RE: OT: Oddity with CRII

[Ryan Russell <ryan () securityfocus com>]

On Tue, 7 Aug 2001, Mark Spieth wrote:

> Erek, We monitor some 70 firewalls and see the same thing, some servers
> are hit repeatedly and some only once in a while. The worm is random as
> too the IP addresses it chooses to hit. For more information about the
> worm look at
> http://aris.securityfocus.com/alerts/codered2/010805-Analysis-CodeRedII.
> pdf

Hey, thanks for the reference. :)

The analysis doesn't include any info about subtle biases in the PRNG,
which is what I think the original poster is essentially asking.  It
generates addresses in the 1-254 range for each octet, and then uses some
or all of them in the new IP address.

Now, if the two web servers have a different first or first and second
octet from each-other, that could explain it.  Machines on networks with
the same first or second byte as a lot of vulnerable IIS servers are going
to see many more scans.

                                        Ryan


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users