- NANOG - lists.nanog.org

Re: Worm probes
by Ulf Zimmermann 18 Sep '01

18 Sep '01

On Tue, Sep 18, 2001 at 11:18:58AM -0700, Michael Martin wrote: > I was getting a huge number of probes on my Bay Area @home cablemodem until > about an hour and a half ago and it looked to be exclusively from @home > space. At that point the traffic I was seeing to my two IPs dropped from > about 200 kbit/sec to zero. It looks like @home put some filters in place. > I in the Bay Area too with @Home service (also got Speakeasy business DSL). As for 11:39am PDT I still see probes on @Home still. -- Regards, Ulf. --------------------------------------------------------------------- Ulf Zimmermann, 1525 Pacific Ave., Alameda, CA-94501, #: 510-865-0204

1 0

RE: Worm probes
by Smith, Rick 18 Sep '01

18 Sep '01

For the past 2 weeks or so, we were averaging 1,200 probes per hour. As of 8 or so this morning, we started averaging > 25,000 per hour! I've noticed that at the same time, we started getting probes from our provider's space (uniquely 23 addresses there), but not our own. Until this morning, we had *0* probes from inside our provider's space. Maybe this is the next round kicking off, looking for things to infect locally before searching the world again. Rick P.S. - Right now: (looks like it will be a bit over 25k this hour :) [root /usr/local/bin]# checkcodered.bash Code Red Log Checker Beginning Time: 10:00:00 Ending Time: 10:32:42 Number of attacks... 31730 Number of unique addresses... 3344 -----Original Message----- From: Daniel Senie [mailto:dts@senie.com] Sent: Tuesday, September 18, 2001 10:26 AM To: sigma(a)pair.com; nanog(a)merit.edu Subject: Re: Worm probes At 09:54 AM 9/18/01, sigma(a)pair.com wrote: >Has anyone else been seeing a dramatic increase in /scripts/.. NT worm >probes this morning? We're seeing about 8000/second, starting around 9:15 >Eastern time, to and from a wide variety of addresses. > >Is CodeRed or one of its relatives scheduled to start sweeping again today? >We've never seen this level of traffic related to the NT worms. Even >though we don't run any NT at all, we still have to suffer :( First ones appeared today, and so far I see 17650 attempts on just one of my servers. We don't run any Microsoft stuff either, but that doesn't keep our servers from getting hammered... ----------------------------------------------------------------- Daniel Senie dts(a)senie.com Amaranth Networks Inc. http://www.amaranth.com

4 3

Re: Re: FW: Worm probes
by Frank Coluccio 18 Sep '01

18 Sep '01

re < readme.exe > : http://www.cert.org/current/current_activity.html#port80 > > > There is also an email vector where README.EXE is sent via email to > > numerous accounts. > > It also seems to set the from address in both the envelope and > header to an address, possibly from the address book(?). I've seen > a number of bounces come back to one of our NOC addresses, and a > couple of reports from humans. :( > > Rob >

