October 2002 - openSUSE Security - openSUSE Mailing Lists

RE: [suse-security] does anybody know such a log
by Thomas Schweikle 12 Oct '02

12 Oct '02

> Yes I do. This is why it doesn't really bother me. I just > can't believe that there's still Nimda/Code Red infected > boxes out there. After more than one year. Unfortunately there are. And often newly installed boxes out there do not incorporate the neccessary fixes to harden them against Nimda/Code Red. Some admins don't apply these patches regulary... -- Thomas

2 1

Re: [suse-security] RE: does anybody know such a log
by Thomas Lamy 12 Oct '02

12 Oct '02

I use a combo of iptables, snort and a script called guardian.pl (got it from freshmeat I think). My snort rules are stripped down to give no (i hope) false positives, every alarm gets picked up by that guardian.pl script, which in turn creates iptables rules to block "intruders" for 24 hours. guardian also features a white list (not a bad thing to have), to keep you (and known freidnly IPs) from locking yourself off. This setup runs fine for me for more than a year now on a SuSE 7.2 + kernel 2.4.x + bridging (so the fw itself is invisible to the net). Thomas

1 0

RE: [suse-security] RE: does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

snort 1.9.0 identified it as [**] WEB-IIS CodeRed v2 root.exe access [**] 10/11-22:26:06.822248 217.219.177.228:1803 -> my.ip.address:80 TCP TTL:112 TOS:0x0 ID:61416 IpLen:20 DgmLen:112 DF ***AP*** Seq: 0x1963F358 Ack: 0xE45FF7F5 Win: 0x4238 TcpLen: 20 =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ iptables didn't pick that one up. Code Red came in using cmd.exe. I had no rule for that. philipp > -----Original Message----- > From: Jörg Fuchs [mailto:jf@meriadon.de] > Sent: Friday, October 11, 2002 11:20 PM > To: suse-security(a)suse.com > Subject: AW: [suse-security] RE: does anybody know such a log > > > Philipp wrote: > > >iptables -t filter -A INPUT -i $EXT_IFACE -p tcp \ > > -d $IP --dport http -m string \ > > --string "/default.ida?" -j DROP > >I'm implementing that and lets see how good the stuff works. > > I would be interested in the outcomes of your test. > Especially the impact on your firewall's load. > Please post your expierence - thanx *g* > > Joerg > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

AW: [suse-security] RE: does anybody know such a log
by Jörg Fuchs 11 Oct '02

11 Oct '02

Philipp wrote: >iptables -t filter -A INPUT -i $EXT_IFACE -p tcp \ > -d $IP --dport http -m string \ > --string "/default.ida?" -j DROP >I'm implementing that and lets see how good the stuff works. I would be interested in the outcomes of your test. Especially the impact on your firewall's load. Please post your expierence - thanx *g* Joerg

1 0

RE: [suse-security] RE: does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

Also I'm feeding my reverse proxy with acl nimdaworm urlpath_regex -i \.eml$ http_access deny nimdaworm acl nimda1 url_regex README.EML acl nimda2 url_regex root.exe acl nimda3 url_regex cmd.exe acl nimda4 url_regex readme.eml acl nimda5 url_regex readme.exe acl nimda6 url_regex default.ida http_access deny nimda1 http_access deny nimda2 http_access deny nimda3 http_access deny nimda4 http_access deny nimda5 http_access deny nimda6 I think, that should do it. Philipp > -----Original Message----- > From: Wolfgang Kueter [mailto:wolfgang@shconnect.de] > Sent: Friday, October 11, 2002 10:51 PM > To: suse-security(a)suse.com > Subject: RE: [suse-security] RE: does anybody know such a log > > > On Fri, 11 Oct 2002 mailinglists(a)belfin.ch wrote: > > > > > Can't tell you, but I found some antidote against such stuff in the > > internet: > > > [iptables -m string --string "pattern"] > > well, the stuff from the patch-o-matic and some of that stuff > is not very > stable, however you might try. Both SuSE default kernels 2.4.28 and > 2.4.19 that came with the two last version offer the module > already, so > can run tests even with the default kernel. > > A simple modprobe ipt_string should be enough. > > I'd believe that this pattern matching will be quite CPU consuming, > anyway, why not try it. > > Wolfgang > -- > shconnect Internet Service > web: http://www.shconnect.de EMail: info(a)shconnect.de > Bundesstrasse 2, 24392 Dollrottfeld, Fed. Rep. Germany > phone: +49 4641 644 > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

1 0

RE: [suse-security] RE: does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

Can't tell you, but I found some antidote against such stuff in the internet: # DROP HTTP packets related to CodeRed and Nimda # viruses silently iptables -t filter -A INPUT -i $EXT_IFACE -p tcp \ -d $IP --dport http -m string \ --string "/default.ida?" -j DROP iptables -t filter -A INPUT -i $EXT_IFACE -p tcp \ -d $IP --dport http -m string \ --string ".exe?/c+dir" -j DROP iptables -t filter -A INPUT -i $EXT_IFACE -p tcp \ -d $IP --dport http -m string \ --string ".exe?/c+tftp" -j DROP I'm implementing that and lets see how good the stuff works. Philipp > **HI > ** > **http://www.cert.org/advisories/CA-2001-19.html > ** > **Code Red :) > IIRC ,wasn't there a script someone on the Suse linux E list > had , that would > stop the thing from filling up your logs ??? Which is , at > present all it can > do.... > > -- > j > > afterthought If this was funny it would be a tagline. > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

