- NANOG - lists.nanog.org

RE: Code Red : Any whitehouse.gov people around?
by Dave Stewart 20 Jul '01

20 Jul '01

At 10:04 AM 7/20/2001, Mike Najarian wrote: >Has anyone gutted an infected box to determine whether it's going to go for > whitehouse.gov > www.whitehouse.gov >or a hardcoded IP? While there's incomplete information available in the standard places, it appears to be a hardcoded IP. I, along with many others, have null routed it.... Symantec's site claims the IP address is no longer active at any rate. It *appears* that from xx-20-xxxx through xx-28-xxxx, this thing will attack that IP address... meaning that measures already in place will minimize damage from the portion of the code that attempts to flood 198.137.240.91. Networks where 198.137.240.91 isn't blocked could see network congestion, I suppose, if they host a large number of infected machines. I've seen a claim that if the date is greater than 28, the threads just go into an infinite sleep. From what I can see, I would expect another round of probes to take place starting on 01-August-2001...

2 1

Code Red : Any whitehouse.gov people around?
by Jasper Wallace 20 Jul '01

20 Jul '01

According to a recent post on bugtraq the worm is going to switch from infecting webservers to DDOS'ing whitehouse.gov in about 1/2 an hour or so. Now i'm not certain if the worm has a hardcoded ip to attack or will do a DNS lookup for whitehouse.gov, but if it is going to do a dns lookup then they've still got a chance to change the A records in their dns records to something else, like 127.0.0.1. Unfortunatly this will make it hard for people to track down and fix infected boxes, so if they could use an ip in a non-routable block, that's unlickley to be used for anything else, e.g. 192.0.2.1, which in on the 'TEST-NET', or possible on 192.0.0.1, which is on the range HP use for printer auto configuration (they only use 192.0.0.192). The TTL on the A RR for whitehouse.gov is 24 hours unfortunatly. :-( -- Internet Vision Internet Consultancy Tel: 020 7589 4500 60 Albert Court & Web development Fax: 020 7589 4522 Prince Consort Road vision(a)ivision.co.uk London SW7 2BE http://www.ivision.co.uk/

3 2

Re: Advanced Countermeasures to prevent a Ddos
by Hank Nussbacher 20 Jul '01

20 Jul '01

At 16:38 19/07/01 -0400, you wrote: It all hinges on your upstream ISPs. The things to ask for are: - SYN and ICMP rate limiting: If you buy a T3 from your upstream, you should ask that they place on *their* peering routers and on the router facing you, Cisco rate limits of about 512kb/sec of ICMP and about 128kb/sec of SYNs. Pay extra if need be. - anti-spoofing: require your upstream ISPs to implement full anti-spoofing for incoming packets. That includes RFC1918, unassigned IANA blocks and (as a minimum) IP anti-spoofing on all single-homed customer links (Cisco ip verify unicast reverse-path) - BGP community: Your upstream should allow you to announce a BGP community for any sub-prefix in your IP block (meaning he has to not be strict in the length of the prefix you announce to him since it can change dynamically) that will me ROUTENULL, which means they eat the packets for you. Find 2 upstreams who will agree to the above 3 items and you are 99% safe from dDoS. -Hank >I was wondering if anyone on this list has considered the idea of trying to >eliminate Ddos attacks while designing their Data Centre's network topology. >If so, did you include server isolation and or distribution? > >Secondly, is it even possible to eliminate (or as close to elimination as >one can have in the tech world) Ddos attacks with network design and server >implementation. Does anyone have an advanced understanding of these issues >and if so are you willing to exchange information off-line? > > >Scott E. MacKenzie >semackenzie(a)crop.attcanada.ca >

3 3

Code Red http log request
by Jon O . 20 Jul '01

20 Jul '01

Hey: I'm doing a post infection analysis of the Code Red worm. If you could send me any http logs showing hits on default.ida that would help get a larger sampling. cat /var/log/apache_access_log | grep default.ida This command outputs a great format. Thanks, Jon

1 0

Re: Cisco, Qwest, Cert, NIPC (was Re: Code Red -> Router Memory depletion? )
by Marshall Eubanks 20 Jul '01

