Nothing like Code Red for......

Article View: demon.security

Article #59

#59

From: Simon Waters
Date: Mon, 06 Aug 2001 18:39

26 lines
2096 bytes

finding out who has the same Class A prefixes as your ISP
193.x.x.x

DEMON seem to have done a better job at putting reverse 
DNS in place than Deutsche Telekom AG (dtag.de), judging 
by the Code Red II probes I'm seeing.


For those who are still having fun with Microsoft IIS servers
scanning for port 80, remember that Code Red II is a new worm
using the same vulnerability, and has a different and nastier
payload. So be careful cleaning up those IIS servers, a reboot
and patch is no longer enough to clean up.

For some reason people seem to have made less fuss about Code
Red II, whilst the network people I know are more irritated by
it that the previous incarnation, and the resulting infection
leaves your server wide open to anyone who wants to run any old
program on it.

Lots of details at http://www.incidents.org/

-- 
Are you using the Internet to best effect ? www.eighth-layer.com
Tel: +44(0)1395 232769      ICQ: 116952768
Moderated discussion of teleworking at news:uk.business.telework

Technical Details

Message-ID: <3B6EE456.E62DE3CC@wretched.demon.co.uk>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!sn-xit-02!supernews.com!isdnet!newscore.gigabell.net!news0.de.colt.net!colt.net!dispose.news.demon.net!news.demon.co.uk!demon!wretched.demon.co.uk!not-for-mail

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 1065b6,544ecc235a3e2780,start
X-Google-Attributes: gid1065b6,public
X-Google-ArrivalTime: 2001-08-06 11:39:01 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!newsfeed.google.com!sn-xit-02!supernews.com!isdnet!newscore.gigabell.net!news0.de.colt.net!colt.net!dispose.news.demon.net!news.demon.co.uk!demon!wretched.demon.co.uk!not-for-mail
From: Simon Waters <Simon@wretched.demon.co.uk>
Newsgroups: demon.security
Subject: Nothing like Code Red for......
Date: Mon, 06 Aug 2001 19:39:18 +0100
Organization: Eighth Layer Limited
Message-ID: <3B6EE456.E62DE3CC@wretched.demon.co.uk>
NNTP-Posting-Host: wretched.demon.co.uk
X-NNTP-Posting-Host: wretched.demon.co.uk:193.237.109.203
X-Trace: news.demon.co.uk 997123104 nnrp-10:4400 NO-IDENT wretched.demon.co.uk:193.237.109.203
X-Complaints-To: abuse@demon.net
X-Mailer: Mozilla 4.76 [en] (X11; U; Linux 2.2.19 i686)
X-Accept-Language: en-GB, en-US, en
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 26