July 2001 - Test - lists.nanog.org

RE: Code Red
by Joe Blanchard 19 Jul '01

19 Jul '01

Only thing I have seen as far as attempts to attack a web server is the following from an apache server: (ip addy masked, although I did see some from a 10 addy) 10.10.18.109 - - [19/Jul/2001:09:03:53 -0400] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3% u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 205 "-" "-" I'm still not sure what this exploit does, other than return a strange error page, not a 404 on an MS IIS system, but more like a "failed SQL query" page on the ones I've tested. I've not had enough time to further this exploit. As for the payload of these items, some of the systems that attempted this seemed to be unpatched for the exploit regarding getting a root shell. Of the ones I had been able to see the exploit on, there was an exe in the scripts directory called root.exe, which turns out to be a copy of cmd.exe. In short, I would assume that if the boxes in question had that exploit any number of payloads(timebombs) could have been deployed. I just figure I'll put up a page called Default.ida on Apache server, some ads and start charging for the hits.. Just my 2¢s -Joe -----Original Message----- From: Dave Stewart [mailto:dbs@ntrnet.net] Sent: Thursday, July 19, 2001 8:32 PM To: nanog(a)merit.edu Subject: Re: Code Red At 11:12 PM 7/19/2001, lucifer(a)lightbearer.com wrote: >Reports from our monitoring systems saw the CPU usage jump by somewhere >between 150-200% for our core routers today; our current theory is that Web servers that were hit beginning this morning at 11:26:41 EDT have not seen another attempt since 19:49:53. I'm wondering if this because it was coming up on 00:00:00 GMT 20-July-2001. According to the PC-Cillin write up, the 100-thread scan only takes place if the system date is less than 20, but if it's 20-28, it launches it's DOS attack at www1.whitehouse.gov Does anybody really know yet what payloads this thing is carrying?

1 0

[clarification] Community Colocation Service
by David E. Weekly 19 Jul '01

19 Jul '01

Just as a clarification, my work on providing a community colocation service is NOT related to my employment at Legato. They are not sponsoring, endorsing, or in any way are connected to this project. This is a personal project only and will hopefully soon be officially incorporated as a non-profit organization. =) Yours, -david

1 0

Re: Apparent widespread Worldcom ATM failure
by Sean Donelan 19 Jul '01

19 Jul '01

As of this evening, the FCC web site is not showing any carrier filing an outage report due to the Baltimore tunnel fire. On Thu, 19 July 2001, Steve Bellovin wrote: > The mainstream media have noticed the effect of the derailment on the > net. See > > http://www.nytimes.com/aponline/technology/AP-Train-Derailment-Communicatio… > http://www.thewbalchannel.com/News/880504/index.html

1 0

Cisco, Qwest, Cert, NIPC (was Re: Code Red -> Router Memory depletion? )
by Sean Donelan 19 Jul '01

19 Jul '01

The Code Red traffic is starting to have a measureable impact on global Internet traffic. The Internet Health Report (Keynote) and the Internet Weather Report (Matrix) are showing packet loss increasing and reachability decreasing throughout the afternoon. Latency didn't start increasing until this evening. Keynote is showing problems in QWEST's network, and Slashdot is reporting that QWEST has widely deployed a version of the Cisco 67x DSL router which is vulnerable to a HTTP data corruption error caused byt the worm. http://www.cisco.com/warp/public/707/CBOS-multiple.shtml CERT/CC and the National Information Protection Center issued advisories today. I don't know at what time, since it hasn't appeared in my e-mail yet. But it is available on the NIPC and CERT/CC web sites. http://www.nipc.gov/ http://www.cert.org/

2 1

Code Red & Abilene
by Ian A Finlay 19 Jul '01

19 Jul '01

If one generates a movie of traffic flowing across abilene circuits, you can see a marked increase in traffic today. I wonder how much of that increase can be attributed to the scanning activity? http://hydra.uits.iu.edu/~abilene/traffic/movie.cgi?archive=%2Fhome%2Fabile… Regards, Ian

1 0

RE: 3+ hours into "Code Red" (BST)
by Joe Blanchard 19 Jul '01

19 Jul '01

Oddly, right around 5pm(PST) I noticed less and less traffic(scans at my firewall) looking for tcp port 80. At the height of today 50% of our traffic on one of our T1s was various foreign addresses looking for open http servers. This is much more then usual and at first thought to be a spoof attack, but the nodes being scanned were too random. Don't know, but most of the ips we logged turned out to be MS IIS none patched boxes. Wonder if these hits on valid http servers are counted as hits and charged to the advertisers? lol. Oh well. -Joe

1 0

3 hours into "Code Red" (BST)
by Av 19 Jul '01

19 Jul '01

No real increase in traffic at LINX in the UK. I'm wondering if the bug is designed to trigger at midnight on a different time zone (ie, not 'Midnight local time') ?? http://ochre.linx.net/cgi-pub/combined?log=combined.bits

2 1

Cogent Reviews?
by David E. Weekly 19 Jul '01

19 Jul '01

Hi, all. I'm looking to start a non-profit community colocation facility in Silicon Valley, and it seemed to me that Cogent Communications had the best deal on getting a big chunk of bandwidth ($1000/months for 100mbps). Are there comparable deals out there, or is Cogent the only one at this price point? Do they have good peering? What kind of latency/throughput does one get over their network? Do they have any customers? Any of you use Cogent? Thanks *so* much for any of your input; we're hoping to keep costs way down, any input on this would be much appreciated. Yours, -david

5 8

Re: Code Red -> Router Memory depletion?
by Steven M. Bellovin 19 Jul '01

19 Jul '01

A colleague of mine, Balachander Krishnamurthy, is looking for Web server logs from sites that have been attacked by Code Red. He's working on analysis techniques to detect flash crowds, DDoS attacks, etc. Please reply directly to him (bala(a)research.att.com) if you can supply any data. (You can see the kind of stuff he's been doing by looking at some of his recent papers, at www.research.att.com/~bala/papers)

1 0

Re: Apparent widespread Worldcom ATM failure
by Steve Bellovin 19 Jul '01

19 Jul '01

The mainstream media have noticed the effect of the derailment on the net. See http://www.nytimes.com/aponline/technology/AP-Train-Derailment-Communicatio… http://www.thewbalchannel.com/News/880504/index.html --Steve Bellovin, http://www.research.att.com/~smb

1 0