Re: CodeGreen beta release (idq-patcher/antiCodeRed/etc.)

From: Jonathan Rickman (jonathan@xcorps.net)
Date: 09/06/01 

Date: Wed, 5 Sep 2001 22:45:49 -0400 (EDT)
From: Jonathan Rickman <jonathan@xcorps.net>
To: Blue Boar <BlueBoar@thievco.com>
Subject: Re: CodeGreen beta release (idq-patcher/antiCodeRed/etc.)
Message-ID: <Pine.LNX.4.33.0109052232250.595-100000@abacus.xcorps.net>

Moderator: My webserver has logged CodeGreen hits, so I feel I have the
right to respond to this admittedly wasted thread. If nothing else...please
afford me the opportunity to speak to the world without resorting to strange GET
requests in everyone's webserver logs.

> Does anyone realize what a bad idea it is to release worms like this in
> the first place, regardless of wheatehr or nto they mean well?

Obviously not...

195.224.242.248 - - [04/Sep/2001:19:00:30 -0400] "GET
/default.ida?Code_Green_<I_like_the_colour-_-><AntiCo
deRed-CodeRedIII-IDQ_Patcher>_V1.0_beta_written_by_'D
er_HexXer'-Wuerzburg_Germany-_is_dedicated_to_my_sist
erli_'Doro'.Save_Whale_and_visit_<www.buhaboard.de>_a
nd_<www.buha-security.de>%u9090%u6858%ucbd3%u7801%u90
90%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9
090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u
00=a HTTP/1.0" 404 1442 "-" "-"

Logs deliberately not sanitized...

Thanks but no thanks 195.224.242.248, I don't need any help securing this
system. It is not now, nor was it ever, vulnerable to Code Red.

> CodeGreen from my understanding does random scanning like Code Red and is

Apparently so, as this is an Apache server...

> 2) Traffic caused by Code Red brings down routers and
> printers and it even can cause Cisco 2500 series routers (from experience,
> costly ones) to run out of memory and cease functioning until a reboot.

Can't confirm this, but I wouldn't be surprised to find similar problems with
Code Green.

> 3) It's illegal. Just as Code Red gaims unauthorized access to systems,
> so does this worm.

Not much doubt about that. The beauty is, we know who the author of this is. He
claimed responsibility publicly.

> 8) Go to hell.

I was thinking the same thing...

<TONGUE IN CHEEK>
As far as I'm concerned, this is a "log defacement". It's bad enough having to
parse through all the XXXXXXXXXX / NNNNNNNNN / AAAAAAAAAAA / VVVVVVVVVVVV
entries without adding "_is_dedicated_to_my_sisterli_'Doro'.Save_Whale" to the
list. What the hell is that all about anyway???
</TONGUE IN CHEEK> 

-- 
Jonathan Rickman
X Corps Security
http://www.xcorps.net

Relevant Pages

  • Re: User cant connect to particular webserver from his PC.
    ... The user was able to access the webserver when a test user account was ... The logs show that when the user attempts to connect IE is ... able to access the server fine, and this user is able to access all ...
    (microsoft.public.windows.server.security)
  • security issues
    ... My security precautions for my webserver are probably what you might ... call 'fair-to-middling'. ... I checked the logs, and I saw that the auth.log has got many entries ... I don't think the attacker gained access, but I would like some sort of ...
    (Debian-User)
  • Re: strange logs
    ... You actually have a webserver up. ... >> The logs are telling you that someone has tried to download ... >> alanconnor AT earthlink DOT net ... > Here's a quick and dirty web page that you can put up: ...
    (comp.os.linux.misc)
  • Re: Malicious use of grc.com
    ... of course the logs of his webserver are very easily correlated ... > with any portscans leading up to an attack, ...
    (Vuln-Dev)