[Xitami] A Hack Attempt or What?

[Ewen McNeill]

In message <20010805165952.9693.cpmta@c012.sfo.cp.net>, GunnarSwan writes:
>In my Xitami Access and Error logs, I have found the following ... this being o
>nly one of the items. There are about 5-10, all from different IP addresses.
>
>203.250.84.135 - - [04/Aug/2001:05:20:54 -0800] "GET /default.ida?NNNNNNNNNNNNN
>NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
>NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
>NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u
>9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8
>b00%u531b%u53ff%u0078%u0000%u00=a%20 HTTP/1.0" 404 0 "" ""

This is the way that CodeRed (the first version) tries to spread itself.
There's also a second version (CodeRedII) which is more agressive, and
backdoors the systems it infects as well.  Both CodeRed and CodeRedII
infect only IIS (4 and 5 at least) servers via the "ida" service module;
Microsoft has had a patch out for about three weeks, but people are
still being infected by the thousands.

The requests don't affect Xitami (which just says "don't have that ida
thing"), although some other integrated webservers have apparently been
crashing due to the requests being fairly long, so there has been some
collateral damage.

I suspect it's going to take 2-3 weeks before people finally get around
to patching enough systems and this settles down.  Despite mainstream
media attention.

Ewen

-- 
Ewen McNeill, Technical Consultant, iMatix Corporation  www.imatix.com