[lug] Fending off nimda/codered probes. (fwd)

Justin glow at jackmoves.com
Wed Sep 26 08:30:13 MDT 2001


I just want to clarify real quick on what exactly to put in your Apache 
httpd.conf (I'm totally unfamiliar with redirects). I looked at the 
Apache docs on redirects but just want to be sure. Do I add the line 
exactly as follows to my httpd.conf?

RedirectMatch (.*)\cmd.exe$ http://127.0.0.1

Thanks for any help...

Justin

> This is a thing of beauty! I put in the redirect at 1:30pm after 
seeing 
> about 10 hits/hour for Nimda requests, and since then there are no 
hits at 
> all from them.
> 
> But isn't this sort of a mask? The traffic is still showing up on my 
> network, going through my ip forwarding box, arriving at my Apache 
server, 
> and going back out, right? So what this is doing is (a) keeping my 
logs 
> small and more useful, and (b) possibly alerting the infected 
machine's 
> user if they happen to be at all aware which is doubtful. Now, (a) is 
a 
> Good Thing, but is this basically what's happening?
> 
> -Mike
> 
> At 02:40 PM 9/25/2001 -0600, D. Stimits wrote:
> >"J. Wayde Allen" wrote:
> > >
> > > ---------- Forwarded message ----------
> > > Date: Tue, 25 Sep 2001 11:16:09 -0600 (MDT)
> > > From: D.J. Atkinson <dj at pcisys.net>
> > > To: wallen at its.bldrdoc.gov
> > > Subject: Fending off nimda/codered probes.
> > >
> > > Hi Wayde,
> > >
> > > This came to me a bit ago and I thought you might want to share 
it with
> > > those on the BLUG list who are having/have had issues with DoS 
from
> > > nimda/codered probes.
> > >
> > > Basically it suggests using redirects to make those probing look 
to
> > > themselves (127.0.0.1) for the files they're wanting.
> > >
> > > I'm going to set some redirs up on my box.
> >
> >One problem with redirects is that clients have to understand the
> >redirect. Unless the worm understands redirect, it won't look at 
itself.
> >Has anyone experimented with testing the ability to redirect a nimda
> >worm against itself?
> >
> >D. Stimits, stimits at idcomm.com
> >
> >
> > >
> > > DJ
> > >
> > > --
> > >        o o o o o o o . . .                                  
_______
> > >       o         _____ _____        ____________________ ____] D D 
[_||___
> > >    ._][__n__n___|DD[ [     \_____  |  D.J. Atkinson   | | 
dj at pcisys.net |
> > >   >(____________|__|_[___________]
_|__________________|_|_______________|
> > >   _/oo OOOO OOOO oo` 'ooooo ooooo` 'o!o            o!o` 'o!
o         o!o`
> > > -+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+-
-+--+--+-
> > > Visit my web page at http://www.pcisys.net/~dj
> > >
> > > > -----Original Message-----
> > > > From: Fulton L. Preston Jr. [mailto:fulton at prestons.org]
> > > > Sent: Monday, September 24, 2001 7:01 PM
> > > > To: incidents at securityfocus.com
> > > > Subject: RE: Tracking down the still infected hosts
> > > >
> > > >
> > > > I implemented the methods below on my IIS and Apache servers 
and it
> > > > knocked all the local Nimda traffic dead in minutes. Nimda
> > > > traffic from
> > > > neighboring ISPs was way down within an hour.  Since I am on a 
cable
> > > > modem I can't control the rest of the network around me but 
this sure
> > > > did shut them noisy infected boxes up in a hurry :)
> > > >
> > > > The only ones still hitting me (though very slowly now) are
> > > > workstations
> > > > that don't have IIS running but are still infected via other
> > > > means.  The
> > > > boxes that are running IIS even stop responding to pings
> > > > after awhile so
> > > > I assume they die after awhile.
> > > >
> > > > It's stuff like this that makes the SecurityFocus mailing
> > > > lists so darn
> > > > useful!
> > > >
> > > >
> > > >
> > > > -----Original Message-----
> > > > From: Mike Lewinski [mailto:mike at rockynet.com]
