This was all over one of our Apache logs today. The requests are coming from many different IPs from all over the world. We traced IPs to Italy, Brazil, Korea, USA, etc.

I was reading about it and found that this is an exploit for IIS. We run Apache so we are not too concerned, but I just wanted to know if you knew anything about this how problematic it might be.

Thanks.

Never mind. I already found it is code red.

How nice is to run UNIX and not WINDOWS :D

Yep, that is the code red worm :)

I noticed that in our logs two days ago as well, right after we installed the code red patch :)

If you are running linux/unix and want to see how many times you have been scanned by code red, just execute the following command:

cat /path/to/access_log | grep -c default.ida

obviously, the more IPs you have, the more you will get scanned.

thanks for the command jw.

wow, 708 times in 2 days with only 2 ip's =]

has been kicking my door for 4 days.

Just in case any fellow newbies were curious, if you see "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXX" in your logs, that's the new Code Red II, which is more malicious than the first one (and once again shouldn't affect Linux/Unix servers). I heard about it for the first time yesterday, and today I'm getting scanned about once a minute for it. Praise Apache! :)

root@server [~]# cat /usr/local/apache/logs/access_log | grep -c default.ida
11070

We run apache 1.3.20, not IIS but the problem is that 4 hours ago, the above number was half that :eek:

Its now making the server very slow and unresponsive - and dam right annoying :(

What do you think about this:


root@serverXX [~]# cat /usr/local/apache/logs/access_log | grep -c default.ida
35869


:angry: :angry:

of refusing or denying connection for that specific query?

2165 on our new servers (uptime 1 day ;))

Originally posted by Cyberpunk
Is there no way of refusing or denying connection for that specific query?

You could block further accesses beyond the first one, for example by automatically adding the offending IPs to ipchains/iptables.

IANACRE (I am not a Code Red expert ;)), but I don't think such a scheme would be of any use in this case. The infected servers seem to try each IP only once and move on when no vulnerability is found.

Never looked closely enough at the IP numbers of the attempts.

Would make sense for the virus to do that to achieve maximum infection rate before its spotted on the host server.