Internetworkers: http://www.ibiblio.org/internetworkers/

["Michael Hayes" <mhayes AT mphiles.com>]

Yes, my motive was pure amusement.
----- Original Message -----
From: "Steven Champeon" <schampeo AT hesketh.com>
To: "InterNetWorkers" <internetworkers AT franklin.oit.unc.edu>
Sent: Tuesday, September 18, 2001 5:05 PM
Subject: [internetworkers] Re: Virus


> on Tue, Sep 18, 2001 at 05:00:06PM -0400, Kate Johnson wrote:
> > Okay, naive question here - what does 'following a 302' mean?
>
> Sorry.
>
> HTTP (HyperText Transfer Protocol), the underlying protocol that the
> Web uses to transfer files and data, uses response codes:
>
> HTTP 200 OK
> HTTP 302 Moved Temporarily
> HTTP 404 Not Found
> HTTP 500 Server Error
>
> to signify the status of the server's response. A 302 is simply a
> shorthand way of saying "redirect". The issue here is that the worm,
> once it connects to the port and issues its GET requests for the
> various possibly exploitable files, is unlikely to have been built
> such that it would properly handle any unexpected error condition.
> I'd be surprised if it actually handled anything but 200 (OK) or
> 404 (Not Found), so redirecting it to microsoft.com, while amusing,
> probably doesn't have any actual effect.
>
> It'd be easy enough to test, I suppose - redirect to another server
> you control and see if the redirects show up.
>
> --
> hesketh.com/inc. v: (919) 834-2552 f: (919) 834-2554 w: http://hesketh.com
>
> ---
> Come and play at the InterNetWorkers Web site!
http://www.ibiblio.org/internetworkers/
> You are currently subscribed to internetworkers as: mhayes AT mphiles.com
> To unsubscribe send a blank email to
$subst('Email.Unsub')
>