Slashdot Mirror
Happy Birthday Code Red
totallygeek writes: "One year ago today (July 19, 2001), more than 359,000 computers were infected with the Code Red worm in less than 14 hours. At the peak of infection, more than 2,000 new machines were infected each minute. Servers running Internet Information Services from Microsoft were propagating this worm across the Internet faster than anything has up to then or since. For the first time, systems running the Apache web server were getting requests for a document called "default.ida". Here we are a year later, and my web log shows an average of forty-two requests per day for default.ida over the last five days. To really appreciate the spread of this program, look at this animated image."
It is the gift that just keeps on giving.
...that on the anniversary of an attack which paralyzed servers dead in their tracks, we hear the far-away screams of agony from the lone sysadmin of missingleftsocks.com as 100,000 slashdotters pillage his machine simultaneously.
Don't worry about Code Red and related problems. I'm sure Microsoft will fix everything before they start storing our National ID information.
In Capitalist America, bank robs you!
One year anniversary was last week some time. We had been running DeepSight (nee ARIS) in a test mode at the time, and actually detected some test runs of Code Red about a week before the big outbreak.
Folks will notice though that the fixed version of Code Red I (CodeRed.B) is still going. Picked up a couple of hits today.
Servers running Internet Information Services from Microsoft were propagating this worm across the Internet faster than anything has up to then or since
Granted, the 'Net was a lot smaller, but what about the Morris worm?
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
It really was good pizza...and it was quite a bit of fun riding skateboards around the corporate HQ at 2:30am in the morning...
Seriously, though, it also taught the company I work for a serious lesson about staying on top of this kind of stuff. We had just finished a 2 month project to secure our web servers, but we were still bound by our traditional change management processes - 7 days notification for an outage, and testing of all changes documented and submitted for approval in advance. At the time Code Red hit, I had sent a note saying "we've really got to get this hotfix applied", but we were bound by the process, and we got burned.
Needless to say, when an urgent hotfix comes out now, it takes almost no convincing to get it applied ASAP. If it breaks a web app or two, well, that's the risk we take. We'd rather look for signoff from the business to unapply a hotfix that breaks something, than spend a few days trying to secure the approval beforehand. It's a lot cheaper in the long run to troubleshoot the effects of a hotfix that has unintended side effects than it is to watch your entire web farm get demolished by a worm.
Yes, we run IIS, and I suppose you could harp about how this could all be avoided by running Apache, but the point is that without a policy, strategy, and process for rapidly deploying defenses against net-born attacks, no system is invulnerable.
That's the nimda worm. Running apache, you're immune to it, but it makes a mess in your logs.
One thing to do is have a cron job to scan your logs and if it sees any of the above, add the ip to an iptables blocklist. At least that way, you only get hit once by it from each infected host.
Or you could use apache's rewrite rules to forward all attacks to www.micrsoft.com, but I wouldn't recommend that.
dave
from the original analysis by David Moore:
.FLI) .mov {requires QuickTime v3 or newer} )
UK Mirror
UK FTP
AU Mirror
Flipbook animation (207k
Quicktime animation of growth by geographic breakdown (200K
original www.caida.org gif animation
HIV Crosses Species Barrier... into Muppets
What exactly are we supposed to celebrate? The inept SAs that have failed to patch their systems? The sad lack of software development skills and abundance of corporate greed that combine to push shoddy software upon millions of users?
Maybe we should celebrate the resiliency of the Net. The fact that while attacks on systems continue to come daily, and at a seemingly increasing rate, everything still works most of the time.
--knowledge, not information, is power
From the official #python@OPN quotefile:
<skreech> I'm gonna miss code red when its gone, my webpage has never gotten this many hits before
DShield's Code Red Anniversary Page has an interesting graph showing scanning activity they've detected from active hosts since the beginning of this year. Some 35,000 IPs still continue to regularly come alive around the beginning of the month, quiet down towards the middle, and then resume the cycle again - the numbers have remained remarkably consistent.