1 0

FW: Worm probes
by Braun, Mike 18 Sep '01

18 Sep '01

I received this warning from TruSecure regarding the latest worm attack. Mike Braun First American CREDCO -----Original Message----- TruSecure ALERT- TSA 01-023 - W32.nimda.a.mm Date: September 18, 2001 Time: 1000 EDT RISK INDICES: Initial Assessment: RED HOT Threat: VERY HIGH, (rapidly increasing) Vulnerability Prevalence: VERY HIGH, effects IIS servers version 4.0, 5.0, and internal networks. Cost: High, command execution is possible Vulnerable Systems: IIS 4.0 and 5.0 SUMMARY: A new IIS worm is spreading rapidly. Its working name is Nimda: W32.nimda.a.mm It started about 9am eastern time today, Tuesday,September 18, 2001, Mulitple sensors world-wide run by TruSecure corporation are getting multiple hundred hits per hour. And began at 9:08am am. The worm seems to be targeting IIS 4 and 5 boxes and tests boxes for multiple vulnerabilities including: Almost all are get scripts, and a get msadc (cmd.exe) get_mem_bin vti_bin owssvr.dll Root.exe CMD.EXE ../ (Unicode) Getadmin.dll Default.IDA /Msoffice/ cltreq.asp This is not code red or a code red variant. The worm, like code red attempts to infect its local sub net first, then spreads beyond the local address space. It is spreading very rapidly. TruSecure believes that this worm will infect any IIS 4 and IIS 5 box with well known vulnerabilities. We believe that there are nearly 1Million such machines currently exposed to the Internet. Risks Indices: Vulnerability VULNERABILITY PREVALANCE is very high - Milllions of Internet Web server hosts: TruSecure process and essential configurations should generally be protective. The vulnerability prevalence world-wide is very high Threat - VERY HIGH and Growing The rate of growth and spread is exceedingly rapid - significantly faster than any worm to date and significantly faster than any variant of Code red. Cost -- Unknown, probably moderate per infected system. The worm itself is a file called README.EXE, or ADMIN.DLL a 56K file which is advertised as an audio xwave mime type file. Other RISKS: There is risk of DOS of network segments by traffic volume alone There is large risk of successful attack to both Internet exposed IIS boxes and to developer and Intranet boxes inside of corporations. Judging by the Code Red II experience, we expect many subtle routes of infection leading to inside corporate infections. We cannot discount the coincidence of the date and time of release, exactly one week to (probably to the minute) as the World Trade Center attack . REPLICATION: There are at least three mechanisms of spread: The worm seems to spread both by a direct IIS across Internet (IP spread) It probably also spreads by local shares. (this is not known for sure at this time) There is also an email vector where README.EXE is sent via email to numerous accounts. Mitigations TruSecure essential practices should work. Block all email with EXE attachments Filter for README.EXE Make sure IIS boxes are well patched and hardened, or removed from both the Internet and Intranets. Make sure any developer computing platforms are not running IIS of any version (many do so by default if either. Disconnect mail from the Internet Advise users not to double click on any unexpected attachments. Update anti-virus when your vendor has the signature. -----Original Message----- From: Bryan Heitman [mailto:bryanh@communitech.net] Sent: Tuesday, September 18, 2001 8:22 AM To: nanog(a)merit.edu Subject: Re: Worm probes We're also seeing a large increase in this activity. This seems to be more severe than the first time. Have an additional 30 to 40 meg inbound from this. Best regards, Bryan Heitman CommuniTech.Net, Inc. ----- Original Message ----- From: <up(a)3.am> To: <nanog(a)merit.edu> Sent: Tuesday, September 18, 2001 10:05 AM Subject: Re: Worm probes > > > ugh...this is way more impact...a 128k ISDN customer running an NT/Win2k > box is at 100% BW, and my 2x T1's are at about 2x normal traffic for this > time of day, although still well short of capacity...apache server > processor load is WAY up just from the requests, and the logs are growing > like mad. > > On Tue, 18 Sep 2001, deeann mikula wrote: > > > > > On Tue, 18 Sep 2001, ravi pina wrote: > > > > > > > > On Tue, Sep 18, 2001 at 09:54:31AM -0400, sigma(a)pair.com said at one point in time: > > > > > > > > > > > > Has anyone else been seeing a dramatic increase in /scripts/.. NT worm > > > > probes this morning? We're seeing about 8000/second, starting around 9:15 > > > > Eastern time, to and from a wide variety of addresses. > > > > > > affirmative. i just looked at my logs, and it looks like > > > each probe tries a bunch of things. i haven't seen much > > > on the lists, but i'm looking right now. > > > > i'm pretty sure that the worm's attack phase starts on the 20th (which > > of course, depends upon a correctly set system clock) and also that > > attempting to execute something like /scripts/root.ext/c++ something > > is involved. > > > > i think that cert's website would be a good place to look. i'm *not* > > a security/virus chick, but i did host a talk by marty linder of cert > > where he discected code red's activity and presented a summary. > > > > cert is of course, http://www.cert.org. > > > > > > deeann m.m. mikula > > > > director of operations > > telerama public access internet > > http://www.telerama.com > > 1.877.688.3200 > > > > > > > > > > James Smallacombe PlantageNet, Inc. CEO and Janitor > up(a)3.am http://3.am > ========================================================================= > "MMS <firstam.com>" made the following annotations on 09/18/01 08:34:15 ------------------------------------------------------------------------------ "THIS E-MAIL MESSAGE AND ANY FILES TRANSMITTED HEREWITH, ARE INTENDED SOLELY FOR THE USE OF THE INDIVIDUAL(S) ADDRESSED AND MAY CONTAIN CONFIDENTIAL, PROPRIETARY OR PRIVILEGED INFORMATION. IF YOU ARE NOT THE ADDRESSEE INDICATED IN THIS MESSAGE (OR RESPONSIBLE FOR DELIVERY OF THIS MESSAGE TO SUCH PERSON) YOU MAY NOT REVIEW, USE, DISCLOSE OR DISTRIBUTE THIS MESSAGE OR ANY FILES TRANSMITTED HEREWITH. IF YOU RECEIVE THIS MESSAGE IN ERROR, PLEASE CONTACT THE SENDER BY REPLY E-MAIL AND DELETE THIS MESSAGE AND ALL COPIES OF IT FROM YOUR SYSTEM." ==============================================================================

