- NANOG - lists.nanog.org

RE: Code Red growth stats
by Roeland Meyer 02 Aug '01

02 Aug '01

> From: Steven M. Bellovin [mailto:smb@research.att.com] > Sent: Wednesday, August 01, 2001 7:36 PM > If it has indeed turned up again, I'm at a loss to explain it. While > I'm sure there are some IIS servers on home machines, I doubt > there are > that many. But I don't have another explanation to offer. Are you taking into account that every copy of Win2K comes with IIS? I had to quickly run around and do upgrades yesterday. I clean forgot about the workstations. I bet that I'm not the only one either.

1 0

Re: Code Red growth stats
by Steven M. Bellovin 02 Aug '01

02 Aug '01

In message <200108012026.QAA29111(a)thelonius.ai.mit.edu>, Petr Swedock writes: > > >There's no indication on how the stats are collected... Is it by IP >addr reported? Does it take into account duplicates (re-infection >rates?) > While they don't say, the "number of infected hosts" graph makes me assume that they're counting unique IP addresses that tried to hit them. As I said, my numbers are consistent with others posted here. And I've gotten private mail about another, similar observation -- Code Red, Round 2, appears to have peaked a few hours ago. --Steve Bellovin, http://www.research.att.com/~smb

2 1

Re: Code Red growth stats
by Steven M. Bellovin 02 Aug '01

02 Aug '01

In message <Pine.SOL.3.93.1010801170555.4987V-100000(a)acns.fsu.edu>, Scott Sturs a writes: > >On Wed, 1 Aug 2001, Dave Stewart wrote: > >> I suspect we'll see it begin to pick up a little bit... it looks like >> Billybob is just starting to get home from work and fire up his whizbang >> Windows 2000 machine, which he put IIS on so he can share kewl warez and >> mp3z with his leet friends... > >At 1500 EDT I put a counter on one of our commodity Internet connections, >looking for port 80 connects to one of our unassigned /24 subnets. Here >are the results so far: > >1500-1530: 682 >1530-1600: 536 >1600-1630: 533 >1630-1700: 643 > >Seems to be picking up. Maybe -- we need more data to be sure. But -- given that a lot of folks have patched systems over the last two weeks -- I suspect it's running out of "food". Look at the graph from the last go-round at http://www.cert.org/advisories/CA-2001-23.html -- it leveled off, too. (If the Worm is operating on UTC, the "stop" phase would have commenced at 2000 EDT. Even if it ran on local time, Western European machines wouldn't quiesce until 1700. The drop off starts well before that.) --Steve Bellovin, http://www.research.att.com/~smb

3 2

Re: MicroSoft amplification?
by Steven M. Bellovin 02 Aug '01

02 Aug '01

In message <OF3DD9155A.FA5F9232-ON88256A9B.00804F54(a)almaden.ibm.com>, "Tony Ral l" writes: > >I see it too, on that address and on the second of the 3 addresses mapped >to www.microsoft.com (the third address doesn't respond at all). > >Most likely this is due to a not very smart load distribution system. I'm told that that is indeed the case. Well, strike the "not very smart" part -- I wasn't told that -- but I was told that it is indeed because of the load distribution system. --Steve Bellovin, http://www.research.att.com/~smb

1 0

RE: Code Red growth stats
by Paul Lantinga 01 Aug '01

01 Aug '01

> -----Original Message----- > From: Christopher A. Woodfield [mailto:rekoil@semihuman.com] > > heh, maybe someone can take the worm code and use it to apply the IIS > patch instead of DoS'ing the White House... :) I'd be really curious as to how the courts in various countries would handle something like that. Would patching someone else's server or system without their prior knowledge or consent be considered illegal access? Would it make a difference to the court if the server or system was actively attacking[1] your system? "Mr. Judge, I was only using the resources at my disposal to stop the attack upon my own systems." What if it wasn't attacking you? How would you all feel if the US FBI or other gov't branch patched your server without you consenting or knowing? What if someone proposed that software companies be liable for sloppy coding that allows this kind of thing to happen so frequently? I'm guessing that several truckloads of lawyers could live off of something like that for many years. Paul LANtinga. [1] we all know how well defined that is. ;)

1 0

Internet Pulse report was Re: A watched...
by Simon Waters 01 Aug '01

01 Aug '01

Ironically after I sent the last NANOG message I checked the http://internetpulse.com site again, and QWEST have improved their performance, so the Internet is apparently "healthier" now than it was when Code Red started this morning.

1 0

Re: Code Red growth stats
by Dave Stewart 01 Aug '01

01 Aug '01

At 04:28 PM 8/1/2001, Stephen J. Wilcox wrote: >Does anyone have any theories as to why its tailing, are the thousands of >vulnerable machines being patched all of a sudden? If not then why is >traffic decreasing so fast when the worm just keeps searching? I suspect we'll see it begin to pick up a little bit... it looks like Billybob is just starting to get home from work and fire up his whizbang Windows 2000 machine, which he put IIS on so he can share kewl warez and mp3z with his leet friends... I'm seeing more probes from Roadrunner and @Home hosts in the last little while.

5 4

Re: Code Red growth stats
by Steven M. Bellovin 01 Aug '01

01 Aug '01

I > I ran a little script on the totals reported by www.incidents.org, calculating the ratio between successive samples. (The latest graph I could find, as of 1615 EDT, ended at 1400 EDT.) There was a period of steady exponential growth in there, but it seems to be tailing off. That's consistent with another report posted here. 2.06579 1.6051 1.96429 1.80404 1.78163 1.81081 1.66331 1.67091 1.6844 1.63127 1.4773 1.29124 1.15538 --Steve Bellovin, http://www.research.att.com/~smb

3 2

RE: Code Red growth stats
by Joe Blanchard 01 Aug '01

01 Aug '01

Not sure. I do know that I have been informing the EDUs that seem to have multiple nodes infected and actually am getting a response from them that they are being fixed. Don't know. -Joe > ---------- > From: Stephen J. Wilcox[SMTP:steve@opaltelecom.co.uk] > Sent: Wednesday, August 01, 2001 1:28 PM > To: Steven M. Bellovin > Cc: k claffy; nanog(a)nanog.org > Subject: Re: Code Red growth stats > > > On Wed, 1 Aug 2001, Steven M. Bellovin wrote: > > > I ran a little script on the totals reported by www.incidents.org, > > calculating the ratio between successive samples. (The latest graph I > > could find, as of 1615 EDT, ended at 1400 EDT.) There was a period of > > steady exponential growth in there, but it seems to be tailing off. > > That's consistent with another report posted here. > > Does anyone have any theories as to why its tailing, are the thousands of > vulnerable machines being patched all of a sudden? If not then why is > traffic decreasing so fast when the worm just keeps searching? > > Steve > > >

1 0

Re: Code Red growth stats (fwd)
by Larry Sheldon 01 Aug '01

01 Aug '01

> On Wed, 1 Aug 2001, Steven M. Bellovin wrote: > > > I ran a little script on the totals reported by www.incidents.org, > > calculating the ratio between successive samples. (The latest graph I > > could find, as of 1615 EDT, ended at 1400 EDT.) There was a period of > > steady exponential growth in there, but it seems to be tailing off. > > That's consistent with another report posted here. > > Does anyone have any theories as to why its tailing, are the thousands of > vulnerable machines being patched all of a sudden? If not then why is > traffic decreasing so fast when the worm just keeps searching? A couple of conjectures.... What is the correllation between infection rate and population-where-it-is- still-daylight? (Its middle of the night in Europe, no?) What is the likelyhood that people who din't know they were running IIS have turned it off. How about nets blocking port 80?

1 0