> > > > Sent: Monday, September 24, 2001 12:29
> > > > To: incidents at securityfocus.com
> > > > Subject: Re: Tracking down the still infected hosts
> > > >
> > > >
> > > > > Anyone else doing anything to help this?
> > > >
> > > > I don't think that this has been posted here yet.... The 
following
> > > > appears
> > > > to cripple infected hosts and limits the damage they can cause. 
Others
> > > > who
> > > > have used this report that persistent infected hosts disappear 
from
> > > > their
> > > > logs shortly after applying this configuration change to their 
own
> > > > servers,
> > > > and that browsing an infected server after applying this 
results in
> > > > "HTTP
> > > > 403.9 - Access Forbidden: Too many users are connected"
> > > >
> > > > For Apache:
> > > > RedirectMatch (.*)\cmd.exe$ http://127.0.0.1
> > > >
> > > >
> > > > For IIS:
> > > >
> > > > ----- Original Message -----
> > > > From: "Ron Hornbaker" <ron at hksi.net>
> > > > To: <imail at hksi.net>
> > > > Sent: Friday, September 21, 2001 1:11 PM
> > > > Subject: RE: [imail] IIS Judo against Nimda's DoS attacks (was 
Fwd:
> > > > [isp-linux] Buaaa Haaa Ha Haaaaaaaaa...)
> > > >
> > > >
> > > > > Great tip, Len. Here's the IIS version... just create a file 
in your
> > > > web
> > > > > root called something like "Custom404.asp", with this content
> > > > (customize
> > > > > the friendly part as much as you wish):
> > > >
> > > > <%
> > > > 'Custom404.asp page to thwart Nimda DoS attacks on IIS
> > > > 'by Humankind Systems, Inc. http://hksi.net/
> > > > 'No support or guarantees of any kind are granted with this
> > > > 'code. Use at your own risk. Distribute freely.
> > > >
> > > > 'Get the entire URL requested
> > > > myRequest=Request.ServerVariables("QUERY_STRING")
> > > >
> > > > 'A list of filenames Nimda looks for
> > > > myBadList="cmd.exe,root.exe,admin.dll,default.ida"
> > > >
> > > > 'Detect a GET request from the Nimda virus and take appropriate 
action
> > > > arrBadString=Split(myBadList,",")
> > > > for i=0 to UBound(arrBadString)
> > > > if inStr(myRequest,arrBadString(i))>0 then
> > > > 'turn offending server back on itself
> > > > Response.redirect "http://127.0.0.1"
> > > > end if
> > > > next
> > > > %>
> > > > <html>
> > > > <head>
> > > > <title>Page Not Found</title>
> > > > </head>
> > > > <body>
> > > > Sorry, but that page was not found on our server.
> > > > <p>
> > > > Here is a link back to our <a href="/">Home Page</a>.
> > > > </body>
> > > > </html>
> > > >
> > > >
> > > >
> > > >
> > > > --------------------------------------------------------------
> > > > ----------
> > > > ----
> > > > This list is provided by the SecurityFocus ARIS analyzer 
service.
> > > > For more information on this free incident handling, management
> > > > and tracking system please see: http://aris.securityfocus.com
> > > >
> > > >
> > > >
> > > > --------------------------------------------------------------
> > > > --------------
> > > > This list is provided by the SecurityFocus ARIS analyzer 
service.
> > > > For more information on this free incident handling, management
> > > > and tracking system please see: http://aris.securityfocus.com
> > > >
> > >
> > > _______________________________________________
> > > Web Page:  http://lug.boulder.co.us
> > > Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> >_______________________________________________
> >Web Page:  http://lug.boulder.co.us
> >Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> 
> 
> Michael Deck
> Cleanroom Software Engineering, Inc.   
> 
> 
> _______________________________________________
> Web Page:  http://lug.boulder.co.us
> Mailing List: http://lists.lug.boulder.co.us/mailman/listinfo/lug
> 
> 

-----
glow at jackmoves.com
www.jackmoves.com



More information about the LUG mailing list