At 04:28 PM 8/1/2001, Stephen J. Wilcox wrote:
Does anyone have any theories as to why its tailing, are the thousands of vulnerable machines being patched all of a sudden? If not then why is traffic decreasing so fast when the worm just keeps searching?
I suspect we'll see it begin to pick up a little bit... it looks like Billybob is just starting to get home from work and fire up his whizbang Windows 2000 machine, which he put IIS on so he can share kewl warez and mp3z with his leet friends... I'm seeing more probes from Roadrunner and @Home hosts in the last little while.
Hello, Over the course of the last 1.5 hours some hits from @home but most all others are not US while before most were within the US. Michael... On Wed, 1 Aug 2001, Dave Stewart wrote:
At 04:28 PM 8/1/2001, Stephen J. Wilcox wrote:
Does anyone have any theories as to why its tailing, are the thousands of vulnerable machines being patched all of a sudden? If not then why is traffic decreasing so fast when the worm just keeps searching?
I suspect we'll see it begin to pick up a little bit... it looks like Billybob is just starting to get home from work and fire up his whizbang Windows 2000 machine, which he put IIS on so he can share kewl warez and mp3z with his leet friends...
I'm seeing more probes from Roadrunner and @Home hosts in the last little while.
heh, maybe someone can take the worm code and use it to apply the IIS patch instead of DoS'ing the White House... :) -C On Wed, Aug 01, 2001 at 01:50:28PM -0700, michael@aplatform.com wrote:
Hello,
Over the course of the last 1.5 hours some hits from @home but most all others are not US while before most were within the US.
Michael...
On Wed, 1 Aug 2001, Dave Stewart wrote:
At 04:28 PM 8/1/2001, Stephen J. Wilcox wrote:
Does anyone have any theories as to why its tailing, are the thousands of vulnerable machines being patched all of a sudden? If not then why is traffic decreasing so fast when the worm just keeps searching?
I suspect we'll see it begin to pick up a little bit... it looks like Billybob is just starting to get home from work and fire up his whizbang Windows 2000 machine, which he put IIS on so he can share kewl warez and mp3z with his leet friends...
I'm seeing more probes from Roadrunner and @Home hosts in the last little while.
-- --------------------------- Christopher A. Woodfield rekoil@semihuman.com PGP Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB887618B
On Wed, 1 Aug 2001, Dave Stewart wrote:
I suspect we'll see it begin to pick up a little bit... it looks like Billybob is just starting to get home from work and fire up his whizbang Windows 2000 machine, which he put IIS on so he can share kewl warez and mp3z with his leet friends...
At 1500 EDT I put a counter on one of our commodity Internet connections, looking for port 80 connects to one of our unassigned /24 subnets. Here are the results so far: 1500-1530: 682 1530-1600: 536 1600-1630: 533 1630-1700: 643 Seems to be picking up. - SLS ------------------------------------------------------------------------ Scott L. Stursa Academic Computing and Network Services Florida State University 850/644-2591 stursa@acns.fsu.edu "What does not kill me, makes me stronger" - Nietzsche ------------------------------------------------------------------------
On Wed, 1 Aug 2001, Dave Stewart wrote:
Billybob is just starting to get home from work and fire up his whizbang Windows 2000 machine, which he put IIS on so he can share kewl warez and mp3z with his leet friends...
I'm seeing more probes from Roadrunner and @Home hosts in the last little while.
I have experienced the same thing with the machines I've been responsible for. @Home, Sprintbroadbanddirect, and a few other residential services have made up the bulk of scanners in my log files. Regards, -- Joseph W. Shaw II Network Security Specialist/CCNA Unemployed. Will hack for food. God Bless. Apparently I'm overqualified but undereducated to be employed.
participants (5)
-
Christopher A. Woodfield -
Dave Stewart -
Joe Shaw -
michaelï¼ aplatform.com -
Scott Stursa