- Test - lists.nanog.org

RE: MicroSoft amplification?
by Rishi Singh 02 Aug '01

02 Aug '01

The DUP packets resemble WLBS (Windows Load Balancing Service) in action. What platform did you ping it from? A unix host? Windows ping command does not show the extra icmp responses. Just a thought. -----Original Message----- From: Steven M. Bellovin [mailto:smb@research.att.com] Sent: Wednesday, August 01, 2001 8:18 PM To: Tony Rall Cc: nanog(a)merit.edu Subject: Re: MicroSoft amplification? In message <OF3DD9155A.FA5F9232-ON88256A9B.00804F54(a)almaden.ibm.com>, "Tony Ral l" writes: > >I see it too, on that address and on the second of the 3 addresses mapped >to www.microsoft.com (the third address doesn't respond at all). > >Most likely this is due to a not very smart load distribution system. I'm told that that is indeed the case. Well, strike the "not very smart" part -- I wasn't told that -- but I was told that it is indeed because of the load distribution system. --Steve Bellovin, http://www.research.att.com/~smb

1 0

Re: Internet Pulse report was Re: A watched...
by Avi Freedman 02 Aug '01

02 Aug '01

In article <10171.175034.25348(a)avi.netaxs.com> you wrote: : Ironically after I sent the last NANOG message I checked the : http://internetpulse.com site again, and QWEST have improved : their performance, so the Internet is apparently "healthier" now : than it was when Code Red started this morning. I'm not sure I'd put a lot of faith in internetpulse.com measurements... Better than matrix.net (who exists to make keynote look good), but not by very much. For example, "sprint to sprint" is now showing red, and digging in, it's "phoenix" to "phoenix" is 195ms. From one keynote machine in a rack to another? Riiiiiight. Avi

1 0

Re: A watched pot never boils: The Return of Code Red
by Andy Bradford 02 Aug '01

