RE: Code Red and other anomalous activity from 1433

From: lsi (stuartat_private)
Date: Fri Jul 12 2002 - 03:29:14 PDT

  • Next message: Brooke, O'neil (EXP): "RE: Lessons Learned from the MPAA's use of DCMA"

    I have noticed more attempts than usual to establish a netbios connection to my system.  Also, I was on a 
    Chinese webserver the other day - www.suoluo.com - and I found some unusual stuff.  It appeared the 
    server had been cracked and was being used to scan other systems.  I downloaded the entire "worm" 
    directory and have been perusing it slowly since then.  A directory listing of the worm is below.  A ready-
    to-install version of this "autorooter" - FluXay 4 - is at http://www.netxeyes.org/ 
    
    The program includes over 100 attack scripts for various operating systems and servers, including Sun, 
    Linux, and IIS, formmail, various shopping carts, etc.  It also mentions SQL, IPC, and password cracking.
    
    Who knows whether this tool has anything to do with an increase in any kind of anomalous activity - but 
    this tool is out there, it does look pretty nasty, and it was being used, although apparently this was in 
    February, judging from timestamps.
    
    Stuart
    
    Directory of G:\down\hack\_worm
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    exploit        <DIR>        08/07/02  16:00 Exploit
    help           <DIR>        08/07/02  16:00 Help
    plugins        <DIR>        08/07/02  16:00 Plugins
    reports        <DIR>        08/07/02  16:00 Reports
    sqlrcmd        <DIR>        08/07/02  16:00 SqlRcmd
    tools          <DIR>        08/07/02  16:00 Tools
    fluxay4  exe     2,056,192  06/07/02  10:37 fluxay4.exe
    1        flx           120  26/02/02   5:06 1.Flx
    202982~1 ftp            42  26/02/02   5:06 202.98.221.5.ftp
    1        hif           458  26/02/02   5:06 1.HIF
    brute    dic            92  26/02/02   5:06 brute.dic
    cgibugs  dat        20,571  26/02/02   5:06 cgibugs.dat
    brute    ult            86  26/02/02   5:06 brute.ult
    cracked  pwd           100  26/02/02   5:06 Cracked.pwd
    dialup   ini             3  26/02/02   5:06 Dialup.ini
    chinese  dic        36,753  26/02/02   5:06 chinese.dic
    dict     his           293  26/02/02   5:07 dict.his
    exploi~1 rul           825  26/02/02   5:07 exploit.rule
    exploi~2 rul         1,557  26/02/02   5:07 exploit_cn.rule
    exploi~3 rul         1,636  26/02/02   5:07 exploit_en.rule
    fshttp   exe       192,512  26/02/02   5:07 FsHttp.exe
    fshttp~1 htm        18,330  26/02/02   5:07 fshttp.html
    ftp      hlt            15  26/02/02   5:07 FTP.hlt
    http     hlt            45  26/02/02   5:07 HTTP.hlt
    http1    gif        41,270  26/02/02   5:07 http1.gif
    http2    gif        12,975  26/02/02   5:07 http2.gif
    http3    gif         9,354  26/02/02   5:07 http3.gif
    httpiis  hlt           737  26/02/02   5:07 HttpIIS.Hlt
    ipcdet~1 inf           163  26/02/02   5:07 IpcDetail.Inf
    ipchost  hlt         1,971  26/02/02   5:07 IpcHost.Hlt
    ipclist  ini            75  26/02/02   5:07 IpcList.INI
    ipcsin~1 ini           101  26/02/02   5:07 ipcsingle.ini
    last     flx         1,740  26/02/02   5:08 Last.Flx
    last     hif             0  26/02/02   5:08 Last.HIF
    last     pwd             0  26/02/02   5:08 Last.pwd
    libmysql dll       217,088  26/02/02   5:08 libmySQL.dll
    mfc42    dll       995,383  26/02/02   5:08 MFC42.DLL
    netxey~1 jpg        37,341  26/02/02   5:08 netxeyeslogo.jpg
    msvcp60  dll       401,462  26/02/02   5:08 MSVCP60.DLL
    ntcmd    exe        20,480  26/02/02   5:08 NTCmd.exe
    name     dic         1,426  26/02/02   5:08 Name.dic
    normal   dic         9,247  26/02/02   5:08 Normal.dic
    ntipc    hlt           371  26/02/02   5:08 NTIPC.hlt
    ntlmauth dll        20,480  26/02/02   5:08 NTLMAuth.dll
    password dic        14,898  26/02/02   5:08 password.Dic
    pipecmd  exe        40,960  26/02/02   5:08 PipeCmd.exe
    pop      hlt            29  26/02/02   5:08 POP.hlt
    pophost  hlt           125  26/02/02   5:08 PopHost.Hlt
    pubauth  key        44,187  26/02/02   5:08 PubAuth.Key
    report~1 htm             0  26/02/02   5:08 Report.html
    restore  ini            56  26/02/02   5:08 restore.ini
    rhv      dll        45,056  26/02/02   5:08 RHV.dll
    sample1  gif         7,337  26/02/02   5:08 sample1.gif
    sample2  gif         7,563  26/02/02   5:08 sample2.gif
    sample3  gif         3,310  26/02/02   5:08 sample3.gif
    sample4  gif        10,484  26/02/02   5:08 sample4.gif
    sample5  gif         9,596  26/02/02   5:08 sample5.gif
    sample6  gif         8,524  26/02/02   5:08 sample6.gif
    sample7  gif         3,178  26/02/02   5:08 sample7.gif
    search   his            30  26/02/02   5:08 search.his
    server   dll           531  26/02/02   5:08 server.dll
    single   dic             8  26/02/02   5:08 single.dic
    single   ini             8  26/02/02   5:08 Single.INI
    sqlhost  hlt           665  26/02/02   5:08 SqlHost.Hlt
    sys_mo~1 dic         2,232  26/02/02   5:08 Sys_Month_Date.Dic
    sys_year dic           300  26/02/02   5:08 Sys_Year.Dic
    uninstal exe        19,483  26/02/02   5:08 uninstal.exe
    uninstal ini        16,796  26/02/02   5:08 uninstal.ini
    unixcgi  dat         6,328  26/02/02   5:08 unixcgi.dat
    user     his            33  26/02/02   5:08 user.his
    words    dic        91,453  26/02/02   5:09 Words.dic
            65 file(s)      4,434,464 bytes
    
