- Test - lists.nanog.org

Re: Code Red growth stats
by Dave Stewart 01 Aug '01

01 Aug '01

At 04:28 PM 8/1/2001, Stephen J. Wilcox wrote: >Does anyone have any theories as to why its tailing, are the thousands of >vulnerable machines being patched all of a sudden? If not then why is >traffic decreasing so fast when the worm just keeps searching? I suspect we'll see it begin to pick up a little bit... it looks like Billybob is just starting to get home from work and fire up his whizbang Windows 2000 machine, which he put IIS on so he can share kewl warez and mp3z with his leet friends... I'm seeing more probes from Roadrunner and @Home hosts in the last little while.

5 4

Re: Code Red growth stats
by Steven M. Bellovin 01 Aug '01

01 Aug '01

I > I ran a little script on the totals reported by www.incidents.org, calculating the ratio between successive samples. (The latest graph I could find, as of 1615 EDT, ended at 1400 EDT.) There was a period of steady exponential growth in there, but it seems to be tailing off. That's consistent with another report posted here. 2.06579 1.6051 1.96429 1.80404 1.78163 1.81081 1.66331 1.67091 1.6844 1.63127 1.4773 1.29124 1.15538 --Steve Bellovin, http://www.research.att.com/~smb

3 2

RE: Code Red growth stats
by Joe Blanchard 01 Aug '01

01 Aug '01

Not sure. I do know that I have been informing the EDUs that seem to have multiple nodes infected and actually am getting a response from them that they are being fixed. Don't know. -Joe > ---------- > From: Stephen J. Wilcox[SMTP:steve@opaltelecom.co.uk] > Sent: Wednesday, August 01, 2001 1:28 PM > To: Steven M. Bellovin > Cc: k claffy; nanog(a)nanog.org > Subject: Re: Code Red growth stats > > > On Wed, 1 Aug 2001, Steven M. Bellovin wrote: > > > I ran a little script on the totals reported by www.incidents.org, > > calculating the ratio between successive samples. (The latest graph I > > could find, as of 1615 EDT, ended at 1400 EDT.) There was a period of > > steady exponential growth in there, but it seems to be tailing off. > > That's consistent with another report posted here. > > Does anyone have any theories as to why its tailing, are the thousands of > vulnerable machines being patched all of a sudden? If not then why is > traffic decreasing so fast when the worm just keeps searching? > > Steve > > >

1 0

Re: Code Red growth stats (fwd)
by Larry Sheldon 01 Aug '01

01 Aug '01

> On Wed, 1 Aug 2001, Steven M. Bellovin wrote: > > > I ran a little script on the totals reported by www.incidents.org, > > calculating the ratio between successive samples. (The latest graph I > > could find, as of 1615 EDT, ended at 1400 EDT.) There was a period of > > steady exponential growth in there, but it seems to be tailing off. > > That's consistent with another report posted here. > > Does anyone have any theories as to why its tailing, are the thousands of > vulnerable machines being patched all of a sudden? If not then why is > traffic decreasing so fast when the worm just keeps searching? A couple of conjectures.... What is the correllation between infection rate and population-where-it-is- still-daylight? (Its middle of the night in Europe, no?) What is the likelyhood that people who din't know they were running IIS have turned it off. How about nets blocking port 80?

1 0

Code Red growth stats (fwd)
by Larry Sheldon 01 Aug '01

01 Aug '01

> (david moore with help from a bunch of elves) > http://www.caida.org/analysis/security/code-red/aug1-live-hosts.gif Seems to be dead--what happened? I also can't seem to find the "internethealthreport" any more.

