Code Redux 472
I don't understand why Symantec classifies a "remote root" exploit as only "medium" damage. Code Red [?] is hitting cable modem networks especially hard, as the new variants scan "nearby" IP's in preference to random ones, which has apparently caused enough damage and network congestion that AT&T's residential broadband division (MediaOne) has cut off port 80 across their network to try and halt the spread of the worm, or so several submitters reported. Newsforge has a story about various reactions to the worm, and reader nettdata sent in an interesting story about the worm becoming the main course at a dinner of security specialists.
Man, I wish... (Score:5, Insightful)
I really think that it's the responsibility of a machine's owner to lock down his/her system from attack. Ignorance of the rule is no excuse. If you put a machine on the net, and it's not secure, it becomes a danger for everyone.
The easiest thing to do is to shut down the access to machines that are infected. That way, you have their undivided attention when they call you up and say, "My cable's not working!" You simply respond... "Yes, we shut it off, because you wouldn't take care of business."
You're not lame for running IIS if you've patched it. You're lame if you aren't paying attention to the patches out there.
It is only Medium DAMAGE! (Score:2, Insightful)
I don't understand why Symantec classifies a "remote root" exploit as only "medium" damage.
Maybe because they don't! You are thinking in terms of security hole. With a virus it is different, you are more concerned about data loss.
A virus can inflict low damage, ie: print a message on the screen that you are stupid, or a high DAMAGE rate of deleting your whole hard drive. Medium is a good measurement of this one, as it only has the POTENTIAL for data loss.
Re:Medium damage (Score:5, Insightful)
Well, given the choice between having j00r box r00ted and having something like WinCIH blank out your BIOS and wipe out your FAT...
For security, it's critical. But the amount of data loss is minimal until after someone telnets to the open port and blows away your drive.
Finally, consider Symantec's core market -- not the guy running a brokerage firm on a farm of IIS boxen, but home and office users of PCs worried about the virus that'll wipe out their pr0n collection. Joe Win95er really isn't at risk from Code Red II, apart from wondering why "the Internet is slow" if he's on RoadRunner.
Considering Symantec's core audience, and what this worm could be doing to compromised systems, and yeah, I'll buy "medium".
OT: pedantic correction (Score:2, Insightful)
Okay, if you're going to use the archaic, tongue-in-cheek unix-guru term "boxen," at least bother to learn that its denotation is plural.
And now back to your regularly scheduled worm discussion.
Re:BIG NEWS: (Score:2, Insightful)
Re:It's about time... (Score:3, Insightful)
I'll bet that it gets strictly enforced from now on, killing all the fun even for people like me who run Apache on OpenBSD.
Two Reasons..... (Score:0, Insightful)
>damage. Code Red^[?] is hitting cable modem networks especially hard,
>
>
1) Microsoft asked (told) them to.
2) Their software doesn't do squat against worms like Code Red.
Twenty-four hours. (Score:5, Insightful)
grep ida access_log | cut -d" " -f1 | sort | uniq | wc -l
139
Looking over the infected hosts, it seems that half are broadband clients (RR, Bellsouth, Verizon, @Home, etc.), a third are overseas (with
I see Code Red as a big boon to jobhunters, especially those looking for SA work. Right there in your logs is a list of companies that are hiring, whether they know it or not.
I guess the big question is this: do you root their box before the first interview or after?
k.
It is "medium" because hysteria won't help us (Score:4, Insightful)
The kind editor should also remember his math and Netcraft nice figures. IIS installations represent some 25% of the servers out there. Most of those are already patched by now. Even when they were not patched Code Red got only 6-7% of them (considering 4 million servers/250 thounsand infected).
Code Red is certainly a local problem in networks where it finds a nice ecologival niche. Cable modem networks are likey to suffer due to their archtecture and their own flaws. Other networks will suffer down the road.
But the main point is that this particular the worm is out of the way for nmost of us (if it ever was in the way) and will only affect the bandwidth locally.
It is almost time to reduce its risk rating to low.
You misunderstand the danger (Score:3, Insightful)
I reiterate, the only safe path is to install on an airgapped machine, or on a well secured LAN. But if you have to download it from the internet, there is a chance that *anything*, not just CodeRed, will be hiding somewhere by the time you patch.
Code red growth spurts (Score:5, Insightful)
One possible saving grace is that most of our students come back after the worm is supposed to sleep (20th of the month). However, it might wake again come Sept. 1st. Not to mention any server out there with bad dates ready to spew it around.
On another note, I've notified several people in other departments that they've been hit with the CR II version. They say "well, I'll just apply the patch". Wrong, that will stop your computer from trying to broadcast the worm. Unfortunately, the patch doesn't clean up the trojan explorer.exe and registry settings. I tell them "you'll need to reformat the whole computer, and they laugh". Well, at least I can be first in line to berate their IT department for not taking that suggestion when their whole networked gets compromised from another backdoor installed during the computers 'open' state.
-A non-productive mind is with absolutely zero balance.
- AC
Re:Create a Good Virus? (Score:2, Insightful)
Amerist A'Toll
Re:It _is_ quite benign. (Score:2, Insightful)
Re:Against the DMCA? (Score:0, Insightful)
Is the virus a copy protection measure? No. Now go away, please.
Lazy vs. Stupid (Score:2, Insightful)