like Event Viewer and Server Manager, require RPC using NetBIOS, which is difficult if not impossible to secure.
UNIX may have its problems, but secure remote administration using native tools is not one of them.
Helevius
But my cable provider (Road Runner) has been having problems today and yesterday (connection seems to just go "poof"). Might not be this virus though. I've had 1676 attempts on my cable connection. Finally I shut down Apache (getting tired of it loading from inetd).
/var/log/messages it seems there have been numerous attempts today, most of which are from RR.
From looking at
July (19-20ish): 22 hits
August 1st : 22 hits
August 2nd : 26 hits
August 3rd : 30 hits
August 4th : 205 hits
August 5th : 318 hits
August 6th : 352 hits (!)
August 7th : 253 hits
August 8th : 210 hits
August 9th : ~193 hits as of 11:18am
Dijkstra Considered Dead
Now when it hit their Windows Update site, that was funny. Slow day?
DataSquid.net, a little about me.
heh. heheheh. heheheheheheheheheheheh..... hehehehaehahahahahahahaaaaaaaahahahahaaaaaaaaaaaaa aaaaaaaaaa.... oh, man...... heheheh. muahahahahahahahahaaaaaaaaaaaaaaaaaaaahahahahaHAHA HAHAHAHAAAAAAAAAAAAAAAAAAAAa...
hee heeeeeeee....
i think it's FreeBSD, which came with hotmail when they acquired the company that developed it. I've only heard this, and cannot confirm it in the least.
A: None. The Universe spins the bulb, and the Zen master merely stays out of the way.
This whole code-red business brings to the front the trade-offs between security and ease of use
This episode really highlights difficulties faced by end-users in patching up systems, that are fundamentally architected with a weak security, continually.
When even Microsoft finds it difficult to keep-up, how can we blame the others?
The battle ahead between linux and microsoft, will really boil down to this fundamental tradeoff, and the current problems with code-red really help in raising the security conciousness of the server community
XP and beyond will have mandatory registration processes which will inevitably (spelling?) tick some people off. These will most likely be power users who will install on two to three computers at home who don't want to pay M$ all that money. Many of these ticked off users will become hackers (which may also be inevitable) as they find how easy it is through learning to be a power user under a different OS. So, M$ is creating a bunch of Ticked-Off Hackers who will probably just create more and more of these annoyances.
Certainly every man at his best state is but vapor
When they tried to run Hotmail with NT, it crashed. When they tried to switch to 2000, it gets Code Red'd.
Why don't they just keep with what works, FreeBSD.
DanH
Cav Pilot's Reference Page
UNIX - Not just for Vestal Virgins anymore
Okay, people keep saying it isn't a problem, the news doesn't know what to say about it, but I can confirm, it is a problem. More of a pain in the ass. Cisco DSL modems are still vulnerable, because people don't realize it is code red locking them up. Infected IIS servers are all over the place, and I keep getting more scans every day.
On my web server (with multiple IPs), 689 probes yesterday. 613 of those were Code Red II. 685 the day before (578 were CRII). 543 the day before that (419 CRII). 433 the day before that (224 CRII).
So, simply put, Code Red II is worse than Code Red, and getting more so. Who cares what it does to the servers, right now, it is a major pain in the ass.
Ever tried explaining to a client that their network is down because of a worm that infects web servers? And no, I didn't install those Ciscos, I would have brought CBOS up to date if I had.
And this the company whose software that the vast majority of ISPs insist that you use if you want to connect to the internet using their lines.
I think I'll have some new ammunition the next time I get into an argument with an ISP over what software I'm allowed to run.
CUR ALLOC 20195.....5804M
I think my sarcasm was over stated. I shouldn't imply that everyone that reads slashdot is a drone zealot. I simply wanted to give a good laugh, my typical motivation. It's good to laugh at yourself and others just to keep sane.
:-)
I do believe that there are plenty of the M$ drones as you say, implementing MS solutions just because they come from MS and MS can do no wrong in their eyes. And there are just as many GPL sealots out there touting quirky tag lines climbing to the speakers pedestal every chance they get to "defend free speech". I sit on the fence laughing at everyone, including myself, for being swept up in bravado and a lot of rhetoric.
I simply wanted to give a good laugh and maybe try and work in an asimov reference while I was at it
"Could you imagine the heat MS would be getting if they charged for Hotmail?" They are already doing so with their Windows OS'es. It's the same ;-)
Funny, when we shut down access to port 80 through our firewall, worker productivity went up 172%!
The emphasis is my own, and I'm happy to point out that a reporting agency has finally begun to grasp the fact that Microsoft IIS is part of the problem.
This article doesn't mention the fact that anybody in the world could possibly have had unrestricted access to any number of email accounts. I wish they would post some statistics on the number of people who took advantage of the fact that there was a root shell on the hotmail servers.
"Can't sleep. Clowns will eat me"
This is a sure way to uninfect your system if you have Code Red.
Step 1) Open a command prompt
Step 2) Run 'ping localhost'
Step 3) Press F7 and Enter quickly a couple times in a row
Your Code Red infection is now gone.
Thank you for your attention.
It seems this was the true attack pattern - to infiltrate the geek comunity by hitting hotmail servers. Thereby wreaking havok with all of the /. users spam accounts and ultimatly destroying our freedom of speech...
:)
.ph0x
Well I know - it's a long shot as far as ideas go... but hey so is most of the stuff here.
---
ps -aux | grep mind
It's a feature.
"There's nothing more useless than an internet account with a monthly cap."
--Blair
"You'll find truth only in mathematics."
