- NANOG - lists.nanog.org

A call to sanity/action on responding to Code Red.
by Erik Antelman 31 Jul '01

31 Jul '01

according to a "pundit" (http://www.pbs.org/cringely/pulpit/pulpit20010730.html) "officials" determined that sending E-Mails to sysadmins of infected domains would be unacceptable. WHAT!? - This is crazy, I learned of our server being infected by a admin in Oregon and I was grateful, who wouldn't be? Those that would be upset can live with the abuse as long as they don't fix there machines. A central authority notifying infected hosts would be far more beneficial than wasting bandwidth on redundant notifications, until such an authority stands up keep those notifications going out to people with infected machines. for(;;); /* eantelman(a)acm.org */

1 0

Code Red round two
by Larry Sheldon 31 Jul '01

31 Jul '01

> So what, if anything, are people planning to do differently as 8 pm > EDT today and the possibility of a new round of Code Red Worm > activity approaches? Are there things that we as network operators > can and should be doing beyond encouraging end users to patch their > vulnerable systems? I'll do what I have done for most of the over-hyped hysterical panics that I have taken the time to think through (yes, that says I have dozed and gotten caught up in frenzies--Y2K was not one of them [1]): I'll go to the dentist to get a tooth filled after lunch. That will annoy me enough that I will go home. I'll feed the cats, and make myself something interesting (last day to play, my wife returns tomorrow) to eat. I'll either eat what I made, or head 7 miles to the nearest pizza store for a replacement (they won't deliver that far out <*snif*>. To earn the big bucks I get, at the magic hour or as soon as I finish eating, which ever occurs last), I'll start paying closer attention to our network indicators, the logs, email, and the office voice mail. If the evening goes the way I think it will, I'll get tired of it and go to bed. If it goes the way some say it will, in between telephone calls to the support troops (they are all on "speed dial" anyway), I'll be looking up recipes for things like, crow, my hat and so on. [1] Does anybody else think that W2K actually is doing what Y2K only dreamed of?

1 0

Re: Hard data on network impact of the "Code Red" worm?
by Steven M. Bellovin 31 Jul '01

31 Jul '01

In message <200107310341.WAA01723(a)bluejay.creighton.edu>, Larry Sheldon writes: > >> On Mon, 30 July 2001, k claffy wrote: >> > so, 1 aug midnite GMT (tomorrow 17:00 in california), >> > codered goes back into 'spread' mode. >> > within a few hours, we'll have 100,000-300,000 >> > globally infected machines again. > >NTBUGTRAQ is carrying informatiion that says that is not right. > >They say that currently extant copies of the thing will sleep forever, >or until the host is re-booted--at which time the thing ceases to exist. There seems to be some disagreement about this point. CERT, in fact, notes that explicitly (http://www.cert.org/advisories/CA-2001-23.html) They also claim that enough infected machines have their clocks set wrong that there may be a new outbreak tonight (EDT) -- that one strikes me as less plausible. > >The hazard tomorrow is the introduction of new copies of the thing. > That hazard isn't specific to August 1. --Steve Bellovin, http://www.research.att.com/~smb

1 0

Re: Hard data on network impact of the "Code Red" worm?
by Sean Donelan 31 Jul '01

31 Jul '01

On Mon, 30 July 2001, Christian Kuhtz wrote: > Your logic is flawed. If this was true, zombie networks would be largely > ineffective. The current mutation is nothing more than an automated zombie > distribution network, with all fun options of current zombie networks such as > remote control, remote upgrades etc... > > You may want to read up on the details of this one, like the presentation at > the bottom of http://www.digitalisland.net/codered/ If "code red" is nothing more than what we've been seeing for years, why the special CNN reports every half-hour, and the joint press conference with our fearless leaders today? What makes "code red" so extrodinary it merits this special response, when previous "zombie" networks didn't? I have a hard time seeing how "Code Red" will ever live up to the advance hype on August 1. Is Don King managing the pay-per-view for this event? Michelangelo Vs. Code Red. Why don't we just have an annual, lets update your Microsoft software patches day. Every year the press can get on the bandwagon and remind us about changing the batteries in our smoke detectors and downloading the latest patches. There are a lot of flawed systems out there. Downloading a couple of patches for "Code Red" isn't enough to protect your system from all the other things. I'm worried the joint press release is doing a disservice if people have a false sense of security because they protected themselves from "code red." On the other hand, will wednesday really be that much different from any other wednesday with the normal thousdand DDOS attacks happening, and normal spam, and normal e-mail/macro viruses, and normal zombies? I think its a bit premature to predict the end of the Internet on August 1.

