full-disclosure - Sobig has a surprise...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: jheidtke at fmlh.edu (Jerry Heidtke)
Subject: Sobig has a surprise...

Ron was asking if anyone had more details about the OTHER addresses that Sobig tried to contact:

67.164.250.26/8998
129.244.36.194/8998
67.73.60.121/8998 
218.146.139.246/8998
66.169.84.77/8998

Other people have seen the same thing. The exact circumstances are still unknown (at least to me). Is this a newer, or older, variant of Sobig? Were these copies of Sobig that were contacted and given a new list? What is/was on these five machines?

There is apparently some "official" interest in answering these questions, if some of the people who have contacted me privately are to be believed. I wonder if we'll ever get the whole story.

Oh, and keep in mind that Sobig does it again on Sunday, and on Friday and Sunday for the next two weeks. Still lots of opportunities for mischief.

Jerry

-----Original Message-----
From: Paul Schmehl [mailto:pauls@...allas.edu]
Sent: Saturday, August 23, 2003 10:34 AM
To: full-disclosure@...ts.netsys.com
Subject: RE: [Full-Disclosure] Sobig has a surprise...

<snip>
>
> Anyone have more details to the other addresses?
>
{{{sigh}}}  They've been posted here more than once.  They're on the Sophos 
website.

But here they are again, taken from my logs, so these are verified IPs that 
Sobig.f was contacting on 8998/UDP:

<snip repost of information that was not being requested>

Confidentiality Notice: This e-mail message, including any attachments,
is for the sole use of the intended recipient(s) and may contain
confidential and privileged information.  Any unauthorized review, use,
disclosure or distribution is prohibited.  If you are not the intended
recipient, please contact the sender by reply e-mail and destroy all
copies of the original message.