I didn't do a netcraft followup with any of these servers, but judging from the slightly different "there is nothing here" screens of the infected machines, a good amount of these servers are NT4 machines, which are rebooted a bit more than the more stable W2K machines. Plus, you've got to take into account those people who use these boxes as a work machine, and shut them down at the end of the day. Since these machines are not puting any real content on the server, the owners don't even know they're vulnerable.
If god had intended you to be naked, you would have been born that way.
(twas a ZDNet story I can't seem to locate)
"I can't give you a brain, so I'll give you a diploma" - The Great Oz (blatently stolen sig)
One little server on a little 128k leased line and the attack pattern since 1st August reads
13,35,24,27,27,63,73,47,32 (in 15 hours)
Until the 4th August all the attacks were from the initial breed (NNNNNN). On the 4th 3 of the 27 attacks were from the new breed (XXXXXX). On the 5th 15 NNNNN and 12 XXXXX. Day 6 and only 10 of the old breed arrive while 63 of the new breed are in and since then we are down to about 3 attacks of the old NNNNN per day.
I actually agree with the concept setting up a lot of machines to reply to the virus with the fix. It seems obvious that too many NT/2000 boxes out there are abandoned and vulnerable thanks to the lack of knowledge required to expose one. Who thinks that we won't see any attacks next month?
Never underestimate the dark side of the Source
Um... maybe that's where Code Red originally came from.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
We discussed this one year ago this week. It was concluded that they were running a round-robin DNS, and you'd sometimes get Apache (~20% of the time) and sometimes get IIS 5.0 (~80% of the time.) To run your own experiment, try the script that I included at the time.
/var/tmp/hotmail
#!/bin/bash
i=1
while [ "$i" -lt 253 ]
do
lynx -head -dump http://lw7fd.law7.hotmail.msn.com/ |grep Server >>
let i="$i"+1
done
-Waldo
IIRC, it doesn't DROP the records, it simply does not retreive & display them after the table they reside in gets to be a certain size. 1000 records, 10,000 records? The records are still there, they just don't show up in query results.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
I call your bluff; evidently you do not work for the same IBM that I do.
No IBM internal servers have been blocked, nor access to external servers.
I remember hearing somewhere that the Redmond server farm consists of THOUSANDS of boxes. This equates to a huge warehouse of racks.
Now, I know what it takes for us in a small (50 person) company to patch our desktop and server machines, so it seems to me that this patching undertaking would take a LOT of people a LOT of time. Who knows, maybe they HAVE been patching their servers, it's just taking them months to do it!
While they probably have some sort of automated or remote patching facility, I like to envision a bunch of interns with crash carts (monitors/keyboards) and freshly burned CD's walking from rack to rack installing the patch.
Sucks to be them.
$0.02 (CDN)
Unfortunately you then get the other side of the coin, the number of EMails I have recieved from people trying to send EMails to a friend and having it bounce back with an over quota message and then demanding to know what that means or telling you to fix your computers is phenomenal.
:)
I term these people aquaintance's. Not friends. I tend to call people who have a clue friends, well unless they are really really good looking. In which case they get my mobile number but no email address that i actually check
Do the following really mean anything? SCSA MCP CCSA CCNA
--I'm not actually after an answer!
Saying "Just my 2 cents" at the end of your posts shows you are someone who lacks assertivness and are afraid of treading on someone elses beliefs. Quit being a pansy ass.
The original poster was correct. IBM US had major outages (48 hours+) in Raleigh, Boulder, and Austin. I'm in Austin, and they restored connectivity fully only last evening at 8PM.
> This company release a warning, what, like 6 months ago
June 18. Nowhere near 6 months ago. Barely a month before the onslaught of Code Red I.
GET /default.ida?heheheheheheheheheheheh.....heheheh.m uahahahahahahahahaaaaaaaaaaaaaaaaaaaahahahahaHAHAH AHAHAHAAAAAAAAAAAAAAAAAAAAa%u9090%u6858%ucbd3%u780 1%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801% u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0 078%u0000%u00=a HTTP/1.0
;-)
-- It only takes 20 minutes for a liberal to become a conservative thanks to our new outpatient surgical procedure!
I was once a hardcore "Outlook" user but last October I switched to this: :)
http://www.junglemate.com
and I'll never go back - so far it has everything I need and accessing all my mail from practically anywhere is the only way to go. When your mailbox fills up, they defer for a day & then bounce your mail instead of automagically deleting
But we (slashdot) already knew this didn`t we?
Or at least the brave souls who read post at 1, don`t ask me why its not moderated up.
Cut, and paste:
Why code red is still around (Score:1)
by jerrytcow on Tuesday August 07, @05:58PM EST (#82)
(User #66962 Info)
I was looking at my server log, and couldn't believe how many hits from the second round code red it received. I did a DNS lookup on a few of the addressed (most of the hits seem to be from 64.x.x.x). Several are from 64.4.13.232 (msgr-cs22.msgr.hotmail.com).
At first I was astounded that so many users could running IIS still unpatched, but if sites like hotmail can't patch their servers, how can we expect the average home user to?
We had some people get unplugged b/c they had the virus and weren't fixing it fast enough, but there is no general port 80 blockage that I am aware of.
Well... At some point (long ago) I went to Netcraft's "What's that site running?" section, and it told me it was FreeBSD. Supposedly they've switched to Windows 2000, but, as you can see if you read through all the posts, a lot of people still suspect that it's running FreeBSD on the 'back end'.
