[Xitami] "default.ida?"

[John Poltorak]

On Mon, Aug 06, 2001 at 10:48:00AM -0500, Craig Morrison wrote:
> 
> Can you say, "Code Red"? I thought you could..
> 
> Seriously though, it is an infected system trying to infect your system via
> Code Red.
> 
> 1. No, not unless you want to spend all your time writing access masks.
> 2. They are trying to exploit a vulnerability that Xitami does not have.
> 3. They are trying to trigger a vulnerability in MS's IIS (v4,v5 unpatched)
> that allows the virus to have SYSTEM access to your server. Since you are
> running Xitami you don't have any worries.
> 
> Just to have a little fun I set up a page just for those unfortunate souls who
> do get infected. Instead of returning a 404 error, Xitami on my system greets
> them with a "nice" welcome. :-)

I'd like to have a little fun with them by shutting their systems down and 
prevent them from being such a nuisance.

>From reports I've read, systems infected  with the new variant leave 
themselves with a publicly accessible telnet. I'd love to invoke an automated
remote shutdown on any systems trying to attack mine. Is this possible?

 
> -- 
> 
> Craig Morrison
>   MTS Professional @ http://www.2cah.com/
>   A Win32 Email server that works for _you_.
> EzMTS - A _free_ Win32 EMail Server
>   http://www.ezmts.org/
>   Anonymous FTP at ftp://ftp.ezmts.org
> 


-- 
John