Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Bug

1 Year Anniversary of Nimda Outbreak 304

Posted by CmdrTaco from the my-logs-hurt dept.
dots and loops writes "Today marks one year to the date that the nimda worm began making its way across the Internet." Hey, speaking of hilarious worms, I'm still getting 5-10 klez virus's a day! Yay Security!
This discussion has been archived. No new comments can be posted.

1 Year Anniversary of Nimda Outbreak More

1 Year Anniversary of Nimda Outbreak

Comments Filter:
  • happy birthday to nimda..

    happy birthday to nimda ..

    happy birthday you iis infecting worm...

    happy birthday to you...

    may you make anti virus vendors riiiiiiccchhh

    • Dear hikeran,

      It has come to our attention that you published a portion of our copyrighted material. Namely the lyrics to the popular [but copyrighted] song : 'Happy Birthday To You'.

      We would ask that you refrain from repeating this action and ask that you make the best effort to remove such violations made by you.

      Should this matter be brought before us again we will demand a license fee payable to Warner Brothers.

      The work has been subject to copyright laws since 1935 and doesn't expire until 2012.

      For more details see here [cni.org]

      Thank you,

      Daffy & The Guys

    • Well, perhaps not, but today is the twentieth birthday of the emoticon!! Check out this interview [npr.org] (Requires Real) with the first person to ever use the ubiquitous smiley.

  • One year, and still.. (Score:3, Funny)

    by molo ( 94384 ) on Wednesday September 18, 2002 @11:38AM (#4281668) Journal
    Its hard to believe that its been one year and I'm still getting scans on my apache server. Are there really that many braindead admins??
    • But how many of these machines are run by admins? (definition of admin being a professional)
      • I'm not kidding, the expectation of an MS admin can be as low as:

        1) Keep the services that should run running(even if it's already owned, as long as nothing is being defaced...)
        2) Keep up to the latest service patches (okay, if it's not the latest, the next latest)
        3) The server will crash and blue occasionally(may be due to some exception in virus), just reboot it, case close.
        3) The server will be mysterically getting slower and slower(due to unhandled Code Red, e.g.). Ask for more rams, extra disk and extra CPU or even a newer server.

        I.e., no need to scan security news, no need to tune the system, no need to perform any housekeeping tasks, no scary log files to be seen....

        I haven't seen one exception of them around so far.
    • Nimda also spreads via e-mail, file shares, etc... so it's much more than just machines with administrators that get infected. That's one of the big reasons for Nimda's "success".

    • Re:One year, and still.. (Score:4, Insightful)

      by frank_adrian314159 ( 469671 ) on Wednesday September 18, 2002 @04:14PM (#4283988) Homepage
      Its hard to believe that its been one year and I'm still getting scans on my apache server. Are there really that many braindead admins??

      Actually, almost all of mine are coming from individual subscribers coming through big DSL-/Cable-based ISP's like RoadRunner, SW Bell, etc. For each incident, I fire off E-Mail to their security departments, giving times, IP's, etc. (I have set of log scanning scripts that generate them automatically. How's that for geekiness? No, you can't have them. They suck. That's high in geek factor, too :-). I've seen NO action taken by them. What a bunch of lamers. Do they really think their customers want to be infected and spew out into the net? The issue is that, really, as long as that $50/mo. comes in, they don't give a rat's ass.

      The smaller DSL ISP's are usually on the job, though. They give me a small amount of hope.

  • Yeah (Score:2, Funny)

    by eamber ( 121675 )
    I work for a school district, and I swear, everyone pronounces it nimBA - it drives me crazy.

    Anyway, yeah, last year around this time was fun. Thanks for dredging up those memories.

  • Nimda (Score:2, Insightful)

    by Anonymous Coward
    Of course, the patch to fix the security problem was out months beforehand but lazy sysadmins just didn't update their systems.

    Thats what you linux guys say every time there is an Apache worm, isn't it? Let's be consistent, shall we?

