The UNIX and Linux Forums  

Go Back   The UNIX and Linux Forums > Special Forums > Security
Code Red Redirect Code Red Redirect
Google UNIX.COM
Forums Portal Register Forum Rules FAQContribute Members List Arcade Search Today's Posts Mark Forums Read


Security Anything involving computer security goes here.

More UNIX and Linux Forum Topics You Might Find Helpful
Thread Thread Starter Forum Replies Last Post
how i prepare a c++ code(c code) for implementing my own protocol format amitpansuria High Level Programming 1 09-06-2007 08:09 PM
SSH key code versus server key code Texan Security 1 04-12-2006 08:57 AM
Return code from PL/SQL Code Shaz UNIX for Advanced & Expert Users 7 06-03-2003 07:56 AM
PHP Redirect perleo Shell Programming and Scripting 2 05-11-2003 08:17 AM
Redirect <Therapy> IP Networking 1 03-20-2002 04:54 AM

Reply
 
Submit Tools LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 08-08-2001
Neo's Avatar
Neo Neo is offline
Administrator
  

Join Date: Sep 2000
Location: Asia Pacific
Posts: 4,277
Stumble this Post!
Code Red Redirect
For Apache servers getting hammered with Code Red hits, one solution is this addition to your httpd.conf files in Apache:


Quote:
Redirect /default.ida http://www.microsoft.com
This will help keep the load off your web server and put the load where it belongs, sending the probes to the originator. Seems only fair and ethical to return the probe to the originator.
Reply With Quote
Forum Sponsor
  #2 (permalink)  
Old 08-08-2001
mib mib is offline
Registered User
  

Join Date: Jan 2001
Location: Calicut
Posts: 228
Stumble this Post!
/me ROTFL
Reply With Quote
  #3 (permalink)  
Old 08-09-2001
PxT's Avatar
PxT PxT is offline
Registered User
  

Join Date: Oct 2000
Location: Sacramento, CA
Posts: 909
Stumble this Post!
Re: Code Red Redirect
Quote:
Originally posted by Neo
This will help keep the load off your web server and put the load where it belongs
Will this really lower the load on your web server? Assuming you are running Apache, then /default.ida probably doesn't exist anyway, which would mean the server sends a 404 Not Found response. With this Redirect, it just sends a 302 Redirect response instead. i don't think it would save you many bytes.

Quote:
Seems only fair and ethical to return the probe to the originator.
Well, not to defend Microsoft, but technically they are not the "originator". IIS is just a "carrier" for the virus.


Its a funny idea though ...
Reply With Quote
  #4 (permalink)  
Old 08-09-2001
Neo's Avatar
Neo Neo is offline
Administrator
  

Join Date: Sep 2000
Location: Asia Pacific
Posts: 4,277
Stumble this Post!
No, it does not really lower the load on Apache servers. It is just a fun idea

When default.ida does not exist, the return code is 400:

Quote:

128.146.87.135 - - [19/Jul/2001:16:46:10 -0400] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucb d3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 252
After redirect the return code is 302:

Quote:
64.95.192.98 - - [09/Aug/2001:17:01:01 -0400] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucb d3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 302 567
Reply With Quote
  #5 (permalink)  
Old 08-10-2001
Registered User
  

Join Date: Aug 2001
Posts: 2
Stumble this Post!
Redirect default.ida on Apache
I did this the other day on my company's server; couldn't resist.

Neo said:

Seems only fair and ethical to return the probe to the originator.

Yes, if Microsoft wouldn't release such buggy code, they wouldn't be in the mess they are.
Reply With Quote
  #6 (permalink)  
Old 08-14-2001
PxT's Avatar
PxT PxT is offline
Registered User
  

Join Date: Oct 2000
Location: Sacramento, CA
Posts: 909
Stumble this Post!
Another interesting solution:

http://www.dasbistro.com/default.ida


A perl script which finds the technical contact by checking the SOA record for each IP that connects and sends them a friendly email...


Or here's another one:

http://www.dynwebdev.com/codered/

which pops up a window on the attacking machine using Java and "net send".


Or yet another which attempts to slow the attack process by getting the attacker caught waiting for TCP timeouts:

http://www.hackbusters.net/CodeRedneck.tgz
Reply With Quote
Google The UNIX and Linux Forums
Reply

« Password Authentication | How many... »
Thread Tools
Display Modes
Linear Mode Linear Mode




All times are GMT -7. The time now is 12:03 PM.

The UNIX and Linux Forums RSS Feeds - Contact Us - The UNIX and Linux Forums - Archive - Top

Powered by: vBulletin, Copyright ©2000 - 2006, Jelsoft Enterprises Limited.
The UNIX and Linux Forums Content Copyright ©1993-2008 The CEP Blog All Rights Reserved -Ad Management by RedTyger Visit The Global Fact Book

Content Relevant URLs by vBSEO 3.2.0