Skip site navigation (1)Skip section navigation (2)
Date:      Fri, 28 Jun 2002 15:21:11 -0500
From:      Pete Ehlke <pde@rfc822.net>
To:        freebsd-security@FreeBSD.ORG
Subject:   Re: Apache worm in the wild [with POSSIBLE block]
Message-ID:  <20020628202111.GA14964@rfc822.net>
In-Reply-To: <20020628200734.GA2222@gsp.org>
References:  <20020628125817.O68824-100000@axis.tdd.lt> <20020628200734.GA2222@gsp.org>

next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Jun 28, 2002 at 04:07:35PM -0400, Rich Kulawiec wrote:
> 
> 4. I believe this IP address is hard-coded into it:
> 
> 	12.127.17.71
> 
> which reverse-resolves to
> 
> 	dns-rs1.bgtmo.ip.att.net
> 
> which I would guess is a DNS server in Bridgeton, Missouri?  Why that
> IP address?  Has the machine there been comprised?  Or is the entire
> purpose of this to attack that single machine?
> 
That machine appears to be running a vulnerable version of BIND. I'd bet 
body parts that it was compromised some time ago and is a cooridination
node for a DDoS network. Null routing it probably won't hurt anyone.

-Pete

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020628202111.GA14964>