Subject: [Fwd: Code Red II alert]

From: "Douglas E. Engert" <[email-masked]>
Date: Tue, 07 Aug 2001 10:33:44 -0500

FYI

-------- Original Message --------
Subject: Code Red II alert
Date: Tue, 07 Aug 2001 16:07:29 +0100
From: Steve Bellovin <[email-masked]>
To: [email-masked]

Folks, I'll be saying this at the plenary in more detail, but you may 
want to show this list of addresses:

217.33.136.83
217.33.136.253
217.33.138.14
217.33.139.225
217.33.140.19
217.33.140.38
217.33.141.12 
217.33.141.111
217.33.144.30
217.33.144.28
217.33.147.91

These are IETF machines that are infected with Code Red II.  Folks who 
take those machines home, or tunnel to their home nets, will spread the 
infection to the inside of their corporate firewall.  (I already know 
of at least three companies that have discovered Code Red II on the 
inside.)

		--Steve Bellovin, http://www.research.att.com/~smb