02 Aug '01

Thus said Sean Donelan on 01 Aug 2001 01:21:18 PDT: > Any updates from the field? Today I saw an extremely high number of scans of port 80 being blocked at the firewall for seemingly random IPs within our /21 at work. I wasn't really certain whether it was a distributed attack using spoofed IPs or whether it was related to Code Red... I'm still seeing them even now (I hope this isn't inappropriate for this list): Aug 1 21:29:44 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 211.72.54.109:2162 216.250.133.18:80 L=48 S=0x00 I=16335 F=0x4000 T=111 SYN (#601) Aug 1 21:29:45 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 148.245.219.161:2328 216.250.132.139:80 L=48 S=0x00 I=21203 F=0x4000 T=116 SYN (#601) Aug 1 21:29:47 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 203.126.253.242:50221 216.250.135.40:80 L=48 S=0x00 I=24959 F=0x4000 T=106 SYN (#601) Aug 1 21:29:49 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 63.214.199.137:4107 216.250.134.32:80 L=48 S=0x00 I=2393 F=0x4000 T=114 SYN (#601) Aug 1 21:29:49 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 193.251.1.38:52206 216.250.130.33:80 L=48 S=0x00 I=20648 F=0x4000 T=101 SYN (#601) Aug 1 21:29:49 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 217.83.8.106:3030 216.250.130.163:80 L=48 S=0x00 I=64392 F=0x4000 T=109 SYN (#601) Aug 1 21:29:50 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 211.72.54.109:2162 216.250.133.18:80 L=48 S=0x00 I=18317 F=0x4000 T=111 SYN (#601) Aug 1 21:29:50 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 66.57.43.29:4461 216.250.130.89:80 L=64 S=0x00 I=4773 F=0x0000 T=112 SYN (#601) Aug 1 21:29:50 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 195.34.25.110:21213 216.250.128.7:80 L=48 S=0x00 I=39855 F=0x4000 T=112 SYN (#601) Aug 1 21:29:50 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 203.126.253.242:50221 216.250.135.40:80 L=48 S=0x00 I=25095 F=0x4000 T=106 SYN (#601) Aug 1 21:29:51 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 148.245.219.161:2328 216.250.132.139:80 L=48 S=0x00 I=21441 F=0x4000 T=116 SYN (#601) Aug 1 21:29:52 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 63.168.101.197:1147 216.250.133.251:80 L=48 S=0x00 I=63886 F=0x4000 T=114 SYN (#601) Aug 1 21:29:52 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 193.251.1.38:52206 216.250.130.33:80 L=48 S=0x00 I=20892 F=0x4000 T=101 SYN (#601) Aug 1 21:29:53 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 66.57.43.29:4461 216.250.130.89:80 L=64 S=0x00 I=4840 F=0x0000 T=112 SYN (#601) Aug 1 21:29:53 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 195.34.25.110:21213 216.250.128.7:80 L=48 S=0x00 I=40036 F=0x4000 T=112 SYN (#601) Aug 1 21:29:55 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 63.168.101.197:1147 216.250.133.251:80 L=48 S=0x00 I=63983 F=0x4000 T=114 SYN (#601) Aug 1 21:29:56 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 195.16.50.219:1363 216.250.134.218:80 L=48 S=0x00 I=23989 F=0x4000 T=114 SYN (#601) Aug 1 21:29:56 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 208.62.155.69:40665 216.250.134.69:80 L=48 S=0x00 I=43342 F=0x4000 T=116 SYN (#601) Aug 1 21:29:57 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 203.126.253.242:50221 216.250.135.40:80 L=48 S=0x00 I=25408 F=0x4000 T=106 SYN (#601) Aug 1 21:29:59 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 195.16.50.219:1363 216.250.134.218:80 L=48 S=0x00 I=24244 F=0x4000 T=114 SYN (#601) Aug 1 21:29:59 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 66.57.43.29:4461 216.250.130.89:80 L=64 S=0x00 I=4990 F=0x0000 T=112 SYN (#601) Aug 1 21:29:59 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 193.251.1.38:52206 216.250.130.33:80 L=48 S=0x00 I=21512 F=0x4000 T=101 SYN (#601) Aug 1 21:29:59 fgw kernel: Packet log: dmz DENY eth1 PROTO=6 208.62.155.69:40665 216.250.134.69:80 L=48 S=0x00 I=45235 F=0x4000 T=116 SYN (#601) Andy -- GnuPG ID 0xA63888C9 (D2DA 68C9 BB2B 26B4 8204 2219 A43E F450 A638 88C9) [-----------[system uptime]--------------------------------------------] 9:30pm up 22 days, 20:09, 6 users, load average: 1.22, 1.16, 1.18

1 0

Re: Code Red growth stats
by Steven M. Bellovin 02 Aug '01

02 Aug '01

In message <EA9368A5B1010140ADBF534E4D32C728025AB1(a)condor.mhsc.com>, Roeland Me yer writes: >> From: Steven M. Bellovin [mailto:smb@research.att.com] >> Sent: Wednesday, August 01, 2001 7:36 PM > >> If it has indeed turned up again, I'm at a loss to explain it. While >> I'm sure there are some IIS servers on home machines, I doubt >> there are >> that many. But I don't have another explanation to offer. > >Are you taking into account that every copy of Win2K comes with IIS? I had >to quickly run around and do upgrades yesterday. I clean forgot about the >workstations. I bet that I'm not the only one either. > Are you sure about that? Or rather, are you sure it's on by default? I just checked my toy desktop machine and rebooted to the other partition of my laptop, and didn't see it running on either.l To be sure, I'd have turned it off if I knew it was on, but I have no idea how to do things like that on Windows... --Steve Bellovin, http://www.research.att.com/~smb

2 1

RE: Code Red growth stats
by Roeland Meyer 02 Aug '01

02 Aug '01

> From: Steven M. Bellovin [mailto:smb@research.att.com] > Sent: Wednesday, August 01, 2001 7:36 PM > If it has indeed turned up again, I'm at a loss to explain it. While > I'm sure there are some IIS servers on home machines, I doubt > there are > that many. But I don't have another explanation to offer. Are you taking into account that every copy of Win2K comes with IIS? I had to quickly run around and do upgrades yesterday. I clean forgot about the workstations. I bet that I'm not the only one either.