    • Re:Nimda (Score:5, Interesting)

      by Mandi Walls ( 6721 ) on Wednesday September 18, 2002 @12:32PM (#4282089) Homepage Journal
      See F-Secure [f-secure.com] for the current infection of the slapper worm, 5 days after discovery. Infected servers: < 14,000 total, according to them.

      Now. this report [com.com] from Sep. 21, 2001 reports 1.3 million infected NIMDA servers.

      Help me out here.

      Where is the comparison? I'm still wading through NIMDA/Code Red requests on my webservers, looking for any sign that those servers have been poked by slapper infected servers. No dice so far.

      Slapper is generating panic because it's got a peer to peer network on the backend, not because it's actually been able to infect a lot of servers. can you imagine what would happen if someone wanted to start a p2p network on the NIMDA/Code Red infected servers that are still online now? to say NOTHING of the 1.3 million and up that were infected originally.

      slapper is a silly excuse for some "Open Source Sucks" journalism, not a reason to head for the hills and unplug the router.

      So here you go:
      [chastise]
      Oh, you lazy stupid 14,000 linux/apache admins! patch your servers!
      [/chastise]
      [screaming rant]
      it's been a year! get that "guy who knows computers" who put that shiatty NT server on the net for you to get back in your office and put some patches on it! give him a beer for pete's sake!
      [/screaming rant]

      Thank you.
      --mandi

  • our office got it. (Score:4, Funny)

    by snatchitup ( 466222 ) on Wednesday September 18, 2002 @11:39AM (#4281674) Homepage Journal
    We had just brought in a bunch of dot-com reject sys admins.

    Suddenly you hear everyone talking about the NAMBLA virus. Seriously, it was a spoonerism, or whatever. But everyone was running around blaming NAMBLA. Finally we realized it was NIMDA.

    Turns out there was a dude that got smoked out because he had kiddie porn on his PC. We just fired him.
    But if it weren't for this virus, we'd wouldn't have had the witch hunt that found this perv.

    • I hope you called the authorities on that guy.
      If not, some poor kid will pay for it.

  • Still kicking (Score:5, Informative)

    by JediTrainer ( 314273 ) on Wednesday September 18, 2002 @11:42AM (#4281698)
    If anybody is interested, I've developed WormScan [freshmeat.net] last year, which is a Java-based program (GPL) which can analyze your Apache log files for pretty much anything you want (just plug in your regular expressions). It detects Nimda and CR1+2 out of the box. It's easy to add your own entries to scan for.

    According to my logs (please be gentle) [websoup.net], I've been hit 650 times yesterday.

    Shameless plug, yes. But it does the job and the users of WormScan seem to be pretty happy with it, judging from the emails I've gotten so far.
    • Yeah, I've gotten pretty much the same conclusions as you. Nimda is still very much alive, and codered(1/2) are practically dead.

    • Re:Still kicking (Score:5, Funny)

      by pclminion ( 145572 ) on Wednesday September 18, 2002 @12:02PM (#4281841)
      If anybody is interested, I've developed WormScan [freshmeat.net] last year, which is a Java-based program (GPL) which can analyze your Apache log files for pretty much anything you want (just plug in your regular expressions).

      I think I've heard of a similar program before. I might have even used it... Hmm, what was that program?

      Oh, yeah! grep

      (sorry man, I'm just pokin' fun)

      • Re:Still kicking (Score:2, Interesting)

        by JediTrainer ( 314273 )
        (sorry man, I'm just pokin' fun)

        :) 'kay. Perhaps I should have mentioned that it's got lots more features than that... most notably the pretty reports with graphs and such.

        No offense taken... grep is what I used before I decided I wanted something that could make more sense visually.
      • I've heard of a similar program that's great for detecting these viruses. Its called Windows. Works every time.
    • Will you guys stop clicking his link? I am trying to download his program. Right now at a steady 0.6 KB/s because of all you bastards.