OT: Simple Traffic Control Question (Howto)
by Mario Ohnewald 11 Oct '02

11 Oct '02

Hello! Sorry for posting this, i know its slightly OT. But i hope to get help here cause most of the networking/sysadmin ppl hang around here! ;) I have read the Howto (Section 9 exspecially!) a few times. It might be the language that i not get this or whatever! I want to make sure that port 14567 (upd) is in a priority 1 band (Minimum Delay). Port 14567 is used by an Online game, a low ping is badly needed. I decided to use Token Bucket Filter ( i hope i have chosen the right one) (...)Note that we use 'tc class add' to CREATE classes within a qdisc, but that we use 'tc qdisc add' to actually add qdiscs to these classes.(...) 1.) Do i have to create a class first ? example: tc qdisc add dev ppp0 root handle 1: htb default 30 2.) then i have to add qdisc to a class? example: tc qdisc add dev ppp0 root tbf rate 220kbit latency 50ms burst 1540 3.) set filter ? example: tc filter add dev eth0 protocol ip parent 10: prio 1 u32 match ip dport 22 0xffff flowid 1:1 I have read the howto but i can not find my mistake! I hope u can help me, i am really new to this! Cheers, Mario

1 0

Re: [suse-security] Re: **maillist-work:: Re: [suse-security] doe s anybody know such a log
by m3047＠inwa.net 11 Oct '02

11 Oct '02

Miguel Albuquerque <mfoacs(a)e-workshop.ch> wrote: >Hi, > >What about this: >schebish.c.crosslink.net - - [11/Oct/2002:17:02:57 +0200] "GET >/default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN >NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN >NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN >NNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc >bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a > HTTP/1.0" 400 329 ?? > A buffer overflow aimed at a legacy API in IIS if I recall correctly (probably Code Red). Really, you should try a search with Google: http://www.google.com/search?hl=en&ie=ISO-8859-1&q=%2Fdefault.ida%3FNNNNNNNN &btnG=Google+Search In other words, I pasted "/default.ida?NNNNNN" into the search window. It *is* that easy... -- Fred Morris m3047(a)inwa.net

1 0

RE: [suse-security] Re: **maillist-work:: Re: [suse-security] doe s anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

Hi yes, it's really possible. Our reverse proxy just today picked up the same logs coming from a french IP address. I'm just checking what exactly this is. Philipp > -----Original Message----- > From: Thomas Seliger [mailto:CRJLJAKTJORB@spammotel.com] > Sent: Friday, October 11, 2002 2:01 PM > To: suse-security(a)suse.com > Subject: [suse-security] Re: **maillist-work:: Re: > [suse-security] does > anybody know such a log > > > Hi, > > What Hannes says is true. There are quite a few nimda > infected computers > out there that are connected to the internet via T-DSL, even > some with > ISDN. With "flatrates" getting affordable, people often have > their PCs > connected their PCs almost 24h to (e.g. for download or P2P). Also > running a Webserver on such hosts isn't as uncommon as it used to be. > > peace, > Tom > > > Johannes Studt wrote: > > > On Friday 11 October 2002 13:28, mailinglists(a)belfin.ch wrote: > > > >>Who's sleeping here? > >>This isn't neither nimda nor code red. This is a scan. it came from > >>a dial up account. Nimda and Code red never came from dial up > >>accounts. They always came from static IP addresses. > > > > > > Why nimda or code red _must_ come from static ip addresses? > > Think of IIS installed on WinPCs which are 24/7 up and > accessible via > > DynDNS names. Such systems are vulnerable too... > > > > Hannes > > > > > -- > Check the headers for your unsubscription address > For additional commands, e-mail: suse-security-help(a)suse.com > Security-related bug reports go to security(a)suse.de, not here >

2 1

RE: [suse-security] does anybody know such a log
by mailinglists＠belfin.ch 11 Oct '02

11 Oct '02

> > > dig -x ip.address: > > > > > > 90.99.11.217.in-addr.arpa. 86383 IN PTR > dialup-90.iberbanda.es. > > > > > > I've seen a lot of logs dealing with nimda and code red a > year ago. > But I > > > never saw this coming from a dial up link. > > I saw several attempts from dsl and dial up. I checked the french and the spanish ip addresses. These definitely were dial up boxes. And whatever it is they send, it cannot affect my boxes. > Anyway it does not affect any linux-box! > Any responsible admin will not tolerate those insecure iis and use > apache (even with or without asp)! That's for sure. > concerned about this attempts, that do not effect your server (I think > you are running apache, don't you?)? Yes I do. This is why it doesn't really bother me. I just can't believe that there's still Nimda/Code Red infected boxes out there. After more than one year. My installation is very new. That's why snort isn't running yet. I'll be able to see more once snort runs. > If you got iis make some acl's in your reverse proxy will help filter > all nasty requests and don't effect your system(s)! Thank you all for your kind help Philipp

1 0