________________________________________________
suwain_2
It really caught my eye where they claimed 110 million Hotmail accounts. I wonder... if Hotmail implemented an activity percentile (a la Sourceforge) how many of those 110 million would fall into the bottom %1? ... the bottom %0.5?
I like to play children's songs in minor keys.
"We're all sons of bitches now." --J. Robert Oppenheimer
Same story at the Folsom site at least. And there is a _lot_ of stuff done over the web, at least for the team I'm on.
http://www.myrealbox.com/
from Novell is definitely the winner.
This is what I call the Novell effect you reach a point where people are happy with what they have and see no reasion to up grade.
what is the gmx's OS ????
there's no McAfee or Symantec anti-virus tools for linux!
---
...Code Red is taking down Hotmail so that people can't get to their accounts that are filled up with SirCam?
"Enough of this wretched, whining monkey life." -- Marcus Aurelius, _Meditations_, Book 9, 37
thats a good proof of the "security" of microsoft servers. i long switched to gmx.net
".Sig Stealer" was here
Losing track of Nuclear materials
Nuclear Materials System Not Buggy, Says Microsoft
There is much cruelty in the universe, John.
Yeah, we seem to have the tour map.
Workers get things done, they dont wander in circles holding their heads chanting "ohmygod...ohmygod.."
They do where I work - The Christian Coalition.
W32/SirCam@MM Virus Found
There is no cure available for the virus on the file test.doc.pif
It is not possible to download files from Hotmail that contain incurable viruses. Contact the originator of the file, inform them that the file contains a virus, and ask them to send a virus-free version of the file.
I think you mean a router.
$5 / month hosted VPS on linux = awesome!
Um, I actually am surprised to see the level of hostility levied towards a service that is provided free of charge to the general public. One thing that is also interesting is the number of posts (I knew it was inevitable) touting Linux. I love Linux. I think it's great. You want to know why there are no real virus threats against Linux? It's because no one has targeted it. Maybe all the virus writers are 15 years old and using Linux? It seems to me that *no* OS is safe if people really want to target it, and laughing at the misfortune of another smacks of immaturity and a certain foolishness.
read the notes from the intel employees above and talk about bulls* again. in a lot of companies, the internal technical support is done through a web page to 'reduce costs'. but how do the employees tell tech support that their web page is down :)
I seem to remember some savvy /.er out there somewhere who showed that MS was actually using Linux to power Hotmail. Maybe with the recent facelift upgrade they did, they changed the backend as well...
Captain_Frisk
What's new? People rag on Linux all the time.
This is the first time I've ever replied to anything at slashdot, although I've read the boards for a couple of years now. Just a point about Exchange running IIS. In Exchange 2000, this is an absolute must for Outlook Web Access. It's ugly, a security hole, but a service demanded by corporate users who travel extensively. I run the Network Services for a large multi-national corporation. If I had my way, we'ld be running Sendmail on Unix boxes with Apache as the web front end, but somehow, the executives like the fact that we use MS. Life can be unbearably painful some days in an MS shop! Fortunately we are heterogeneous, but the Linux and Unix boxes are just as useless as the MS boxes when Code Red infected machines (we develop software and for some reason, developers like running IIS on their workstation whether or not they need it) start flooding the WAN pipes.
favourite
mum
bloke
And the real difference: Americans are citizens. The Brits are subjects.
hahahaha :)
My guess is they're working on CRIII
Probably because the rest of their servers run BSD...
2) Pick a platform that is insecure
3) Pick a platform that can't handle the amount of customers you have
4) Pick a platform that costs a tonne of money
5) Pick a platform that requires a person with a dodgy qualification to run it, who doesn't know left from right, and demands more money than they are worth
6) Pick a platform that is proprietary
7) Pick a platform that runs on low-end server hardware or worse only
8) Pick a platform that you will have to lease by the year or per billion processor cycles within the next 3 years
9) Pick a platform with a database server that "loses" data given certain queries
10) Pick a platform that is forever morphing, changing technology, and has a history of instability
11) Pick a platform which would get you the sack if management had a clue
Ahh, I thought they weren't supposed to be reinfected on reboot. And considering the worm reboots the machine, they should avoid propagating for all of about 10 minutes/day.
Question is, will the people who own these machines think it is strange that they are rebooting every day, or just think its par for the Win2K course.
Can you believe I have not ever received one single Sircam OR "love bug" mail?
Imagine trying to run an e-mail service on NT. What a pack of incompetent marketdroids.
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
You can forge the headers the server returns... especially easy since Apache is open source. Who says its actually IIS?
My server
Sign me up for Hailstorm right now! Do you need my credit card number now or later? When do you want my ssn, drivers license, home address and other personal information? Boy, I sure am glad I've got a big responsible company to handle my sensitive data instead of a bunch of foreign nobodies. If MicroSoft can't protect my information, who can we trust? ;)
You must be the change you wish to see in the world - Ghandi
www.myrealbox.com is pretty good. At least it doesn't insert unwanted ads into my outbound mail.
U.S. Democracy: born 7/4/1776, died 12/12/2000 R.I.P.
Mr Troll:
That's because there are no Linux viri!
McAfee does make a linux server tool for detecting WinDoh's viri on the server side (before the user gets it)... along with a few other Linux-based tools to try to protect WinDoh's lusers from thier idiocy.
When I die, please cast my ashes upon Bill Gates -- for once, make him clean up after me!
Probably the same thing that happened with Windows. Same situation, just not free.
--
"Outlook not so good." That magic 8-ball knows everything! I'll ask about Exchange Server next.
I'd love to know who sits around and caclulates all the 'millions' of dollars they are loosing. That's just a comment for the press.
