Slashdot Mirror
Code Red Refunds?
bubblegoose writes "In Washington state Qwest customers are asking for a refund due to losses of service during the Code Red thing. Qwest is refusing to give the refunds.
Excite has a story about it here." I tend to think this is just complaining bull crap. My net connection when down too, and I don't run around demanding $5 back. I'd be more upset if I was a business and my server rooted by this. The irony is that this will probably end up just pushing subscription software.
we all know it was the copper's fault.
~
There are too many companies getting away with complete incompetance and expecting us to just shut up and put up. What's wrong with making them pay for their own stupidity? They waste your time and get surprised/upset when you express annoyance. I don't know about you, but my time is more valuable than that.
Qwest is probably standing behind some small line in the fine print of their user agreement that says "Qwest will not be held responsible for interruptions in service," meaning they will not provide refunds in the event their service is temporarily offline or has other problems.
Personally, my cable modem is sometime offline, but it's usually during the day while I'm at work hence I dont notice.
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
I use Qwest for both my DSL and ISP. I thought they were very helpful during this whole Code Red thing. Qwest called and left a message on my answering machine detailing how I could fix my DSL modem and patch my computer so that I would not be infected. They also called back to see if I had received their message and if I needed any help. I've been very happy with Qwest and was surprised by their customer support.
Anyway, point is.. I think they do a great job. Keep up the good work Qwest.
-Frijoles-
I cheerfully pay my ISP every month, because they provide me with a reliable, stable, fast DSL line. If it wasn't that way, I'd be in line clamoring for a refund too.
The computer industry is way too lax on quality of service - every program, OS, or hardware device has a disclaimer that they aren't responsible if it doesn't work. What am I paying for then?!?
Comment removed based on user account deletion
The problem is Qwest business subscribers were garenteed 99.9% uptime. If slashdot or some other business was run off an ISP and they went down taking your site/business with them you would want a refund to. Unless you like vendors not following their contracts to your detriment.
While demanding a refund may seem a little off, I'd have to admit that if I was a subscriber to a program such as this one, offered by my provider, and got "protected" by having my port 80 shut off, I'd be asking for a refund too.
You can actually do this!!! Ohhhh Charter is going down!
I tend to think this is just complaining bull crap. My net connection when down too, and I don't run around demanding $5 back.
Maybe you should. TimeWarner Austin (part of the evil AOL Empire) will give credits for service problems with RoadRunner. All I have to do is call up whenever there is a problem (outages, etc.) and they credit me for the inconvenience.
Mister Black
You are standing in an open field west of a white house, with a boarded front door. There is a small mailbox here.
Did the customers own the equipment that failed, or did they get it as part of the package? Every DSL service I've seen you get the hardware with the package. If this is the case, then if Qwest's hardware won't let you access the service you are paying the for, why shouldn't you expect a refund?? Now, if on the other hand, you buy your own DSL modem and you pick a lousy one that is prone to failue, then it is by no means your ISPs fault if it goes down.
I look at it like my cell phone service: if the phone that I own breaks, it is my responsibility to get it fixed. If my providers towers all go down and I can't get service for a month, I wouldn't expect to have to pay!
-- "Big Brother is Watching..."
the side effects some cisco routers became vulnerable to were (IIRC) the large packets being sent by code red to possible IIS servers, plus some routers simply couldn't handle the amount of extra traffic code red creates, especially as more machines behind a router become infected. Much like the slashdot effect - sometimes it isn't the server that is to blame, it's the connection the server has to the internet from routers, firewalls, etc.
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
While were talking about refunds, lets all get refunds from Microsoft because there crappy software has bugs and was affected by something as simple as the code red bug.
Oh, I'm sorry, when we all sold our souls to microsoft when we signed the user agreement I bet that was covered.
Of course, the responsible thing to do would be any or all of the following
Buy Hex-Rated Stuff, fight the DMCA!
What Qwest clearly fails to comprehend is that, by choosing the tools they did, which have a known history of virus vulnerability, they are responsible for the reprocussions.
It's a well-settled legal principle that persons are held responsible for the actions of their agents when those agents act in the furtherance of their employers' wishes and in a manner not contradictory to responsible behavior.
Microsoft and Cisco perhaps should be held independently responsible for their failings here, but it certainly does not follow that Qwest ought be absolved of all duty to its customers.
The rationale behind such a legal relationship is readily apparent. The customers have their dealings with Qwest.
The customers often are not provided the opportunity to inquire into the methods Qwest is using to provide customers with services.
And even when they are, there is no reasonable expectation that these subcontractors will listen to these end customers. (After all, their customers aren't Qwest's customers. Their customer is Qwest alone.)
But Qwest has no real reason to complain to Microsoft and Cisco, since Qwest can simply pass the costs on to their consumers as they're trying to do here.
In the end, consumers are shafted, and everyone else profits.
Only by extending legal reliability up the foodchain to people making the final decision can we attempt to ensure that moronic decisions like these accurately produce the reprocussions for decision-makers that consumers feel.
Or if Qwest doesn't wish to offend their customers, they should just blame Microsoft. I understand that this is standard practice... just yesterday, some Delphi fucktard (you know the type... "just drag and drop the components! yes, that all it takes to be a real programmer!" ha ha ha) was telling me that the ability to blame Microsoft -- even for things that aren't really Redmond's fault -- is an advantage of running NT! It's really getting difficult for me to defend Windows as a rightful player in the heterogenous world of computing when its users display such poor judgement and reasoning.
--
I like to watch.
Is there some irony there? like when MSNBC.com reports on the latest M$ security hole/virus/etc ???
E.
Build Your Own PVR/HTPC news, reviews, &
It depends on what they were guaranteed, doesn't it? If the contract they signed stipulated an always-available Internet connection, and it wasn't always available (due to whatever circumstances), shouldn't a refund be in order?
When a telephone pole near my house was struck by lightning last year, I lost cable (and cable modem Internet access) for a couple of weeks. The cable company not only happily refunded me half a month's worth of charges, but I didn't even have to ask.
- A.P.
"Remember when the U.S. had a drug problem, and then we declared a War On Drugs, and now you can't buy drugs anymore?"
It wasn't packet size, it was that CBOS (Cisco Broadband OS) versions earlier than 2.4 suffer the same vulnerability to specifically malformed URI's as IIS.
maybe if they *didn't run IIS*....
Karma only matters to me now and zen.
Excite has a story about it here
I hope Excite@HOME customers don't demand refunds.
"the fax machine is nothing but a waffle iron with a phone attached to it." - Grandpa Simpson
I've never taken the time to write an angry post about the editorial content... but sheesh.
First, if you lost cablemodem service for almost a WEEK, WHILE BEING LIED TO about the cause, wouldn't you be a little mad? This was the case here in Fairfax. They tried to say it was "sheduled router upgrades", only to backpedal a couple days later after everyone figured it out (and they had to implore their users to patch, and their email system was down, etc etc).
Second, I guess I'm wacky, but if I pay for something, I want what I paid for, as other people have said here. I pay $45 a month for cable service. I don't call and complain if it goes out during a storm for a couple hours. But if its down for DAYS, their tech support line is TURNED OFF, and no one will tell me when it's coming back up, I expect to not have to pay for this service! I am not being given anything but a blinking data light. Some of us do not maintain multiple backup dial-up accounts; yes, I'll freely admin I'm spoiled by broadband, but at the same time, I can't justify spending $25 a month in case I lose my connection for a week.All the DSL providers in my area are dead or dying; roadrunner is my only option besides modeming (which is a bad scene in and of itself, die to "multiplexed lines" or some such nonsense which means I get 28.8 tops).
Third, if no one says anything and just rolls over, then the company will not be challenged to provide a high level of service, since they will know customers will just take it.
Sorry, Taco, but you're a helmet.
ZOMG I WOULD LOVE TO KNOW ABOUT YOUR FEELINGS ON MACINTOSH VERSUS WINDOWS, VI VERSUS EMACS, AND HOW YOU'RE NOT A DORK
Lets see, a few hundred refunds of $5 a peice which the service contract does not require, OR the knowledge that you will only loose a handfull of customres because broadband is a monoply.
Oh an option number 3: Be a pissed off customer and complain you want your $5 in this time of economic uncertanty for broadband companies and if enough other people do it the company is unable to pay its bills and you are left with no service at all.
Lets just say that when my nntp connection goes down with @home for a few hours each month I do not call demanding a refund.
Ascii artist &
I will grant that they were probably pretty busy during all this so I could understand the 2 and 3 hour wait times. I wasn't really expecting techs to be able to help me anyway. ("poorly trained" was a really NICE way of putting it.)
I just don't think that Qwest was proactive enough in coming to a solution. They tossed out "patches" and "quick-fixes" without really testing them. I just think that the whole issue could have been resolved much faster than it was. They *should* be handing out refunds, but they never will. I for one am looking into new ISP alternatives. This is not the first time my company has gotten screwed by Qwest.
ok, thanks for the info. The thing I heard was simply a rumor from a co-worker who thought that because the packet containing the http GET request was considerably large, it potentially caused problems on some routers (Maybe he thought the malformed URI meant the packet was bloated or something) It sounded a little fishy to me because the concept of spliting packets up during their trip has been commonplace among routing systems long before the internet tookoff in the early 90s.
The One Rule Of Chess You'll Ever Need: Don't play someone who carries a kit in their bookbag.
You sue your ISP,
then your dumb Microsoft product using ISP sues microsoft,
Microsft disappears into the blackhole created by the massive gravitational effect caused by so many money-hungry lawyers rushing to Redmond to jockey for position at the trough.
