Full Disclosure mailing list archives
RE: Tracking a virus by logging infected machines
From: "Richard M. Smith" <rms () computerbytesman com>
Date: Tue, 2 Sep 2003 12:43:43 -0400
To show off. ;-) The author of the Marker virus did exactly this. Richard -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of Joel R. Helgeson Sent: Tuesday, September 02, 2003 12:07 PM To: full-disclosure () lists netsys com Subject: Re: [Full-disclosure] Tracking a virus by logging infected machines Why would any virus writer do this? This leads a clear audit trail that would lead the authorities directly back to the creator. I suppose it wouldn't be a bad thing if the virus author was looking for some free room & board for the next 5-10 years. Joel R. Helgeson Director of Networking & Security Services SymetriQ Corporation "Give a man fire, and he'll be warm for a day; set a man on fire, and he'll be warm for the rest of his life." ----- Original Message ----- From: "Richard M. Smith" <rms () computerbytesman com> To: <jasonc () science org>; <full-disclosure () lists netsys com> Sent: Monday, September 01, 2003 6:38 PM Subject: [Full-disclosure] Tracking a virus by logging infected machines
Hi Jason, >>> Is there any way to determine who the winner is? Not that I want to encourage virus writing, but I think it would be
very
helpful to gather infection statistics if a virus were to keep a log
of
the IP addresses of all the machines it infected. The log could be appended to the end of the executable file of the virus. Each copy of
a
worm or virus would contain a record of one branch of the tree of infected machines. To make a log easy to locate and extract, the log can start with an easily identified string such as "VIRUS INFECTION LOG\n". IP
addresses
should be recorded in ASCII with a \n between each IP address. Richard _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: Virus, whether the scanners say so or not?, (continued)
- Re: Virus, whether the scanners say so or not? Bennett Todd (Sep 01)
- Re: Virus, whether the scanners say so or not? Paul Schmehl (Sep 01)
- Re: Virus, whether the scanners say so or not? misiu_ (Sep 01)
- Re: Virus, whether the scanners say so or not? gregh (Sep 01)
- Random SoBig.F Thoughts Jason Coombs (Sep 01)
- Tracking a virus by logging infected machines Richard M. Smith (Sep 01)
- Re: Tracking a virus by logging infected machines Ralf (Sep 01)
- Re: Tracking a virus by logging infected machines Marcus Graf (Sep 02)
- Re: Tracking a virus by logging infected machines morning_wood (Sep 02)
- Re: Tracking a virus by logging infected machines Joel R. Helgeson (Sep 02)
- RE: Tracking a virus by logging infected machines Richard M. Smith (Sep 02)
- Tracking a virus by logging infected machines Richard M. Smith (Sep 01)