Hi,
For weeks now I've seen my Red Hat 7.0 server filling up with gibberish. I setup another system, Red Hat 7.1 this time with full security. I even added firewall settings to only allow ftp and http traffic. But now I'm getting the same garbage in my access_log file of apache. Here's what it looks like:

62.131.253.216 - - [03/Aug/2001:09:15:30 -0700] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucb d3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 330
213.1.22.239 - - [03/Aug/2001:09:42:05 -0700] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucb d3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 330

As you can see in the above example it's not just from one IP address. The 400s means it's a bad request. But! Could this be the Code Red Worm trying to infect? Or a hacker that's compromised the net in another way?

Thanks for all the help u can provide. Also if anyone else is seeing this please leave a note. I kinda feel I'm not an isolated situation.

Yep, it's just the CodeRed requests. If you're running IIS over NT/2K then I hope you are patched. If you're running Apache then no harm done other than chewing up some some bandwidth. If you're running apache have a look at this week's security notes. I just upped to 1.3.20 from 1.3.17 (OK it was LONG overdue).

Wow. Here's an update. There's a NEW variant that appears to be more selective about the subnet it's scanning. I'm getting around 20+ requests per hour at the time of this writing and the flow has been increasing al day. The 'new' worm's calling card is just a little different;Note the use of "XXX" rather than "NNN" (didn't see it until well into my 2nd cup of coffee). http://www.incidents.org/diary/diary.php has a recent (21:15 EST Aug 04) report which also claims that the new version may leave a gaping HOLE in your NT boxen.Lift a pint on this long weekend for the poor slobs who are rushing back to the IIS ranch for damage control.

I got it too:

dsl-64-171-1-244.dsl.sntc01.pacbell.net - - [10/Aug/2001:19:32:58 -0700] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucb d3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 299
hse-kitchener-ppp232166.sympatico.ca - - [10/Aug/2001:19:44:14 -0700] "GET /default.ida?XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%ucb d3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00=a HTTP/1.0" 404 299

What is the significance in changing from N to X ? And are the last numbers after the http 1.0 the port number?

The first nunber is the code that indicates the status of the request - 404 being and error that the server was unable to find the file. The second number is the size of the transfer to the client.

cheers

Jamie...

The "NNNN" sequence was the original CodeRed worm. The "XXXX" is the CodeRedII. The N's and the X's are just used as fodder for the buffer overflow. The buffer examines these and says "Hey I can't run that crap!" However it completely ignores anyhting over 255(?) bytes and that's the 'payload' that makes the connection and gets the remainder of the code home.

Also note that while the worms have been dubbed CodeRed and CodeRedII, the only real similiarities are that they both use the same exploit to 'get in' and they both actively scan networks for a new host to infect. CodeRedII uses a meaner network scanner and leaves a backdoor to the entire system, regardless of permissions and allows shell commands to be executed from a remote station. Nasty.

thanks Jamie and mcleodnine for answering my question, very thoughtout and well implemented "Code". What a mess if every programmer on the planet wanted to wreck havoc on the net!

Take care!

I'm getting this too, my question however is, how do I get my apache server logs to do DNS lookups?

[EDIT]

Sorry, I RTFM and found it in httpd.conf