From owner-freebsd-security Fri Jun 28 13:21:13 2002 Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A798837B400 for ; Fri, 28 Jun 2002 13:21:09 -0700 (PDT) Received: from bastet.rfc822.net (bastet.rfc822.net [64.81.113.233]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2839843E06 for ; Fri, 28 Jun 2002 13:21:09 -0700 (PDT) (envelope-from pde@bastet.rfc822.net) Received: by bastet.rfc822.net (Postfix, from userid 1001) id 396B19FD21; Fri, 28 Jun 2002 15:21:11 -0500 (CDT) Date: Fri, 28 Jun 2002 15:21:11 -0500 From: Pete Ehlke To: freebsd-security@FreeBSD.ORG Subject: Re: Apache worm in the wild [with POSSIBLE block] Message-ID: <20020628202111.GA14964@rfc822.net> References: <20020628125817.O68824-100000@axis.tdd.lt> <20020628200734.GA2222@gsp.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20020628200734.GA2222@gsp.org> User-Agent: Mutt/1.3.27i Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Fri, Jun 28, 2002 at 04:07:35PM -0400, Rich Kulawiec wrote: > > 4. I believe this IP address is hard-coded into it: > > 12.127.17.71 > > which reverse-resolves to > > dns-rs1.bgtmo.ip.att.net > > which I would guess is a DNS server in Bridgeton, Missouri? Why that > IP address? Has the machine there been comprised? Or is the entire > purpose of this to attack that single machine? > That machine appears to be running a vulnerable version of BIND. I'd bet body parts that it was compromised some time ago and is a cooridination node for a DDoS network. Null routing it probably won't hurt anyone. -Pete To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message