Click here or here.
many months ago when default.ida was the rage around the www, I added these couple lines to my httpd.conf:
SetEnvIf Request_URI "^/default.ida" dontlog
ErrorLog logs/254-error_log
CustomLog logs/254-access_log combined env=!dontlog
check out SetEnvIf in apache docs, you can do even better than this.
Is it slashdotted or is that the demonstration?
;)
Server is still infected with a IIS virus (though not Code Red). Here it is
I sent them an email - almost a year ago in fact. They just brushed me off and gave a rather pathetic excuse ("the box is too slow to run Norton").
You can read the e-mail here.
Of course, these are the same people who run a trouble ticket server on the district wide WAN that any old joe at school can access and see where the security issues are.
No one ever notes that the CRW absolutely rape cisco dsl routers.
At its peak, Qwest had a 5 hour hold time for people who's cisco was taken down by the vuln.
Incidently, the fix was killed more routers.
forget it.
That's the first time I've seen someone getting smashed by the /. effect, and coming back asking for more!
"They do not preach that their god will rouse them, a little before the Nuts work loose." Kipling, 'The Sons of Martha'
What pisses me off is that when an early exploit was detected awhile back (err, many years), somebody released worm to go around and fix it but THEY where the ones who got in trouble with the FBI, thus setting a precident in the future saying that the computer community was not allowed to take all neccisary steps to fix problems that may pop up.
Kind of killed off community effort right there. >;(
Need help treating your acne? Come here!
I doubt the worm is going to bother to follow redirect requests.
/default.ida https://www.microsoft.com/ /robots.txt https://www.microsoft.com/ /root.exe https://www.microsoft.com/ /cmd.exe https://www.microsoft.com/
Besides https://microsoft.com/ would chew up more cycles on their end....
All kidding aside, with a redirection rule, the worm may not follow it, but at least it cleans up the logs a little. Plus, Apache's default error page and it's default redirect page are about the same size (for the bandwidth conscious).
Just add the following to your httpd.conf at the root level (so they are inherited by all of your <VirtualHost>s as well):
RedirectMatch
RedirectMatch
RedirectMatch
RedirectMatch
For those of you who think these are a bit too general (they match quite a few URLs), or if you have legitimate destinations which are matched by the above patterns, I'm sure they can be modified to suit your needs....
moto411.com
Someone will let them know... hehehe.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
Considering that despite the worm being in the wild for over a year, that either installing a *nix varient, applying a service pack, or simply running a decent antivirus app were alternatives to being infected? All of which are conscientious actions of the user, admin, etc? All actions that are made on the part of the user? All options undertaken or not by the user?
Sounds an awful lot like the fault of the user to me...
Just because you can mod me down, doesn't mean you're right. Shoes for industry!
Does that mean, therefore, that anyone running Linux without the fix for the 1i0n (or however that's spelled) exploit, can sue Linus Torvald, Redhat, et al for damages? How about anyone running a Micro$oft OS that has an exploit taken advantage of with a worm, virus, etc, that was created on a Linux system with the sole purpose of damaging as many M$ OSs as possible?
If you get shot by someone and suffer horrendous injuries, do you sue every bullet proof vest manufacturer, or gun manufacturer because they didn't base their business model around you? Or do you sue (or at least lock up) the one who pointed the gun at you and pull the trigger? Do you go around your neighborhood, testing each doorknob to see if the house is locked, then rob and burn down each house that isn't? Is it the homeowner's fault for not locking the door, or you for entering in the first place?
If you want to hold anyone responsible, try the guy/s who code viruses and worms... Anyone with sufficient pathological incentive to wreak havoc and trash a computer system (or, basically, anything else) will do so...
Responsibility goes two ways, on one hand, those who have known for a substantial period of time that there was a problem that needed addressing, and those who take advantage of that problem... The net makes this all more obvious, at least to those of us with a smidgen of common sense...
