On Tue, Sep 18, 2001 at 09:49:30AM -0700, Bill Stewart wrote: | Somebody did a paper about a hypothetical "Andy Warhol Virus", | studying how long it takes to take over a server, | how many servers you can attack per minute, and | what it would take to coordinate an attack that really hit everywhere. | 15 minutes is about enough to hit most of the net, | if you find holes in Apache and IIS that don't need manual tweaking, | and if you don't alert people by scribbling their pages with | "Hacked by Chinese" or "Reformatted by bin Laden" before you're done. | Our chief weapons are surprise, exponential growth and | dividing up target address space effectively, | with quick checks to make sure you don't waste time on infected machines, | and, purely optionally, an almost fanatical analysis of hosting center configs. Someone else (Staniford?) did a paer on flash worms, which add a pre-scan of the Internet for vulnerable machines, so that you start higher on the exponential curve. Its a good thing script kiddies don't read the literature. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

The worm hit Cryptome at 8:43 AM EST and is now sucking at a rate of about 90% of the load. As others have noted, the bulk of the hits appear to be coming from our own ISP, either by design or by spoofing the origin. Our server is on Apache but the worm generates endless errors attempting to find holes in IIS. Pervasive DDoS attacks are reportedly underway at gov sites. We are not seeing an unusual number of that type.

More worm derivatives... And to think we could have killed off all derivatives as well as all the "harborer of incompetance" units long, long ago, but no... our wonderful feds here in the states indicate that release of a repair bot (regardless of where from) would be appropriate merit to be assholes and arrest/imprison the simpleton sheep willing to fix other moronics and prevent these horrendous antics... As my various servers are being hit at over a hundred persistant requests a second, probibing for cmd.exe/etc and related failures in basic system design... Too bad said boxes have never run faulty code. Oh well... Who is actually at fault? Possibly the feds can again raise their hands in this case, eh? ... -Wilfred Wilfred@Cryogen.com