www2.sco.com enjoys good response times

Further corroboration of the generally good connectivity across the Internet can be seen by viewing www2.sco.com. which is on the same Class C that www.sco.com occupied until earlier this evening. http://www2.sco.com/ loads very quickly to the eye, and the traceroute seems very good considering the circumstances.

A graph of performance of www2.sco.com has just started appearing. while a comparative table of performance of some of the sites connected with the MyDoom virus is also available. Each is updated every fifteen minutes.

Note that sco.com and caldera.com, which both shared the same ip address as www.sco.com are still down, possibly because of stale DNS caching, or perhaps simply because the machine that ran those sites has been shut down.

% host sco.com
sco.com has address 216.250.128.12
%host www.caldera.com
www.caldera.com has address 216.250.128.12

The most recent Web Server Survey found some 58 hostnames running web sites that resolved to this ip address, and one would presume that SCO is unconcerned about their availability, since it would have been possible to give www.sco.com its own ip address in the prelude to the DDoS.

Continue reading

SCO drop www.sco.com from the DNS

SCO have done the public spirited thing and taken www.sco.com out of the DNS. This means that there will be no more http traffic travelling across the internet from the infected machines to www.sco.com.

Plausibly, the hostmaster's plan was set the TTL to 60 seconds to give himself the flexibility of having changes propogate promptly, and then see what the http traffic was like before making a decision to remove the site from the DNS. He has now decided that he has seen enough. SCO may also have been the subject of pressure from ISPs to put a stop to the http traffic.

%host www.sco.com
Host www.sco.com not found: 3(NXDOMAIN)
% dig www.sco.com
www.sco.com.                   IN      A
% date
Sun Feb  1 19:29:50 GMT 2004

Generally, conditions on the Internet seem very acceptable at the moment, with few hosting company sites experiencing failed requests . This contrasts markedly with forecasts from Anti-virus companies and this morning's press release from SCO which reported the Internet as being overwhelmed.

Sunday morning and www.sco.com is still in the DNS

We had expected that SCO might take www.sco.com out of the DNS in the run up to the MyDoom DDoS payload in order to keep the denial of service http traffic off the Internet. So far, though, www.sco.com still resolves and receives http requests, though closing the connection without sending a response.

That said, the sco.com hostmaster is reserving his options, with the TTL set to just 60 seconds at time of writing.

% host www.sco.com
www.sco.com has address 216.250.128.12
% dig www.sco.com
www.sco.com.            60      IN      A       216.250.128.12
% telnet www.sco.com http
Trying 216.250.128.12...
Connected to www.sco.com.
Escape character is '^]'.
Connection closed by foreign host.

Contrastingly, www.microsoft.com's performance is as normal. Microsoft has chosen to leave the hostname still resolving to a set of 8 ip addresses in Redmond, rather than point it at Akamai's content distribution network, with their TTL set to just under an hour.

www.microsoft.com.      7       IN      CNAME   www.microsoft.akadns.net.
www.microsoft.akadns.net. 7     IN      CNAME   www2.microsoft.akadns.net.
www2.microsoft.akadns.net. 8    IN      A       207.46.156.252
www2.microsoft.akadns.net. 8    IN      A       207.46.245.92
www2.microsoft.akadns.net. 8    IN      A       207.46.245.156
www2.microsoft.akadns.net. 8    IN      A       207.46.249.252
www2.microsoft.akadns.net. 8    IN      A       207.46.250.222
www2.microsoft.akadns.net. 8    IN      A       207.46.250.252
www2.microsoft.akadns.net. 8    IN      A       207.46.134.221
www2.microsoft.akadns.net. 8    IN      A       207.46.144.188

A graph of the www.sco.com response times, is available while people may also subscribe to receive outage alerts on the sites.

Elsewhere, the Internet looks quite benign with presently just 10 of the fifty hosting company sites monitored by Netcraft showing failed requests during the last 24 hours, and none showing outages.

February 2004 Web Server Survey

In the February 2004 survey we received responses from 47,173,415 sites.

The number of responding sites is up by over one million from January; however the percentage share between the different web servers is little changed, with Microsoft's half a percent drop in active sites being the most salient point of interest.

Graph of market share for top servers across all domains, August 1995 - February 2004

Top Developers
Developer January 2004Percent February 2004Percent Change
Apache3104092267.383170388467.21-0.17
Microsoft967597921.00984997120.88-0.12
SunONE15038553.2616572953.510.25
Zeus7520531.637552271.60-0.03

Continue reading

www.sco.com is a weapon of mass destruction

Much of the commentary on the SCO distributed denial of service scenario, including our own, has been based on the premise that SCO badly wants to keep their web site running. This may not be the case: unlike Microsoft, which has a real business to run and a real need to keep its web site operational, SCO Executives may not strongly care about the availability of www.sco.com. After all, Michael Doyle’s half a billion dollar patent win against Microsoft scarcely hinged on the response times of the Eolas web site.

In fact, the author of the MyDoom virus has delegated control of the most enormous volume of http traffic that the Internet has yet seen to hostmaster@sco.com. On a whim, SCO can direct that Tsunami at an object of their choosing, simply by changing an A record in named.conf in time for the change to propagate by Sunday.

In this context, SCO Executives may have latitude to consider alternative defenses which do not involve having to parlay with low-down-no-good-Linux-loving-CDN-providers.

Continue reading

Phishers expand into telephony

Further evidence of the financial rewards presently available from phishing is that fraudsters can afford the time and labour of making the attacks by phone rather than being constrained to electronic mail. A mail we received continues the story.

My husband was called on Wednesday by "VISA" and I was called on Thursday by "MasterCard". It worked like this:

Person calling says, "This is Carl Patterson (any name) and I'm calling from the Security and Fraud department at VISA. My Badge number is 12460. Your card has been flagged for an unusual purchase pattern, and I'm calling to verify. This would be on your VISA card. Did you purchase an Anti-Telemarketing Device / any expensive item for £497.99 from a marketing company based in 'Anywhere'?"

Continue reading