    Directory of G:\down\hack\_worm\Exploit
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    local          <DIR>        08/07/02  16:00 local
    7350wu~1 gz         16,229  26/02/02   5:04 7350wu-v5.tar.gz
    admmou~1 tgz         7,431  26/02/02   5:04 ADMmounted.tgz
    amd      c           4,751  26/02/02   5:04 amd.c
    linx86~1 c           9,624  26/02/02   5:04 linx86_bind.c
    lsub     c           5,588  26/02/02   5:04 lsub.c
    rpcaut~1 c           3,294  26/02/02   5:04 rpc.autofsd.c
    rpc_cmsd c          12,455  26/02/02   5:04 rpc_cmsd.c
    sadmin~1 c          17,254  26/02/02   5:04 sadmindex-sparc.c
    seclpd   c          11,791  26/02/02   5:04 seclpd.c
    snmpxd~1 c           8,279  26/02/02   5:04 snmpxdmid.c
    statdx   c          19,729  26/02/02   5:04 statdx.c
    ttdbse~1 c           9,017  26/02/02   5:04 ttdbserver.c
    wuftp2~1 gz          3,861  26/02/02   5:04 wuftp25.tar.gz
            13 file(s)        129,303 bytes
    
    Directory of G:\down\hack\_worm\Exploit\local
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    sunspa~1       <DIR>        08/07/02  16:00 Sun Sparc
    su       c          12,554  26/02/02   5:04 su.c
             1 file(s)         12,554 bytes
    
    Directory of G:\down\hack\_worm\Exploit\local\Sun Sparc
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    5        6     <DIR>        08/07/02  16:00 5.6
    5        7     <DIR>        08/07/02  16:00 5.7
    5        8     <DIR>        08/07/02  16:00 5.8
             0 file(s)              0 bytes
    
    Directory of G:\down\hack\_worm\Exploit\local\Sun Sparc\5.6
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    lpset          <DIR>        08/07/02  16:00 lpset
    lpstat         <DIR>        08/07/02  16:00 lpstat
    netpr          <DIR>        08/07/02  16:00 netpr
             0 file(s)              0 bytes
    
    Directory of G:\down\hack\_worm\Exploit\local\Sun Sparc\5.6\lpset
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    default  htm        26,148  26/02/02   5:04 default.htm
             1 file(s)         26,148 bytes
    