Lets see, microsft disappears and we lose the lawyers, perhaps human civilization might have a change to survive afterall
The current Slashdot moderation system is made by gay communists!
Yes. At least with AT&T@home the Tech Support people are authorized to give refunds for outages. At least that was the way it was when I worked there.
Enigma
The configuration webserver on the Cisco 675 had serious DOS problems in the setups that various dsl providers were providing (i think it had to be in bridging mode or something), which were known even prior to the CodeRed problem. Essentially, if you did a getrequest with too much crap in it, it crashed.
It hit bugtraq a few months ago, while cisco was fairly responsive and issued a patch, Qwest at that time declared that patch unsupported.
Seems to me that if an ISP is going to be held responsible for this type of problem, then shouldn't Microsoft be responsible as well? After all, ISPs are customers of the company with the flawed software.
;-)
I have to wonder what the implications for responsibility would be if they were using open source code instead.
Reminds me of the whole Ford/Firestone fiasco.
Anybody who's ever blown a tire would know that you shouldn't get into an accident unless you do something stupid. (Car&Driver verified this with an elaborate road test). Ford and Firestone have to blame each other to avoid directly calling their customers idiots. (just for the record, I drive a Ford, so flame away
Anyway, to get back on topic, this is a classic case of blaming the "fall guy" because it's too tough to go after the real problem.
Flame Away!
I wonder what all these customers reactions would be if their ISP tried to bill them extra every time they clicked on a SirCam attachment and sent 5 gig worth of pr0n, resumes, and book reports through the mail servers? Shit happens people; unless you got an uptime agreement with your ISP, live with it.
If my line went down because the people that run my ISP are inept, I would DEMAND a refund of the time that it was down. If I had an option, I'd switch ISPs.
Honest accidents, or causes like weather, are understandable. Large tech companies that have extensive tech staff running Microsoft products is unexcusable.
So what happens if you are without service for a day, a week, a month? Does that count as temporary? This is a very gray area they could have a chance of getting the law on their side.
Im not here now... Im out KILLING pepperoni
...by the Code Red virus. A few entries in Apache's access_log but I didn't go down (nor did my PacBell DSL line). But I think I'll sue all of Qwest's customers (or maybe just the ones suing Qwest) for attempting to attack my system. That's cyber-terrorism, no? They should've been patched and my guess is a bunch of those morons were propogating the worm further. Who knows, maybe Qwest targetted some of their customers specifically who they thought (legitimately or not) were further propogating the worm.
Dammit. That didn't do what I hope it'd do. Sorry for the noise.
-- ;-)
Kuro5hin.org: where the good times never end.
as we are (slowly) learning, when you deal with a monopoly such as {telco/cable co/power co/water co/etc} you pays your money and you takes your chances. They promise minimal service and maximum hassle in exchange for as much of your money as they can squeeze out of you. I'm far less concerned about the business practices of Microsoft, where there are options ad nauseum, than I am about true officially sanctioned monopolies such as those listed above, which are basic necessities (well, cable isn't since cable isn't a necessity).
this is getting old and so are you
blog
DSL is not a commercial-grade service.
DSL is not a commercial-grade service.
DSL is not a commercial-grade service.
If you have a business that needs 24x7 connectivity with a rapid response in the event of a failure, get a T1 line, or at least an ISDN line. If you're relying on a DSL (or cable) connection as a lifeline for your business, you're relying on the wrong technology.
The guy said he lost $5000 in business due to the outage. If his internet connection is worth that much in business over just a few days, he should have invested more than $50 a month in it.
Reason being, the average home user probably isn't going to care about (or even understand) whatever caused the problem at the ISP. All the average consumer knows is that they paid X amount of dollars for an always-on connection that suddenly wasn't on. Should my DSL provider suddenly go down and claim it was Code Red, I'd be upset, but being someone who has at least a little understanding of the nature of networking, I'd be a little understanding (especially if the connection was back up quickly).
I'd imagine that as these types of weaknesses become more exploited, ISPs/DSL providers will have no choice but to try and do business with systems that are increasingly less vulnerable to attacks, because the defense of "it wasn't our fault, our routers/servers were exploited" probably won't hold up to their customers.
My sigs always suck.
How long was the average user down? It might justify asking for a refund if the ammount was large enough.
I am all too familiar with the tricky 'agreements' they make you sign before getting broadband service. They are typefied by fairly sketchy and vague descriptions of how good the service will be.
However, they do make certain guarantees of the service, and let's face it - their job is to keep the system working, whether it be Code Red virus, or scheduled repairs. Home users who lost a lot of time due to this should be compensated for the loss.
On the other hand, people using DSL for business purposes should know better. I've had clients complaining "why has my cable been down for a week... I'm using this for a business!!!".
Cheapskates like this deserve downtime. DSL and cable are not mature enough products (esp. DSL) to warrant business use. It is cheap, and that attracts a lot of people, but it just doesn't have the stability businesses need.
Learn a lesson or two... if you're entrusting your ENTIRE business to online presence or connectivity, spend a bit of money and get at least an ISDN connection. You have to spend money to make money. Frankly I don't know why people rely on the internet so much anyway. It is a *convenience*, not a staple.
Blaming Qwest for loss of service because of Code Red is roughly the same as blaming the state of california becuase your house fell into the San Andreas fault.
Okay, So let's say you poor folks got slammed by ISP's in the states (hahaha.. my Canadian DSL provider just laughed through it!) with a few hours of downtime..
1) Check your contract carefully.
2) Check your Contract carefully.
3) Whine some more. Then, Check your contract carefully.
4) Consider: Is this "internet thing" end-to-end deliverable, in terms of ANY kind of guarantee? Put this in comparison with a contract that might state: Yah, your local loop is guaranteed to be up, 99% of the month..
Stop your whining. Fess up. Pay your cash for what you get. 56k!? I did grow up using a C64 and 300bps modumb. Coddled. That's what you are, in an UNREGULATED communications medium.
REGULATE it, and it'll be reliable. leave it UNREGULATED, and we're stuck with occasional delays.
Cheers,
Canuck boy.
As long as it remains unthinkable, it will be.
Show me an effect without cause and then I'll believe in chaos.
Conclusion: Qwest was negligent in needlessly exposing its users to HTTP server flaws, and deserves to pay for not following accepted security procedures -- i.e., turn off all unused network services.
It takes all types, and obviously comuters and the internet are now rife with the types of the clueless. (Ok, I know, that ain't a news flash by any means) First off the TOS with any isp states that they are responsible for nothing, and if something happens that is not of their doing that interrupts your service then tough cookies. This is like asking the Cable company to refund your money because while your power was out you couldn't watch tv! or demanding a refund from the phone company because you couldnt use your phone while your house was burning down.
Unfortunatly, the courts will either help these "poor" users. or it will be swept under the table.
I just wish for once we'd get a judge that would publically announce that the plaintiffs in a friviouls lawsuit were morons and idiots... but then that'll bring more friviolus lawsuits... and so starts the spiral downward...
If this case is won by the users.... when can we sue microsoft for all the lost productivity their operating system causes weekly?
Do not look at laser with remaining good eye.
... their target be Microsoft or the creater of the virus? This is just as frivilous as suing mp3.com for allowing users to copy artist's work.
--------
It's OK to be social, just don't tell anyone about it.
I have to accept paying for the pre-installed OS that I wiped clean, waste my time loading Linux the way I want, and then throw the still-shrink-wrapped software in the trash. I don't peel the stupid Microsoft Windows license sticker glued to my new machine and mail it back to either the manufacturer OR Microsoft. I deal with it.
This virus outage complaint is the EXACT same thing. I don't ask for a refund because my modem light is glowing, even though I have no systems on, nor when my Apache logs are filled to the brim, nor when it takes five to ten minutes to check my mail due to the latency.
It is part of life. Sorry. Get over it.
One thing people need to realize is that when someone pays for a service, DSL or any other type of net connection, they are paying for a service. They are not "purchasing" the lines, they are essentially "renting" the use of the lines. Qwest should not be held responsible, neither should any other ISP for that matter, for users who unfortunately didn't know better to patch their machines. The only way I think ANY ISP should be held accountable is if THEIR machines caused the outage or decrease in service.
I also wanted to address the business of AT&T, as well as many other smaller ISP's, blocking port 80. This again is a measure taken by AT&T, who by contract holds the discretion and right to do with their service as they see fit. If they had in their contract that they MUST provide access to port 80, then people have something to go after them for. I'm not saying that this was "right" or anything. It sucks. But AT&T and others took the proactive approach (as proactive as possible) to stop the spread of this worm, and to save their bandwidth, so they WOULDN'T have a complete outage.
If an ISP doesn't cut the worm off at the source, how is the ISP supposed to defend itself? I think the people who should be approached are the ones who left their machines open for infection, and then saying "I'm not infected" when people start talking about all the infected machines.
I have not experienced loss of service, but it's all the big ass ISPs that I'm getting hit the most by. I've gotten just a hair under 30,000 Code Red/II attempts since July 19th between the two domains I host. Both servers were salvaged PPro 200's with relatively small hard drives. Having 99% capacity in /var is not good, as before CR, it topped out at 20%. Thanks to lazy admins and lazy ISPs that refuse to discipline their offending customers, I'm running out of drive space.
My company being a small company, there's not always $$$ to throw around for upgrades.
Anyway, at last count, AOL customers alone (*.aol.com) had over 4,000 attempts, and AOL's PROXIES for god sake tried a few hundred. I'll grep for qwest tomorrow. But why should *I* suffer for not installing inferior software? I don't get it.
See subject
I agree with Qwest. They shouldn't have to pay.
What happens if a road/bridge is closed because of a flood. A buisness on the other side looses customers for that day because customers are either unable to navigate an alternate route or no other route exists. Does this give the buisness the right to sue the transpotation department because it was unable to clear the flood?