2 3

Code Red Scans
by Joe Blanchard 01 Aug '01

01 Aug '01

Still seeing tons of traffic scanning for port 80s. Already sent off 4 emails to various .edu s that appear to be infected (several nodes) and one to Microsoft as well. In a brief listing of nodes my count is greater than 64k of unique IP addys so far. Hmm, Pretty bad when MS themselves look to be infected. Or maybe there "testing" something, or someone is spoofing? > Aug 1 12:37:36: %PIX-3-106010: Deny inbound tcp src > outside:131.107.112.124/3383 dst inside:xxx.xxx.xxx.xxx/80 > Aug 1 12:37:40: %PIX-3-106010: Deny inbound tcp src > outside:131.107.112.124/3383 dst inside:xxx.xxx.xxx.xxx/80 > Aug 1 12:40:04: %PIX-3-106010: Deny inbound tcp src > outside:131.107.190.124/41854 dst inside:xxx.xxx.xxx.xxx/80 > Aug 1 12:40:08: %PIX-3-106010: Deny inbound tcp src > outside:131.107.190.124/41854 dst inside:xxx.xxx.xxx.xxx/80 > Aug 1 12:40:39: %PIX-3-106010: Deny inbound tcp src > outside:131.107.86.103/4167 dst inside:xxx.xxx.xxx.xxx/80 > Aug 1 12:41:52: %PIX-3-106010: Deny inbound tcp src > outside:131.107.112.124/4367 dst inside:xxx.xxx.xxx.xxx/80 > Aug 1 12:42:00: %PIX-3-106010: Deny inbound tcp src > outside:131.107.112.124/4367 dst inside:xxx.xxx.xxx.xxx/80 > Aug 1 12:43:02: %PIX-3-106010: Deny inbound tcp src > outside:131.107.90.67/3667 dst inside:xxx.xxx.xxx.xxx/80 > > > Microsoft Corporation (NET-MICROSOFT) One Redmond Way Redmond, WA 98052 US Netname: MICROSOFT Netblock: 131.107.0.0 - 131.107.255.255 Coordinator: Microsoft (ZM39-ARIN) noc(a)microsoft.com -Joe

1 0

What happens when a fiber carrier goes broke ?
by Joe McGuckin 01 Aug '01

01 Aug '01

I see that a number of companies that lease dark fiber are near bankruptcy. What is the legal position of someone who has purchased a multi-year IRU on the fiber? Can the bankruptcy trustee or creditors reposess your fiber strands? Joe

2 1

MicroSoft amplification?
by Brandon Ross 01 Aug '01

01 Aug '01

So with all the noise about Code Red, and in the process of trying to recover from various attacks, I happened to try to ping www.microsoft.com. It's probably par for the course that this happens: Wed Aug 1 14:05:29 bross@ogre:~ $ ping www.microsoft.com PING www.microsoft.akadns.net (207.46.197.100): 56 data bytes 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=37.5 ms 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=41.2 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=42.8 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=43.9 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=45.0 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=46.1 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=47.3 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=48.4 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=49.5 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=1 ttl=45 time=57.6 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=39.8 ms 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=41.4 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=42.7 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=43.3 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=44.4 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=45.5 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=46.8 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=47.9 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=49.0 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=2 ttl=45 time=51.6 ms (DUP!) 64 bytes from 207.46.197.100: icmp_seq=3 ttl=45 time=39.6 ms I find it interesting and almost amusing that MicroSoft's own web server can be used for amplification attacks. -- Brandon Ross 404-522-5400 EVP Engineering, NetRail http://www.netrail.net AIM: BrandonNR ICQ: 2269442 Read RFC 2644!

1 0

Code Red growth stats
by k claffy 01 Aug '01

01 Aug '01

(david moore with help from a bunch of elves) http://www.caida.org/analysis/security/code-red/aug1-live-hosts.gif was exponential till about an hour ago, we're not sure if leveling off is due to our monitor load or an actual peak in the data. log-scale version http://www.caida.org/analysis/security/code-red/aug1-live-hosts-log.gif will put on main caida home page later today and update every minute (you'll have to hit reload, and you won't actually notice changes at a minute granularity so please no per-minute cron jobs to reload :) ) note the corresponding graph for 19-20 july: http://www.caida.org/analysis/security/code-red/gifs/cumulative-ts.log.gif no per AS stats for this outbreak yet, also under construction.

2 1

RE: telnet vs ssh on Core equipment , looking for reasons why ?
by Roeland Meyer 01 Aug '01

01 Aug '01

> From: Charles Sprickman [mailto:spork@inch.com] > Sent: Tuesday, July 31, 2001 9:41 AM > 6) Finding a unix ssh that supports 3DES and DES. > > I curse those OpenSSH folks for making me have to trudge > through the code > to find out how to get DES working... > > 6a) Finding a release on CCO that supports 3DES. You are probably aware, but EFF published the DES crack. I understand that it is now an issue of cracking DES in less than 12 hours. 3DES is better but it only amounts to DES with a 128-bit key. Definitely a limited shelf-live.

6 5