    Directory of G:\down\hack\_worm\Exploit\local\Sun Sparc\5.6\lpstat
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    default  htm        27,868  26/02/02   5:04 default.htm
             1 file(s)         27,868 bytes
    
    Directory of G:\down\hack\_worm\Exploit\local\Sun Sparc\5.6\netpr
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    default  htm        26,424  26/02/02   5:04 default.htm
             1 file(s)         26,424 bytes
    
    Directory of G:\down\hack\_worm\Exploit\local\Sun Sparc\5.7
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    lpset          <DIR>        08/07/02  16:00 lpset
    lpstat         <DIR>        08/07/02  16:00 lpstat
    netpr          <DIR>        08/07/02  16:00 netpr
    xsun           <DIR>        08/07/02  16:00 xsun
             0 file(s)              0 bytes
    
    Directory of G:\down\hack\_worm\Exploit\local\Sun Sparc\5.7\lpset
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    default  htm        26,148  26/02/02   5:04 default.htm
             1 file(s)         26,148 bytes
    
    Directory of G:\down\hack\_worm\Exploit\local\Sun Sparc\5.7\lpstat
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    default  htm        27,868  26/02/02   5:04 default.htm
             1 file(s)         27,868 bytes
    
    Directory of G:\down\hack\_worm\Exploit\local\Sun Sparc\5.7\netpr
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    default  htm        26,424  26/02/02   5:04 default.htm
             1 file(s)         26,424 bytes
    
    Directory of G:\down\hack\_worm\Exploit\local\Sun Sparc\5.7\xsun
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    default  htm        26,048  26/02/02   5:04 default.htm
             1 file(s)         26,048 bytes
    
    Directory of G:\down\hack\_worm\Exploit\local\Sun Sparc\5.8
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    kcssun         <DIR>        08/07/02  16:00 kcssun
             0 file(s)              0 bytes
    
    Directory of G:\down\hack\_worm\Exploit\local\Sun Sparc\5.8\kcssun
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    default  htm        26,508  26/02/02   5:04 default.htm
             1 file(s)         26,508 bytes
    
    Directory of G:\down\hack\_worm\Help
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    1        27    <DIR>        08/07/02  16:00 1.27
    image          <DIR>        08/07/02  16:00 image
    faq      mht        20,731  26/02/02   5:05 faq.mht
    fluxay~1 htm        24,924  26/02/02   5:05 fluxay4.html
    form     mht       205,476  26/02/02   5:05 form.mht
    http     mht       476,093  26/02/02   5:06 http.mht
    index~1  htm         2,405  26/02/02   5:06 index.html
    ipc      mht       165,112  26/02/02   5:06 ipc.mht
    remote   mht        93,332  26/02/02   5:06 remote.mht
    plugin~1 htm        12,539  26/02/02   5:06 plugin.html
    sql      mht       181,576  26/02/02   5:06 sql.mht
    result~1 htm        39,513  26/02/02   5:06 result.html
            10 file(s)      1,221,701 bytes
    
