Full Disclosure mailing list archives
Re: Tracking a virus by logging infected machines
From: "Joel R. Helgeson" <joel () helgeson com>
Date: Tue, 2 Sep 2003 11:06:54 -0500
Why would any virus writer do this? This leads a clear audit trail that would lead the authorities directly back to the creator. I suppose it wouldn't be a bad thing if the virus author was looking for some free room & board for the next 5-10 years. Joel R. Helgeson Director of Networking & Security Services SymetriQ Corporation "Give a man fire, and he'll be warm for a day; set a man on fire, and he'll be warm for the rest of his life." ----- Original Message ----- From: "Richard M. Smith" <rms () computerbytesman com> To: <jasonc () science org>; <full-disclosure () lists netsys com> Sent: Monday, September 01, 2003 6:38 PM Subject: [Full-disclosure] Tracking a virus by logging infected machines
Hi Jason, >>> Is there any way to determine who the winner is? Not that I want to encourage virus writing, but I think it would be very helpful to gather infection statistics if a virus were to keep a log of the IP addresses of all the machines it infected. The log could be appended to the end of the executable file of the virus. Each copy of a worm or virus would contain a record of one branch of the tree of infected machines. To make a log easy to locate and extract, the log can start with an easily identified string such as "VIRUS INFECTION LOG\n". IP addresses should be recorded in ASCII with a \n between each IP address. Richard _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Virus, whether the scanners say so or not? Scott Phelps / Dreamwright Studios (Sep 01)
- Re: Virus, whether the scanners say so or not? Bennett Todd (Sep 01)
- Re: Virus, whether the scanners say so or not? Paul Schmehl (Sep 01)
- Re: Virus, whether the scanners say so or not? misiu_ (Sep 01)
- Re: Virus, whether the scanners say so or not? gregh (Sep 01)
- Random SoBig.F Thoughts Jason Coombs (Sep 01)
- Tracking a virus by logging infected machines Richard M. Smith (Sep 01)
- Re: Tracking a virus by logging infected machines Ralf (Sep 01)
- Re: Tracking a virus by logging infected machines Marcus Graf (Sep 02)
- Re: Tracking a virus by logging infected machines morning_wood (Sep 02)
- Re: Tracking a virus by logging infected machines Joel R. Helgeson (Sep 02)
- RE: Tracking a virus by logging infected machines Richard M. Smith (Sep 02)
- Tracking a virus by logging infected machines Richard M. Smith (Sep 01)
- <Possible follow-ups>
- Re: Virus, whether the scanners say so or not? roman . kunz (Sep 01)
- Fw: Virus, whether the scanners say so or not? morning_wood (Sep 01)