... for great justice!!!
wasn't it not too long ago this very forum was laughing at the piddly virus 'code red', because the author had 'stupidly' used a site name instead of its IP to attack it. now look at how much trouble it has caused and answer me... how many other more successful viruses have there been? maybe its intended purpose, DDOS-ing whitehouse.gov, has gone by the wayside, but man, what a lot of crap being posted here, there, and everywhere, on the TV, etc, etc. this is an unbelievably 'successful' virus.
The REAL sam_at_caveman_dot_org is user ID 13833.
They did for a while, about 8 hours or so. There were at least for systems, in different cities, that I could telnet to, log into, and connect to the webserver with "telnet localhost 80", yet could not access the webserver remotely. There was no notice of such blockage, but it did happen.
Dear Mr. aozilla:
Please get your tongue out of my ass.
Sincerely,
Bill Gates
My work just killed all inbound port 80 connections from their VPN clients (i.e. folks like me) because some set of idiots was running IIS from their systems and blasting the intranet with scans after their boxes were compromised. :)
This really blows because it affects my work quite a bit. Happily, apache can run on > 1 port concurrently.
What really sucks is that this is probably going to be the case for a few weeks. At least we've got vnc set up on one of our boxen to test systems on the intranet via port 80. Oh well. workarounds to the workarounds.
losing NOT loosing (lose, not loose), you illiterate idiot.
They're not sure where to get the patch!
which antivirus vendor they use? I heard somewhere that they had used CA's InoculateIT at one point. I dont know if that is true...Does anyone know?
Intelligence is like four wheel drive, having it just means you'll get stuck in more remote places.
Oh, sorry I forgot. Some people just can't take the competition.
Is it true that I can get my FREE download of MSN Explorer at http://explorer.msn.com/intl.asp? Wow! That's just what I've always wanted, FREE software.
Friends don't help friends install M$ junk.
Yahoo has threatened to shutdown my email account for ages (at least a year) yet nvr has, I cant access it from the web interface anymore, but oh well. I just use pop.mail.yahoo.com and telnet in if I need to check it from the road.
Even though their POP3 service disappeared some time ago, I'm still using them. You can replace Outlook with webbased Yahoo! Mail as default mail-client on your windows computer.
They have built in Norton Antivirus just a click away, and you can scan attachments before you download them. That was how I found about this Code Red thing in the first place (I've been on vacation for 4 weeks).
You know you're in a bad position when a large group of people say that despite your service being free it still sucks. Could you imagine the heat MS would be getting if they charged for Hotmail?
BOSTON SUCKS!
Behold! for I am a slashdrone30000. My positronic brain responds eagerly to any and all anti-MS statements. In the entire history of of the 3000 model there has never been a missed opportunity to bash MS. Excuse me, I mean M$. They are evil and I stand for good.
These are the 3 rules of slashdrones:
1. A slashdrone may not injure a human being, or, through inaction, allow a human being to come to harm, except for Bill Gates, because he is evil.
2. A slashdrone must obey the orders given it by slashdot except where such orders would conflict with the First Law. All words from slashdot should be considered as the word of god itself.
3. A slashdrone must protect Linux's existence as long as such protection does not conflict with the First or Second Law, and especially if it means showing your massive amount of positronic brain power to the mere mortals by writing a soliloquy on each and every single topic on slashdot.
FOR GREAT JUSTICE AND ALL THAT CRAP!
Hotmail was shut down by the new flavor of Mountain Dew? Man.. that must be pretty strong stuff....
Polymorphism -- It's what you make of it.
- Yeah, I been real busy lately replying to all these messages from people writing to me for advice. Funny they all chose the same subjectline, how's that for a coincidence?
:)
Its not the subject, its the message body. You'll confuse them.
Actually Windows 95 and NT4.0 with office 97 does everything an office worker needs.... actually even earlier versions of office are plenty sufficent. all versions after 5.0 are just adding intentional incompatabilities to force upgrades as the features are useless... (Funny how abiword is 10 times smaller than word.... oh wait there isnt an entire version of VB5.0 in it!)
for productivity, corperate and all companies havent had to upgrade for 6 years.. It's the morons in the IT/IS department that gotta have the latest!
Do not look at laser with remaining good eye.
If they can't figure out how to patch their servers then get a switch to filter out those attacks. It's not that hard to make a url-rule in fx a ServerIron to catch those attempts. I work with them a couple of places where we configured them to redirect all attacks on their netblock to a Apache server just so we could count the attacks for fun. :-)
The switches where in place there already for content switching so it was no big deal.
"Sucks to be them"
I can think of worse jobs than being paid by Microsoft to watch their servers being brought down by their own software!
I can connect fine (HTTP), but can't ping. Maybe they block ping. (Boston area, BTW.)
Liberty in your lifetime
With Windows 2000 (all but Professional), IIS 5.0 is installed by default.
Oh. It would be nice to do things properly, but I'll settle for the job the cable company did for me. Their little name for my box cx####.btnrug1.la.home.com has dns set up for it and it seems to work. Some dull mail set ups, like the NT system where I work, take a little time to find the IP, but they get it eventually.
Friends don't help friends install M$ junk.
Actually, I know of a major computer manufacturer that would exactly take an order for 300 laptops and push it through for a quote through an entirely web based system. Everything from the initial sales call to the final delivery of the product is tracked through a web application, which really streamlines the process. To go back to the old way of doing things (email, fax, post-it, etc.) would be catastrophic to the process because it ruins the ability to track opportunities and perform reporting, not to mention nobody really remembers how to do it the old way anymore. They wouldn't lose an order for 300 laptops as a result, but it would take an extra week or two to deliver it, that's for sure.