    Directory of G:\down\hack\_worm\Help\1.27
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    additi~1 htm         4,712  26/02/02   5:04 addition_filelist.html
    anfade~1 cla        16,397  26/02/02   5:04 AnFade.class
    anfade   jar        11,065  26/02/02   5:04 AnFade.jar
    dictcomb gif         4,590  26/02/02   5:04 DICTCOMB.GIF
    dictpr~1 gif         8,310  26/02/02   5:04 dictproper.gif
    dictsp~1 gif         4,373  26/02/02   5:04 dictsplit.gif
    engdict  gif         8,512  26/02/02   5:04 ENGDICT.GIF
    engdic~1 gif         3,465  26/02/02   5:04 engdictad.gif
    flux     gif        40,417  26/02/02   5:04 FLUX.GIF
    flux1    gif        26,519  26/02/02   5:04 FLUX1.GIF
    flux2    gif        40,417  26/02/02   5:04 FLUX2.GIF
    flux3    gif        47,837  26/02/02   5:04 FLUX3.GIF
    flux4    gif        60,885  26/02/02   5:04 FLUX4.GIF
    flux5    gif        45,600  26/02/02   5:04 FLUX5.GIF
    fluxst~1 gif        50,671  26/02/02   5:04 fluxstartup.gif
    functi~1 gif         5,248  26/02/02   5:04 function_attackoption.gif
    functi~2 gif         1,930  26/02/02   5:04 function_connectoption.gif
    functi~3 gif        22,891  26/02/02   5:04 function_dictIII_1.gif
    functi~4 gif        21,942  26/02/02   5:04 function_dictIII_2.gif
    functi~5 gif        22,408  26/02/02   5:04 function_dictIII_3.gif
    functi~6 gif         7,823  26/02/02   5:04 function_dictIII_4.gif
    functi~7 gif        21,021  26/02/02   5:04 function_dictIII_5.gif
    functi~8 gif         3,389  26/02/02   5:04 function_dictoption.gif
    functi~9 gif         2,423  26/02/02   5:04 function_otheroption.gif
    funct~10 gif         3,340  26/02/02   5:04 function_singleoption.gif
    funct~11 gif         5,557  26/02/02   5:04 function_sysoption.gif
    index~1  htm         3,580  26/02/02   5:04 index.html
    intro    gif        50,426  26/02/02   5:04 INTRO.GIF
    mainback jpg         5,096  26/02/02   5:05 MAINBACK.JPG
    menu_a~1 gif         2,816  26/02/02   5:05 menu_attack.gif
    menu_e~1 gif         4,462  26/02/02   5:05 menu_edit.gif
    menu_f~1 gif         2,485  26/02/02   5:05 menu_file.gif
    menu_h~1 gif         1,236  26/02/02   5:05 menu_help.gif
    menu_o~1 gif         1,687  26/02/02   5:05 menu_option.gif
    menu_t~1 gif         4,313  26/02/02   5:05 menu_tool.gif
    msdos    gif         8,606  26/02/02   5:05 MSDOS.GIF
    part_1~1 htm         2,983  26/02/02   5:05 part_1.html
    part_2~1 htm        19,152  26/02/02   5:05 part_2.html
    part_3~1 htm         1,989  26/02/02   5:05 part_3.html
    part_3~2 htm         1,138  26/02/02   5:05 part_3_1.html
    part_3~3 htm         4,105  26/02/02   5:05 part_3_2.html
    part_3~4 htm         1,295  26/02/02   5:05 part_3_2_1.html
    part_3~5 htm         7,111  26/02/02   5:05 part_3_3.html
    part_3~6 htm         8,313  26/02/02   5:05 part_3_5.html
    part_3~7 htm        18,577  26/02/02   5:05 part_3_4.html
    part_3~8 htm        14,948  26/02/02   5:05 part_3_6.html
    part_3~9 htm         2,293  26/02/02   5:05 part_3_7.html
    part_5~1 htm         1,007  26/02/02   5:05 part_5.html
    part_4~1 htm         3,092  26/02/02   5:05 part_4.html
    planedit gif         4,753  26/02/02   5:05 Planedit.gif
    produc~1 gif        62,290  26/02/02   5:05 productsn.gif
    sharem~1 gif        70,662  26/02/02   5:05 sharemail.gif
            52 file(s)        800,157 bytes
    
