RE: CodeRed Observations.

From: larosa, vjay (larosa_vjay@emc.com)
Date: 03/13/03

  • Next message: Matthew Todd: "tcp/25 (smtp) and tcp/24942 (unk)" 
    From: "larosa, vjay" <larosa_vjay@emc.com>
To: 'Rob Shein' <shoten@starpower.net>, "larosa, vjay" <larosa_vjay@emc.com>, incidents@securityfocus.com
Date: Thu, 13 Mar 2003 11:32:17 -0500

    There are no filters in place for viewing the firewall logs.
    Even if there were, the attacks I am seeing are even targeted to
    IP addresses that are not up and on-line in my network. So
    how would a "get default.ida?XXX" string be sent to a host that
    is,

    a) Not up on the network.
    b) Behind a firewall that blocks ALL incoming port 80.

    If there is no three way handshake to set up a TCP session
    I should not see this data trying to flow to my hosts (Dead
    IP's or even live IP's). The traffic I am seeing is stateless
    (Stick/Snot).

    vjl

    -----Original Message-----
    From: Rob Shein [mailto:shoten@starpower.net]
    Sent: Thursday, March 13, 2003 10:57 AM
    To: 'larosa, vjay'; incidents@securityfocus.com
    Subject: RE: CodeRed Observations.

    Check your filters. You might be looking at traffic through a selection
    filter that doesn't show the handshake, so that you can concentrate on the
    content that passes back and forth. That's what I usually find to be the
    case when someone makes this kind of observation...

    > -----Original Message-----
    > From: larosa, vjay [mailto:larosa_vjay@emc.com]
    > Sent: Wednesday, March 12, 2003 7:48 PM
    > To: 'incidents@securityfocus.com'
    > Subject: FW: CodeRed Observations.
    >
    >
    > > Hello,
    > >
    > > I have been watching this recent spike in CodeRed activity and one
    > > thing I am noticing is the lack of TCP session establishment. I am
    > > seeing common get strings like this showing
    > > up at my firewalls without ever establishing a TCP three
    > way handshake. I
    > > have seen several
    > > hundred packets with in the last two days similar to this
    > at my firewalls.
    > >
    > > 47 45 54 20 2F 64 65 66 61 75 6C 74 2E 69 64 61 GET
    > /default.ida 3F
    > > 58 58 58 58 58 58 58 58 58 58 58 58 58 58 58
    > ?XXXXXXXXXXXXXXX 58 58
    > > 58 58 58 58 58 58 58 58 58 58 58 58 58 58 XXXXXXXXXXXXXXXX
    > 58 58 58
    > > 58 58 58 58 58 58 58 58 58 58 58 58 58 XXXXXXXXXXXXXXXX 58
    > 58 58 58
    > > 58 58 58 58 58 58 58 58 58 58 58 58 XXXXXXXXXXXXXXXX
    > >
    > Snip------------------------------------------------------------------
    > > ----
    > > ------------------------------------------------------
    > >
    > > I find it awfully strange that there is no handshake (not even a
    > > single SYN to try and establish a session) but these
    > packets show up
    > > anyway. I also am not seeing an increase of port 80
    > > scans in my firewall logs or with any of my IDS sensors. Is
    > anybody else
    > > out there seeing the
    > > same things we are?
    > >
    > > Thanks!
    > >
    > > vjl
    > >
    > > V.Jay LaRosa EMC Corporation
    > > Information Security 4400 Computer Dr.
    > > (508)898-7433 office Westboro, MA 01580
    > > (508)353-1348 cell www.emc.com
    > > 888-799-9750 pager larosa_vjay@emc.com
    > >
    > >
    > >
    >
    > --------------------------------------------------------------
    > --------------
    >
    > <Pre>Lose another weekend managing your IDS?
    > Take back your personal time.
    > 15-day free trial of StillSecure Border Guard.</Pre>
    > <A href="http://www.securityfocus.com/stillsecure">
    > http://www.securityfocus.com/stillsecure </A>
    >
    >

    ----------------------------------------------------------------------------

    <Pre>Lose another weekend managing your IDS?
    Take back your personal time.
    15-day free trial of StillSecure Border Guard.</Pre>
    <A href="http://www.securityfocus.com/stillsecure"> http://www.securityfocus.com/stillsecure </A>

  • Next message: Matthew Todd: "tcp/25 (smtp) and tcp/24942 (unk)"

    Relevant Pages

    • Re: Linksys Firmware Upgrade Available
      ... First I will say that I have no experience with WinRoute. ... filtering -vs- personal firewall applications. ... Basic packet filters work by inspecting the pkt headers (usually the IP ...
      (comp.security.firewalls)
    • Re: Linksys Firmware Upgrade Available
      ... First I will say that I have no experience with WinRoute. ... filtering -vs- personal firewall applications. ... Basic packet filters work by inspecting the pkt headers (usually the IP ...
      (comp.security.firewalls)
    • Re: Firewalls and Cryptography
      ... greater than a firewall only device. ... layer 7 according to RFC 2979, if it filters away data with malware. ... network is one that doesn't allow any data through at all and that the only ... But in this case - and the reason I jumped in on this ...
      (comp.security.firewalls)
    • RE: IPsec vs any personal software firewall
      ... This prevents the source port 88 issue. ... It is possible to bypass the filters and contact a service listening on UDP. ... Should you use it if you have a firewall running externally of the machine? ... IPSec filters are not a replacement for a firewall. ...
      (Focus-Microsoft)
    • Re: Basic Firewall IP filters
      ... Javier [SBS MVP] ... "Where do you adjust the firewall for SBS" <Where do you adjust the firewall ... >> Routing and Remote Access supports IP packet filtering, ... Pass through all traffic except packets prohibited by filters. ...
      (microsoft.public.windows.server.sbs)