RE: Update to "Code Red" Worm. Its a date bomb, not time.

["Marc Maiffret" <marc () eeye com>]

It is hard coded to the IP address. :-/

Signed,
Marc Maiffret
Chief Hacking Officer
eEye Digital Security
T.949.349.9062
F.949.349.9538
http://eEye.com/Retina - Network Security Scanner
http://eEye.com/Iris - Network Traffic Analyzer
http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities

|-----Original Message-----
|From: matt sommer [mailto:mms () speakeasy org]
|Sent: Thursday, July 19, 2001 10:15 PM
|To: Marc Maiffret
|Cc: Vuln-Dev; SECURITY-BASICS
|Subject: Re: Update to "Code Red" Worm. Its a date bomb, not time.
|
|
|On Thu, 19 Jul 2001, Marc Maiffret wrote:
|
|> We made an error in our last analysis and said the worm would start
|> attacking whitehouse.gov based on a certain time. In reality its 
|based on a
|> date (the 20th UTC) which is tomorrow.
|>
|
|If the worm isnt hardwired to attack 198.137.240.91 and 198.137.240.92,
|its too bad the folks at www.whitehouse.gov probably arent willing to
|change their IN A records to 127.0.0.1 for a few days.
|
|-- 
|Matt Sommer [MMS26], CISSP
|
|
|
|