full-disclosure - Anybody know what Sobig.F has downloaded?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <F3B5F5076E21DE4EA34F7799688442EC69B0@syp-exchange.syp.stoneyamashita.com>
From: rliebsch at stoneyamashita.com (Robert J. Liebsch)
Subject: Anybody know what Sobig.F has downloaded?

Um, haven't all but one or two of the download servers been taken down?
Don't you think the remainders would have been black-holed by now?
http://www.internettrafficreport.com/main.htm shows traffic normal.
http://isc.incidents.org/ shows nothing that exciting.
http://www.f-secure.com/v-descs/sobig_f.shtml shows it as a yawn.

Wax or Wane, the show is over for now... 

More interesting is the information was known and held back by the vendors 
*gasp* Are we surprised? Of course not. Every month the next big new media
whore is born. Be it a kiddie, a hatter, or some code.

-----Original Message-----
From: Compton, Rich [mailto:RCompton@...rtercom.com] 
Sent: Friday, August 22, 2003 1:33 PM
To: incidents@...urityfocus.com; 'full-disclosure@...ts.netsys.com'
Cc: honeypots@...urityfocus.com
Subject: [Full-Disclosure] Anybody know what Sobig.F has downloaded?

As many of you know, the latest Sobig.F virus was scheduled to begin
downloading unknown code from various IPs at 3:00 EST today on UDP port
8998.  Does anybody have any idea what this code is?  Are the infected boxes
actually downloading code?  Does anybody have an infected Windoze box with
Sobig that can see what code was downloaded?

Here's a link to some info at Sophos in case you are unfamiliar with this.  

http://www.sophos.com/virusinfo/articles/sobigextra.html

Looking at the infection rates of this virus, I'd say that it's pretty
important that we find out what this code is and what it does ASAP!

Thanks,
Rich Compton 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html