Re: Publishing Nimda Logs

[Glenn Forbes Fleming Larratt <glratt () io com>]

"Truly sad"? I would use "pathetic" - the vulnerability for Code Red
was only *months* old when CR came out; the (web directory traversal) one 
for Nimda was *years* old.

Frankly, I'm going to opine #3, although I'd not use "Boring" so much
as "Futile" - consider:

        - how long have ORBS and its knock-offs been around?
        - is the open relay problem getting better?

I'm all for public pressure, but unless you can convince a 
large-enough-to-become-inconvenient bloc of domains to shun
entire networks because they don't secure their systems, you're
not going to get a critical mass of concern on the part of the
(already) irresponsible people.

It's also the case that (a) keeping such a thing properly up to date, and
(b) avoiding the mistake of the open-relay-zealots (i.e. "you're in our
list because we don't agree with your methods"[1]) will become nontrivial 
over time.

My strategy has been to only report/block the flagrant outside offenders, 
and to ignore the small ones - and to immediately, without exception, shut
down anyone in my network who gets himself infected.

Conclusion: 3.5 Futile. It's Nimda, and it's not gonna stop as long as IPV4
and IIS that ships UNPATCHED (*#$!) by default are out there. Deal with
it, keep your own systems secure, and ignore the logs.

        -g

[1] Our approach to open relay issues was to block SMTP from outside our
network to any but our approved, properly secured mail servers. When
we reported this to one of the open-relay-zealot sites, who had us listed,
they refused to remove us from the list - not because we had an open relay,
but because they could not get an SMTP connection to check every host in
our network. We have taken the position that it is no-one's position to
arbitrarily scan our network for vulnerabilities, for any reason, and
told the aforementioned zeolots to take a flyin' leap. 



On Tue, 7 May 2002, Deus, Attonbitus wrote:

>   It is truly sad that so many people are still infected with Nimda. There
>   is a company with my corporate ISP that I have notified 3 times now that
>   they are attacking other systems. It seems they can't figure out how not
>   to install Win2k/IIS5.0 while connected to the net. The sad thing is that
>   this is a computer company.
>
>   I have seen a site where people have published the IP of the offending
>   boxes for stuff like Nimda and CR. I am thinking about doing the same
>   thing so that people can either use that information to block the IP's or
>   to do whatever they want for that matter.
>
>   I'm curious to see how other feel about this. Is it:
>
>   1) Recommended. Go for it and publish the IP's and let the "Gods of IP"
>   sort out the damage.
>   2) A Bad Thing. These are innocent victims, and you will just have them be
>   attacked by evil people.
>   3) Boring. Who cares? It's Nimda, and an everyday part of life. Deal with
>   it and ignore the logs.
>
>   If "1," then I was thinking of going with a "Hall of Shame" and providing
>   ARIN look ups, contacts, and the whole bit. I could even allow other
>   people to post logs there and stuff like that...
>
>   Input appreciated.
>
>   AD
>
>
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 7.1
>
> iQA/AwUBPNgHPIhsmyD15h5gEQLsWACZASlsx6Wew0YfTHAzIHxotQYAdkAAoIoV
> VSob5Hcw7X9DDzDxNUzXftdm
> =Xv5m
> -----END PGP SIGNATURE-----
>
>
> ----------------------------------------------------------------------------
> This list is provided by the SecurityFocus ARIS analyzer service.
> For more information on this free incident handling, management 
> and tracking system please see: http://aris.securityfocus.com

-- 
Glenn Forbes Fleming Larratt         The Lab Ratt (not briggs :-) 
glratt () io com                        http://www.io.com/~glratt  
There are imaginary bugs to chase in heaven.


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com