Interesting People mailing list archives
-- more on -- Sobig's Friday 3 p.m. action MAY BE MORE COMING
From: Dave Farber <dave () farber net>
Date: Sat, 23 Aug 2003 16:38:32 -0400
Date: Sat, 23 Aug 2003 09:33:19 -0400 From: Rich Kulawiec <rsk () gsp org> Subject: Re: [IP] -- more on -- Sobig's Friday 3 p.m. action To: Dave Farber <dave () farber net> The other shoe drops. Recall this from yesterday: > >The list of ips that Sobig F will > >try to download its new payload from is hardcoded and known. > >This is a message from X-Force: > > > >Computers infected with the Sobig.F worm are programmed > >to automatically download an executable of unknown function > >from a hard-coded list of servers at 19:00 UTC (3:00pm EDT) > >X-Force is recommending wholesale outbound filtering of > >the following IP addresses: Now try this on for size: > From: "Jerry Heidtke" <jheidtke () fmlh edu> > Date: Fri, 22 Aug 2003 17:11:27 -0500 > Subject: RE: [Full-Disclosure] Sobig has a surprise... > > All the experts were totally faked out. While everyone was concentrating > on getting the "magic 20" machines shut down, no one realized that > different copies of Sobig.f had different lists of servers to contact. > > We put a block of udp port 8998 on our firewall this morning. We had 3 > previously undetected infected machines on our network, each of which > tried to contact a different list of 20 machines. One of the lists > corresponds to the one that Sophos and others have published. The other > two lists have no addresses in common with the published list, or with > each other. > > I wonder how many different sets of servers there were, how many > different variants of Sobig.f there were, and how many infected machines > now have some additional trojan, worm, or ddos code waiting for a > command to do something. ---Rsk
------------------------------------- You are subscribed as interesting-people () lists elistx com To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/
Current thread:
- -- more on -- Sobig's Friday 3 p.m. action MAY BE MORE COMING Dave Farber (Aug 23)