full-disclosure - New variant of Nachi ?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20031029134638.GA16366@deneb.enyo.de>
From: fw at deneb.enyo.de (Florian Weimer)
Subject: New variant of Nachi ?

Helmut Springer wrote:

> Has anyone seen any evidence besides this and the two postings on
> public lists?  No real trace after more than 24h it seems...

We see increased scanning activity, but it doesn't look like a
widespread worm:

    date    | sources | targets | flows
------------+---------+---------+-------
 2003-10-20 |    8058 |   10796 | 27206
 2003-10-21 |    3331 |    5908 | 11425
 2003-10-22 |    3660 |    7324 | 13989
 2003-10-23 |    2137 |    3853 |  6885
 2003-10-24 |    1459 |    3603 |  5505
 2003-10-25 |    1743 |    5717 |  9193
 2003-10-26 |    4248 |    5487 | 10954
 2003-10-27 |    8117 |   10073 | 23920
 2003-10-28 |    8463 |   10658 | 27231
 2003-10-29 |    3651 |    5171 | 10898

(Date, number of distinct source addresses, number of distinct target
addresses, flows AKA connection attempts -- incoming packets only, and
and the 2003-10-29 row is still increasing, of course.)