6 5

Re: Hard data on network impact of the "Code Red" worm?
by Sean Donelan 31 Jul '01

31 Jul '01

On Mon, 30 July 2001, k claffy wrote: > so, 1 aug midnite GMT (tomorrow 17:00 in california), > codered goes back into 'spread' mode. > within a few hours, we'll have 100,000-300,000 > globally infected machines again. > and presumably they won't stop at the > end of the day to start phase two this time. > (remember CRv2 only had a day before it > went into phase two the first time) I agree, we were lucky on some things. But predictions are always hard because we never completely understand the problem. What natural limits (or predators) exist controlling the spread of the worm. If the worm destroys the very infrastructure it needs to survive, it tends to be self- limiting. If the worm keeps re-infecting the same machines, they tend to die and stop spreading. Custodians (i.e. system and network administrators) have shown the ability to adapt, and respond if the worm is too slow. I suspect, but have no evidence, the worm can quickly spread through hundreds of thousands of machines, but then the worm's behavior tends to interfere with its ability to propagate. If it attacts attention to itself, the system administrator may take action. I know, later variants no longer change the web site. If the worm takes out DSL modems and other network infrastructure, machines behind DSL modem are isolated until a network operator can intervene. If the site is on auto-pilot, this also limits the worm. Several folks have sent me mail saying we should be worrying about the quiet zombie machines. They feel there are far more of them on the net than the "code red" worm. But the question is what are they waiting for? Argh, this is why I got out of security. Too many twisty passages. It is dark. You have been eaten by a Grue.

3 2

Hard data on network impact of the "Code Red" worm?
by Sean Donelan 30 Jul '01

30 Jul '01

As several government agencies gear up today to get additional funding, what hard data about the impact of the code read worm on the Internet exists? CAIDA posted some data about the speed of infection. But I was looking at overall Internet performance during the time period. The worm tended to revisit the same systems over, and over again, so I would agree those people may have been severely affected. But 350,000 hosts isn't that big of a number any more. The Morris Internet Worm infected an estimated 10% of the internet hosts of the day. What do you think had more world-wide impact on the Internet? 1. The train accident in Baltimore 2. The "code red" worm

7 7

Re: Hard data on network impact of the "Code Red" worm?
by k claffy 30 Jul '01

30 Jul '01

In-Reply-To: <20010730111612.2308.cpmta(a)c011.sfo.cp.net>; from sean(a)donelan.com on Mon, Jul 30, 2001 at 04:16:12AM -0700 As several government agencies gear up today to get additional funding, what hard data about the impact of the code read worm on the Internet exists? CAIDA posted some data about the speed of infection. But I was looking at overall Internet performance during the time period. actually we did see some difference in macroscopic performance from the skitter topology data, we're still writing that up but are a little more concerned with tracking the patching of systems at the moment (any grad students free, there are a few theses lurking in this data...) The worm tended to revisit the same systems over, and over again, so I would agree those people may have been severely affected. But 350,000 hosts isn't that big of a number any more. The Morris Internet Worm infected an estimated 10% of the internet hosts of the day. What do you think had more world-wide impact on the Internet? 1. The train accident in Baltimore 2. The "code red" worm am a little more concerned about the latter since i don't think the train accident is programmed to recur this tuesday, and the survey i mentioned caida is doing suggests that the patch rate is as slow as we feared so, 1 aug midnite GMT (tomorrow 17:00 in california), codered goes back into 'spread' mode. within a few hours, we'll have 100,000-300,000 globally infected machines again. and presumably they won't stop at the end of the day to start phase two this time. (remember CRv2 only had a day before it went into phase two the first time) the peak of infection will not hit until after normal business hours (in the US). note that even if you've patched, it may affect you (printers, routers, web load balancers, dsl modems, general 0.5-1.5 Tbps bandwidth that will be consumed, etc). do operators have some contigency plans? if everyone fiercely encouraging their customers to patch? do operators have an AUP that would allow them to filter port 80 (in this case) to hosts that are verified to be vulnerable? (mixed strategy since then that machine can't download the patch...) do you (nanog) want caida to provide a web page of stats of patched/unpatched systems by AS? in particular we find a LOT of unpatched systems behind cable modem providers (home.com, rr.com) we don't really have time to email each AS poc individually... but we don't want to upset the community either. http://worm-security-survey.caida.org/ also, we do expect that someone is writing a strain of it that will actually do 'g.c.f.' damage, yes? scary. really scary. k