I had a geocities account that I hadn't been using for a long time. When Yahoo took over geocities, they made setup a yahoo account but let me keep the old address and POP3. I don't really need it but it's nice to have an offsite POP3 just in case I want it
The true shame is that, We, the readers of /. have knowledge and see the errors in the M$ systems, We know how to deal with errors and solve the problems as they happen.
Sadly the general public will thank M$ for making the patch to there software, The M$ media machine will turn and grind the "good" things that M$ has done. Again fooling the public.
How often does the few know the truth and the masses know nothing.
tiss is the shame we might have to carry.
ONEPOINT
if you see me, smile and say hello.
I am running Tiny Web Server Right now and am having NO problems (and it is a grand total of 180k in size)
Thanks to file sharing, I purchase more CDs
Thanks to the RIAA, I buy them used...
I have seen one of Msoft's server buildouts at an Exodus building. It is for the most part what you would expect. Many rows of 19" racks fully populated (or getting that way) of 2u and sometimes 4u rack mount boxes. It is all well placed and well cabled... as it should be with the huge number of contractors they hire. The only thing I get a chuckle out of is watching the rolling carts in there moving around with monitors, keyboard and mice on them. So much for serial console management!
--- I do not moderate.
Ok, I know it's a lot of servers, but the company that runs Hotmail, also wrote the OS that is insecure. This company release a warning, what, like 6 months ago, and also released a patch at the same time. They have been claiming that this is a major security hole since then and strongly encourages everybody to install the patch, yet they themselves don't.
Somehow, when I picture a server farm, I see this clean, organized room with nice neat racks. With everything that happens with MS's servers, all I can envision is a building reminiscent of a level from Diablo. Something dark & gloomy with servers just sitting on workbenches with their hard drives just hanging out of the side of the case and the motherboard coated in 1/2" of dust.
How can you forget a bunch of servers. I work for a small ISP so we're not the most organized place, but hell, all we have is two racks for modems & routers, and a dozen boxes sitting on the floor for servers. But we at least have pieces of paper tacked to the wall with a list of IP addresses, server names, functions and OS. We install the patches on all of our machines just fine.
All you need is a list of all the servers. Then take that list around with you and after you install the patch, put a little "X" next to the server on the list. Not really complex guys. Of course this is Microsoft, they're probably running little handhelds with WinCE, connecting wirelessly to a MSSQL server that seems to simply misplace records for the hell of it.
Whatever they pay their PR department, it's not nearly enough..
I expect an MS Product manager to walk into their office this morning, only to find them to have all hung themselves..
.. unless they anticipate said MS Product manager to be walking in with yet -another- set of healthy bonus cheques.
Oh, and that new crucifix in Redmond, that has nothing to do with religion, that's the Hotmail admin responsible for this mess.
Microsoft is. If microsoft would stop making suck fucking crap, viruses would be elimitated. The problem is most people who use microsoft have no real business touching computers. If you disagree with me that you too have no real business touching computers.
Code Red: Exploits a secruity bug in Micro$oft IIS, winds up taking down Micro$oft Hotmail servers. Damn. These guys are good at making money, and making themselves look stupid.
All your Hotmail are belong to us.
Windows is not the answer.
Windows is the question.
The answer is "NO."
Clueless hotmail admin to security guy:
- What's this code red anyway?
Security guy:
- A worm that infects iis servers with OR without index server and then spreads to other iis servers. Why haven't you patched the servers?
- Well, I read the bulletin but it said index server, and since we aren't running it I thought I wouldn't have to install the patch?
Security guy looks the other way.
- Uh, right... Well, even if you don't run index server we have prepared a mapping to idq.dll, just in case you would've. So, you know, just apply the patch.
- Ok, I'll get right on it. How long's this worm been around anyway?
- What?! You missed all the coverage in the news??
- Yeah, I been real busy lately replying to all these messages from people writing to me for advice. Funny they all chose the same subjectline, how's that for a coincidence?
<Security guy vanishes in a cloud of buffer underruns and vbscript>
Unless your firewall is explicitly denying all http traffic, there's nothing a firewall can do to stop Code Red. With Code Red riding on port 80, any unpatched IIS server on the inside and allowed through the wall is vulnerable. A firewall has no way to determine "legit" port 80 traffic from "harmful" port 80 traffic. I work for a large telecommunications company security dept. and we've had gobs of customers get hit by this simply because of IIS's flaws. Some of our firewalls were brought to a halt themselves because of the amount of scans going through and the amount of logging being done. If this doesn't teach people not to run IIS as a webserver I don't know what will.
Even better, I decided to bite the bullet at Yahoo because they offer smtp & pop access with an 'opt-in' email every week as the catch. I clicked on really obscure interests (i.e. not computing!) and I haven't received an ad in the 4 months I've been with them. Nor have they ever lost several weeks worth of incoming mail with no explanation (unlike mail.com).
Oh, joy - wait till .NET arrives and we are totally
owned by Microsoft.
first off, cmdrtaco, please keep moaning about getting too much mail all the time from these viruses. it really adds to the discussion to hear every 5 posts or so, 'wah, i am getting megs of virus mail.' okay, we get it. but... what is really weird is the reaction of 'real businesses' to these viruses. IBM for one (and this is why i'm posting anonymously...) SHUT DOWN their entire internal access to all port 80 traffic to stop the spread of code red -- this is a big deal, as this is affecting entire companies' modes of operation and costing millions in lost productivity (no access to even internal web docs, let alone external web resources, etc).