      He said be GENTLE. Usually slashdotters are really gentle with links to servers, but today, why must everyone be so rude? One at a time!

      Thanks.

    • http://www.treachery.net/~jdyson/earlybird/

      I recieved this link from a linux group. It basically detects nimda attacts on your apache/linux system then attempts to e-mail the sysadmin of the ISP. it works great. It has spam potential yes but nimda and the incompitent Admins who incubate this virus on there system needs to be irradicated.
    • Interesting... according to my stats [sodablue.org] I'm only getting around 5-8 hits per day on port 80. Far far less than I was receiving at this time last year.

  • Slapper (Score:3, Informative)

    by Dynamoo ( 527749 ) on Wednesday September 18, 2002 @11:45AM (#4281715) Homepage
    Aww heck I hadn't realised Nimda was a year old.. maybe it's not a coincidence that Slapper [theregister.co.uk] is gearing up a huge P2P Apache-based worm for something.. maybe today?

    Where did I put my hard hard? I think I might be needing it.

  • Nimbda? (Score:3, Insightful)

    by Second_Derivative ( 257815 ) on Wednesday September 18, 2002 @11:45AM (#4281721)
    I'm still getting nailed by Code Red. Weird how something can survive for two years without touching a single permanent storage device.

  • Nimda Fraud (Score:2, Insightful)

    by Anonymous Coward
    Nimda 0|/\|Nz j00 !

    No really , its a brilliant little Virus. I am sure lot of unscrupulous people made a lot of money from that one. Think about it, any unsecured server with this virus broadcasts this fact to the whole world !

    Just backtrack to the Broadcassting computer, and you can own it in 5 Minutes. I shudder to think at all the financial information that was made availiable from this virus.

    With Windows 2000 and XP still unsecure, we just need to wait for Nimda 2 and really make some money =-)

  • Slashdot uptime = 1 year (Score:5, Funny)

    by msheppard ( 150231 ) on Wednesday September 18, 2002 @11:47AM (#4281737) Homepage Journal
    And it's probably no coincidence that slashdot stats report 365days uptime today.

    M@

  • NIMDA the sysadmins friend :-s a little anecdote (Score:5, Interesting)

    by fruey ( 563914 ) on Wednesday September 18, 2002 @11:47AM (#4281739) Homepage Journal
    Oh... first of all, it's viruses. Not virus's... what the hell is that?

    I was working on a project to set up a proxy (Squid, in fact) for an education institution here in Morocco. If you think US sysadmins could get some clue, think again. I noted they were running NT workstation service pack 3 (lol) and I was already sweating. I set the proxy up as the gateway, to make it transparent, and started the service. Within 10 minutes the log file had grown massive. I tweaked a few params, and then left it running, saying I'd come back the next day.

    The client calls me first thing, saying my proxy is shit, doesn't work, etc. I turn up in a panic, thinking I'd messed something simple up. Then it dawned on me... seems like most of the hosts on the network were infected with Nimda (amongst other things). The logfile had exceeded 2Gb and had crashed the service (it had filled the /var partition completely). It was logging 100 Nimda scans a second.

    This was just about 3 months ago. The sysadmin didn't even really know how her DHCP server worked, and had no service packs anywhere. The only reason sp3 was some places was because the NT CD had been bought just before Win2K came out, and SP3 was bundled with a sticker "make sure you install this too".

