full-disclosure - Sobig has a surprise...

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: david.vincent at mightyoaks.com (David Vincent)
Subject: Sobig has a surprise...

> All the experts were totally faked out. While everyone was 
> concentrating on getting the "magic 20" machines shut down, 
> no one realized that different copies of Sobig.f had 
> different lists of servers to contact.
> 
> We put a block of udp port 8998 on our firewall this morning. 
> We had 3 previously undetected infected machines on our 
> network, each of which tried to contact a different list of 
> 20 machines. One of the lists corresponds to the one that 
> Sophos and others have published. The other two lists have no 
> addresses in common with the published list, or with each other.

care to publish those ips?

> I wonder how many different sets of servers there were, how 
> many different variants of Sobig.f there were, and how many 
> infected machines now have some additional trojan, worm, or 
> ddos code waiting for a command to do something.

<insert theme from "jeopardy">

-d