bugtraq - Re: DCOM worm analysis report: W32.Blaster.Worm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <200308130407.h7D473qe003827@turing-police.cc.vt.edu>
Date: Wed, 13 Aug 2003 00:07:03 -0400
From: Valdis.Kletnieks@...edu
To: Andrew Thomas <andrew@...erator.co.za>
Cc: bugtraq@...urityfocus.com, incidents@...urityfocus.com
Subject: Re: DCOM worm analysis report: W32.Blaster.Worm

On Tue, 12 Aug 2003 10:11:03 +0200, Andrew Thomas <andrew@...erator.co.za>  said:

> If the information contained herein is still correct, then it would appear that
> the algorithm used for target IP selection is far from optimal, and 
> would result in large concentration of traffic around the IP address ranges 
> of the initial infections.

That may have been true in the first half hour or so.  Just remember that the
*first* time the worm hops to another /8, it will start creating another large
concentration around THAT address range... and inside 30 minutes there's too
many pools to count.

Another way to look at it - by the time you started seeing "me too" postings
that *something* was up, it had gotten out of the original ranges (remember
that the "me toos" are in general evidence that it's left the original range)



Content of type "application/pgp-signature" skipped