full-disclosure - AT&T early warning system

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.33.0310182123120.853-100000@stratigery.local>
From: eballen1 at qwest.net (Bruce Ediger)
Subject: AT&T early warning system

On Sat, 18 Oct 2003, S G Masood wrote:

> IMHO, testing on a private network is always
> preferable for highly accurate predictions.

My guess is that the msblast worm's author did do testing on a private
network.  I wrote a simulation of msblast that placed susceptible hosts
in "bands" in a 16-bit address space.
(http://www.users.qwest.net/~eballen1/nws/, section "msblast - effect of
banded address space")

msblast-style sequential probing does pretty well in a smaller address
space that has victim hosts in blocks.  That style of probing does poorly
against victim hosts placed at random addresses, even in small address
spaces.