[NCLUG] Code Red Attacks & DSL Routers

[R P Herrold]

On Thu, 19 Jul 2001, Michael Dwyer wrote:

> A worm dubbed "Code Red" is in circulation right now.  Mostly
> harmless to us, since it exploits unpatched ISS machines, but
> it hits all IPs regardless (grep your httpd.error logs for
> "default.ida" and check how many times you've been hit!)

All linux hosts ... I have consolidated several ...

[root at new bin]# cd /var/log/httpd/
[root at new httpd]# grep default.ida * | wc
    152    1156   48579
     72     834   33606
    362    4344  178314
    140    1160   44855
    174    1740   82085

... Do I win?