Re: Code Red gone to sleep?

[cambria () owt com]

CR's 10/1 exit was predicted by some of the analyses of CR.

> From http://www.incidents.org/react/code_redII.php ...

"Before each attempt to connect to a new target, the worm
checks the local time to see if the year is less than 2002
and if the month is less than 10. If either of these checks
return false, then the worm ceases the propagation cycle
and reboots the server. Note that this implies that all worms
will cease propagating by Oct. 1, 2001."



Greg



On 10/2/2001 at 3:54 PM Jay D. Dyson wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
>
> Hi folks,
>
>       We were discussing on the Early Bird Developers list that none of
> us have seen any Code Red scans since September 30th.  This can only mean
> one of four things:
>
>       1.      Code Red has "gone to sleep,"
>
>       2.      Code Red committed ritual seppuku and rm'd every box it
>               previously infected,
>
>       3.      Nimda has taken over all previously infected Code Red
>               systems[*],
>
>       4.      All the automated intrusion attempt notices finally paid
>               off and affected sites have finally shut their infected
>               systems down.
>
>       While I'd like to believe that the silence is due to option #4,
> experience leads me to believe that options #1 and #2 are most likely, and
> option #3 is a close runner-up.
>
> - - -Jay
>
> * Nimda is still banging away like a nympho bunny on Spanish Fly.
>
>  (    (                                                         _______
>  ))   ))   .-"There's always time for a good cup of coffee."-.   >====<--.
> C|~~|C|~~| (>------ Jay D. Dyson - jdyson () treachery net ------<) |    = |-'
> `--' `--'  `--------------- rm -rf /bin/laden ---------------'  `------'
>
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.2
> Comment: See http://www.treachery.net/~jdyson/ for current keys.
>
> iQCVAwUBO7o3j7lDRyqRQ2a9AQH6JgP/dBanAhC7L2O9Y0DiqXYx7sqX/dmiSmVh
> Bd4eBI/t/01FmYBg+EV3SgFWrX/+u+JCl5soPz/ck0XQ+0YN5Lmq3ltsw1TDqwVa
> ApyxIRhNBe3hZSpID1LnpuNuNpQm+O3ZXD/jXPRGHVnaobzjAMnPwDYNhNGHRUhV
> wIJs3tFt6VM=
> =yh/M
> -----END PGP SIGNATURE-----
>
>
> ----------------------------------------------------------------------------
> This list is provided by the SecurityFocus ARIS analyzer service.
> For more information on this free incident handling, management
> and tracking system please see: http://aris.securityfocus.com




----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com