The flood wasnt caused by the road crews, exactly like Code Red was not caused by Qwest. The hypothetical road crews placed signs and closed roads to prevent further damages to roads and drivers, much like Qwest notifying its customers of the damage and telling them how to fix and prevent further problems.
Most insurance companies often do not fully insure against damages caused by 'Acts of god'. They do this because these events are uncontrollable and unpredictable much like a large scale internet virus. How is damage to the internet by an act of god different to damage caused by an act of god in the real world?
Getting any kind of refund from Qwest for a lack of service for any amount of time (even a ridiculously extended period) seems to me to be impossible. I use Qwest for my DSL service, and I was out of service for the months between and including November of last year and April of this one. These five months not only lacked broadband service, but they continued to extract a monthly charge despite my numerous angry exchanges with the technical support and the sales staff. I finally paid the fellows at the local station a less-than-friendly visit and made brutally clear to them how I felt about the whole affair. Needless to say, the matter was sorted out quickly and easily in my presence, and since I have enjoyed virtually constant DSL service from the good folks at Qwest (unfortunately, however, I am getting 30% or less of my allotted downstream bandwidth, a very disappointing circumstance considering my ever-increasing home networking situation). Although, the good folks at Qwest are not so reasonable. That is to say they are about as reasonable as they are competent. In spite of the fact that I had exactly zero service for a period of no less than five months, and had continued to be charged the hefty sum of $30 a month throughout, Qwest refused and continues to refuse a refund of any kind, much less the full deserved amount lost of approx. $150, if I have done that math correctly (and I think it is unquestionable that I have).
All in all, I wouldn't expect any money back or the minor infraction caused by Code Red. It barely affected the modem itself, and it took about two seconds to make the modem completely invulnerable to such an attack again, even before consulting the Qwest support page or people.
Lack of eloquence does not denote lack of intelligence, though they often coincide.
I guess it comes with being a telco and being used to screwing customers over, but Qwest are seasoned pros. It has become customary for them to try to sneak extra charges on my bill anytime I order anything from them (which I avoid when at all possible now). Currently, I am trying to get my ISP switched from Qwest.net to another local service provider. I was quoted Aug. 15 at 5 PM for the switchover. A few days after this, I realized I had not been switched and called to complain; they told me the switchover would be today (Aug. 22) at 5! Right now, it's 9, and I just called support, asking why I wasn't switched, and they had NO such switchover on file at all. Next stop is the Better Business Bureau and the Public Utilities Commission ...
Qwest doesnt owe these customers any sort of refund. The issue was largely out of Qwest's control, and thefore
should be faulted to the wild nature of the internet.
Although, I dont see why Qwest was hit so hard by this, it does seem a bit odd, a weak infrastructure maybe.
There were public announcements on how to fix the DSL modem crashing problem during the whole Codered crisis, you would
have to be blind, deaf, and dumb not to head the encouragements to upgrade the firmware on the Cisco device, or to disable the web interface.
Brent Jones
We were down fo three weeks. The first week due to an administrative oversite on Qwests end. And the next two because of Red Code. Moreover numerous hours of my time were spent dealing with it. Add those costs up and we're into the $500 range. I don't think I should have to pay my $80 for this month either! Moreover from point of view, Qwest did a poor job of dealing with the problem.
:T:R:A:N:S:
1) they have money.
2) If you are runnng, oh say unix, you didn't agree to their licence.
3) Their shoddy product is unsafe on the information superhighway, and create unsafe conditions for the others.
Microsoft has had staffers and employees state the goal is to push out new product, andding features over 'good code' or fixing old bugs. You might just get #3 to stick.
All you have to do is get a jury to buy #3. The lawyers will like 1 and 2.
If it was said on slashdot, it MUST be true!
Although many people were hit with the virus, the problem that I had was that Qwest's network just crapped out. My modem was patched right away and wasn't even being hit yet I was loosing packets left and right. Hell I couldn't even get to routers and servers inside the Qwest network at times. Blaming the virus is one thing, but having such a fragile network is shameful. I hopped on Earthlink at a friend's house and it was plenty fast. Hmm? Perhaps Code Red doesn't target Earthlink customers.
I tell you what, I pay for my DSL Service. I don't use Microsoft products, and there was no reason to shut down port 80 on my web server. I use NAT and my web server is on a LAN behind my DSL gateway. I spent about 4 hours trying to figure out what was going on.
When I figured it out, I called Verizon tech support and they told me they had put a network wide block on port 80. I pointed out to them that obviously their web servers weren't hampered by that block.
Verizon's respond, "I'm sorry, there's nothing we can do."
Unacceptable, and yes, I would like a partial refund for the 4 days my web site was down.
*They* would know who to sue - micro$oft! Now's
the time to prove shrink-wrap disclaimers aren't enforcable.
I think you've allready missed the boat comrad. It's allready happening! What exactely is the RedHat Network and xiniam about?
The sad thing is, it's not sad at all. You can have your cake and eat it too {in the digital wold that is, hehee}
--Prepare yourself, the dark forces may strike.
I'm sorry but saying that the qwest users deserve a refund is like saying the guy who drives the only taxi in a small town should be sued because his cab was stolen and someone had to walk 3 blocks to the store.
Sure it is an inconvienience to them, I've had my cable go down for 2 days and it was a pain in the ass. Did I ask for a refund? Nope, you know why? Someone STOLE the cable. Ya it's dumb in their part for not haveing backups and the cable being exposed, but it's still not something they could have knowingly prevented.
Mod parent to "+5, funny".
I received a credit for the 36+ hours my DSL (here in MN) was actually down. So I dont really have any complaints. The real problem here, was that for the first several days they were telling every one that all you had to do was "set web disable" (which I already had in my setup) to protect your cisco 67x from code red.
My problems started on friday and I tracked down the info about setting the web configuration to another port on my own. I even sent several emails to qwest tech. support in addition to telling several of their support people how to fix their problems. It wasn't until monday that they started telling people to change the web management port.
And yes their wait times were 100+ mins for days.
but I'm starting to agree with Gibson. Imagine how much worse the flood would have been if NT5 had the power of real sockets.
--
I like to watch.
-Legion
The attack exploited a known vulnerability in certain Microsoft software that some Cisco products were running. Other Cisco products also were vulnerable due to unexpected side effects.
Since when do Cisco products run Microsoft software?
I think a journalist is confused...
Code Red affects Microsoft Windows systems running IIS, and I believe the exploit used also crashes some Cisco 67x DSL routers with old firmware. Cisco won't provide firmware patches because Cisco doesn't sell 67x routers to consumers directly, and Qwest won't provide firmware patches because Qwest doesn't care.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
It isn't "five bucks" for a loss of downtime. Most connections alone run between $30-50 in the DSL/Cable range a month, so 10 days, or 1/3 of that, is a loss of at least $10. Add to that work that cannot be completed over the internet, and the downtime can become severe.
Also, I don't think this situation is helping my provider, @Home, stay in the business any longer. If they can't start blocking these packets they're going to lose subscribers, which is the very last thing they should be doing right now.
I helped quite a few Qwest customers get back online after the worm knocked them off the Net repeatedly, so I can speak with confidence about the cause of the problem. First, Qwest did not update the firmware in users' Cisco DSL modems to the latest version, which was more resistant to the worm. Second, it did not configure those modems to disable the Web interface, which is a serious security risk. Finally, when users' modems began to fail, Qwest did not supply complete information on how to fix the problem for several days... and when it finally did update the information, many users with crashing modems could not see it because it was on the Web! Cisco shares a bit of the blame in that it produced the susceptible modems, but for the most part, the fault lies with Qwest, which believes that it does not have to care because it has a well-cemented monopoly in virtually all of its 14-state territory.
It's important to note that Internet access is fundamentally, essentially, and always peer-to-peer. If you don't allow peer-to-peer access, you can call it "client-server" access or something else, but it's a lie to call it Internet access.
Anyone who wants to limit service in this way is incompetent to boot, since the Right Way to prevent abuse is not port blocking, but bandwidth capping. At a time when AT&T cable access is such a takeover target, it makes you wonder what the hell they are thinking.
Worse, by getting away with such a deceptive, unfair, and unnecessary abuse of their relationship with the customer, they are only paving the way to battle the Internet back into the traditional broadcast mode, where a few big companies have a voice, and individuals have none. I'm sure DisneyTimeWarnerNbcABCBSViaColumbialetric would love that, but you should hate that unless you also hate freedom. Like I said, if that's the service they want to offer, let them, but they can't claim that it's "Internet access" without ripping you off.
Expanding a vast wasteland since 1996.
I certainly didn't get any calls or helpful advice from Qwest.
after puzzling over my dead connection, I tried the old reliable on-off-on trick. sure enough, I was online again. the first fix for the CodeRed attack I found here on slashdot! no help on Qwest's site, of course.
Qwest's DSL tech support is in fact worthless. if your connection goes down, and if you can sit on hold for 20 minutes, and if you can take the insult of your intelligence (is the modem plugged in? did you try a reboot?), they never give you an answer on why your DSL is down or when its coming back up. "everything looks ok on our end! it must be you!" swell, thanks. sometimes they even promise to "get right on it" if someone else in your area calls in with the same problem. to be fair their service is alright, just don't expect help when Things Go Wrong.
one of Qwest's talking heads was just on the news, explaining nobody will get a refund because it was "an external attack" and "the modem isn't our hardware". lol
when i worked at RR Time Warner in Milwaukee we gave out 1 day, .5 day credits all the time, hell when we ran out of IP's adn people couldn't get logged on we gave out 3 month credits, just call and polietly, but firmly ask, don't be rude, or you won't get a dime, adn the nicer people were tome the more inclinded i was to give them a bigger credit.