    Directory of G:\down\hack\_worm\Help\image
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    netxey~1 jpg        37,341  26/02/02   5:05 netxeyeslogo.jpg
    scanbase gif        37,323  26/02/02   5:05 scanbase.gif
    scanport gif        32,356  26/02/02   5:05 scanport.gif
    scanpop  gif        31,557  26/02/02   5:05 scanpop.gif
    scanftp  gif        31,790  26/02/02   5:05 scanftp.gif
    scansmtp gif        31,512  26/02/02   5:05 scansmtp.gif
    scanimap gif        31,629  26/02/02   5:05 scanimap.gif
    scante~1 gif        31,049  26/02/02   5:05 scantelnet.gif
    scancgi  gif        32,358  26/02/02   5:05 scancgi.gif
    scancg~1 gif        12,953  26/02/02   5:05 scancgirule.gif
    scansql  gif        31,692  26/02/02   5:05 scansql.gif
    scanipc  gif        33,061  26/02/02   5:05 scanipc.gif
    scaniis  gif        32,478  26/02/02   5:05 scaniis.gif
    scanfi~1 gif        31,677  26/02/02   5:05 scanfinger.gif
    scanrpc  gif        31,079  26/02/02   5:05 scanrpc.gif
    scanmisc gif        31,560  26/02/02   5:05 scanmisc.gif
    scanpl~1 gif        12,395  26/02/02   5:05 scanplugin.gif
    scanop~1 gif        35,264  26/02/02   5:05 scanoption.gif
    tcpopt~1 gif         2,344  26/02/02   5:05 tcpoption.gif
    result~1 gif         4,985  26/02/02   5:05 result_ipc.gif
    result~2 gif         7,302  26/02/02   5:05 result_ipc_ntcmd.gif
    result~3 gif         4,829  26/02/02   5:05 result_sql.gif
    result~4 gif         3,559  26/02/02   5:05 result_iis_remoteexecute.gif
    result~5 gif         8,183  26/02/02   5:05 result_sql_sqlrcmd.gif
    result~6 gif         3,050  26/02/02   5:05 result_iis_remoteexecutetyp.gif
    result~7 gif         3,946  26/02/02   5:05 result_pca_connect.gif
    result~8 gif         9,237  26/02/02   5:05 result_iis_remoteexecutewin.gif
    result~9 gif         4,967  26/02/02   5:05 result_pca_ftp.gif
    resul~10 gif         2,246  26/02/02   5:05 result_pca_crack.gif
    resul~11 gif         3,559  26/02/02   5:05 result_fpg_ipc.gif
    resul~12 gif         1,836  26/02/02   5:05 result_fpg_add.gif
    resul~13 gif         6,806  26/02/02   5:05 result_fpg_import.gif
    resul~14 gif         3,401  26/02/02   5:05 result_fpg_selectuser.gif
    resul~15 gif         5,000  26/02/02   5:05 result_ipc_planter.gif
    resul~16 gif         9,419  26/02/02   5:05 result_mysql.gif
    resul~17 gif        10,862  26/02/02   5:05 result_sun_finger.gif
    resul~18 gif         4,369  26/02/02   5:05 result_sun_finger_crack.gif
            37 file(s)        648,974 bytes
    
    Directory of G:\down\hack\_worm\Plugins
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    nullpr~1 flu           264  26/02/02   5:06 nullprinter.flux
             1 file(s)            264 bytes
    
    Directory of G:\down\hack\_worm\Reports
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    202102~1 htm           887  26/02/02   5:06 202.102.108.111-202.102.108.111.html
    202981~1 htm        55,758  26/02/02   5:06 202.98.196.1-202.98.198.255.html
    202981~2 htm         4,645  26/02/02   5:06 202.98.197.146-202.98.197.146.html
    202982~1 htm           820  26/02/02   5:06 202.98.216.9-202.98.216.9.html
    202996~1 htm         2,232  26/02/02   5:06 202.99.67.100-202.99.67.100.html
    netxey~1 jpg        37,341  26/02/02   5:06 netxeyeslogo.jpg
             6 file(s)        101,683 bytes
    
    Directory of G:\down\hack\_worm\SqlRcmd
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    sqlrcm~1       <DIR>        08/07/02  16:00 SqlRCmd_Express
    sqlrcm~2       <DIR>        08/07/02  16:00 SqlRCmd_Normal
             0 file(s)              0 bytes
    
    Directory of G:\down\hack\_worm\SqlRcmd\SqlRCmd_Express
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
             0 file(s)              0 bytes
    
    Directory of G:\down\hack\_worm\SqlRcmd\SqlRCmd_Normal
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
             0 file(s)              0 bytes
    
    Directory of G:\down\hack\_worm\Tools
    
    .              <DIR>        08/07/02  16:00 .
    ..             <DIR>        08/07/02  16:00 ..
    netsvc   exe        78,640  26/02/02   5:06 NETSVC.EXE
    ntlm     exe       110,592  26/02/02   5:06 NTLM.EXE
    pskill   exe        77,824  26/02/02   5:06 PSKILL.EXE
    runasex  exe        36,864  26/02/02   5:06 RunAsEx.exe
    srv      exe        59,392  26/02/02   5:06 SRV.EXE
             5 file(s)        363,312 bytes
    
    Total files listed:
           198 file(s)      7,925,848 bytes
            71 dir(s)        1,061.63 MB free
    
    
    On 11 Jul 2002 at 14:53, Michael Fredericks wrote:
    
    From:           	"Michael Fredericks" <mfredericksat_private>
    To:             	"'Graham, Randy (RAW) '" <RAWat_private>,
      	"'Curley Mr Eric P'" <CurleyEPat_private>, 
    <incidentsat_private>
    Subject:        	RE: Code Red and other anomalous activity from 1433
    Date sent:      	Thu, 11 Jul 2002 14:53:08 -0700
    