    Explaining to the client that all the hosts were infected, that they seriously needed an antivirus solution, and that all machines would have to be taken offline (they had public IPs for chrissakes) until the disinfection was finished was a tough thing to do without just flaming that person, I assure you. We did get them sorted out in the end, but somehow they still think my proxy isn't worth shit :-(



    • Here is my Nimbda nightmare. I manage two offices, primarily CAD and graphics. Both connected to the net via a T1. My local office sits behind a nice iptables firewall with my patch and locked down NT server serving one IP for VPN. The other office is managed by a consultant because I cant' always get there as needed. Long story short the server died ( dead array) so after 12 hours of recovering the work I headed out instructing the consultant to lck down the server ( patch it, remove uneeded service, apply lockdown patch close unecessary ports) ofcourse he didn't in the space of 12 hours my entire network was filled with nimda eml nws files. luckly that was teh extent of teh infection that office. The server was a fresh install W2k server. Needless to say the next few days was speent hand picking corrupted files from the server. Before I even thought nimda was cute but now it's hell's own scurge. I consistently e-mail ISP's notifying them of infected machines probing my network.
    • yeah even you are the first one hero found the problem you are the easily one to blame. Don't feel bad about it.

      Just for the sake of exp sharing. If keeping log is not an requirement then I'll just turn it off or redirect it to null, unless you've some measure of cleaning up the log. Log files is always the bane for lazy admin.(and definitely not your fault). Turn off anything that they didn't ask for, there's no need to be your daddies' good boy in business.

      If keeping logs is an requirement? Easy, add up huge function points in spec and charge more for services. Schedule extra time to test and teach the log keeping - and even more money will be charged.

      That's the logs you asked to look, you shouldn't blame me to charge more.

  • Hrm (Score:3, Insightful)

    by Alizarin Erythrosin ( 457981 ) on Wednesday September 18, 2002 @11:47AM (#4281740)
    Why is it every time there's an addendum or update on a worm/virus report that Taco hasta remind us how much crap mail he gets?

  • The most long-lived virus/worm/trojan? (Score:4, Interesting)

    by burgburgburg ( 574866 ) <splisken06NO@SPAMemail.com> on Wednesday September 18, 2002 @11:49AM (#4281748)
    CmdrTaco writes that he's still getting multiple Klez viruses after all this time. That begs the question: what has been the most long-lived virus/worm/trojan so far?

    That question should probably be broken down into two parts:a) What virus/worm/trojan, as originally written, has been present in the wild for the longest? b) What virus/worm/trojan, through slight adjustment, has been able to keep coming back infecting and reinfecting for the longest?

  • Aha... Now I understand the meaning of that phrase...

  • A limerick suiting this topic... (Score:5, Funny)

    by Chagatai ( 524580 ) on Wednesday September 18, 2002 @11:57AM (#4281806) Homepage
    Nimda, Klez, and Red
    Whilst fornicating in bed
    Felt something new
    Saying, "Melissa, is that you?"
    And found Bill Gates naked, instead.

  • Ahh the memories... (Score:2, Interesting)

    by mrgrey ( 319015 )
    I work in a rather large school district and we run 6+ Netware servers and only 2 NT servers, not because we want to run NT, just because some software requires it. Anyways, we run Nortans Corporate Virus Scanner on a couple of the Netware boxes and they scan every file that comes through the network and beep if the file is infected. So I'm sitting in a lab and I'm looking through some folders on the network and I'm seeing tons of these .elm file and such. I ask another tech what was up. He didn't know. I walk into the server room and all I hear is BEEEEEEEP BEEP BEEEEP BEEP BEEP etc etc. At this point I concluded that we were screwed. I do some quick reasearch and discover nimd@. Oh, joy, it infects mapped drives. Good thing we have mapped drives in EVERY login script. Crap... Quickly login and start doing recursive deletions of .elm and etc files that nimd@ creates. Then we spend the weekend running a nimd@ cleaner on every machine in the district (1000+). All the while that was going on our NT boxes were attacking 5-6 other districts NT boxes and their boxes were attacking ours. It was a joyous occasion...
  • One year after Nimda. We are fighting the Slaper worm [f-secure.com]. Did anyone say Deja vu?

    Wonder what we are going to fight next year.
  • Does this mean I have to write another one?

