Return-Path: <sentto-279987-2117-1001041288-fc=all.net@returns.onelist.com> Delivered-To: fc@all.net Received: from 204.181.12.215 by localhost with POP3 (fetchmail-5.1.0) for fc@localhost (single-drop); Thu, 20 Sep 2001 20:03:15 -0700 (PDT) Received: (qmail 10004 invoked by uid 510); 21 Sep 2001 03:01:49 -0000 Received: from n12.groups.yahoo.com (216.115.96.62) by 204.181.12.215 with SMTP; 21 Sep 2001 03:01:49 -0000 X-eGroups-Return: sentto-279987-2117-1001041288-fc=all.net@returns.onelist.com Received: from [10.1.4.55] by n12.onelist.org with NNFMP; 21 Sep 2001 03:01:25 -0000 X-Sender: fc@big.all.net X-Apparently-To: iwar@onelist.com Received: (EGP: mail-7_3_2_2); 21 Sep 2001 03:01:27 -0000 Received: (qmail 13622 invoked from network); 21 Sep 2001 03:01:26 -0000 Received: from unknown (10.1.10.142) by l9.egroups.com with QMQP; 21 Sep 2001 03:01:26 -0000 Received: from unknown (HELO big.all.net) (65.0.156.78) by mta3 with SMTP; 21 Sep 2001 03:01:26 -0000 Received: (from fc@localhost) by big.all.net (8.9.3/8.7.3) id UAA05177 for iwar@onelist.com; Thu, 20 Sep 2001 20:01:22 -0700 Message-Id: <200109210301.UAA05177@big.all.net> To: iwar@onelist.com (Information Warfare Mailing List) Organization: I'm not allowed to say X-Mailer: don't even ask X-Mailer: ELM [version 2.5 PL1] From: Fred Cohen <fc@all.net> Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com Delivered-To: mailing list iwar@yahoogroups.com Precedence: bulk List-Unsubscribe: <mailto:iwar-unsubscribe@yahoogroups.com> Date: Thu, 20 Sep 2001 20:01:22 -0700 (PDT) Reply-To: iwar@yahoogroups.com Subject: [iwar] [fc:New.worm.slows.some.Internet.operations] Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit New worm slows some Internet operations By Robert Lemos, CNET News.com, 9/20/01 http://news.cnet.com/news/0-1003-200-7219541.html Many companies worldwide saw Internet bandwidth slow to a crawl Tuesday, as a new Internet worm flooded PCs and servers in its attempts to spread. While many companies connected to the Internet seemed unaffected by the worm, known as Nimda, others said the damage ranged from nuisance to full-fledged outages. "It seems to randomly be going through every IP (address) of my network," said Ian Neubert, director of information services for online telecom equipment seller TWAcomm.com, which found itself inundated with scans from infected machines. "This is ridiculous." The worm, which appeared early Tuesday morning, spreads using a multipronged attack and infects both PCs and servers running Microsoft's Windows 95, 98, Me and 2000 operating systems. To spread, the program sends an e-mail message with the worm in an attachment, scans for and then compromises vulnerable servers, jumps to shared hard drives on a network, and sends itself to any surfer whose browser requests a Web page from an infected server. The multifaceted nature of the malicious program's infection is unprecedented, said experts. "It's the Swiss Army knife of worms," said Greg Shipley, a security consultant with network protection firm Neohapsis. "It's friggin' amazing." Yet Nimda's largest effect seems to be the amount of data it creates. The sheer volume produced by the worm's attempts to spread has caused grief for many companies. Exodus Communications, a major Web hosting company, scrambled its Cyber Attack Tiger Team (CATT) this morning when the first intrusion detectors alerted the company to the worm around 5:30 a.m. PDT. "This morning those things started going off like a Christmas tree," said Charles Neal, vice president of cyberterrorism detection and incident response for Exodus. Some Exodus customers were affected, but CATT didn't yet know how many. In addition, about 10 computers in Exodus' 800-person consulting unit were affected and immediately patched, investigators said. "All I can say is, in general, everyone who does business on the Web is going to be affected," said Bill Swallow, director of incident response at Exodus. Network-protection service Counterpane Internet Security said most of its customers had seen their Internet bandwidth drop off as a result of the worm. The company, which monitors clients' networks and warns them of possible intrusions, would not divulge its customers' names. "We have noticed a jump in terms of our alert volume between 1,000 and 10,000 times normal," said Tina Bird, architect of engineering for Counterpane. The Computer Emergency Response Team (CERT) Coordination Center at Carnegie Mellon University warned its members of the worm. Antivirus company Symantec gave the worm its second-highest "Level 4-severe" rating, and F-Secure gave the virus its highest rating. While the worm infects computers running Microsoft Windows 98, Windows Me and Windows 2000, some reports have indicated that Unix machines running the popular Apache Web server software crashed when scanned by the worm. That particular side effect crashed several servers at EarthLink's Web hosting business, according to Mel Lower, a customer of EarthLink. Lower, who hosts Web sites for small businesses through EarthLink, said two of his customers' sites were inaccessible for much of Tuesday. The Davenport, Iowa, resident said he contacted EarthLink and was told that Nimda "crippled" two Unix server farms. EarthLink representatives could not immediately be reached for comment. "We were told to shut down our e-mail for an hour while the company installed the virus-protection software," said Carol Snyder, spokeswoman for Lowestfare.com, based in Las Vegas. "After that there were no more problems." Some sites unaffected Not everyone was hampered by the worm, however. Network-performance monitor Keynote Systems, which watches connectivity to 40 major Web sites, did not see any bandwidth problems Tuesday. "We certainly aren't seeing" degradation, said Bill Jones, director of public services for the company. "When Code Red hit, we did see some elevation. I feel pretty comfortable that our numbers are an accurate representation." A representative of online auction house eBay said the company had not been infected by the worm and had no indication of the reported Internet bandwidth problems. A Yahoo representative said some employees had been infected by the malicious program, but the worm did not affect company operations. Representatives of Excite@Home, the nation's largest broadband service provider, said the company had not had any indication that it had been affected by the worm, nor had many of the nearly 4 million subscribers of Excite@Home's high-speed Internet service. A spokesman for San Francisco-based BlueLight.com said the company had not experienced any virus-related problems. "The biggest problem I've got is from the e-mail from friends warning me not to open certain e-mail attachments," spokesman Dave Karraker said. Both Sony and Texas Instruments said their networks had not been affected by the spread of the worm. Though others may not have seen the worm, Counterpane's Bird said the infection is still going on and is still significant. "It's just nuts that this might be a false alarm," she said. "We have had to take systems offline to clean the infection up." Nimda continued to spread late in the afternoon, according to CERT. "We are receiving a steady stream of reports of systems being affected by this," said Chad Dougherty, Internet security analyst for the Pittsburgh, Penn., security group. "We are looking on the order of tens of thousands of compromised machines." Although the organization could not comment on reported widespread bandwidth problems, it did acknowledge that many of its members had encountered network slowdowns. "We got a number of reports from sites that had localized bandwidth denial of service," Dougherty said. ------------------------ Yahoo! Groups Sponsor ---------------------~--> Secure your servers with 128-bit SSL encryption! Grab your copy of VeriSign's FREE Guide: "Securing Your Web Site for Business." Get it Now! http://us.click.yahoo.com/4mr93B/zhwCAA/yigFAA/kgFolB/TM ---------------------------------------------------------------------~-> ------------------ http://all.net/ Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/
This archive was generated by hypermail 2.1.2 : 2001-09-29 21:08:46 PDT