Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Bug

Code Red Back For More 866

Brian Stretch writes: "The Code Red II worm was unleashed early this morning and appears to be very different than the original and far more dangerous. CR2 infected servers only attack servers within their Class A address block and their Class B address block in particular: since 9:11am EST I've logged 148 CR2 attack attempts, 89 of which are from within my Class B subnet, suggesting that only servers within Class A networks that were deliberately seeded are being attacked. The 24.x.x.x range is one of the hardest hit, and as before, it's folks with cable modems and DSL connections that are providing the most victims." Several @home customers have written about slowed service today, but they're definitely not alone.
This discussion has been archived. No new comments can be posted.

Code Red Back For More

Comments Filter:
  • by CodeRed ( 5676 ) on Sunday August 05, 2001 @01:00AM (#2110880) Journal
    Errrr.... More things named in my honor... This can't be good!

    If worms start popping up with Linux4Green (my ICQ nick) then I know I'm bad luck. :-P
  • Re:me too (Score:3, Funny)

    by mcleodnine ( 141832 ) on Sunday August 05, 2001 @01:53AM (#2111509)
    Several @home customers have written about slowed service today, but they're definitely not alone.

    Should read: Several @Home users reported that everything was moving along normaly. Most of thier friends giggled and left the room.

  • by Saint Aardvark ( 159009 ) on Sunday August 05, 2001 @01:56AM (#2111729) Homepage Journal
    Fuck me...read a little farther down where it says that, based on random scans of the 359k IP addresses infected last time 'round, they estimate that thirty percent are still infected!

    What the fuck? What the fuck is going on? How the fuck is it that I can have old ladies calling me up at work (tech support for an ISP) and asking if the reason they can't pick up their email is because of the Code Red worm, 'cos they saw the press conference and, hey, they're wondering, and something like 105,000 separate IP addresses are still infected? Did the rapture happen when I wasn't looking, and God took the people responsible for these computers, those left behind couldn't find the passwords anywhere? How is this possible?

    (I know, I know; not everyone lives w/in viewing distance of CNN, default installations of MS whatever -- but still, this absolutely amazes me.)

  • by fanatic ( 86657 ) on Sunday August 05, 2001 @11:52AM (#2111855)
    ...Pick any one.
  • by matthewg ( 6374 ) <matthewg@zevils.com> on Sunday August 05, 2001 @01:26AM (#2112162) Homepage
    Wow, Cox has deployed IPv6 already? ;)
  • As long as they don't change that to the worth of their software, or $5 US, wichever is more.
  • by Maditude ( 473526 ) on Sunday August 05, 2001 @02:31AM (#2112972)
    ...and I want to know if I'll get spanked for sending my log (367 entries and growing quite quickly) of these default.ida? requests to abuse@microsoft.com ;-)
  • by david duncan scott ( 206421 ) on Sunday August 05, 2001 @12:25PM (#2113327)
    I prefer the thing I've heard pool players say. It's a combination shot, so they "combinate".
  • by Anonymous Coward on Sunday August 05, 2001 @01:30AM (#2114854)
    At least your name isn't Michael Bolton!

    Your name is Michael Bolton? Wow, like the singer guy?
    Yes, and it's just a coincidence.
    So do you like his music?
  • by MyMomIsALinuxHacker ( 469701 ) on Sunday August 05, 2001 @05:44AM (#2115962)
    Taken from http://www.securitynewsportal.com/article.php?sid= 1354&mode=thread&order=0 [securitynewsportal.com]

    Code Red--the soda--has been spreading almost as fast as its namesake computer worm, which has infected hundreds of thousands of computers to date. The caffeine-laden, cherry-flavored version of its pale-yellow cousin, Mountain Dew, was released in May, months before the Code Red worm threatened to clog Internet traffic. And as computer security experts work to contain the damage from the Code Red worm, the soda's maker, Pepsi, is coincidentally featuring a "Crack the Code" contest on the Mountain Dew Web site.

    Code Red has been an especially big hit with computer programmers, who often guzzle the high-octane drink to fuel late-night code-writing sessions. Among the drink's fans were the staff of eEye Digital Security, who say they identified the Code Red worm and named it after their favorite soda..

    The rest of the story can be found on http://www.securitynewsportal.com/article.php?sid= 1354&mode=thread&order=0 [securitynewsportal.com] .

    Its funny. Laugh. Please?
  • by Tackhead ( 54550 ) on Sunday August 05, 2001 @02:30AM (#2116322)
    > Man, I'm glad that I'm not using [Microsoft Product]. This new [virus/worm/trojan] exploits a [flaw/bug/backdoor] in [Microsoft Product], and it [does/doesn't] use Outlook and the stupidity of users. Luckily, I'm running [Free alternative to Microsoft product], so I'm not at risk. In fact, [Free alternative to Microsoft product] has protected me from [any integer over 200] [viruses/worms/trojans]. And just look at the [hundreds/thousands/millions/billions] of dollars that I've saved using [Free alternative to Microsoft product]. I hope that this [Free alternative to Microsoft product] takes off, along with [free alternative to Microsoft OS]. Unfortunately, my [company/home] has to pay for the stupidity of Microsoft: this [virus/worm/trojan] sucked [250KB/250MB/250GB/250TB] of bandwidth!

    I hereby propose we adopt your post as a convention.

    We can thus encode "war stories" about the latest [worm/virus/trojan] as follows, saving Slashdot a fortune in bandwidth charges.

    For instance, I can now describe my evening as follows:

    "IIS. Code Red II. flaw. IIS. doesn't. FreeBSD. 429. worms. thousands. Apache. Apache. FreeBSD. company. worm. 6.2MB."

