IT Employment

Ask something
Discussion Locked

Has the Slapper worm affected you?

0 helpful
4 replies

by maryweilage

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Tell us what you think about the Slapper worm, as discussed in the latest Internet Security Focus newsletter. If your organization has been hit by the worm, how did you respond?

4 replies

by infosecgeek

I think this article should have included these
two tips plus any other known:

1)Change the Apache ErrorDocument configuration directive for HTTP error 400 (Bad Request) creating a custom HTML page served to any client making a bad request. The directive should look like this :
ErrorDocument 400 badrequest.html
Remember to apply the directive in every virtual
host and tha main server as well.
2)Disable SSLv2 in the SSL portion of your Apache config file.
3) Hide your Apache version until you re-compile it with the following directive applied in the main server config:
ServerTokens Prod
If your Apache is newer than 1.3.12 this will set the Server header to "Apache", hiding your mod_ssl and OpenSSL versions.

Of course this does not fix the problem but it gives you some time to plan for the upgrade.

I liked the article, even if it missed these few lines.

by dnreeves

How can I determine if my server has already been infected by the slapper worm?

Regards,

David Reeves

by infosecgeek

The most evident sign of compromise is that
the server might be making outgoing connections on UDP port 2002 to communicate with the master of the DDoS network created by the worm.

For a complete description of the worm manifestations take lookat the CERT advisory in this URL:

http://www.cert.org/advisories/CA-2002-27.html

To avoid these doubts of "Has my server been compromised?" use Tripwire, which is a file integrity checker that will report if the server files have been altered. You can find it in http://www.tripwire.org .-

by author - kevin koch

Although a useful article regarding the slapper worm, yet another professional columnist who has to shove in his anti-microsoft propaganda.

There is no such thing as 'better'. The only thing that makes IIS better than apache or vice versa is a logical decision based on your business requirements. If you're running a web farm and hosting simple html pages and require absolute 24/7 uptime, go for apache. If you need to spawn dynamic word docs or require simple database access with a DSN and don't want the nightmare of configuring Oracle, MySQL etc... then you may be better off opting for IIS.

Everyone has their own opinion and should voice it as such, and not try to preach it as fact. I am open to any technology out there that satisfies my requirements, and would implement it regardless of the company name attached to it.

This discussion is closed to new replies.