That's the same attutude when us non-Qwest users get spam from their downstreams. "What spammer?" while they nicely /dev/null the complaint.
--
# Canmephians for a better Linux Kernel
$Stalag99{"URL"}="http://stalag99.net";
I've got DSL from Qwest in Portland, OR. When things went to hell I waited for two days before calling. Partially because my DSL goes down at least three times a week and the downtime can be anywhere from an hour to three or four. The main reason I didn't call right away was that I have never been on hold waiting for Qwest's customer service for less than 30 minutes.
I did call my ISP (not Qwest) in hopes that the problem was something simple on their end. They didn't know what was going on. They said that Qwest was getting hit by the Worm. Every one of their DSL customers in Portland were down.
When I did call or rather, tried to call, things just went to hell. The phone number for DSL customer support was disconnected. Thinking that the number had simply been changed since the last dreadful time I had to call them, I called the general support system and waded through until I got to a help system. It had two options: Option #1 was for people with Qwest as their ISP. Option #2 was for people with a different ISP. I chose Option #2 of course. After a few beeps, I was disconeccted.
I called and waded through the system once again a got the same result. Going back, I chose option #1 and was put on hold for 15 minutes before being disconnected.
I'm stupid so I did it again and waited on option #1 for over an hour.
When I finally was able to speak to a human I explained that I didn't want to start a trouble ticket, I just wanted information. Namely, what was going on and when they thought it would be fixed. The botbrain I was speaking with could not understand this simple request. He insisted that I had to start a trouble ticket. After going back and forth with this person for about ten minutes I asked to speak to his boss. After another ten minutes the boss gets on the line and tells me the same thing.
I could NOT get some simple information without starting a trouble ticket.
Well since all of my ISP's customers were down I was pretty sure that the problem was not on my system. I explained this to the boss and he just repeated the customer "support" mantra, "Do you want to start a trouble ticket?"
I know there are people that do not have problems with Qwest's DSL service. Some of them have posted here. I am not one of those people. I have never had a satisfactory "customer service transaction" with Qwest or US West.
If it were possible to get a cable modem I would. Not because there are fewer problems, but because it's cheaper. Unfortunately cable modem service stops a few blocks away.
I HATE monopolies.
A lot of people will regard this as generic Microsoft bashing, but I think there's a least a grain of reasonableness in this suggestion. If you look at the product recalls that happen all the time in the non-virutal world (e.g., cars, baby strollers), you see that the producers of those products do bear some responsibility for their work.
So far, the software industry has managed to avoid much of that responsibility, but we are rapidly creating a world where people (and even lives) depend on it. As such, software manufactures should be held accountable when poor design or shoddy workmanship are rampant.
The second option is that they can deny all incoming requests to port 80, since the UA forbids running servers anyway, and slowly wait for the code-red running machines to go away. This is what they did
I don't want "proactive measure" anywhere near my net connection. You do realize that a proactive measure would have to monitor all your traffic in depth, and then try to guess when you're behaviour was dangerous. When it has a false alarm, then you'd blame @Home for using such an error prone method, instead of a simple reactive method.
The trouble with listening to an idiot is that you might give them what they asked for.
THis is slightly off topic, but does anyone know if AT&T is still restricting port 80 for home users? I'm trying to Http some pics out to my folks and they can't access em.
assuming your in washington state of course.
i reported an ISP to the BBB once, and they
never responded. go to http://www.wutc.wa.gov/
and click on the complaint form. i spent 6 months
getting a charge for $215 taken off my bill for a dsl modem i sent back last december. i just got the charge removed 2 weeks ago. i think the complaint helped. if your not in washington state try to find the public utilities commission for your state and complain to them
I really have to wonder why this code red thing is such a problem in the US, but seemingly not so much in Canada. Now, its pretty well known that up here we get great service for a great price, and I believe that more Canadians are hooked to high-speed access than any other country (per capita of course).
Sure, I see a handful of hits an hour from it in my logs, but I haven't had any degredation of the network, no port 80 being shut off, no outtages. My cousin is also on cable in a different part of the country, and although he's had a lot more hits and maybe even some degredation, he also hasn't had any outtages or ports shut off.
So what gives? I'd like to joke that Canadians are smarter and more of our users have patched their systems, and so its not propagating across our networks as much, but I don't think that can actually be true. So what's the reason then?
P.S. Can anyone report on the situation in Southern Ontario? I have a theory up my sleeve...
--
"Karma can only be portioned out by the cosmos." - Homer Simpson [1F10]
An uncontrollable net storm caused by a virus, or an idiot admins' decision to block port 80 on a whole segment vs pushing individual machines off
as they were identified as infected. If you are looking for a refund for the FIRST you should sit down and be quiet, IF you are looking for a refund for the SECOND then I APPLAUD your efforts.
errr....umm...*whooosh* *whoosh* Is this thing on ?
This whole thing is stupid. When the worm was spreading rapidly, it seems that not many people were getting pissed at MS for the bug, but people who FAILED to patch their servers. Its like trying to sue MS because I used outlook to open an email attachment that wiped out my computer. Its the users responsibility to update their hardware (firmware in this case), the routers come with manuals as well. So lets all bitch at Qwest because we are too stupid to read a manual!
Yeah the customers will get their $5 refund while the lawyer gets his millions. Sweet isn't it.
I'd give them to ya.
The parent makes several salient points about
a pssible internet model.
errr....umm...*whooosh* *whoosh* Is this thing on ?
Could Microsoft be sued for being an accessory to the breaking of computer security, and possibly false advertising (I remember secure being used in several advertisments for windows 2000 and nt)
Just my rambling
period limit. They will deduct the cost of any outage over 24 hours, otherwise you just stomach it.
errr....umm...*whooosh* *whoosh* Is this thing on ?
The irony is that this will probably end up just pushing subscription software.
What does subscription software have to do with Qwest's infrastructure getting hammered by Code Red? Does paying for software more frequently somehow result in fewer bugs?
IIS security fixes were available long after Code Red was still romping around, and at no cost to the users at all.
The question shouldn't be "why not" it should be "who".
Whose responsible for the lax security in the #1 email client?
Who lets the idiot users that use their idiot software run attachments?
I'll give ya a hint. They have plenty o' cash, and his name is Bill. Last name Gates. Works for Microsoft. In Redmond, Washington. He's friggen rich, dumbass! Sue that guy! now your damn ISP which is gonna go out of business anyway! Good grief!
for QWEST and EVERYONE of your statements would still be true. The ONLY thing PAC-BELL has going for them is DSL is a relatively stable, or it would be beyond them to handle at all.
errr....umm...*whooosh* *whoosh* Is this thing on ?
Perhaps CmdrTaco would feel a bit differently if he was the one spending 16 hours a day on the phone every day for 14 days straight listening to that elevator music from Hell while overworked and scatterbrained qwest.net employees accidentally canceled his entire account three times just because he wanted to switch off a DMT line so that his Cisco 675 would work - what should have been a 24 hour interruption-free and painless operation. Perhaps he'd be outright enraged if this was in some way, shape, or form, critical to, say, slashdot's smooth functioning (analogy, obviously).
--Ryvar
Asking for refunds is a bad idea for another reason, especially if this were to go to court and the plaintiffs were to win... it would just be another reason for the losers who create these worms to keep creating them. I can see it now: "d00dZ! Not only can we strike at M$ but we can get all these lame ass ISPs in trouble too!"
No thanks.
Did they provide reasonable protection for their customers ? I think they screwed the pooch badly,
and are looking for anyway to blame someone, anyone else. There were very simple steps to remove ANY machine that was infected, rather than DO THE JOB they were getting PAYED FOR, they will blame someone else. If you offer a network, your clients have a right to assume YOU KNOW HOW TO RUN IT.
errr....umm...*whooosh* *whoosh* Is this thing on ?
Wow.. now isn't this interesting. Qwest actually started CALLING our QwestDSL customers to let them know of the problem, and detailing how to fix it, even walking them through this on the phone. Now, as if this wasn't enough, whenever you call the QwestDSL support number you get a long (5-6 minute) recorded message detailing, IN FULL, how to fix the problem. My only complaint is having to listen to it to get through to a real tech (and watching them disconnect a customer's service for 2 weeks to bump his speed down to 256k)... but this is ridiculous.
Qwest was doing the Right Thing here by being proactive and calling customers, but since they're the big bad telco, this is all their fault anyway. Do you honestly think Qwest is going to get any reimbursement from Cisco for all the support this problem has caused? I highly doubt it.
"Oh, excuse me Mr. Governor, but while driving on one of your state highways, my faulty tire blew out.. I demand you pay me for having it fixed and an extra chunk of money for my invaluable time!"
Pathetic.
Gee, makes me wonder about CIHost's 99% guaranteed up time. Code Red knocked them loopy for over a week.
healyourchurchwebsite.com - WWJB?
Anyone stupid enough to base their business on xDSL without some form of backup needs to just suck it up when access is down. xDSL is not meant for reliable connectivity (even most ISPs say so, I know PBI does). If you want that, pay the price and get a fractional or full T1. Hell, if you're doing hosting off of an xDSL line that is going to lose you money if it goes down, co-locate it. If you're just complaining because your internal users couldn't get outside access, have backup ISDN if nothing else.
US$5K worth of business lost? Get real. If it cost you that much money, spend some proactively to be prepared. What if your xDSL modem fried and you couldn't get a replacement ASAP? I recall when I got my ADSL that it had statements stating that they wouldn't be held liable for any revenue lost, etc., from loss of service. Qwest has something simular:
Actual speeds you experience may vary due to line or weather conditions or other factors out of the control of Qwest
Code Red would fit "other factors out of the control of Qwest."
