lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Tue Jan 24 20:11:25 2006 From: kyphros at gmail.com (Mike Owen) Subject: BlackWorm technical information On 1/24/06, Valdis.Kletnieks@...edu <Valdis.Kletnieks@...edu> wrote: > The *interesting* question is whether it's possible to use this to count > the *actual* number of affected machines by excluding all the rubberneckers > that are visiting the page and hitting "refresh" to see the numbers go up. > Maybe by looking at the Referer or User-Agent values? > > That's what the Snort rule looks for, a connection to that page without a Referer: tag. Not perfect, but it works well enough. Mike
Powered by blists - more mailing lists