linux.e-m.gr

[Spiros Bolis]

On Thu, 13 Oct 2005, Giorgos Keramidas wrote:

> To akoma pio kalo einai na hackepseis to ksefrago ampeli kai na tou
> petakseis ena dd if=/dev/zero of=/dev/hda me ena panemorfo reboot sto
> kapaki.  Ta alla einai metriothtes :)
>

yphrxe (sxedon) ena tetoio kolpo thn epoxh toy IIS worm love_kati 'h
nimda

ebazes ena perlo-scripto ston apache soy kai molis kapoio mhxanhma soy
ekane probe, to xtypage pisw xrhsimopoiwntas thn idia trypa kai
ekteloyse px. shutdown sto molysmeno server! ;-)

http://news.spamcop.net/pipermail/spamcop-geeks/2001-August/003271.html
http://www.hammerofgod.com/strikeback.txt
http://archives.neohapsis.com/archives/vuln-dev/2001-q3/att-0505/01-strikeback.pl

mia pio "light" ekdosh einai ayth
http://members.cox.net/18james/utilities.html

worm protection
The Earlybird gets the worm! Apache::Earlybird is a mod_perl module for
Apache WWW servers that traps probes from remote IIS servers infected by
the CodeRed or Nimda worms. The module returns a 403 Forbidden notice to
the attacker without cluttering the local error log, and emails
notifications of the infection attempt to a security tracking authority
and to the ISP of the infected machine. Earlybird finds appropriate
email notification addresses even for sites with unresolvable
ip-addresses, and maintains a cache so notifications are sent for each
attacking site only once every 24-hours. Requires an Apache WWW server
compiled with mod_perl and a number of perl packages available from
CPAN. The tarball includes a README and a perl Makefile.PL that checks
dependencies on the system before installing the module.