Qwest shouldn't be held responsible for morons who use unpatched IIS.
I have DSL service from QWest in the Seattle area and lost service for about 24 hours during this outage. The problem most certainly was not Code Red on the DSL modem. Before this announcement I had killed the web server on the modem and upgraded the firmware. During the outage I must have power cycled the modem a dozen times vainly hoping it would work and I could check my e-mail. When I called QWest tech support in the afternoon they told me that the service was down for a few hours for "Server Upgrades" to deal with Code Red. I tried calling back later that night and spend an hour and a half on hold before giving up. I think QWest screwed up on the back end and used the Code Red attack on the Cisco modems as a convenient excuse. Simply unplugging waiting a few seconds and then plugging it back in would fix (until the next attack) any Cisco 675 modem.
.. according to Cisco, there are several products that use IIS in one form or another, though from that list I don't see anything that should be running on public, non-firewalled IPs.
That's stupid to give refunds. It's not a network comapnies job to insure stupid users don't attack each other and bring down the network in the process. This is about liability -- you are ultimatly responsible for what your computer does. What do these people want a refund from? Their own foolishness?
In some cases, there may be those whom had never actually had the bug, and had experienced a network outage because of the "other people.". This happens. Quest cannot control the weather from destorying a router station just as much as it can't control a virus. Downtimes are a fact of life, a network is dynamic. Shit happens.
Avoid blaming at all, but at least when you need to, put blame where blame is deserved -- the Code Red virus. Don't sue the messenger.
"I'll just chip in a bit for RedHat: I actually have that installed on my university machine." - Linus, '95
I'm sorry to rant a bit but I work for a broadband ISP and I was a customer of that ISP for years previous to my employment there so I really am not being biased.
The code red worm has nothing to do with qwest.
QWest did not author the worm nor did they release it to the public in the first place.
The majority of the traffic caused by the worm was ARP traffic which uses minimal bandwidth, perhaps 3 - 9 kbps (more likely 3). Secondly most broadband ISP's or even DSL likely include a clause pertaining to running servers on a residential connection meaning "we do not permit you to use a server on the modem" so for those who were infected they were likely already in breach of the user agreement anyhow. If QWest went to the trouble of informing those who were infected and helping them recover then I would consider that excellent service. As someone in another post said "I could understand if there was a storm and the connection went down for a couple of hours" how is this much different? Probably 75% of the code red infected machines were being run by people who are morons and shouldn't have been running IIS in the first place. A real sys admin would have had it patched before or would have recovered quickly and with a patched system. This has nothing to do with any ISP's ask the idiots who ran infectable and poorly maintained machines for your money back!
The phone, the bane of my existance, rings. "Hello, Computer Room" I say, being helpful - BOFH
maybe we should all whine for a little karma. :)
geqgnegjeko ega;oighw fnawoihgohif faebluie kvbeihbfiwehbfiwehfo; agohweogihwe bfwehbfwebhf;owehf jehwgf;owehfin jn feabf nejbfoq; kbfwoqbfqw kfbqnfbi f enbfubqn fwqfoiwh
guk is gay
Quoting from article:
Steve Larsen, who heads the attorney general's new Cyber consumer resource center, said in a message to Mangus: "It seems reasonable that a customer should not have to pay for service they can't get. If you can't watch your cable TV or your newspaper doesn't show up for days/weeks at a time, I assume you won't pay. I believe that is all your customers ask here regardless of fault."Scenario. Some idiot is driving a poorly-maintained car which was ill-conceived at the design stage. Maybe he didn't even know he was driving...
A wheel breaks off and his car plays Guardrail Ping-Pong on the turnpike.
The ensuing traffic jam shuts down the city's busiest artery, halting all commerce in the city. Your newspaper doesn't arrive as a result.
Multiply that by many, many cars at the same time.
Why don't we go after the bigger problem and charge the jackasses who designed perpetually failure-prone cars and the jackass owners who don't maintain them?
Going after them instead of the local highway contractor seems like a better idea to me.
Especially since these drivers have no excuse for not knowing how dangerous their flawed little cars are.
Fire and Meat. Yummy.
Also, the article talks about "Microsoft software" that some Cisco devices where using. What software was that? IIS runs embedded in Cisco stuff now?
I'm afraid that seems to be the case. Just look at this Cisco security advisory:
"The following Cisco products are vulnerable because they run affected versions of Microsoft IIS:
Actually, I don't know that we'll ever learn why Qwest had issues today, but the segment of the Qwest network affected did have a fairly pronounced Code Red II infestation. About 2/3rds of the infections reported at this Code Red report are from a monitor on the Phoenix Qwest DSL network. I can only suspect that the disruption was the result of having all those compromised hosts with root.exe running on them undetected.
With:
running on separate Eterms for the day, I've learned that Qwest shut down the router from the Phoenix DSL network a couple times and brought it back up only to find the behavior was the same. After some (infered) head-scratching after a period where they turned the router off for about 35 minutes, I saw a new hop beyond loop1.phnx-dsl-gw8.phnx.uswest.net but then dropped. This new router (not putting it out here since I'll leave that forensic recon to any potentially involved individuals in this outtage who are interested) had a new IP. No further hops for about 20 minutes (configuring this new router with new routes?). And, then it popped. All ETerms started showing smooth flow of traffic.
Perhaps a fairy tale inspired by a consultant who just lost a billable day. Perhaps a clue to solving a riddle that probably affected anyone on the Qwest Phoenix DSL network today. Potentially, a clue as to what people out there are doing with infected IIS machines.
If these conjectures have any modicum of merit; we're in trouble. Serius trouble.
Of course, this could all be my own imagination and the outtage the result of a backhoe operator on a Cottonwood corn farm.
You be the judge. If you're using Qwest DSL in Phoenix, this probably happened to you also.
www.dedserius.com
VB != VisualBasic
you don't want
you don't need
you know from years of clueful experience will cause harm to your particular system?
PAUSE ... PAUSE ... PAUSE
(security-fix == security-fix) ... 133%!!!!!
If you mean a "security-fix" all by itself that is just and only a "security-fix" then I am with you brother
(service-pack != security-fix)
If you mean a "security-patch" that is bundled with (is this the "no cost" part???):
a slew of other upgrades
modifications they will not tell you about
bug fixes
headaches
more holes
more bugs
expensive hardware upgrades that didn't need to be done but I had to do anyway due to this poorly designed SERVICE PACK
What they mostly offer is never "just a security-fix all by itself"
I believe Juanita
These peçple should attack Microsoft instead... Especially if they are NOT using Microsoft products.
;-)
When you buy Microsoft products, the EULA says that Microsoft is not liable to any damage done to you...
But if you are using let's say, FreeBSD (or Linux, or Solaris,...), you never agreed with Microsoft Eula. So, Microsoft products DID HARM YOU via this Code Red Worm thing and you ARE NOT BOUND to Microsoft Eula... Microsoft clauses telling hey are not liable to any damage done to you don't apply in that case...
In the worst case, Microsoft could forward the complain to its users... But that would be a very unpopular move... "Use Microsoft products and you could be sued by non-Microsoft users because of the flaws in Microsoft products and can't attack Microsoft because of the Eula"...
Could be interresting
IMPORTANT NOTE: Joe/Jane Consumer did NOT sign/accept/whatever an EULA associated with Microsoft Web Server (e.g. IIS). Joe/Jane was just "harmed" by the poorly designed, fault ridden, Microsoft Server Software. Joe/Jane NEVER signed/accepted/whatever the EULA associated with the poorly designed, fault ridden Microsoft Server Software.
I believe Juanita
My home DSL server has been hit 2,347 times since the first of the month. My primary server has been hit now ~ 15,000 (and climbing)
At the worst, Code Red was hitting my main server several times per minute!
Compared to the base traffic, not really all that much (I have three OC3 network feeds ath the colo) but still nothing to sneeze at...
-Ben
Furthermore, Joe/Jane Consumer did NOT sign/accept/whatever an EULA associated with Microsoft Web Server (e.g. IIS), they only accepted the license agreement for Win95.
Joe/Jane was just "harmed" by the poorly designed, fault ridden, Microsoft Server Software.
Again, Joe/Jane NEVER signed/accepted/whatever the EULA associated with Microsoft Server Software (IIS). can he/she sue Microsoft for losses???
IMPORTANT NOTE:
I believe Juanita
The key, I believe is that the injured party must not have accepted the EULA for the Microsoft SERVER software (IIS).
EXAMPLE
An injured party runs a small consulting outfit out of their bedroom. They were unable to reach customers/clients via email due to the network traffic jam caused by the Microsoft Code Red Worm I & II.
The injured party was unable to submit the bid for contract to Big Company, Inc.
I believe Juanita
My provider isn't "The Wicked Q of the West", but I ended up downloading Cisco 675 CBOS upgrade from their site. This is what happened.
1. I have received announcements about Code Red in everything security-related that I was subscribed to, and as usual, ignored it because I don't use IIS, Windows and other garbage of that kind.
2. Cisco 675 router that connects me to my providers (ISP is Megapath, line was Rhythms) started hanging in the most outrageous manner possible, being not accessible even from its serial console that I have attached to one of my Linux boxes through USB multiport serial converter. It was "outrageous" and not merely "bad" because same Linux box happened to have still-working Ricochet modem attached to another USB port, and I was able to reach it from work even when DSL was down, but couldn't reset DSL until I was physically at home.
