Re: Bobax and Kibuv

[Valdis.Kletnieks () vt edu]

On Mon, 24 May 2004 17:41:34 +0200, Tobias Weisserth <tobias () weisserth de>  said:

> I can't understand why it seems so hard to catch samples of worms that
> knock at my firewall 24/7.
>
> Just open the corresponding ports and forward them to a vulnerable
> machine on a different subnet (DMZ) and let the worms infect a machine
> you designated for this purpose.

The only tricky part is catching *only* a Bobax and Kibov.  I can guarantee
that if you put the shields down low enough to catch something that beats on
the LSASS, you'll catch something.  The question is whether you'll catch a
Bobax before you have to stop and throw a Sasser or other malware off the
system....

It's kind of like trying to catch a chlamydia sample by banging hookers without
a rubber - you'll probably catch it along with other stuff too....

Attachment: _bin
Description: