Re: Code Red, anyone?

From: Glenn Forbes Fleming Larratt (glrattat_private)
Date: Tue Jul 31 2001 - 19:31:37 PDT

  • Next message: S. Staniford: "Re: Code Red, anyone?"

    Here at (unnamed-for-policy-reasons academic Class B) we've seen
    exactly one packet matching our Snort rule for IIS exploit attempts of
    the sort that include Code Red (from 195.219.102.44 in .de, FWIW).
    
    We've also examined MRTG graphs of all our network and subnet links,
    paying particular attention to the turnover of 0000 UTC 1 August, and
    have observed no anomalies in traffic flows that would indicate either
    widespread infection or DDoS attempts.
    
    	-g
    
    On Tue, 31 Jul 2001, Alfred Huger wrote:
    
    > I realize that most of you have taken shelter and are awaiting the
    > impending demise of the Internet as we know it. However for those of you
    > stalwart bastions of courage who are still manning the ship in the face of
    > this clear and present danger, I have a question. Anyone seeing Code Red
    > activity yet?
    >
    -- 
    Glenn Forbes Fleming Larratt         The Lab Ratt (not briggs :-)
    glrattat_private                        http://www.io.com/~glratt
    There are imaginary bugs to chase in heaven.
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Tue Jul 31 2001 - 20:42:54 PDT