  • Still getting hit (Score:5, Informative)

    by rossz ( 67331 ) <ogre&geekbiker,net> on Wednesday September 18, 2002 @12:08PM (#4281901) Journal
    No doubt in celebration of the birthday, I got a number of nimda hits this morning.

    mount -t smbfs password= //xx.xx.xx.xx/C$ /mnt/dork
    vi /mnt/dork/boot.ini

    Change the boot delay to some huge number and the boot message to "Run a virus scanner, asshole".

    umount /mnt/dork

  • I dumped OE because of Nimda. Yeah, there's a patch but I still haven't gone back and secured it. I switched to Pegasus. I hate Pegasus, but I guess not as much as I hate sending away for the patch.

  • Here's an idea for a web service. Have a query system over at one of the major security clearinghouses that can be queried remotely by an application. Then have an application that runs on your system that periodically scans your system for files that are potentially at risk due to the latest security vulnerability.

    Right now, the problem is that vendors will release information specific to their platform, but then if you download anything outside that platform, you are possibly putting yourself at risk unless you actively keep track of each piece of software. If you install enough software this becomes a tremendous pain.

    This way, if there's a possible problem, you get alerted to it, can review the related security advisory, and then easily download the patches for it. That could really trim down on the severity of worm outbreaks I suspect.

  • Klez programmed to go off September 13 (Score:2, Informative)

    by Anonymous Coward
    the reason why klez and its variants are still going strong now is because they are programmed to commence 'attacking' on September 13 (among other dates). lots of systems were infected but because the virus was dormant, they were undetected. since september 13, Klez has been in full force.
  • To write some some kind of module for Apache to correct this. It wasn't hard to write a module, apparently, that e-mailed the sysadmin in question and said, hey, you're infected. Do something about it, Bozo!

    What about a module that detected Nimda, Code Red, whatever attacks, then just attacked back? On attacking back, it uses the very same security holes (I think four of them) through which these worms propagate to issue a shutdown on the system and change the registry key for the startup text to say, "Hey, you're infected by Nimda, fix this now, download this."

    Actually, rather than a shutdown, which may just restart some servers, it should issue a big fat SYSTEM HALT with a notice of infection. "Oh, yeah, we've changed your administrator password to XYZZY, too. A registry key has been added such that, if an attack is detected from your machine a second time, FORMATTING OF YOUR HARD DRIVE WILL OCCUR." Probably get someone's attention.

    Yeah, this wouldn't be particularly legal, but it isn't as if Nimda logs what targets it is attacking. Just leave up a few boxes running this and the infection would drop dramatically.

    • Why not just fix the machine? Isn't their a simple fix that could be sent to their machine, run, thus clearning things up for them. Didn't someone try this?
      • This was discussed in great detail and at length in the original threads about Nimda a year ago. I think the general conclusion of the community (if you can really say there was one) was that the legal risk (at least for those of us in the states) was too high to do it.
    • Actually, you could look at these viruses as more of a protocol than a virus. When the other user initiates the connection, you can simply send a series of 'response' packets to verify that you received the request for a connection. If their computer doesn't know how to handle the 'response' and does something silly like crash, well, that just means they need to update the driver they have for that 'protocol' I mean, the guy who wrote that version they are running now must have been crazy! Its practically a virus!

    • It might not be legal in the sense that you "attack back" the infected server. However, If you set up a webpage that people go to in order to "fix" their infected computers, and that page just so happens to be named one of the files that the worms are attempting to access.

      In the past, I've seen pages that would allow you to test your system to see if you were vulnerable to the various nuke programs (winnuke, teardrop, etc), of the sort "if you get this message, that means you're still operational, and you're not vulnerable"

      So set up a page, explain exactly what it will do, and include on there a link to the script that will "fix" the client computer. If people come along, access my server, and my server does exactly what they requested it to do.... how grey is the legal area?

      Of course, its probably still illegal, since nobody "authorized" the activity, but it might be less shaky legal ground. If you don't want my webserver fixing your computer, then don't access it. Dunno.