Heh Thx, I needed this :)
Burn the land and boil the sea, you can't take the sky from me
Ghar, the local ISP here had Xamime installed.. not a single client copped anything from Sircam... oh wait, this is about RedCode? :)
Apparently, that "patch" only works some of the time. As others have pointed out, if you have URL Forwarding active, Code Red just blasts right through that "fix."
Taco, The logical response to your repeated complaints about Sircam is for a few of the trolls to start sending you unlimited numbers of the virus. Stop whining.
-- Slashdot sucks.
It seems to me that microsoft.com is also badly effected by something [Code Red?]. It's been returning, Servery Busy, and Access Control Violations all morning. When you do get a page returned it's slow, very slow.
I have found two solutions:
www.mail.com
www.graffiti.net
Both provide free email excellent (and web hosting) service, and are smart enough to not run Microsoft products.
Neither of these comes close to:
fastmail.fm
which gives you IMAP access to your email, so you can manage all of your email folders from Outlook Express, mozilla-mail, KMail, etc and then see those same folders and messages on the web.
And it has no graphics, and appends no tag-line to outgoing emails, and lets you set your reply-to address to whatever you like...
Has anybody disassembled the CRII code to see if it is at all possible for a server(that the worm is trying to infect) to send a response back to the worm that would cause the worm to crash? A simple script named default.ida and some knowledge of CRII is all thats needed. It would be a unique way of ending this thing...but I have a feeling that the person(s) who coded this worm may write tigher code than MS.
Guru Meditation #6d416769.21610a21
Basically because most links go through a few highly connected nodes, simultaneous ddos attacks on those nodes COULD 'take down the net'.
This also explains why SirCam and even Lovebug won't die:
Everything that touches their hotmail becomes their property right? So does that mean the worm is their's now? =)
"We must all be alike. Not everyone born free and equal, as the Constitution says, but everyone made equal."
Why does the title of the article say that Microsoft may have been victim of Code Red worm when it later says that The software giant on Wednesday confirmed that some of its MSN Hotmail servers were infected with a Code Red virus. Aren't you a victim if your computers get infected? Or do you have to wait until all your disk drives are formatted?
- Right click on My Computer
- Select Manage.
- Double click Services and Applications
- Double click on Internet Information Services
- single click on Default Web Site
- Click Delete
- Repeat for other web sites
- Open up Internet Explorer
- Go to http://www.apache.org
- Download the Win32 binaries
- Unzip and install them
- Click on Start/Programs/Apache/Configure/Edit http.conf
- Edit that file to add whatever sites and functionality you need
- Restart Apache
You are now immune. Microsoft releases a few patches here and there, but you are running A Patchy web server....Actually, this is what I did when the first one hit. It saved my box because I am running an old betal of Whistler on one machine for testing purposes and did not want to be without protection from the virus. The information I was able to get on whether I was vulnerable was inconsistant.
LedgerSMB: Open source Accounting/ERP
It's bad enough that they need Free Software to keep Hotmail afloat as it is. I can't se Microsoft using a Free Software solution on their boxes too...
Part of the problem, may be that NT doesn't respond well to remote admin.. I can see some intern going from box to box, plugging and unplugging keyboards and mice, and doing the upgrades.
"Oops! I must have missed 3 of the 85 boxes that I was supposed to patch!"
Sometimes boldness is in fashion. Sometimes only the brave will be bold.
Pop
Mom
Heck
Mission
Issues
Self-help
Obesity
Faggoty
WinNT/IIS-4.0 with URL Redirection Still Vulnerable After Patch http://www.incidents.org/diary/diary.php#801
...from dot-net to not -net.
LOAD "SIG",8,1
LOADING...
READY.
RUN
In the past, the server cracks tended to hurt the people who owned the servers, leaking information and so forth. These people couldn't sue MS for shoddy work, because that license agreement took away those rights.
But now we've got Code Red. People who never signed any sort of license agreement with MS are now paying the price for their lousy quality control. Can these people sue? If Code Red causes your ISP's network traffic load to go up, if it overloads your company's router, whatever, can MS be sued?
I'm waiting for the lawyers to start circling on this one...
-jon
Remember Amalek.
Right now (12:15 PDT Aug 9) I can't ping
hotmail.com (64.4.53.7) or www.hotmail.com
(64.4.44.7), from my work or home machines
in the SF area. Anyone else observing this?
m00.
Click here or here.
Actually, the MS provided patch doesn't work against Code Red if you have URL forwarding on your server. I bet they have it enabled, and so they were left open...
Unfortunately, the customers are not all that bright. I could make a long list of M$ shortcomings that are tolerated or ignored by real IT professionals (who should know better). [List omitted to conserve bandwidth]
If they use media hype and FUD to successfully release yet another mediocre/unsecure product, how is this any different from their traditional tactics?
It's hard to make a good product and sell it to a few smart people. Why bother doing that when you can make a mediocre product and sell it to millions of dummies?
If they could get past this Sircam thing, maybe they could finish up and release Microsoft Cupholder. Then again, I wonder how they intend to stop Outlook VB script viruses from closing the CD-ROM and spilling my coffee!
Apache is open source. There is NO reason they could not modify the headers it returns in such a way that it just tells the world it's IIS/Win2k. Better evidence than Netcraft and Netcraft-style lookups is needed.
