BlackWorm infected IP's reporting
Hi. In the next day or so some of us will cooperate to bring to the attention of all effected AS's information about infected users in their net-space. This will be coordinated with several groups and organizations. Please expect these emails, thanks. Gadi.
Hi.
In the next day or so some of us will cooperate to bring to the attention of all effected AS's information about infected users in their net-space.
That would be "affected".
This will be coordinated with several groups and organizations. Please expect these emails, thanks.
In other words, NANOG is a step child of these and we'll only see the PR? If you're going to keep the mitigations off of NANOG, it's probably safe to keep it all off. We all read newspapers, blogs, and slashdot. I'll post my pre-94 copy of the Compuserve Directory if someone can prove this story didn't come from this list: http://www.eweek.com/article2/0,1895,1915070,00.asp SANS has it, but they aren't being authoritative about it, quoting elsewhere: http://isc.sans.org/diary.php?storyid=1067 I'd love to see the US authoritative sources jump in on these and advise us to cough up our dimes for the dances or not. -M<
Gadi Evron wrote:
Hi.
In the next day or so some of us will cooperate to bring to the attention of all effected AS's information about infected users in their net-space.
This will be coordinated with several groups and organizations. Please expect these emails, thanks.
Small update: It is possible later reports will be received as well, but if you have infected users, you should get the emails within a few hours. These email messages will include a web link to the SANS ISC where you would be able to securely reach IP addresses relevant to you. It is possible (although we try and avoid it) that you will get notifications twice, from different email addresses. If that happens, we can only apologize. I am sure you understand that despite coordination, some confusion happens when so much is done by so many people in so short a time. If you get no email message for whatever reason, and wish to *make sure* this was not because of some fluke and your net-space really is clean, feel free to ping me back in a day or so (off-list). Thanks again, Gadi.
participants (2)
-
Gadi Evron -
Martin Hannigan