Just because you can mod me down, doesn't mean you're right. Shoes for industry!
If you think Linux is a "Safe Haven" then you're just asking for your ass to be handed to you.
If you think you can put ANY server up on a public network and not maintiain it--you WILL be in for a rude awakening one day.
No, he's pointing out that the patch was available a full month before the worm hit.
A full month.
And, being a competent admin, his boxen weren't hit.
6/18: MS sends MS01-33: Unchecked Buffer in Index Server ISAPI Extension Could Enable Web Server Compromise - Run code of attacker's choice.
7/18: CodeRed hits, those of us who installed the MS01-33 patch laugh.
7/30: MS et al send out another alert uring people to read MS01-33 and install the patch.
Of course - that's not to say it can't happen to Linux in the future. Some changes that would have to take place would include:
1) An increase in un-administered machines (which is possible as more Linux machines go in to service and are promptly forgotten about or appropriate support stuff aren't also put in place).
2) More distributions installing services by default without user knowledge (which most distros seem fairly resistant to doing - but not all).
3) Patches that become as devistating as the security threat they attempt to mitigate (I've yet to see this and would think that any organization that constantly produced dangerous patches / replacement packages would find their user base fleeing to another distribution).
Microsoft still insists that such things are the fault of the user, not the software.
Microsoft is right. The user is using Microsoft software.
This was not an exhaustive search, nor a statistically significant sample group, and dynamic IP allocation muddled the results a bit, but it was enough to make me wonder. How many of the 'code red attacks' these days are really script kitties with unix boxes? My guess is they account for most of them.
Has anyone looked into this for more than the 15-20 minutes I put into it?
Build stuff. Stuff that walks, stuff that rolls, whatever.
robots.txt has a legitimate use. Redirecting attempts to access it would be extremely stupid.
When a legitimate bot such as google scans your system, it looks in robots.txt for find out where NOT to scan in case you have web pages you do not wish to be searchable.
-- Will program for bandwidth
We jokingly discussed an Evil Plan where I worked when CodeRed first came out.
One thing we discussed doing was getting a copy, disassembling it, and building a version that would install FreeBSD with Apache with Front Page Extensions and the Active Server Pages module over top of the Windows installation, with all of the web site content left more or less intact.
We figured that it would be pretty cool if we could make it so that people would not notice that their server had been "competitively upgraded" until the next scheduled reboot/update.
We thought that it would be even more likely to go a long time if we captured the console screen of the running server, and used it as the boot "splash screen" for the replacement OS...
Of course, as I said, doing this would be Evil, so we only discussed the possibility.
-- Terry
I share a birthday with an IIS worm! Seriously!
Do I get a cookie?
- Every coder makes programming errors (some more than others, true).
- Microsoft released a *working* patch a few months before the exploits started.
- A work around was also available.
- A properly installed & configured server was *not* vulnerable.
- A web server does not need to *establish* outbound HTTP connections through the firewall, only to accept and reply to them.
You kind of get an idea where they are coming from.PS. That last point is the crux, and denying webservers the ability to establish outbound HTTP connections would have stopped Code Red type exploits dead. If your network is properly configured, even if you are exploited, then the exploit should have a much harder time propagating and thus making you look like a complete incompetent. The *real* problem is that a *huge* proportion of sysadmins don't seem to understand the most basic of security principles, and that's not Microsoft's problem at all.
UNIX? They're not even circumcised! Savages!
Hotfixes don't kill webapps. I develop webapplications (the n-tier stuff, VC++/VB/ASP/IIS/SQLServer etc) for over 5 years now and have applied a zillion or so hotfixes on IIS and NT / Win2k server to keep the systems up to date, but never ever have I encountered 1 single hotfix which killed a webapplication nor did I hear from collegues that hotfixes killed their webapplications. If the webapp is written solidly, by the guidelines MS has supplied, you can apply any hotfix, period.
