Nothing like Code Red II for .....

Article View: demon.security

Article #58

#58

From: Simon Waters
Date: Mon, 06 Aug 2001 18:26

22 lines
1909 bytes

finding out who has the same Class A prefixes as your ISP -
193.x.x.x

DEMON seem to do a better job at getting reverse DNS lookup in
place in the DNS that 
Deutsche Telekom AG (dtag.de), judging by the Code Red II probes
I'm seeing.


For those who are still having fun with Microsoft IIS servers
scanning for port 80, remember that Code Red II is a new worm
using the same vulnerability, and has a different and nastier
payload. So be careful cleaning up those IIS servers, a reboot
and patch is no longer enough to clean up.

For some reason people seem to have made less fuss about Code
Red II, whilst the network people I know are more irritated by
it that the previous incarnation, and the resulting infection
leaves your server wide open to anyone who wants to run any old
program on it.

Lots of details at http://www.incidents.org/

Technical Details

Message-ID: <3B6EE163.14FA0710@wretched.demon.co.uk>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!sn-xit-02!supernews.com!news.tele.dk!212.74.64.35!colt.net!dispose.news.demon.net!news.demon.co.uk!demon!wretched.demon.co.uk!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 1065b6,33984ddfebcfb476,start
X-Google-Attributes: gid1065b6,public
X-Google-ArrivalTime: 2001-08-06 11:26:01 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!sn-xit-02!supernews.com!news.tele.dk!212.74.64.35!colt.net!dispose.news.demon.net!news.demon.co.uk!demon!wretched.demon.co.uk!not-for-mail
From: Simon Waters <Simon@wretched.demon.co.uk>
Newsgroups: demon.security
Subject: Nothing like Code Red II for .....
Date: Mon, 06 Aug 2001 19:26:43 +0100
Organization: Eighth Layer Limited
Message-ID: <3B6EE163.14FA0710@wretched.demon.co.uk>
NNTP-Posting-Host: wretched.demon.co.uk
X-NNTP-Posting-Host: wretched.demon.co.uk:193.237.109.203
X-Trace: news.demon.co.uk 997122349 nnrp-12:10958 NO-IDENT wretched.demon.co.uk:193.237.109.203
X-Complaints-To: abuse@demon.net
X-Mailer: Mozilla 4.76 [en] (X11; U; Linux 2.2.19 i686)
X-Accept-Language: en-GB, en-US, en
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 22