nanog mailing list archives
Re: Code Red : Any whitehouse.gov people around?
From: Etaoin Shrdlu <shrdlu () deaddrop org>
Date: Fri, 20 Jul 2001 07:09:37 -0700
Sabri Berisha wrote:
On Fri, 20 Jul 2001, Jasper Wallace wrote:According to a recent post on bugtraq the worm is going to switch from infecting webservers to DDOS'ing whitehouse.gov in about 1/2 an hour or so.Knowing that some of the colocated boxes in our network *might* be infected; I have placed a nullroute for 198.137.240.92 (the IP www.whitehouse.gov resolves to).
Wrong IP to blackhole. Oops. I've copied the bugtraq post below for those of who are not subscribed, who might have missed it, or are overwhelmed.
On Thu, 19 Jul 2001, Laurence Hand wrote:I believe the DDoS started an hour and a half ago, at 5:00 PDT (0:00 UTC, the next day). I was getting 5-10 attempts an hour, and I've had 0 since 4:43:29 PDT. Folks will notice that www.whitehouse.gov is still accessible. The worm authors only put in one IP address, the one for www1.whitehouse.gov. BBN (who appears to be the provider for whitehouse.gov, according to my tracert) has blocked that single IP address at their peering points. So www2.whitehouse.gov is still running just fine. Presumably, www.whitehouse.gov used to be RR DNS between the two. Now, www.whitehouse.gov resolves to just 198.137.240.92, and it has a TTL of only 872. For a relatively clever worm, the author sure screwed up his target list. Whoops.
Best to change that nullroute to www1.whitehouse.gov, and let up on www2. Name: www1.whitehouse.gov Address: 198.137.240.91 Name: www2.whitehouse.gov Address: 198.137.240.92 -- Powered by Guiness. Feds never "take a vacation" from being a fed. Aj Effin ReznoR
Current thread:
- Code Red : Any whitehouse.gov people around? Jasper Wallace (Jul 19)
- Re: Code Red : Any whitehouse.gov people around? Sabri Berisha (Jul 20)
- Re: Code Red : Any whitehouse.gov people around? Etaoin Shrdlu (Jul 20)
- <Possible follow-ups>
- RE: Code Red : Any whitehouse.gov people around? Mike Najarian (Jul 20)
- Cabinet/FDDI at MAE-West (55 Market) Andrew Staples (Jul 20)
- Re: Code Red : Any whitehouse.gov people around? Alan Hannan (Jul 20)
- RE: Code Red : Any whitehouse.gov people around? Ariel Biener (Jul 20)
- Free Code Red checker Seth M. Kusiak (Jul 20)
- Re: Free Code Red checker Gary E. Miller (Jul 20)
- Re: Free Code Red checker Larry Sheldon (Jul 20)
- Re: Code Red : Any whitehouse.gov people around? Sabri Berisha (Jul 20)
- RE: Code Red : Any whitehouse.gov people around? Laurence Berland (Jul 20)