Karen --
If you find a way to completely stop the activity I will kiss you, and there will be thousands of people standing in line behind me to do the same thing. Heck, I'd kiss hobbes if he came up with a real solution.
From looking at the logs, it appears to me that every time Nimbda hits my site it hits 16 times, looking for 16 different files. My first goal was to reduce the bandwidth associated with each request; I ended up with the 410 redirection idea to avoid sending my 10k 404 page.
Your question caused me to look at just what is really sent when my 410 goes out. It turns out that I send 526 bytes:
HTTP/1.1 410 Gone
Date: Sat, 07 Sep 2002 13:41:26 GMT
Server: Apache
Connection: close
Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>410 Gone</TITLE>
</HEAD><BODY>
<H1>Gone</H1>
The requested resource<BR>/scripts/..Á{../winnt/system32/cmd.exe<BR>
is no longer available on this server and there is no forwarding address.
Please remove all references to this resource.
<HR>
<ADDRESS>Apache/1.3.26 Server at www.skolnick.org Port 80</ADDRESS>
</BODY></HTML>
Better, but more than I expected. I got it down to 357 bytes by defining a 410 document, 410.html
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD>
<TITLE>Go Away</TITLE>
</HEAD><BODY>
<H1>Go Away</H1>
</BODY></HTML>
Not too bad. I got it down to 220 bytes by making 410.html a zero byte file. All good. Thank you for causing me to look, and finding a way to cut the bandwidth by more than half.
As to how, I telnet into my website (telnet my_domain 80) and type
GET /scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir HTTP/1.0
followed by two carriage returns. I cut and paste the response into Word and run Tools/Word Count on it. Add the number for "Characters (with spaces)" with "Lines" and you get the number of bytes transferred.
The hope that the 410 error might make Nimbda (or at least that one particular Nimbda) go away is admittedly wishful thinking.
Our choices are limited:
301 - the resource has moved permanently
302 - the resource has moved temporarily
303 - the resource has been replaced
403 - access to the resource is forbidden
404 - the resource was not found
410 - the resource is gone
500 - internal server error
See the HTTP specification (http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html) for a complete list of status codes. I thought 410 made the most sense.
If someone has done a forensic analysis of Nimbda and can better describe how it reacts (if at all) to response codes we could make a better choice.
If Nimbda actually follows redirects, I'd be tempted to write a little Perl script to get the remote address and generate a 301 error pointing back at the machine with Nimbda on it. Let it pound on itself for a while.