On Fri, 30 Jan 2004, Leo Bicknell wrote:

If anyone has any good analysis on the current worm (other than "it attacks www.sco.com"), that would be welcome.

Yep, the information gap is pretty big on this one. Neither the anti-virus vendors nor the ex-Symantec guy at Homeland Security seems to be releasing much details how the virus actually behaves on the network. Lots of information about changing Windows registries, but not much about how often it checks or loads the network. Some people say they've gotten it to do something in the lab, other people report its a dud. I can't tell what the difference is.

On Fri, 30 Jan 2004, Mike Tancsa wrote:

Are there any reliable estimates as to the amount of infected hosts out there? Looking at my stats for email sent this week, I am seeing a 70:1 ratio for mydoom.a as compared to Swen.a (the next most prevalent virus). Perhaps if we had some rough #s to work with we could start to approximate the range of traffic volumes we might see.

Reliable? Not really. McAfee's global virus statistics say 17% of all scanned computers were infected by W32/Mydoom.a. But I don't believe that number, because it is wildly different than other metrics. A lot of users have experienced the MyDoom file being on their computer (e.g. through a mail message). But I don't think that represents the number of people which clicked and executed the file, infecting their computer.

In a message written on Fri, Jan 30, 2004 at 04:18:05PM -0800, Donovan Hill wrote:

I think we should help out SCO by creating new wildcard entries into our DNS servers that point *.sco.com to 127.0.0.1 as well as blackholing all SCO SWIPd IP Address Space.

I'm going to be one of the last people who will defend SCO recent actions. However, as much as I hate, and hate is the word, SCO I feel the need to speak up after your comments. Bruce Perens has said it far better than I ever could at http://perens.com/SCO/DOS/. Please read what he has to say. We (Open Source, ISPs, etc) must, MUST, come to SCO's defense on this one. I am doing what I can with my employer to do just that. Allowing attacks like this to succeed, either directly or indirectly is far more harmful than allowing SCO to stay online. We cannot condone these actions for any reason, the end does not justify the means in the case of worms. -- Leo Bicknell - bicknell@ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/ Read TMBG List - tmbg-list-request@tmbg.org, www.tmbg.org

On Friday 30 January 2004 04:39 pm, Leo Bicknell wrote:

In a message written on Fri, Jan 30, 2004 at 04:18:05PM -0800, Donovan Hill wrote:

...

I think we should help out SCO by creating new wildcard entries into our DNS servers that point *.sco.com to 127.0.0.1 as well as blackholing all SCO SWIPd IP Address Space.

I'm going to be one of the last people who will defend SCO recent actions. However, as much as I hate, and hate is the word, SCO I feel the need to speak up after your comments.

Bruce Perens has said it far better than I ever could at http://perens.com/SCO/DOS/. Please read what he has to say.

We (Open Source, ISPs, etc) must, MUST, come to SCO's defense on this one. I am doing what I can with my employer to do just that. Allowing attacks like this to succeed, either directly or indirectly is far more harmful than allowing SCO to stay online. We cannot condone these actions for any reason, the end does not justify the means in the case of worms.

Please don't misunderstand me. I in no way condone or encourage DoS attacking SCO/Caldera (or anyone for that matter). To my mind, that'd be like encouraging one group of people to attack another group of people for any reason. It's certainly not acceptable. My comments were meant in partial jest and partial frustration. Jest as a solution to the pending DDOS and frustration that SCO will spin this as an attack by the Linux community against SCO, which it is not. I apologize if I didn't make that clear. For the record, I fully believe that this worm (both variants) is designed to attack high profile targets in order to take the focus off of it's spamming capability and create uncertainty as to what group actually authored the worm. It is my firm belief that this worm was written by spammers for the purpose creating spam relays. Also, for the record, I believe everyone has the right to say what they will regardless of legitimacy, and this does include SCO. Again, I apologize if I gave the wrong impression that the pending DDOS attack on SCO was a good thing. It's not. -- Donovan Hill Electronics Engineering Technologist, CCNA www.lazyeyez.net, www.gwsn.com

On Sat, 31 Jan 2004 18:24:42 GMT, "Stephen J. Wilcox" said:

I'm not sure what the point of the DoS is if its intended to be a spam engine, that would have the effect of helping to identify and hence clean up the infections.

Ahh.. you didn't take the time to think it through. ;) Consider - the perpetrator releases a *very* noisy worm with a DDoS engine on it (admittedly buggy). Then you go on vacation someplace warm and sunny, where visually attractive people of your preferred gender are walking around wearing a lot more than you need to wear where you were... Computers catch it. Computers spew it. Computers do their DDoS tapdance. Hopefully users and ISP staff notice and take action. Then 3 weeks later, you come back, tanned and rested - and run another scan. If you find your spam backdoor on port 3127 *still* open on a machine, you can be fairly sure you can spam away with impunity - if the user and their ISP didn't notice the box spewing mail the FIRST time, they won't notice the second time.....

On Sat, 31 Jan 2004 17:48:13 CST, "Laurence F. Sheldon, Jr." <larrysheldon@cox.net> said:

The analysis works if that was the word "less".

D'oh! ;)

I doubt that the length of 3 is important. Based on my past experience "Then 3 weeks later" can be replaced by "Some time later when the cold is gone".

Locally, I'm looking at a low of 7F tonight, with wind chills well below zero, and the National Weather Service says Monday night we have "freezing rain, with snow and sleet north of Highway 460". Great, I live 2 blocks *south* of 460.. Anybody got recommendations on warm places that have good bandwidth to the beach? :)