Date: Fri, 28 Jun 2002 15:21:11 -0500 From: Pete Ehlke <pde@rfc822.net> To: freebsd-security@FreeBSD.ORG Subject: Re: Apache worm in the wild [with POSSIBLE block] Message-ID: <20020628202111.GA14964@rfc822.net> In-Reply-To: <20020628200734.GA2222@gsp.org> References: <20020628125817.O68824-100000@axis.tdd.lt> <20020628200734.GA2222@gsp.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Jun 28, 2002 at 04:07:35PM -0400, Rich Kulawiec wrote: > > 4. I believe this IP address is hard-coded into it: > > 12.127.17.71 > > which reverse-resolves to > > dns-rs1.bgtmo.ip.att.net > > which I would guess is a DNS server in Bridgeton, Missouri? Why that > IP address? Has the machine there been comprised? Or is the entire > purpose of this to attack that single machine? > That machine appears to be running a vulnerable version of BIND. I'd bet body parts that it was compromised some time ago and is a cooridination node for a DDoS network. Null routing it probably won't hurt anyone. -Pete To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20020628202111.GA14964>