  • by sdo1 ( 213835 ) on Sunday August 05, 2001 @12:39PM (#2117366) Journal
    Right now this dude is looking at his server logs and thinking "Awesome! I can't believe how many people are pumped about my resume! Job offers are going to be ROLLING in any second!"

    -S

  • by MajroMax ( 112652 ) on Sunday August 05, 2001 @01:46AM (#2120759)
    Man, I'm glad that I'm not using Minesweeper. This new virus exploits an unexploded mine in Minesweeper, and it does use Outlook and the stupidity of users. Luckily, I'm running OpenMine, so I'm not at risk. In fact, OpenMine has protected me from 2^37-302 virii. And just look at the millions of dollars that I've saved using OpenMine. I hope that this OpenMine takes off, along with OS/2. Unfortunately, my doghouse has to pay for the stupidity of Microsoft: this virus sucked 212 nibbles of bandwidth!
  • My range... (Score:2, Funny)

    by heliocentric ( 74613 ) on Sunday August 05, 2001 @01:19AM (#2121148) Homepage Journal
    Well, with everyone feeling the need to chime in about what ranges they see like we did when we were taking bets if school would be canceled, I just felt like saying:

    Nothing from the 192.168.0.x range here!!

    =)
  • by tswinzig ( 210999 ) on Sunday August 05, 2001 @02:47AM (#2121317) Journal
    Modify the code red code to apply the security patch to the vulnerable IIS servers and reboot the system? While this is potentially destructive to your system (I'm told -- MS security patches and all that) it would pretty well take care of this problem...

    Nah, this will just make the sysadmins even lazier.

    SysAdmin #1: Dude, your NT machines are all infected with Code Red!

    SysAdmin #2: I know! I'm just waiting for for them to be infected with the fix... should be any day now...
  • by mpe ( 36238 ) on Sunday August 05, 2001 @04:44AM (#2122355)
    Someone should copyright the "code red algorithm".

    Or maybe patent it. Also how about sending the BSA after anyone running it without a licence.
  • by meta-monkey ( 321000 ) on Sunday August 05, 2001 @01:18AM (#2123148) Journal
    WHY do i have to pay extra for the functionality of NOT being succeptable to virii and net attacks?

    Actually, you don't. Linux is free :-p
  • by billh ( 85947 ) on Sunday August 05, 2001 @03:48AM (#2123799)
    Look at his street address...
  • by stuccoguy ( 441799 ) on Sunday August 05, 2001 @02:09AM (#2128303)
    This guy's computer is infected and attacking me every 10 minutes or so. I went to his web page and found this [66.1.83.146] resume which indicates the guy is a Windows2000 expert and Network Technician!
  • by startled ( 144833 ) on Sunday August 05, 2001 @02:49PM (#2128790)
    Bah, what a waste. Screw that, here are some other things you should do along with your white hat program:

    1. Distribute Elcomsoft's e-book reader to all compromised boxes; search for any Adobe e-books and write out a plaintext copy.
    2. Append the code to DeCSS to all Word documents on the box.
    3. Modify the code to only patch the box when Dmitry is finally released from jail.
    4. Install Linux; reboot.
    5. Install BSD; reboot.
    6. Configure box to DoS MS's IIS patch servers; condemn MS for making patches inaccessible.
    7. Script all boxes to respond to /. stories with one of two comments: "dammit, this is a duplicate! Here is the original at goatse.cx", or "Katz iz 4 t00l!!!1@".
    8. Install SETI; add the box to your team; brag about your high score.

    Note: these are jokes. Please, please, do not do these things. Especially because if you do, the feds will come knocking on my door. :)
  • by gascsd ( 316132 ) on Sunday August 05, 2001 @05:43AM (#2133945)
    heh. he lives in my apartment complex, and i know exactly where his apartment is (i have a friend over there on that side of the complex). i'll go tell him his box got 0wN3d then hand him my 4.3R CD =)
  • by dozing ( 111230 ) on Sunday August 05, 2001 @01:39AM (#2136777) Homepage
    Wouldn't the best and quickest fix be to telnet into the machines and give 'em the old:
    c:\deltree windows

    maybe we could even install scripts on our own servers to automatically do this each time we recieve a new attack. Automated windows repair solutions.
  • by RzUpAnmsCwrds ( 262647 ) on Sunday August 05, 2001 @01:15AM (#2138057)
    Man, I'm glad that I'm not using [Microsoft Product]. This new [virus/worm/trojan] exploits a [flaw/bug/backdoor] in [Microsoft Product], and it [does/doesn't] use Outlook and the stupidity of users. Luckily, I'm running [Free alternative to Microsoft product], so I'm not at risk. In fact, [Free alternative to Microsoft product] has protected me from [any integer over 200] [viruses/worms/trojans]. And just look at the [hundreds/thousands/millions/billions] of dollars that I've saved using [Free alternative to Microsoft product]. I hope that this [Free alternative to Microsoft product] takes off, along with [free alternative to Microsoft OS]. Unfortunately, my [company/home] has to pay for the stupidity of Microsoft: this [virus/worm/trojan] sucked [250KB/250MB/250GB/250TB] of bandwidth!

  • by jarodss ( 243400 ) <mikedupuis79&hotmail,com> on Sunday August 05, 2001 @01:54AM (#2151490) Homepage
    My range, I don't seem to find anything coming from 127.x.x.x and I installed CodeRedII myself.

Work without a vision is slavery, Vision without work is a pipe dream, But vision with work is the hope of the world.

Working...