Code Red Worm
When the Code Red worm attacks, it tries to access the file default.ida to propagate itself across Microsoft IIS servers. The Nimda worm does the same thing, except it tries to access root.exe and/or cmd.exe. My server, running Apache, is immune to these exploits, but my site returns a 404 page in response and consumes my bandwidth in the process. I could create an empty file and redirect all results to this file, but I get a deeper, more smug satisfaction by sending these requests on to Microsoft. Let the worm eat up their bandwidth; it’s their sloppy programming that caused the problem in the first place.
To do the same thing yourself, add the following RewriteRules to your httpd.conf file:
RewriteRule ^(.*default\.ida.*)$ http://www.microsoft.com$1 [R]
RewriteRule ^(.*root\.exe.*)$ http://www.microsoft.com$1 [R]
RewriteRule ^(.*cmd\.exe.*)$ http://www.microsoft.com$1 [R]
For more information on using RewriteRules, consult the Apache documentation.
(I have no idea if the worms actually go to the redirected URLs. Anyone know?)
Email subscription