1 0

Re: Code Red growth stats
by Steven M. Bellovin 02 Aug '01

02 Aug '01

In message <200108012026.QAA29111(a)thelonius.ai.mit.edu>, Petr Swedock writes: > > >There's no indication on how the stats are collected... Is it by IP >addr reported? Does it take into account duplicates (re-infection >rates?) > While they don't say, the "number of infected hosts" graph makes me assume that they're counting unique IP addresses that tried to hit them. As I said, my numbers are consistent with others posted here. And I've gotten private mail about another, similar observation -- Code Red, Round 2, appears to have peaked a few hours ago. --Steve Bellovin, http://www.research.att.com/~smb

2 1

Re: Code Red growth stats
by Steven M. Bellovin 02 Aug '01

02 Aug '01

In message <Pine.SOL.3.93.1010801170555.4987V-100000(a)acns.fsu.edu>, Scott Sturs a writes: > >On Wed, 1 Aug 2001, Dave Stewart wrote: > >> I suspect we'll see it begin to pick up a little bit... it looks like >> Billybob is just starting to get home from work and fire up his whizbang >> Windows 2000 machine, which he put IIS on so he can share kewl warez and >> mp3z with his leet friends... > >At 1500 EDT I put a counter on one of our commodity Internet connections, >looking for port 80 connects to one of our unassigned /24 subnets. Here >are the results so far: > >1500-1530: 682 >1530-1600: 536 >1600-1630: 533 >1630-1700: 643 > >Seems to be picking up. Maybe -- we need more data to be sure. But -- given that a lot of folks have patched systems over the last two weeks -- I suspect it's running out of "food". Look at the graph from the last go-round at http://www.cert.org/advisories/CA-2001-23.html -- it leveled off, too. (If the Worm is operating on UTC, the "stop" phase would have commenced at 2000 EDT. Even if it ran on local time, Western European machines wouldn't quiesce until 1700. The drop off starts well before that.) --Steve Bellovin, http://www.research.att.com/~smb

3 2

Re: MicroSoft amplification?
by Steven M. Bellovin 02 Aug '01

02 Aug '01

In message <OF3DD9155A.FA5F9232-ON88256A9B.00804F54(a)almaden.ibm.com>, "Tony Ral l" writes: > >I see it too, on that address and on the second of the 3 addresses mapped >to www.microsoft.com (the third address doesn't respond at all). > >Most likely this is due to a not very smart load distribution system. I'm told that that is indeed the case. Well, strike the "not very smart" part -- I wasn't told that -- but I was told that it is indeed because of the load distribution system. --Steve Bellovin, http://www.research.att.com/~smb

1 0

RE: Code Red growth stats
by Paul Lantinga 01 Aug '01

01 Aug '01

> -----Original Message----- > From: Christopher A. Woodfield [mailto:rekoil@semihuman.com] > > heh, maybe someone can take the worm code and use it to apply the IIS > patch instead of DoS'ing the White House... :) I'd be really curious as to how the courts in various countries would handle something like that. Would patching someone else's server or system without their prior knowledge or consent be considered illegal access? Would it make a difference to the court if the server or system was actively attacking[1] your system? "Mr. Judge, I was only using the resources at my disposal to stop the attack upon my own systems." What if it wasn't attacking you? How would you all feel if the US FBI or other gov't branch patched your server without you consenting or knowing? What if someone proposed that software companies be liable for sloppy coding that allows this kind of thing to happen so frequently? I'm guessing that several truckloads of lawyers could live off of something like that for many years. Paul LANtinga. [1] we all know how well defined that is. ;)

1 0

Internet Pulse report was Re: A watched...
by Simon Waters 01 Aug '01

01 Aug '01

Ironically after I sent the last NANOG message I checked the http://internetpulse.com site again, and QWEST have improved their performance, so the Internet is apparently "healthier" now than it was when Code Red started this morning.

1 0