Subject: Code Red II at the IETF meeting

From: Steve Bellovin <[email-masked]>
Date: Mon, 06 Aug 2001 16:56:17 +0100

Well, folks, my packet suckers have shown a Code Red II attack from a 
machine on the IETF meeting net.  It's 217.33.140.38 -- if you have 
that address, you need to disinfect and patch your machine.  For the 
rest of you, be careful...

		--Steve Bellovin, http://www.research.att.com/~smb

---

From: [email-masked]
Date: Tue, 7 Aug 2001 03:51:59 +0800 (SGT)

traceroute to www.bt.com at 2045 hrs (BST)

 1  host217-33-136-1.ietf.ignite.net (217.33.136.1)  15.412 ms  8.859 ms  3.767 ms
 2  213.120.86.2 (213.120.86.2)  3.068 ms  3.183 ms  6.647 ms
 3  213.121.157.209 (213.121.157.209)  8.893 ms  8.112 ms  6.018 ms
 4  core3-gig2-0.reading.ukcore.bt.net (62.6.198.9)  9.511 ms  6.016 ms  6.917 ms
 5  core3-pos9-0.ilford.ukcore.bt.net (195.99.120.217)  10.244 ms  9.192 ms  9.148 ms
 6  195.99.120.214 (195.99.120.214)  11.154 ms  18.372 ms  12.437 ms
 7  core2-gig5-0.bletchley.ukcore.bt.net (62.6.197.98)  9.666 ms  12.479 ms  12.556 ms
 8  vhsaccess1-pos8-0.bletchley.fixed.bt.net (62.6.197.138)  11.137 ms  11.832 ms  27.750 ms
 9  ugint0069-p.vhsaccess1.bletchley.fixed-nte.bt.net (217.32.244.70)  11.277 ms  10.045 ms  14.710 ms
10  ugint0069-p.vhsaccess1.bletchley.fixed-nte.bt.net (217.32.244.70)  14.020 ms !X * *
11  ugint0069-p.vhsaccess1.bletchley.fixed-nte.bt.net (217.32.244.70)  12.240 ms !X * *
12  * ugint0069-p.vhsaccess1.bletchley.fixed-nte.bt.net (217.32.244.70)  708.319 ms !X *

Of course connection to the outside world was also not possible.

-- 
/amlan

---

From: Theodore Tso <[email-masked]>
Date: Mon, 6 Aug 2001 17:06:20 -0400

> rest of you, be careful...

To be more explicit, if you're using Windows 2000 on your laptop, and
are running IIS (apparently some people who use W2K don't realize that
they have IIS enabled), you **really** want to make sure that you
check and make sure your laptop isn't infected with Code Red before
you go back home and connect your laptop to your corporate network.

I've been told that at least one IETFer's company (who shall remain
unnamed) were currently having their internal network severely
impacted by Code Red worms running rampant inside their internal
corporate network, behind their firewalls --- where people tend to be
much more lax about security and installing the latest patches on
their machines).  Don't let this happen to your company....

						- Ted

---

From: [email-masked] (Bobby Krupczak)
Date: Tue, 7 Aug 2001 09:21:06 -0400 (EDT)

Hi!

>rest of you, be careful...

Do you always snoop on traffic at IETFs?

Just curious.  Dont read anything else into my question.

Bobby

---

From: Patrik Fältström <[email-masked]>
Date: Tue, 07 Aug 2001 14:49:27 +0100

> Just curious.  Dont read anything else into my question.

You don't have to snoop. Just run a webserver on port 80 on your local host
and look at the virus trying to attack your local laptop.

I run a local apache, and the logs are full of things like these:

217.33.136.83 - - [07/Aug/2001:14:32:44 +0100] "GET
/default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc
bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
HTTP/1.0" 404 271
217.33.24.50 - - [07/Aug/2001:14:36:21 +0100] "GET
/default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc
bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a
HTTP/1.0" 404 271

     paf

---

From: John Angelmo <[email-masked]>
Date: Tue, 07 Aug 2001 19:58:38 +0200

> bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a

Well i't my bad luck that I'm missing the meeting perhaps I need to 
invite all the guys(girls are welcome to) for some beer :)

OK back to subject

Yes I must say I just hate these buggers

SetEnvIf Request_URI \.ida$ bugger
CustomLog logs/bugger_log common env=bugger
CustomLog logs/access_log common env=!bugger
CustomLog logs/error_log common env=!bugger

This would fix so the .ida requests don't get in the usual log but in an 
own specific log.
I havn't had the chance to try this but I don't consider my apache box 
on the private 192.168.* a subject to the attacks

And for those ppl who hate "scanners" I recomend:
http://www.thinkgeek.com/stuff/things/38df.html

Good luck with the meetings everyone

/John

-- 
Webgiro AB
---------------------
+46-850640765 Phone
+46-850640701 Fax
+46-733864346 Cellular
RIPE handle: JA4953-RIPE