      -Restil

  • The solution (Score:3, Insightful)

    by Mr_Silver ( 213637 ) on Wednesday September 18, 2002 @12:19PM (#4281977)
    It would appear that Taco doesn't read postings on Slashdot, even the ones modded +5.

    Anyway, here is it again for Taco:

    Put this in your .procmailrc file:

    :0 B
    * Content-Disposition: attachment
    * name=.*\.(com|exe|pif|scr|bat|lnk|shf|vbs)
    {
    # Stick it somewhere
    :0 B:
    /dev/null
    }

    Of course, this is a bit drastic by throwing every file that ends in that type into the bin, so you may want to replace it with something like /home/username/mail/viruses

    Finally (and this bit is especially for Taco) you will probably need to have a .forward file with the following in it:

    |/usr/bin/procmail

    Once you've done that, then finally we'll never heard again from you how many viruses a day you can get.

    • Re:The solution (Score:2, Interesting)

      by SecretAsianMan ( 45389 )
      Just a few small notes:
      • You may want to use H instead of B to deliver to the bit bucket. The header is likely to be smaller than the body, so using H can result in a much smaller write.
      • You don't need to put a second colon on that line, either. There's no reason to use locks when delivering to the bit bucket. I think procmail may even ignore this colon.
      • Maybe you should anchor the regular expressions to the beginning of the line.
  • check out my /.journal [slashdot.org] for two articles i've posted, the first one about how to keep your apache logs clean from coredred/nimda queries, and a second one posted a few months ago which points you to a list of all unique codered/nimda queries i've received.

  • I've started reporting Klez to the site abuse mailboxes in the hopes they will do something about it. Just report it as you would a normal spam, but say it's a probable virus and give the IP address.

    I can't say they'll do anything, but it's better than doing nothing.
    • I report them several times a day. Does nothing. I still have people hitting my webserver (the same IPs).

    • Re:reporting klez (Score:2, Informative)

      by Eric Savage ( 28245 )
      You realize that Klez is a client virus right? Mailing abuse@ is only going to piss off the person reading and take time away from dealing with issues they have some control over.

      • Re:reporting klez (Score:2, Informative)

        by leviramsey ( 248057 )

        It depends on the network you're emailing to. University IT departments, being knowledgeable, will tend to just immediately disable that computer's MAC address.

        For instance, UMass apparently tells the DHCP server to assign an IP address on one of the netblocks reserved for NAT and has the routers redirect any HTTP requests to a page saying that that computer's rights to access the network have been suspended and how to restore those rights (apply the patches, and inform the IT people, who presumably run a scan on your computer to determine whether you've patched).

      • Yes. It's a client virus that harms both the network it's using and other's networks. I think abuse@ is the perfect group to deal with it.

        Besides, they are the ones with the tools at hand to track down who was using what IP at what time and notify them. Otherwise we wait until that user discovers they have 30 different viruses all competing for network time on their machine. That is how they can have control over this issue. The user doesn't have to be cut off, just informed.

        Also, by prefacing it with a little note like "probable virus at IP#", if they choose not to deal with it, it only takes them 4 seconds to read and delete.

  • Macs (Score:2)

    by tral ( 223126 )
    If there is one thing a Mac is good for it is checking email.

    • Re:Macs (Score:3, Funny)

      by Mononoke ( 88668 )
      Yup. Nimda: Just another app that won't run on Macs.

      I do like being able to safely open all the interesting attachments Klez sends me. Interesting and funny stuff in there from time to time.

  • As Ed Felton said... (Score:2, Insightful)

    by MoonRider ( 31804 )
    "Given the choice between dancing pigs and security people will choose dancing pigs every time."

    There'll be many "nimdas" yet to come...

  • Nimda Removal (Score:2, Interesting)

    by Sufoog ( 576631 )
    What are people's opinions on an anti-nimda client which when scanned by a nimda infected machine will use the Nimda exploits to remove Nimda from the attacking system?