3. Later announcements mentioned Cisco routers as vulnerability, and recommended to disable web administration on the router as a workaround, and upgrade the firmware. Cisco page mentioned an upgrade but did not offer anything to download -- required to call their phone number or email them and beg for firmware update. Knowing that everybody who ever bought Cisco 6xx, plus a bunch of people who didn't know how their company's Catalyst differs from bitty box 675, will be trying to reach Cisco, I have chosen to do a workaround.
4. I have disabled web administration, it stopped working, but router continued listening on the port 80. I assumed, it will just ignore all data that it receives, so a bug won't be triggered.
5. Router still hangs. I have set a filter to block everything that comes from outside to the port 80 on the router. It looked like router stopped responding to this, so I was confident that I am not vulnerable to that thing anymore.
6. Router still hangs. Apparently my mind was not advanced enough to comprehend the brokenness of CBOS -- broken code was receiving packets BEFORE THEY PASSED THE FILTERS.
7. I have looked at the Cisco site to check if they got the idea, how many requests for copies of CBOS patches they are supposed to process and posted the binaries. Nothing -- the page still contained a phone number and email address, and since I was at home, I could be pretty sure that people who were supposed to answer at Cisco weren't at work either.
As opposed to other Cisco products, CBOS has no optional pieces, and is useful for a single puprose of upgrading shitty 6xx boxes, so why they needed my phone call to make sure that I am indeed going to use their software to upgrade their router and not, say, print as a hex dump and smoke it, is still a mystery for me.
8. While constantly resetting Cisco, I have started IRC, and asked some of my friends if they know, where to find those damn patches. After few minutes I have received some rather unflattering description of CBOS, Cisco and Intel (who happened to be the real authors of this shit), and the URL on Qwest site with CBOS images.
9. CBOS images were distributed as Windows executables, with Windows upload program but no instructions -- probably following the logic that if a customer has his servers infected by a virus, running downloaded executables is the least of his concerns. Fortunately, Windows executable was a wrapped zip file, and upload procedure over a serial console was in the router's documentation.
10. Router worked fine ever since, but it looks like it's still impossible to filter or completely disable web administration on it.
---
Of course, this was that simple only because I had a full access ("exec" and "enable" passwords) to the router. I am afraid to think, how Qwest technicians would have to work if they had to upgrade customers' routers over the network while routers were being attacked, or to distribute passwords to the customers to make them able to run the updater program (I have never seen it running, I assume that it uploads updates either by xmodem over console or by TFTP -- in the first case only customer can enter the password, and in the second one _someone_ has to login to the router and still enter the password), so I kinda understand why Qwest couldn't do much in this situation. OTOH, Cisco could at least issue binary patches as a public-accessible download.
Contrary to the popular belief, there indeed is no God.
I guess I am a little bit obsessive-compulsive about paying for services, but I do pretty heavily police what I pay for.
The majority of businesses that value their customers do not mind doing a pro-rata credit for service or product outages. Verizon, Hearst Magazines, Ntelos, Sprint... They are all companies that I have had positive experiences with.
It is unfortunate that Qwest doesn't appear to be a bit more understanding. If I am to understand the article and the situation correctly, it was preventable... Had they been using a more secure platform. Additionally, the poor support is unexcusable.
Qworst? =)
It really is a better business practice to issue credits to those with legitimate claims, while not admitting liability. And if someone feels they need to take it further, they will.
I guess I have to be nicer to Verizon. They could be as mean as Qwest.
jrbd
and should not be compared to such
If you're a home user with a single dialup at a local ISP, that's one thing.. (and I still think you have a right to stable service here as well)
...but if you're a large organisation maintaining a global development infrastructure, and you're paying a telco a couple of $$$K a month, then you should be certainly be entitled to a refund when that service dies and disrupts your business...
...further, if it can be shown that the service died due to incompetence, eg. the service died in the later rounds of Code Red attacks AFTER all of the press and subesquent release of patches etc., then you should be able to sue them for damages.
Large or small, its a service you pay a fee for. If its not your fault, then no service, no fee.
'sapientia potestas est'
Note, those cisco products are PC-based things, that run Windows. They provide a UI through a webserver, which is IIS.
:-)
I'd hardly call that "embedded", unless you call a Win2k box being owned an "embedded rootkit"
The IOS routers run their own webserver also, which is pretty bad code (it's disabled by default on routers, but needs to be disabled with "no ip http server"). The IOS webservers serve no additional purpose, they merely provide a web UI to the IOS CLI, so it's really unnecessary (thankfully!).
Ameritech's DSL service for once pulled through this one. The only difference I saw was that my modem resync'd quite a few times, till now that things have died down a bit (seeing 200 accesses to port 80 instead of over 500.)
Those with their service know of the usually unhelpful tech support.
As much as I hate to side with USWest / QWest / Whatever the hell they choose to call themselves these days, I don't think anyone is entitled to a refund. I was somewhat irritated about the whole mess, but it wasn't QWest's fault and I believe they did they best they could to deal with it. Amazingly enough I not only got a letter but a phone call as well with information about the problem and what to do about it. It was a bit difficult to convince the person who called that I did know what I was doing and was at no risk, but that's besides the point. My service was out for maybe half a day at the most, and I had enough mp3, divx, and pornography to "weather the storm." :) Perhaps a good analogy could be comparing them to a gas station. They agree to sell you fuel, but they are not responsible if hooligans come in the night and fill your gas tank with sugar. You'd at the very least lose the gas you bought and possibly could suffer damages to your vehicle.
:)
If you didn't know enough to set up your computer properly when you connected it to the internet, I have no sympathy for you. Were it up to me, everyone would be required to begin their computer using with a Commodore 64 and then move up to more sophisticated machines. (And yes, there ARE web browsers for Commies. Not bad ones at that.) There seems to be a mentality out there that just because you throw money at something it'll work right all of the time. Either learn how to use it properly or don't bitch when some juggalo comes in the night and exploits your misconfiguration. You aren't entitled to a refund.
Besides, they'd prolly just spend it on crack.
Well, the local ISP I work for also had customers calling up complaining about slow speeds, many of them on DSL. Alot of our DSL equipment wasn't effected, but overall internet traffic was hell for at least a few days. We informed customers we were doing some rerouting, to avoid it the best we could, and we definitely did not do anything lame like block off port 80. The customers we did find (if any) agreed to patch their IIS webservers, and even those who didn't know what was going on, I explained to them how Code Red works. I think alot of our customers were patient and appreciated anything we could do for them. None of them even mentioned the idea of refunds, but I'm sure that might come up at least once or twice.
As a consumer, I can say... if you're not happy with the quality of a service, definitely don't pay for it. I mean, quit it all together. Ok, let's say my cable modem went down for 3 days... for any reason. Can I deal with that? Sure, I would be aweful damn happy when it was over with. But what's worse? Being down for 3 days, or getting so pissed off and disconnecting the service alltogether? If you were down for 3 months, an unreasonable amount of time, I would say sure, a rebate would be in line. But I think after a month or so, you would have cancelled the service and gone with someone else. It's the nature of business and places like Qwest know this, so they do what they can to get people back up and running as soon as possible. And besides, nothing's perfect and we're all human.
I did what I could for our customers. I informed them about Code Red. And hopefully when they left work that day and went to the bar, they told all their friends about the Code Red story and how to patch your server, etc. And hopefully alot of people listened and cooperated to get this thing under control.
FLR
My net connection when down too, and I don't run around demanding $5 back.
Very bad that you do not. If you did, and everybode around did the same, probably the current sore state of the security would improve, some knowledgeable sysadmins would be hired and some holes would be plugged.
As long as the users agree to get crappy service, crappy software and crappy security for their money, they will get crap. The only way to not get crap is to refuse to tolerate that anymore. So if somebody sues their ISP that neglected to provide them the required service and to maintain secuirty, it's a very good thing. If people are promised 24x7 connection and support and then when the problem comes they are said "well, it doesn't work, just wait and maybe it will be fixed in a day or two or more" - they have the right to demand compensation.
-- Si hoc legere scis nimium eruditionis habes.
The only people you can sue succesfully are the people running unpatched IIS. Everyone has to agree that they a guilty of gross negligence, pure an simple.
They cause(d) the damage, they should pay.
There are only a few DSL companies left before Verizon takes over the world. I think we should stand with them on this and not let an even worse company that cares about nothing take over
Damages could also include additional bandwidth consumed hat you paid for, and time to manage the damage.
Think too of including e-mailed and other viruses....All the things that make Microsoft a poor neighbor.
Benefit to the consumer? When the cost of writting good code is less than the shlock they now produce, the code will get better.
If it was said on slashdot, it MUST be true!
Who causes damage to you?
Did Microsoft cause damage to you?
They warned the users of IIS to patch their software didn't they? So I guess the only people responsible for this mess are the ones running unpatched servers. They should be sued.
There is no agreement between you and the owner of the unpatched server, so they can be sued. And they will learn that:
-buying from Microsoft is not a safe option ("nobody gets fired for buying Microsoft")
-having a knowledgeable system administrator around is very usefull
B.T.W. if someonen attacks you from an unpatched server, it doesn't matter what license agreements you have signed. You have not signed the license agreement of the unpatched server, so you are not bound by it.
"The Road Runner system has been designed to offer access to all the high speed services mentioned above, even assuming continuous, maximal usage by every Road Runner user in a neighborhood simultaneously.
Since Road Runner is supposedly designed to be impossible to saturate, then they should refund money to those who had unusable connections -- especially since the vast majority of the Code Red traffic came from within their network. Of course, this is just another example of marketing hyperbole as many Road Runner franchises (including mine) are horrendously overloaded and subject to packet loss and high latency at peak usage times.