    > Hi All,
    > I've been getting slammed with Subseven attempts in the past 24 hours.
    > Again they are almost all from Asia (APNIC) and most of the ones I've
    > traced so far have been in Korea. Since it is Subseven, I wouldn't
    > imagine they'd be spoofed so I think it is safe to say there is
    > something weird going on in Asia.
    > 
    > Michael Fredericks
    > Manager - Networks and Telecommunications
    > InfoSol, Inc.
    > mfredericksat_private
    > http://www.infosol.com/
    > 
    > 
    > -----Original Message-----
    > From: Graham, Randy (RAW) [mailto:RAWat_private] 
    > Sent: Thursday, July 11, 2002 12:56 PM
    > To: Curley Mr Eric P; incidentsat_private
    > Subject: RE: Code Red and other anomalous activity from 1433
    > 
    > Seeing about 24 hours worth of traffic here.  Started a little before
    > 8:00
    > yesterday morning.  Last we saw of it was around 6:30 today (at least,
    > the
    > last my internal snort sensor picked up - not sure if the firewall guys
    > have
    > just blocked it or if it has stopped).
    > 
    > Randy Graham
    > -- 
    > Recursion (ri-'k&r-zh&n) [noun] - See: Recursion
    > 
    > 
    > > -----Original Message-----
    > > From: Curley Mr Eric P [mailto:CurleyEPat_private]
    > > Sent: Thursday, July 11, 2002 10:26 AM
    > > To: incidentsat_private
    > > Subject: Code Red and other anomalous activity from 1433
    > > 
    > > 
    > > Has anybody else been getting slammed by Code Red activity 
    > > today?  It seems
    > > to be coming from mostly Asian blocks  but there are some other blocks
    > > thrown in there as well.  Then again it could all be spoofed 
    > > and could be
    > > coming from the 12 year old down the street..Thrown into all 
    > > this traffic
    > > I'm also seeing a lot of Dest ports with 1433; Possibly that 
    > > SQL stuff that
    > > happened last month..anywho, just wanted to know if anybody else was
    > > experiencing this.
    > > 
    > > Cheers,
    > > Eric
    > > 
    > > -----Original Message-----
    > > From: H C [mailto:keydet89at_private]
    > > Sent: Wednesday, July 10, 2002 1:40 PM
    > > To: Pavel Kankovsky; incidentsat_private
    > > Subject: RE: TCP port 139 probes
    > > 
    > > 
    > > 
    > > > Having done a superficial examination
    > > > of system directories on those machines (they had a
    > > > publicly accesible
    > > > share, ergo I was invited, wasn't I? <g>) 
    > > 
    > > Uh...no, you weren't.  Just b/c a share is publicly
    > > accessible, does NOT, in fact, mean that you were
    > > invited.  This is simply the age-old rhetoric used to
    > > justify malicious actions.  While many admins have
    > > said that they would be very happy to be told by an
    > > outsider that they had a vulnerable machine, to date
    > > not a single one has said that they'd be happy to have
    > > that person access the machine via some vulnerability
    > > and take files.
    > > 
    > > > I downloaded 3 of them and they all seem to be
    > > > compressed executables
    > > 
    > > As with your previous posts, this one is incredibly
    > > vague and lacking in any useful information. 
    > > Compresses with what?  PKZip?  UPX?  What version? 
    > > Did you uncompress the files?
    > > 
    > > > having a common prefix, 
    > > 
    > > If you're referring to the first couple of bytes of
    > > the file, "MZ" is the common prefix for executables on
    > > Windows systems.
    > > 
    > > > and there are some fragments
    > > > of strings ("rom",
    > > > "y smt", ") with", "ESM", "Mime-", "-Typ", "quit"
    > > > etc) in that common
    > > > prefix suggesting there is some SMTP implementation
    > > > there--presumably
    > > > some kind of malware able to spread via email.
    > > 
    > > Did you run strings on the compressed or uncompressed
    > > file?  
    > >  
    > > > But I did not find anything similar on other
    > > > machines I examined.
    > > 
    > > Interesting how you've posted to a public list,
    > > basically stating that while you refuse to do any
    > > testing on your end to verify that the activity you're
    > > seeing is a worm (in your own words to me via email,
    > > you're "too lazy"), you're more than willing to access
    > > vulnerable systems and take files...
    
    
    -- 
    Stuart Udall
    stuartat_private - http://www.cyberdelix.net/
    ..revolution through evolution
    
    want to make some cash? check out http://cyberdelix.net/affiliates.htm
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Fri Jul 12 2002 - 15:30:12 PDT