20 Jul '01

> >The Code Red traffic is starting to have a measureable impact on >global Internet traffic. The Internet Health Report (Keynote) >and the Internet Weather Report (Matrix) are showing packet loss >increasing and reachability decreasing throughout the afternoon. >Latency didn't start increasing until this evening. > >Keynote is showing problems in QWEST's network, and Slashdot >is reporting that QWEST has widely deployed a version of the >Cisco 67x DSL router which is vulnerable to a HTTP data >corruption error caused byt the worm. > >http://www.cisco.com/warp/public/707/CBOS-multiple.shtml > >CERT/CC and the National Information Protection Center issued >advisories today. I don't know at what time, since it hasn't >appeared in my e-mail yet. But it is available on the NIPC >and CERT/CC web sites. > >http://www.nipc.gov/ >http://www.cert.org/ > > Sean; Is there any evidence that the worm attacks are quasi periodic ? I saw waves of packet loss on vBNS to Columbia U. this afternoon in multicast, with bad loss roughly every one minute out of 5 or so. This happened much of the afternoon, and is pretty unusual. Regards Marshall Eubanks

1 0

RE: Code Red
by Joe Blanchard 20 Jul '01

20 Jul '01

Only thing I have seen as far as attempts to attack a web server is the following from an apache server: (ip addy masked, although I did see some from a 10 addy) 10.10.18.109 - - [19/Jul/2001:09:03:53 -0400] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 205 "-" "-" I'm still not sure what this exploit does, other than return a strange error page, not a 404 on an MS IIS system, but more like a "failed SQL query" page on the ones I've tested. I've not had enough time to further this exploit. As for the payload of these items, some of the systems that attempted this seemed to be unpatched for the exploit regarding getting a root shell. Of the ones I had been able to see the exploit on, there was an exe in the scripts directory called root.exe, which turns out to be a copy of cmd.exe. In short, I would assume that if the boxes in question had that exploit any number of payloads(timebombs) could have been deployed. I just figure I'll put up a page called Default.ida on Apache server, some ads and start charging for the hits.. Just my 2¢s -Joe -----Original Message----- From: Dave Stewart [mailto:dbs@ntrnet.net] Sent: Thursday, July 19, 2001 8:32 PM To: nanog(a)merit.edu Subject: Re: Code Red At 11:12 PM 7/19/2001, lucifer(a)lightbearer.com wrote: >Reports from our monitoring systems saw the CPU usage jump by somewhere >between 150-200% for our core routers today; our current theory is that Web servers that were hit beginning this morning at 11:26:41 EDT have not seen another attempt since 19:49:53. I'm wondering if this because it was coming up on 00:00:00 GMT 20-July-2001. According to the PC-Cillin write up, the 100-thread scan only takes place if the system date is less than 20, but if it's 20-28, it launches it's DOS attack at www1.whitehouse.gov Does anybody really know yet what payloads this thing is carrying?

1 0

[clarification] Community Colocation Service
by David E. Weekly 20 Jul '01

20 Jul '01

Just as a clarification, my work on providing a community colocation service is NOT related to my employment at Legato. They are not sponsoring, endorsing, or in any way are connected to this project. This is a personal project only and will hopefully soon be officially incorporated as a non-profit organization. =) Yours, -david

1 0

Re: Apparent widespread Worldcom ATM failure
by Sean Donelan 20 Jul '01

20 Jul '01

As of this evening, the FCC web site is not showing any carrier filing an outage report due to the Baltimore tunnel fire. On Thu, 19 July 2001, Steve Bellovin wrote: > The mainstream media have noticed the effect of the derailment on the > net. See > > http://www.nytimes.com/aponline/technology/AP-Train-Derailment-Communicatio… > http://www.thewbalchannel.com/News/880504/index.html

1 0

Cisco, Qwest, Cert, NIPC (was Re: Code Red -> Router Memory depletion? )
by Sean Donelan 20 Jul '01

20 Jul '01

The Code Red traffic is starting to have a measureable impact on global Internet traffic. The Internet Health Report (Keynote) and the Internet Weather Report (Matrix) are showing packet loss increasing and reachability decreasing throughout the afternoon. Latency didn't start increasing until this evening. Keynote is showing problems in QWEST's network, and Slashdot is reporting that QWEST has widely deployed a version of the Cisco 67x DSL router which is vulnerable to a HTTP data corruption error caused byt the worm. http://www.cisco.com/warp/public/707/CBOS-multiple.shtml CERT/CC and the National Information Protection Center issued advisories today. I don't know at what time, since it hasn't appeared in my e-mail yet. But it is available on the NIPC and CERT/CC web sites. http://www.nipc.gov/ http://www.cert.org/

2 1

Code Red & Abilene
by Ian A Finlay 20 Jul '01

20 Jul '01

If one generates a movie of traffic flowing across abilene circuits, you can see a marked increase in traffic today. I wonder how much of that increase can be attributed to the scanning activity? http://hydra.uits.iu.edu/~abilene/traffic/movie.cgi?archive=%2Fhome%2Fabile… Regards, Ian

1 0