Re: [BUGTRAQ] Full analysis of the .ida "Code Red" worm.

From: Vern Paxson (vernat_private)
Date: Thu Jul 19 2001 - 16:33:19 PDT

Next message: Christopher McCrory: "windowsupdate hit with code red worm"

Previous message: Ken Eichman: "Re(2): 'Code Red' does not seem to be scanning for IIS"
Next in thread: Vern Paxson: "Re: [BUGTRAQ] Full analysis of the .ida "Code Red" worm."
Next in thread: LARD BENJAMIN LEE: "Mitigating some of the effects of the Code Red worm"
Reply: Vern Paxson: "Re: [BUGTRAQ] Full analysis of the .ida "Code Red" worm."
Reply: Vern Paxson: "Re: [BUGTRAQ] Full analysis of the .ida "Code Red" worm."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

> This one's gonna be bad.

Oh yes.

Yesterday (pre-worm), about 1,600 different remote hosts attempted to
connect to web servers in the lbl.gov IP space for which no server was
listening.  This is the typical background rate (previous day was 1,300.)

So far today, it's been 1.17 million different remote hosts.

		Vern

Next message: Christopher McCrory: "windowsupdate hit with code red worm"
Previous message: Ken Eichman: "Re(2): 'Code Red' does not seem to be scanning for IIS"
Next in thread: Vern Paxson: "Re: [BUGTRAQ] Full analysis of the .ida "Code Red" worm."
Next in thread: LARD BENJAMIN LEE: "Mitigating some of the effects of the Code Red worm"
Reply: Vern Paxson: "Re: [BUGTRAQ] Full analysis of the .ida "Code Red" worm."
Reply: Vern Paxson: "Re: [BUGTRAQ] Full analysis of the .ida "Code Red" worm."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Thu Jul 19 2001 - 17:43:51 PDT