If they did it right...

IWETHEY v. 0.3.0 | TODO

1,095 registered users | 0 active users | 0 LpH | Statistics
Login | Create New User

Welcome to IWETHEY!

Post #114,954

by folkert

8/22/03 3:17:05 PM

If they did it right...

the machine are prolly VERY VERY well endowed.

And are on specifically selected Networks with "pipes out the wazoo"

And since it appears to be a SMALL meesage request and reply, shouldn;t be to bad.

--
[link|mailto:greg@gregfolkert.net|greg],
[link|http://www.iwethey.org/ed_curry|REMEMBER ED CURRY!] @ i_wethey<

Post #114,960

by inthane-chan

8/22/03 4:04:17 PM

Looks like they didn't.

[link|http://www.f-secure.com/v-descs/sobig_f.shtml|http://www.f-secure....scs/sobig_f.shtml]

Update on 19:00 UTC

When deadline for the attack was passed, one machine was still (somewhat) up. However, immediately after the deadline, this machine (located in the USA) was totally swamped under network traffic.

We've tried connecting to it, just like the virus does. We do this from three different sensors from three different machines in three different countries. We haven't been able to connect to it once. If we can't connect, neither can the viruses.

So the attack failed. Whoa.

We'll keep monitoring until 22:00 UTC. If we're not able to connect once, we can safely say that the attack was prevented.

Update on 19:50 UTC

Still not a single connection from any of our sensors to any of the servers.

In that final hour, when each breath is a struggle to take, and you are looking back over your life's accomplishments, which memories would you treasure? The empires you built, or the joy you spread to others?

Therin lies the true measure of a man.

sobig.f to mutate at 1900 UTC - (inthane-chan) - (26) - Aug. 22, 2003, 02:13:32 PM EDT

Re: sobig.f to mutate at 1900 UTC - (admin) - Aug. 22, 2003, 02:38:40 PM EDT

How come nobody tried to insulated the 20 PCs? - (Arkadiy) - (4) - Aug. 22, 2003, 02:48:15 PM EDT

They're trying now. - (admin) - (3) - Aug. 22, 2003, 02:51:04 PM EDT

Best we can hope for... - (inthane-chan) - (2) - Aug. 22, 2003, 03:09:38 PM EDT

If they did it right... - (folkert) - (1) - Aug. 22, 2003, 03:17:05 PM EDT

Looks like they didn't. - (inthane-chan) - Aug. 22, 2003, 04:04:17 PM EDT

Well Here we GO!!!! -NT - (folkert) - (4) - Aug. 22, 2003, 02:59:07 PM EDT

This could get very nasty - (jake123) - (3) - Aug. 22, 2003, 03:04:16 PM EDT

Kinda fun to watch from the sidelines, actually... -NT - (admin) - (2) - Aug. 22, 2003, 03:05:01 PM EDT

Not really - (jake123) - (1) - Aug. 22, 2003, 03:44:51 PM EDT

Sure it is. - (admin) - Aug. 22, 2003, 04:17:46 PM EDT

One server's still up. - (inthane-chan) - (2) - Aug. 22, 2003, 03:15:00 PM EDT

The worm is suffering from a Denial of Service... - (Simon_Jester) - (1) - Aug. 22, 2003, 04:02:43 PM EDT

Ok, this reminds me of something. - (inthane-chan) - Aug. 22, 2003, 04:25:03 PM EDT

So then - and, while it's early-on - (Ashton) - (11) - Aug. 22, 2003, 05:46:12 PM EDT

Was on my soapbox today... - (screamer) - (10) - Aug. 22, 2003, 11:37:57 PM EDT

I get the impression you weren't heard - (Ashton) - (3) - Aug. 23, 2003, 07:38:09 AM EDT

Re: basic cost accounting - (a6l6e6x) - (2) - Aug. 23, 2003, 02:57:50 PM EDT

Aye see one dem dere LRPD thangs (new thread) - (Another Scott) - Aug. 23, 2003, 03:12:51 PM EDT

Swahili poetry it is, then.. - (Ashton) - Aug. 23, 2003, 06:34:02 PM EDT

Impressions II - (for next? Round) - (Ashton) - (5) - Aug. 23, 2003, 07:40:35 PM EDT

Three problems: - (mhuber) - (1) - Aug. 24, 2003, 12:47:04 AM EDT

I believe you have disqualified yourself from - (Ashton) - Aug. 25, 2003, 03:39:41 PM EDT

TLA deficiency exception on slide 1! :) -NT - (a6l6e6x) - Aug. 24, 2003, 03:41:22 PM EDT

Responding to Worthy reviewers - (Ashton) - Aug. 24, 2003, 06:59:09 PM EDT

Thanks for the advice... - (screamer) - Aug. 25, 2003, 05:59:24 PM EDT

iwethey.org

Where is Mac Daddy Warlock Pimp Ken(tm)?
73 ms