nanog mailing list archives

RE: in case nobody else noticed it, there was a mail worm released today


From: "David Luyer" <david () luyer net>
Date: Tue, 27 Jan 2004 19:39:32 +1100


This lovely little worm will start beating on the door at www.sco.com come
Feb 1/04. Interesting huh?

Wonder if we should all be proactive to prevent the DoS attack,
and drop the A records for www.sco.com now?  Just in case any
customers' clocks are set forward ;-)

This virus, so far, has been the most prolific (in terms of copies
per hour) I've seen on a number of sites' (our own included) virus
scanning servers, not a good sign.  It did slow down by around 10%
at COB AEDT but I wouldn't be surprised to see a big surge as the
US business day starts.

Even just my personal inbox is getting around 5/minute (direct
copies combined with bounces from forged messages).  Interestingly,
the vast majority of the bounces are to an address that has never
been used to send mail, and is only rarely given over the phone,
david@<domain-of-isp-i-work-for>.  One of the virus scanners here
is getting around 20/second.

David.


Current thread: