lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <001a01c395b3$4244de00$6101a8c0@fosi>
From: steve.wray at paradise.net.nz (Steve Wray)
Subject: AT&T early warning system

What if people developing worms do small test runs
before the final release?

The AT&T approach might not work if the developer
was testing it on a private network, but if they
used a small collection of zombies on the internet 
to test it out and see how well it works, 
conceivably it could be detected?

Or something like that...

> [mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Hoho
> On Fri, 2003-10-17 at 22:44, jkm wrote:
> > Quote 2:
> > "AT&T saw anomalies in its network three to four weeks 
> before that worm
> > hit and was able to take certain precautions. "When the 
> worm actually
> > happened, AT&T's network did not take a hit,'' Eslambolchi said."
> 
> 
> Doesn't it seem like they're trying to violate causality? If the worm
> doesn't exist yet, then its associated traffic doesn't exist 
> yet, hence
> there's nothing to detect. Wonder what those 'anomalies' 
> were. Seems no
> more effective than just watching MS security patches and reading FD.


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