When your developers are not that educated however, perhaps they use dirty tricks which will break when a hotfix is applied (allthough I doubt it, hotfixes mostly overwrite existing files without updating CLS_ID's etc, because these stay the same) and the app will die after the hotfix is applied: one reason to kick them out the door for some real professionals.
Never underestimate the relief of true separation of Religion and State.
That stands for "You have been trolled".
The perl script is a troll, it won't work, I can't believe this got modded up.
Recommended gifts from admirers:
1) DIVX's of Hackers or The Net.
2) Natalie Portman... Enough said.
3) Port me to more platforms.
and finally.... a 2nd chance.
--
CodeRed, the lower user #. No relation to SirCam.
You should have seen it last year, one day we were receiving so many requests for non-existant files that out server was crawling, because our not found page was generated by some scripts. I simply wrote a Perl handler to handle it(roughly 60 secs) and that took care of it.
Quite humorous it was. And that we still get thousands of hits from infected machines is hilarious.
Heh, Internet worms... fun stuff.
Sticking feathers up your butt does not make you a chicken - Tyler Durden
Did it occur to you that maybe you should connect the box to the Internet as the LAST STEP? - AFTER the server is configured and PATCHED?
You can get the service pack on another system and write it to CD so you don't need an ethernet connection to make the system current with patches.
Plug the ethernet cable into the server as the dead LAST step.
Ever dream you could fly? Get up from the Flight Sim. I Fly
My home server, running WormScan:
Nimda - 319242 attacks
CodeRed 2 - 15488 attacks
CodeRed - 359 attacks
All from 5777 unique hosts.
You can accomplish anything you set your mind to. The impossible just takes a little longer.
Did it occur to you that maybe you should connect the box to the Internet as the LAST STEP? - AFTER the server is configured and PATCHED?
Perhaps that should be obvious to an experienced sysadmin, but most installers of Windows 2000 won't have a clue about such precautions. The intelligent thing for Microsoft to have done is not had IIS turned on by default. This is especially obvious when you consider how many of the Code Red hits you get come from people who obviously don't even use the IIS that's running on their box.
Since Microsoft is aiming their software at clueless users who can't be bothered to secure their machines, Microsoft needs to ensure that their software is secure out of the box.
Hey kids, there's only 5 days left 'til Yak Shaving Day!
Fifteen years ago we knew that Sun insisted on shipping SunOS with a "+" in
In the real world you have a checklist of things that must be done and things that must be changed before the box can put into production especially on the the big bad Internet. In our company, where the NT operations MCSE staff are not exactly the brightest thinkers, we have a standard Windows 2000 build document that has a security checklist and says to only install IIS if the box is going to be a web server. There ARE checkboxes in the custom install where you can deselect the install of IIS and other unneeded programs.
If you dare to draw a paycheck you SHOULD be a Professional. It's up to you to learn how a professional operates.
Ever dream you could fly? Get up from the Flight Sim. I Fly
Believe it or not, out of all the people in in the world running MS Outlook, fewer than 1% have ever pulled down security patches, see The Great MS Patch Nobody Uses.
Additionally, the Win2K/NT server guys are afraid to install security patches since they never are really how much of their server is going to break. Often times, Admins will patch the servers which touch the Internet but not the Internal servers for fear of breaking them. With Code Red, this was quite humorous because the outer servers were patched as soon as the Code Red patch was available, thinking this action would defend the realm against Code Red, but they forgot about the laptop users which brought Code Red in the back door via the local LAN.
But not to worry folks, once we get Palladium hardware in all our servers, this will not happen again right? In fact we won't even have to patch anymore, since everything will be secure and, only secure applications will be allowed to run.
Oh, wait, wouldn't IIS pass the palladium trusted application test?
Why yes it would...... and Code Red would join the list of "Trusted Secure Applications".!
Sorry, I have to smack Palladium everytime I get a chance.