Home page logo

nanog logo nanog mailing list archives

Re: Symantec detected Slammer worm "hours" before
From: "Jack Bates" <jbates () brightok net>
Date: Thu, 13 Feb 2003 13:39:10 -0600

From: "Mike Lloyd"

You added comment on a fiber cut in that time period - can you offer
more detail?  Barry mentioned another roughly simultaneous attack in
Korea.  One other theory, of course, would be trial runs of the worm,
perhaps with restricted PRNG to localize attack.  I've seen no direct
evidence that this happened, though.

It wouldn't be the first time that someone kicked off some code, found that
it was running too slowly, removed the sleep timers and tried again.
However, if this were the case, trying to find and localize the initial
"slow worm" compared to the later release would be difficult to say the

Jack Bates
BrightNet Oklahoma

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]