Re: 100 Worms per Second, Courtesy of Telstra

["Matthew Murphy" <mattmurphy () kc rr com>]

> Pardon my delurk, but this is very strange worm behavior.  We are seeing
> 100 SQL Worms per second from a single IP address on Telstra.  This is
> about 10k times the level of activity we are seeing from any other
> address.

That is certainly odd.

> Anyone here either know anyone at Telstra who can shut this off, or
> perhaps at least some explanation of why this worm instance would set
> aside its usual randomish behavior and flood us like this?

There seems to be a major weakness in the scanning pattern of this worm that
makes it flood some addresses far more extensively than others.  Considering
that the entire 'random' generator is just a trivial bit shift of the system
timer, it can't be expected to be really 'random' at all.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html