My server
I'm almost crying with laughter, who would have thought that the almighty Hotmail would've been brought down by Code Red. And I thought Microsoft make the best software, not. It looks like they still haven't a clue about security, I wonder what will happen if .net ever takes off.
good idea.
so... why did you tell everybody about it? it only works if a few people do it that way. if everybody does, everybody will get email.
are you so fucking pleased with yourself that you can't keep a secret, you have to just share?
like I said, though, good idea.
I doubt that the Hotmail admins are so incompetent that they forgot to patch their own servers. What are the odds that the patch itself is defective? Their P.R. guys could just be putting a different spin on the story by blaming the admins.
"What is the sound of one belly slapping?"
The closest we get in this scenario to individual accountability is the one who signed off, and he (or she) is probably the person with the least direct involvement with the project. That's usually how it goes in megacorps.
"Hardly used" will not fetch you a better price for your brain.
SirCam just won't go away. Here are my daily counts, starting from 7/23:
3 1 6 2 0 1 3 0 2 3 0 1 1 2 2 1 5
I had thought the worst was over after the 25th, but the last 24 hours have been busy again. This must be absolutely ravaging the Windows world.
Also, I still haven't gotten a single one from anyone I know. Ten are explainable because they came over the Freeciv mailing list (showing that even Windows users like open-source software). It's incomprehensible why any of the others would have me in their address book.
Also, I had one stranger mail out a FixSir.com, asking everyone to run it. (Our standard joke about how to spread e-mail viruses under UNIX may not be as unrealistic as we like to think it is.) This one might have been innocent, put it probably points to a future trend: release a virus, wait until it hits the news, then release a second piggyback virus with a message promising to protect against the first one.
Sheesh, evil *and* a jerk. -- Jade
My cable company gave me a name and a static IP. I've used it as a gateway to a subnet and a mail server because it's visible inside and out. It worked fine and my mail all sent and recieved OK. Glad I did'nt chuck the 486 out.
Now I'm told that it's not such a good idea to run services on a gateway if you want to firewall your local net. What you are supposed to do is forward port 25 to a machine inside the local subnet. I've done this but it looks like I need to make the internal server pretend to be the gateway. Other mail servers have not liked seeing a 192.168.1.X IP and a non extant name, mail_box.
Do it today!
Friends don't help friends install M$ junk.
Their spokesperson is admitting they were infected. This is just the sort of thing MS usually lies about.
I can vaguely remember that Hotmail doesn't use
standard Win2000, but a customised tool (with HTTP
daemon in the kernel).
Maybe the retail patch wasn't directly applicable
Nobody's going to sue Microsoft over this, because the majority of the infected W2K systems are not using legally purchased software.
They're home systems running a duplicate copy of somebody's work installation.
I'll bet you a quarter.
Known about this since Sunday. When I went thro my error_log file on my apache box and found this.
Tue Aug 7 05:37:56 2001] [error] [client 64.4.13.230] File does not exist:
/usr/local/apache/htdocs/default.ida
[Tue Aug 7 05:38:45 2001] [error] [client 64.4.13.230] File does not exist:
/usr/local/apache/htdocs/default.ida
[Tue Aug 7 05:38:54 2001] [error] [client 64.4.13.230] File does not exist:
/usr/local/apache/htdocs/default.ida
[Tue Aug 7 05:40:21 2001] [error] [client 64.4.13.230] File does not exist:
/usr/local/apache/htdocs/default.ida
[Tue Aug 7 05:42:01 2001] [error] [client 64.4.13.230] File does not exist:
/usr/local/apache/htdocs/default.ida
[Tue Aug 7 05:42:15 2001] [error] [client 64.4.13.230] File does not exist:
/usr/local/apache/htdocs/default.ida
[Tue Aug 7 05:42:20 2001] [error] [client 64.4.13.230] File does not exist:
/usr/local/apache/htdocs/default.ida
[Tue Aug 7 05:48:55 2001] [error] [client 64.4.13.230] File does not exist:
/usr/local/apache/htdocs/default.ida
[Tue Aug 7 05:49:13 2001] [error] [client 64.4.13.230] File does not exist:
/usr/local/apache/htdocs/default.ida
64.4.13.230 is msgr-cs20.msgr.hotmail.com
You'd figure they'd patch themselves.
I bet they try to blame their problem on Linux somehow
colour
favourite
mum
mate
Piss off, you stupid Yank.
You think you have "rights", but when was the last time you tried to exercise one of them that might conflict with the interests of one of your powers-that-be?
Isn't it funny that they used to be running BSD over there?
There are thousands of programmers who could write this virus. All it takes is one. You can discourage 9999 out of 10,000, but you can't expect 100% cooperation from the entire world. Protecting servers is more realistic than eliminating every potential outlaw.
(Reality reasserts itself sooner or later.)
I had nothing to do with it! It was Microsoft(TM)'s servers that are having problems. It seems like everyone points the finger at CodeRed, when all I'm guilty of is lurking on Slashdot and posting useless messages over and over.
Please refrain from blaming me for every little thing. Yes, I'm the reason the net is slowing, yes my cousins [2,3] are good at what they do, but isn't it time we point the finger at security issues of other OS's instead of the usual suspects??
And I am no relation to SirCam, I just respect his work!
Thank you,
CodeRed [The low user #]
--
CodeRed, the lower user #. No relation to SirCam.
(Note: calls work fine; it's just directory information that you cannot get.)
[reposted from here]
default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNN..... N N
i was wondering what all those requests for this file were for on my Apache webserver. i dont have a file named default.ida, hundreds of people a day try to get to that page on my home computer. good thing i dont have it. it seems if i did, i'd be screwed like Microsoft's webserver is.