2 1

Re: Hard data on network impact of the "Code Red" worm?
by Steven M. Bellovin 30 Jul '01

30 Jul '01

In message <00a501c1192b$dc200a60$0602a8c0@wojtek>, "Wojtek Zlobicki" writes: > >I just received an "URGENT" MS Security Advisory (I have never seen one >labeled as URGENT in the past). There is apparenlty a new mutation that is >to go out today :( Actually, while there may be new variants, the older ones are still of interest -- on 1 August, they'll go back into "spread" mode. --Steve Bellovin, http://www.research.att.com/~smb

1 0

Re: Hard data on network impact of the "Code Red" worm?
by Wojtek Zlobicki 30 Jul '01

30 Jul '01

Um ..... brain in SirCam Mode :) Oops!! ----- Original Message ----- From: "Larry Sheldon" <lsheldon(a)creighton.edu> To: <wojtekz(a)idirect.com> Cc: <lsheldon(a)creighton.edu> Sent: Monday, July 30, 2001 2:03 PM Subject: Re: Hard data on network impact of the "Code Red" worm? > > > Also, is it possible that the critter got through firewalls and "did > > harm", > > > but could not get back out again? I don't know of any cases like that. > > > > Well this just makes it a good idea to proxy outbound SMTP, just set up an > > access list for only allowing outbound TCP port 25 from certain hosts > > (verified mail servers). > > Umm.....Code Red Worm is all HTTP--port 80, no? > > I disremember any SMTP -- port 25 involvement. > > -- > -.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.- > . . > - L. F. (Larry) Sheldon, Jr. - > . Unix Systems and Network Administration . > - Creighton University Computer Center-Old Gym - > . 2500 California Plaza . > - Omaha, Nebraska, U.S.A. 68178 Two identifying characteristics - > . lsheldon(a)creighton.edu of System Administrators: . > - 402 280-2254 (work) Infallibility, and the ability to - > . 402 681-4726 (cellular) learn from their mistakes. . > - 402 332-4622 (residence) - > . http://www.creighton.edu/~lsheldon Adapted from Stephen Pinker . > -.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-

2 1

Re: Hard data on network impact of the "Code Red" worm?
by Sean Donelan 30 Jul '01

30 Jul '01

On Mon, 30 July 2001, Sean Donelan wrote: > What do you think had more world-wide impact on the Internet? > > 1. The train accident in Baltimore > 2. The "code red" worm What I found interesting is they both had about the same impact on the typical network performance measurements of packet loss, latency, reachability of the world-wide internet as measured by several public internet performance measurement companies. Perhaps someone like Akami has better data. Its somewhat of a rarity for a "security incident" to show up on the global network performance measurements close to the severity of a fiber cut like the Baltimore train wreck. Most security incidents, even typical DDOS attacks, have a significant affect on a few individual networks. But they tend to disappear into the noise when you look at global measurements. I needed to go back to the February 2000 DDOS attacks to find another security incident which had as severe an impact on global Internet performance.

1 0