    You could use the tftp client to download the M$ patches and on the condition they were non-interactive you could install them?

    I am under the impression this is highly illegal, but I am just about fed up with my Apache logs filling up! My ipchains DENY list is already quite excessive as I have a program which denies a machine after it has scanned me. The only problem with this approach is the fact most of these people are dialups with dynamic IP's so I am not doing myself any favours except filtering out whole ISP's in a slow time.

    Thanks, Chris

  • Yeah.. i remember this day well.. (Score:3, Interesting)

    by mattyohe ( 517995 ) <matt.yohe@gma[ ]com ['il.' in gap]> on Wednesday September 18, 2002 @01:05PM (#4282352)
    Had a client call me up wondering why she has so many *.eml files cluttered in her servers... I assumed her virus protection wasnt working. and searched arround.. and only found 1 other person who posted about this issue in SARC. Later they started realizing it was a virus and i remember McAffee misnaming it as "Minda". Then lunch that day I watched John Ashcroft on the tv talking about terrorism and then mentinos Nimda... Quite a day.
  • I got the worm for the first time yesterday. Dropped a cute virus along with it, which quickly infected every EXE on my system. *sigh* and it was such a good install, too.

    Incidentally, the email address it was sent to is one that I haven't looked at in years. It was too long...so I made an alias to it with iName. Nobody else had it -- they all used the alias, and frankly I forgot existed. Then mail.com started charging for the service which took practically no resources on their end. About this time, I also started getting about 7 million spam emails from that address. So I turned off the alias, and moved everything to web-only email on webslum.

    By accident I opened OE, which promptly downloaded thousands of spam emails. This can only mean one thing: mail.com sold my fucking address! It was in the process of lazily deleting these that the virus 'sploited my IE laziness and wrote itself in every EXE on my machine until I jacked the plug. By doing this I lost several programs, including my encryption system.

    If not for email.com selling my address against my wishes and after I severed my association with the,, this never would have happened. Shouldn't that shit be illegal? Should I get, like, a bigass check or a $500 per hour systems guru to rebuild my shattered win2k machine?

    • Re:Ironically... (Score:2, Insightful)

      by Sufoog ( 576631 )
      No you shouldn't!

      You should have to pay $500 for being a prat and not patching your system. If you are still running an unpatched system or not virus checker then you are nearly as bad as the people who wrote the virus in the first place!
  • > I'm still getting 5-10 klez virus's a day! Yay Security!

    Yay Spelling!

    Bob the Angry Flower on the use of the apostrophe [angryflower.com] .

  • New 'winnuke' on the webserver (Score:4, Interesting)

    by SCHecklerX ( 229973 ) <greg@gksnetworks.com> on Wednesday September 18, 2002 @02:52PM (#4283253) Homepage
    I just checked my apache error log because of this story, to find I'm still getting hit too.

    well, I just found a lovely use for the latest 'winnuke' vulnerability. I'm writing a perl script tonight, and naming it as one of the pages that gets hit.

    maybe people who's machines keep going down for unknown reasons will start to have some sort of clue before connecting to a public network.

    I figure if they haven't fixed their machines against something that is a year old, then they certainly haven't applied the patch against this vulnerability (find it yourself :P) and likely have smb exposed too. We can hope :)

  • Recently I had to setup an ArcIMS (IMS = internet map server, or as I call it "Incomplete Masochistic Software") on a Windows 2000 Server.

    You have your choice of IIS or Apache, and guess which one I chose? Yep, Apache.

    After testing the box out, I cleared the logs (access/error) at about 3pm and left it running.
    Next day, I discover that less than an hour later a single IP address (204.xxx.xxx.xxx) hammered on it for 300+ hits with *both* codered and nimda and (the same ip or one in the range, I don't recall) hitting all of the default IIS directories looking for *anything*.

    I chuckled for a good half hour after that.

Slashdot Top Deals

He has not acquired a fortune; the fortune has acquired him. -- Bion

Close