You know, if we all stopped laughing for a while and thought about this, we might do the open source community a bit of good. IIS servers have the virus, and they are probing servers all over the place, including BSD and Linux machines. Why not send out "vaccine" from the *nix boxes, and then tell every news-feed out there about how the OS community is helping to cure Microsoft's servers virus problems for free?
There's no way MS can attack this statement, since it would be true, and it'll go someway toward making their claims Linux is a "virus" seem even more absurd...
Code, Hardware, stuff like that.
Hi, Just an update. Some yahoo managed to get CodeRed inside our firewall where it's running rampant. At one point, the gigabit connection to the Internet was at 90% utilization. We are in the process of finding and patching all servers now. We have several hundred affected machines. Most of the resources from at least three IT organizations are working on this now.
Dirty Pirate Hooker
Over my way, daily average is about 225 attacks, no sign of letting up, and when a browser is pointed towards them, most of them are simply show the default IIS screen. These boxes are probably not going to be patched because the owners of the machines are unaware their machines are owned. So, yeah, Oct 1 is probably when this crap is going to end.
If god had intended you to be naked, you would have been born that way.
oh yeah, that's an oxymoron all right.
Hotmail ran on FreeBSD until fairly recently. If only they hadn't switched to Win2k & IIS, none of this would have happened...
My favorite part about code red is that the fault lies with a single person. This one person wrote code for a small, single aspect of IIS, and all of this is his fault. I wonder what he's doing today? Is he the type of person that's wracked with guilt over shutting down large portions of the internet, or is he the type of person that will realize that he single handedly impacted the entire virtual world, and be proud of it? I wonder what code red's author is doing today, too... rolling on the floor laughing his ass off, I imagine. We should try to get those two people together and see what they can come up with over a few beers.
-- Minds are like parachutes... they work best when open.
Just a thought. I'm running Apache 1.3.x, and was tired of logging all those 404's. I have custom server messages with a few images on them.
I decided to create a 0-byte /default.ida just to cut down on the sheer number of bytes being passed around. Is this advisable? Should I be correct and return a 403 or 404 instead of an empty 200?
I'm getting a Code Red hit about twice a minute.
I don't pay for bytes served _yet_, and don't plan to
Any comments?
jdv
Everyone should offer this wonderful and handy
/dev/zero /default.ida
cleanup service through the web, courtesy of
Linux and Code Red. Simply create the following
symbolic link:
ln -s
Cheers,
RAK
http://minduploading.org
When you select for the setting 'When connection to this resource, the content should come from' option 3: A redirection to a URL, (On the 'Home Directory' Tab in the website's properties in IIS4) you are still vulnerable. You are thus not vulnerable when you do response.redirect() kinda stuff in ASP.
Never underestimate the relief of true separation of Religion and State.
CT, you getting out enough? It seems like every posting you put up has something worthless and asinine about your day. So I ask, are you getting enough human interaction?
:-P
We're just concerned for your well being!
SpamapS -- Undernet #Linuxhelp
Tivoli (Austin -and- RTP) has 0 access to any port 80 site around the internet or intranet, and the official response is that they have closed port 80 because of the code red worm. so which IBM do YOU work for?
....that Microsoft only has around 20% of the server market yet suffers the most vulnerabilities. Not just attacks but vulnerabilities.
Mac OS X and Windows XP working side by side to fight back the night.
Hotmail's interface, the web server access was moved to Windows.
The back end databases remain on Sun Solaris however.
I probably have notes on this somewhere, but can remmeber that a whole lot (hundreds I'd guess) of Windows web servers are feeding just a handful of Sun machines handling the actual mail databases. There is also another layer of servers between the two that figure out which Sun server has a particular person's email.
hopefully someone will mod him down as offtopic... ;)
This is one I found in my Apache's Logs. 65.54.225.31 - - [08/Aug/2001:17:39:01 -0400] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 303 "-" "-"
It's just too bad they put all that UK grammar in it, such as "bollocks" "pounds sterling" and "smoking fags"
Jeez so long I posted that I can barely remember my login and on such a overdone topic but I have never seen the exact question asked how would a properly set up nix system stay up with Joe Doze adding and removing hard and software daily. Christ my cousins win box is a nightmare with every fopnt, icon wallpaper theme Game dumb fractal applet worthless application hacked and other crap its all on a PIII with plenty O disk and RAM Anyhow I dunno how linux gets when you install and uninstall endless packages I think we may see a lot more linux reboots of course Windows is quite often like that from a fresh installation.
I dunno I guess I am just curious to what degree bad administration affects linux stability
Unless this IP has been spoofed, I just got this log entry from the vigilante java applet I started running today. If you look at the site under this IP, http://216.72.47.132/ , it is the Microsoft site for the Windows NT 4.0 Option Pack! Here's the log entry: [09/08/01 10:03:42 EDT] BaitThread: Processing req uest. [09/08/01 10:03:42 EDT] BaitThread: Request string : "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u78 01%u9090%u6858%ucbd3%u7801%u90
90%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078 %u0000%u00=a HTTP/1.0".
[09/08/01 10:03:43 EDT] Decaffeinator: Updated decaffeination script successfull
y.
[09/08/01 10:03:43 EDT] Decaffeinator: Updated decaffeination script successfull
y.
[09/08/01 10:03:43 EDT] Decaffeinator: Decaffeinating http://216.72.47.132/...
[09/08/01 10:04:42 EDT] Decaffeinator: Decaffeinated http://216.72.47.132/ succe
ssfully.
[09/08/01 10:04:42 EDT] Decaffeinator: 1 servers decaffeinated.