----- Original Message Follows ----- From: Gadi Evron <ge@linuxbox.org> To: surfer@mauigateway.com Cc: nanog@merit.edu Subject: Re: router worms and International Infrastructure Date: Tue, 20 Sep 2005 09:18:43 +0200

...

Subnetwork specific worms? I only want to take down as1 , as2 and as3, for example, rather than a large-scale 'internet killer' outage.

Almost a year ago we had a crisis in Israel where something caused ONLY Israeli ISP clients to stop being able to use their DSL connections, and on the SAME DAY.

We believe it was a targeted worm.

Who said this can't happen? It already did. The biggest impact was the help desks being DDoS'd.

Do you mean to imply that it was a router code worm or a normal worm? A "Warhol Worm" in a logically localized area (an AS or three) utilizing router exploitations would be spectacularly fast. scott