The real point is that many networks were not taken down or even substantially slowed by Code Red. That makes it pretty clear that Code Red was not some all-powerful force capable of bringing the Internet to its knees. The networks that were rendered useless by it were the ones that had inadequate capapacity.
code red has nothing to do with email clients, and it has nothing to do with running attachments.
So you are saying that the maker of an unsafe product has *NO* liability?
How about a product that is dangerous?
If it was said on slashdot, it MUST be true!
Those businesses that use M$ technology should
realize that there is a huge hidden cost to using
their technology. Not only in the extra manpower
required to manage and support it (see reports from
IDG, Gartner, etc..) but also in the constant bug
tracking and loss of business that comes from buggy
software. What other OS does one have to format
the disk and reinstall atleast once every 6 months ?
As much as I hate to say it, Qwest should give refunds for the customers who ask for it. Any business should know that "The Customer is always right".
McDonald's provides a good example of this. The great Monopoly game scandel was not their fault, but immediately after news of the scandel broke,
they offered a new $10 million dollar contest. Instead of claiming, "its not their fault", they said they were sorry, toke a minor slap on the wrist, and ended the bad press immediately.
Qwest should do the same. They should just quietly give refunds to the customers who ask for them. Millions of retails companies across the country give refunds every day. Its part of the cost of running a successful business. Tech companies that don't realize this will go out of business (unless they are a monoply, of course).
"My connection didn't go down, therefore no one else's did."
My last bill for RoadRunner service was approximately half it's normal amount. The reduction was the result of a credit for intermittant loss of service for about two weeks. My city seemed to be particularly hard-hit by local CR/CRII infections (I was seeing about 20 arps/second at one point, just from my local segment-- not counting forwarded stuff).
Never asked. Now, I'm the last person to be a fan of mega-mega-octupii like TW/AOL, but I was impressed. Having worked for ISPs in the past I know that outage refunds are not unusual, but in my experience you ALWAYS have to ask.
-- Cerebus
Why not just sue MP3.com ... It seems to work for most other complaints.
On the other hand, I believe they (along with others) had problems relating to bugs in the DSL modems. Bugs which they had a patch for but didn't inform their customers about immediatly. For that they are potentially responsible for.
...was a bit different than yours.
... and am given another phone number to call.
... I get an email response saying that I'm going to have to call them to take care of this issue. Yeah...uhm...I guess I'll wait until I have a good hour or more free to sit on the phone... Right now, like you, I use Qwest for DSL and ISP service. When the change goes through to force people to MSN, I think I'm going to cancel my service.
I received the call (and the letter, for that matter) from Qwest about the Cisco/Code Red issues. I had already heard about it, but, I had a bit of a related DSL problem I had to ask them about. Oh no, the caller informed me, he couldn't help me with that. He gave me a phone number to call.
Ok, says I, I'll just call them up right now and get this taken care of. I call, go through the system
Well....this isn't so convenient, says I, but I'll give 'er a shot. I called up this second phone number and I'm told that all lines are busy now. They'll take my call as soon as they can. My estimated wait is... 60 minutes.
Ok, I wasn't that desperate. So, I went to their website to request help through their online customer service form. They usually get back to people quite promptly, I'm informed.
Five days later
-- dR.fuZZo
Roadrunner in Fairfax, VA just shut off all incoming port 80 access. No warning, no apologies, and so far no refund. Is there a good broadband provider anywhere?
I use Charter Pipeline cable service, through Earthlink, and I lost access for 2 full weeks. They're overcharging for the service as it is, and during the outage they stopped answering their phones and never let *any* of their customers know what was going on, what was being done, and when it was going to be fixed.
If I'm paying through the nose for a high speed connection, and it disappears for 2 solid weeks, you can bet that I want some money back. They're giving us all a free month of service now.
Now who do I sue for the never-ending wu-ftpd/telnetd/sendmail exploits? I never accepted an EULA, so I feel some cash should be lining my pockets right quickly.
Easy does it!
This comment has been submitted already, 276865 hours , 59 minutes ago. No need to try again.
Alot of people seem to be confused. The Cisco DSL routers embed or run IIS. That's how Qwest users are getting infected. As far as who's to blame, well that would be MS, since they wrote IIS. Cisco should have known better than to use IIS.
...Than whine about a problem that NO ONE could possibly have forseen. Besides, it was my fault for not initially spotting, and disabling, the web configuration interface for my own 675.
Sure, Code Red's second incarnation may have knocked my site off the air for a week as a result, but Lord help me if I ever get to the point where I can't stand being "unwired" for at LEAST that long!
(Your word for the day is 'Qwoob.' Please use it responsibly).
I run my 'net presence, and my side business, for the same reason I ran a FidoNet BBS for nearly a decade: Because it's fun. If it should cease to be fun, I cease doing it.
I think the A-G's office should have better things to do as well. Like going after spammers under the WA state anti-spam law. Said law was, after all, ruled by the courts to be very much constitutional.
Open comment to my fellow WA state DSL customers: Grow up! Find something better to do with your time than run around and gripe. There's more than enough frivolous legislation and law-suiting going on without us adding to it.
Oh, BTW: Your word for the day is 'Qwoob.' Please enjoy it responsibly.
Did anybody else think of Paul Dooley (the dad) in the movie 'Breaking Away' when the son gives the guy the refund on the used car?
"Reee-Fund? Reee-Fund?"
Maybe he works for QWEST now...
Everyone will start to cheer when you put on your sailin' shoes.
Qwest needs to kick back cash.
We are in Seattle and were down. We waited on hold for 1 hour and 45 minutes trying to speak with someone at Qwest. We were finally disconnected and never able to speak with someone.
At the time it wasn't clear whether this was a code red thing or another problem with our service.
I would argue that, given the warning they had, they could have better defended against the attack.
But companies these days seem less willing to do what is necessary to retain those "prima donna's" so necessary for these situations. Pay the PD's now, or kick back cash later..
Suprisingly, ATT@HOME offered me a month of free service ($40) due to Code Red problems and my concerns about their changes to the FAQ stating server filtering would be going in. Normally their support is the worst, but the rep was *really* sweet and she offered. We'll see if I get the credit (a common sprint-PCS tactic - offer it, but you never get it).
This both sucks and blows as it messes up my Q3, and UT scores. ;)
make Linux, not Microsoft. sin(beast) = -0.809016994374947424102293417182819
What about all the users who have been infected from inside a gateway? eg. all the internal traffic. Won't help them at all. They would have to block it at the Megapop itself. (I am not a megapop expert) Besides, I just got connected on a new ISP and had 120 hits in one day. My Apache just laughed at them!
make Linux, not Microsoft. sin(beast) = -0.809016994374947424102293417182819
I have good and bad to say about them. First of all, my service was absolutly terrible during the peak two weeks. After the "fixed" "random search" version of code red came around, my connection went down and didn't come back reliably until I got on the phone with them two weeks (and two diablo2 HC characters -- I'm not a fast learner) later. Once I had them on the phone, I had to convince them that YES I had reset the 'modem', YES (both of) my network cards worked, and that YES I had patched my system so I was not the cause of the problem. Once I got past that, the tech put me on hold for twenty minutes while she discussed the situation with someone remotely clueful. Finally, she came back on and said "we have been getting a lot of complaints from your area, we'll send a tech out to take a look. And we'll credit your account for the time you've been down." I had never asked for that, but think it was entirely appropriate. By that evening, everything was fine (and has been, despite the ?still? continual default.ida? requests).
I have been pretty much end-to-end impressed with TWC's service, despite the fact that cable in my area is VERY popular. The incumbent local carrier (*cough*BellSouth) absolutely bites; no concept of quality customer service in the face of crisis. The TWC rep pretty much walked me through the basics, and then got someone to help her that had a grasp of the big picture. They got the problem fixed, *and* made me happy to boot.
'nuff rambling,
jaz
Death to Argument by Slogan!! (This post twice-encrypted with ROT-13. Replies not using same will be ignored)
If it was an act of god, and they had no control then QWEST is not at fault. If on the other hand there was time and precautions were available for MOST PEOPLE, then QWEST is negligent and deserves to pay for that. I am not a qwest customer nor do I know all the details. PACBELL sent email out to anyone who showed PORT 80 activity nearly a week prior to the problem. There WAS NO SERVICE interuption for me, and it is WELL WITHIN my rights as a customer to run a web-server or anyother server. As to why the 'FUCK' they should care, can't help ya there bud.
errr....umm...*whooosh* *whoosh* Is this thing on ?
After about two months of having to unplug my cisco 678 (Also happend to 765s) and plug it back in to get my DSL service working again, I could relate to this problem. When I pay 60 dollars a month to have my DSL service, I expect prompt closure of any situation that may occur, but obviously this wasn't the case.
I didn't think much about it when it first happened, my modem just stopped responding, as if a lockup had occured. It wasn't much of a problem, until the frequency of the problem increased exponentially (Instead of having to unplug my modem once every 2-3 days, it was not once every 2 hours). Qwest had no solution to this problem, infact I heard that they just stopped taking phone calls about it (General Qwest tech support hold times are in the 1 hour plus range, and this is just for the common lacky who will go through a set of written instructions to get you modem to work, higher level tech support requires a call back (If you are lucky)), I still have an email on my system from qwest, suggesting that the user unplug/plug the modem back in when these lockup type problems occur.
The problem stems from the Cisco 67x and the fact that when the Web configuration is disabled, the modem still responds to traffic at port 80. Kind of stupid. But when I was discussing the situation with a friend, she was told by tech support to reflash the Cisco 67x, and that would fix the problem, unfortunately it didn't, and a changing of the Web port was involved, from 80 to something else.
