Re: [cobalt-users] Code Red variations

[Jeff Lasman <jblists@xxxxxxxxxxxxx>]

Carrie Bartkowiak wrote:

> You should've seen my face when I heard a so-called "security expert"
> announce over national radio that the one million home-users who had
> downloaded the patch had "wasted their time". He went on to say that
> home users did NOT need to apply the patch, as it "only affects
> servers, such as those that host places like Yahoo or Ebay".
> 
> Never mind that people DO run NT and W2K on their home boxes, and
> that RoadRunner and @Home have generated the most offending IPs in
> this entire mess. (At least, the last time I checked, which was just
> before he made this stupid announcement.)

Code Red only affects servers, Carrie.  IIS is a server.  If you run it
at home you need to protect against Code Red.  If you don't, you don't. 
I'd guess that close to all of the home users who've downloaded the
patch really have wasted their time.  The patch does nothing to stop the
probes.

> Some expert...

I don't remember right now how the IP#s get selected, so I suppose
you'll say that to me as well <smile>.

And for what it's worth, I maintained a system that was compromised by
Code Red (I) and it took only seconds to apply the patch.  I also
subscribe to Microsoft's security warning list, and I've NEVER yet
received any information on Code Red on it <frown>.

Jeff
-- 
Jeff Lasman <jblists@xxxxxxxxxxxxx>
nobaloney.net
P. O. Box 52672, Riverside, CA  92517
voice: (909) 787-8589  *  fax: (909) 782-0205