3 2

Re: Our Qwest Testimonial: qwestoutage.com
by Paul Vixie 18 Sep '01

18 Sep '01

> This really is way outside most people's "disaster recovery" scenarios. I > can see the thinking now: "If both WTC towers fall over, we have much > bigger things to worry about than fiber cuts." And they were right. Right as far as that goes, yes. But since fiber paths of that kind are used to feed cell towers and other parts of the communications infrastructure including emergency services infrastructure, it IS worth thinking about communications robustness even in the face of destruction on this scale. Not so that folks can surf the web but so that folks in air pockets can call out to their rescuers. -- Paul Vixie <vixie(a)eng.paix.net> President, PAIX.Net Inc. (NASD:MFNX)

1 0

RE: Worm probes
by Roeland Meyer 18 Sep '01

18 Sep '01

2 1

Worm impact - September 18 2001
by Sean Donelan 18 Sep '01

18 Sep '01

I first noticed the worm this morning at the same time the national moment of silence was being broadcast. My web e-mail provider was knocked off the air at that time. I'm using an alternate account. Approximately 1,000 networks of 104,200 vanished from the routing table as seen by Telstra in the past two hours Keynote Internetpulse.com was showning "red" congestion between C&W and Qwest, which has since cleared. InternetTrafficReport.com stopped reporting data. All zeros across the board. Matrix.net Internet Weather Report shows a 3 percent drop in reachability of tested servers.

1 0

RE: Our Qwest Testimonial: qwestoutage.com
by Smith, Rick 18 Sep '01

18 Sep '01

Dsl.net was up all night, down again this morning. Blah. Their idea of redundant links must have been 1 fiber into Tower 1 and another into Tower 2. They'll never BOTH go away, Right? -----Original Message----- From: wgray(a)wwns.net [mailto:wgray@wwns.net] Sent: Tuesday, September 18, 2001 12:01 PM To: nanog(a)merit.edu Subject: RE: Our Qwest Testimonial: qwestoutage.com You should should call the website OUTAGE and include DSL.Net also. -----Original Message----- From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Allen Gwinn Sent: Tuesday, September 18, 2001 10:42 AM To: nanog(a)merit.edu Subject: Our Qwest Testimonial: qwestoutage.com Greetings, Simply put, they've put us through hell, so I've put a website up to tell our story at qwestoutage.com. I'd be interested in feedback--especially anyone that has had similar or different experiences than we've had. I've heard from another customer (DS-3 customer) who has had fairly good experience. His comment was, "the hardest thing to do is to get their attention--but once you do that, they're fairly responsive." I heard from one more that is decommissioning their Qwest circuits nationwide and moving back to UUNET. Thanks, Allen

2 1

Re: What Worked - What Didn't
by Martin Cooper 18 Sep '01

18 Sep '01

Alex Bligh <alex(a)alex.org.uk> writes: > --On Monday, 17 September, 2001 2:32 PM -0400 "Patrick W. Gilmore" > <patrick(a)ianai.net> wrote: > > > Maybe I missed something? > > Only all the well documented attacks (including DoS). > Think about sending RST to BGP port (and other random > ports) on your routers. I thought TCP stacks were supposed to do sequence number checking on RST's to make sure they fell within the bounds of the unacknowledged portion of the current window? Or is Cisco's implementation broken? M.

3 3

An argument for multi-homing
by Roeland Meyer 18 Sep '01

18 Sep '01

1 0