I must reiterate the fact that I pay 60 dollars a month for this service, and should not have these situations pop up as they do. 60 dollars is for the low end basic DSL (On all the time, no static ip...etc). There are companys that pay more than 5 times as much as I do, who need this service, I think customers should be compensated for their troubles.
Until the loser who wrote the virii is caught and tortured^H^H^H^H^H^H^H^Hprocecuted, this will not end. eg. end-user sues ISP, ISP sues (MS/CISCO) who in turn sues the l-uzer^H^H^H^H^H^HPlaintiff. Like anyone is going to get any money out of it.
make Linux, not Microsoft. sin(beast) = -0.809016994374947424102293417182819
C64? Hell, that's an advanced computer with a HL language and everything. It has a keyboard and even displays stuff on a TV!! I think they should start out with a 4004, some perfboard, a wirewrap gun and a databook.
for reasons posted in other thread
I work for an DSL provider and I lived the problem with Code Red/IIS/67x CPE. There are a lot of wrong arguments about this problem, specially on the Cisco side because there is no official announce about this.
Upgrade the 67x to CBOS 2.4.2 solve the problem.
This is not true. This version of CBOS solve the issues when you have the admin web enable, and other issues explained by Cisco, but the CPE keep crashing with web disable option.
Try this at home.... with the newest version of CBOS and web disable do a 'wget http://[IP CPE]:[port]'. After a few seconds you CPE will crash.
Note that does not matter if your have the web disable... your CPE will crash anyways. We have make the same test hundred of times.
The only solution is to change the web port to another port so Code Red don't hit it. Anyways if some one discover the port it can crash the CPE using wget.
What Cisco is saying about this???? NOTHING!!!
Microsoft products have a lot of bugs, but each time one is confirmed they accept it and release a patch, instead Cisco keep silence.
I think we all have to blame Cisco for this problem. They are so arrogant that does not accept that their products have stupid bugs.
If yo do a telnet to any port on CBOS it just do not respond at all, but doing a telnet to the web port you could see (with web disable), the CBOS accept the TCP connection and then close it, and that is the problem. With an average of 15 a sucessive connection attempt, the TCP buffers fills up and crash the CBOS.
With this kind of logic, does this mean I can ask for a tax refund from the department of transportation because people keep ramming my car?
The Internet is generally stupid
And they wonder why @Home is in trouble. I don't get those problems with my DSL line (which came available to me about a week or so before my @Home service dropped off the face of the earth. . .). . .
Being a Quest customer using one of their Cisco 675 routers I was on the recieving end of this affair and I think Qwest owes its customers a refund because of the pathetic way they dealt with this situation. I spent 3 weeks power cycling my router 3 to 4 times a day, not being able to connect to work from home because the router got hit every evening. What really bites about this is I followed Qwest's instructions and they were not sufficient.
Originally, I followed Qwest's instructions to disable web access to the router. I still got hit and had to power cycle multiple times a day. Then I read an article on The Register about the situation and followed the link to a writeup at the Cisco site that described how to work around the problem (turns out you also had to change the access port to >1024). Why didn't Qwest do their homework and discover the real solution originally?
Also, being a Linux user, I have no choice but to use Quest's preferred Cisco router. The only other DSL hardware available for Qwest's DSL system are an internal PCI card and an external USB modem. Both of these devices use proprietary drivers that only work with Windows and I can't even get specs on them to create my own driver.
Since Quest has forced me to use hardware that they selected that was vulnerable to this outage then I believe they should shoulder the responsibility for that selection.
Don Dugger
"Censeo Toto nos in Kansa esse decisse." - D. Gale
That's none of your concern. The other people might be running some software pretending to be infected IIS for all you know.
You should sue people causing damage to you. Then they can find out if they can sue Microsoft for supplying a non bulletproof webserver (which they can't succesfully).
The article doesn't say how the service didn't work.
Did Qwest actually shut down stuff, or was it just so clogged with traffic that it was effectively unusable? If the former, it's QWest's problem and people deserve a refund. If the latter, it's just Life.
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
eat me geeks!
If a service you pay for is down for an hour or even a couple hours, most people wouldn't think of asking for a refund. What if it's down for a week ? three weeks ? At some point, you begin to realize that you're paying for service that's not being delivered. If your lawn service didn't show up for a couple weeks, would you still be willing to pay them for those weeks ?
Qwest, like most broadband ISPs, have a regional monopoly. They're not really concerned with customer satisfaction. If Qwest had competetors nipping at their heels, you'd better believe they'd be concerned with keeping customers happy. Competition is the cure.
Btw, I'm a Mediacom / @home customer. It's not the least bit uncommon for my ISP service to be down for days at a time. If I get 20 days of service a month, it's been a good month
Did I miss something? My cable was down for 12 hours during a storm, would they prorate my bill and take off 1/60th or 1/62nd of the bill? I dont think so.
Before I bought the satellite dish, a drunk took out a utility pole on my street. We called the cable company, which assured us that the police had notified them, and gave us a "return to service" time of, like 8 am the following morning. By mid afternoon I called them to find out what was up: they'd lost the ticket and sent someone out immediately. They credited me 1 month's charge for the missed service call.
In this instance, though, it sounds like the issue the plaintiff's see is that Qwest's own network was infected, rather than "I lost connection because the network was flooded by my neighbors' infected machines."
Times:
Qwest refuses refunds to DSL customers for Code Red outages
Qwest falls short tackling Code Red worm, but other DSL customers appear to fare better
'Code Red' wrigglings put users in knots
PI:
State pressing Qwest for refunds after 'Code Red II' DSL breakdowns
Worm has Qwest DSL customers seeing red
The real story is not in the articles about the State pressing USQwest for refunds, but the earlier ones describing how USQwest basically ignored the problem for as long as possible, then gave people like your Aunt Mildred complex instructions on how to patch their computers and DSL modems, which were broken by Code Red even though the affected customers were not running NT and ISS! Naturally, the Aunt Mildred's of the world had, shall we say, difficulty following the instructions, and if you didn't follow them exactly you only made it worse. It was USQwest's Cisco DSL modems that got hosed, not their customer's PCs, and the customers were first demanding that USQwest fix it and now are rightly demanding a refund for the DSL service they paid for and did not receive.
As the excite.com article said, this is the same as not getting your newspaper or cable TV -- if a customer pays for a service they did not get, they deserve a refund. Unfortunately the outcome in this case will be less than optimal, because it won't result in USQwest leaving Washington State for good!
If all this should have a reason, we would be the last to know.
Irregardless!
Americans sue who they want, when they want, over the stupidest things, and it doesn't have to make sense! that's the beauty of the system!
here.
Exactly. The lousy Microsoft software *IS* damanging me by consuming my bandwidth, my resources.
If their software was not such a hazzard, there would not be things like Sir Cam or code red or..... The *REST* of the world has standards of quality and responsiblity for their products. Why not software and Microsoft?
Providers like above.net , quest et la have it far worse. They pay $400 per meg of bandwidth.
If it was said on slashdot, it MUST be true!
I've spent quite some time dealing with Qwest DSL support and I have a few comments.
First it was because Qwest was providing you with internet access that some peoples service was going down. The problem was out on the internet, it caused older cisco dsl routers to crash. If they were not connecting you to the internet you would not have had a problem, with Code Red anyway. So are you going to sue them for providing the service you contracted them to provide?
Secondly with DSL from the big telcos (not sure if its the same with smaller outfits) what you are contracting for is a two part service. You get a DSL line which connects you to your ISP and in addition to that is the actual ISP service with the telco or some other provider. Qwest the telco just connects you to your ISP. Reasonably its not up to them to do any kind of blocking or filtering. All the telco is concerned with is getting traffic from your ISP to you. It leaves the ISP, goes through the ATM, through the co, down your phone line, and to your modem/router. That being said most ISPs don't block or filter traffic, some do, but like anything else you pay more for those (or your contract inhibits you from offering services that use the blocked ports).
Thirdly the DSL modem/routers provided by Qwest are sold to you, not leased. They are your property. Its not up to Qwest to configure them or update them to the latest versions of CBOS. They provide assistance in doing both and as a Cisco reseller will repair or replace them for whatever the warentee period is but thats it. Qwest has provided the latest versions of CBOS for download for at least a year. Version 2.4 which shrugs off most of Code Red has been available since the first or second quarter of this year on their site.
Lastly I'd like to discuss businesses that can't function without internet access and are using DSL. I'll take the example provided in the Excite article. That guy lost $5000 in business due to Code Red related outages. If you ask me he deserved it. His business is solely dependant on Qwest DSL internet access. Now how long he was down isn't mentioned so for the sake of argument lets say it was a week. In a month he will do about $20000 in internet related business. And he's banking this on a service that costs $100/month or less? Wouldn't it be prudent to invest another 1/200 of that revenue into a second DSL line from a different provider? If you bank your entire business on something with one single point of failure without a backup you have nobody but yourself to blame when something happens. And it will.
Anyway, just thought I'd throw that out there. I have no love for Qwest, I was without phone service of any sort for a month due to USWest ineptitude. But at the same time I can't stand useless lawsuits by people who think all their troubles are someone elses fault, preferably someone with deep pockets.
Did you say "the TCP buffer fills up and crashes the OS?" Hmmm. This might mean that one can exploit the buffer overflow to do fun things with the router. If so, it might get Cisco to release a version of its CBOS that isn't crashable, which would be a real long term solution to the problem.
I just tried to post the advisory here, but Slashdot's software -- in its infinite wisdom -- rejected it with the message "junk character post" (perhaps it was sensitive to the boxes drawn with text characters). So, go to http://www.cisco.com/warp/public/707/cisco-cbos-we bserver-pub.shtml to see it.