13 Feb
2003
13 Feb
'03
2:39 p.m.
From: "Mike Lloyd"
You added comment on a fiber cut in that time period - can you offer more detail? Barry mentioned another roughly simultaneous attack in Korea. One other theory, of course, would be trial runs of the worm, perhaps with restricted PRNG to localize attack. I've seen no direct evidence that this happened, though.
It wouldn't be the first time that someone kicked off some code, found that it was running too slowly, removed the sleep timers and tried again. However, if this were the case, trying to find and localize the initial "slow worm" compared to the later release would be difficult to say the least. Jack Bates BrightNet Oklahoma