Re: FBI Virus Alerts

[info <info () safer-hex com>]

Also sprach Chris Salter um 12:14 Uhr +0100 am 29.09.2001:
> This prompts me to ask a question that I have been meaning to ask for
> sometime. My apologies if it has been addressed before. Are these report
> statistics published by the AV vendors accurate representations of virus
> activity in the field?

the prob for people like us is, each vendor has different standards 
when a certain category is assigned or an alert is issued.
there is also varying time lags between the vendors. in the case of 
Nimda it was comparatively short, the first being Sophos [Date: Tue, 
18 Sep 2001 16:45:07 +0100 (BST)] the last being McAfee some 7 hrs 
later, minutes after Trend Micro. CERT followed shortly after while 
we received no alert from Kaspersky. Symantec, too, is usually very 
hesitative to ring the alarm bell...


Also sprach David Kennedy CISSP um 11:02 Uhr -0400 am 29.09.2001:
> (...)  I can hardly wait to see if it
> makes the Wild List.
that means, as long as you don't see it in the list, it isn't there?

we operate an alert service, and when an a/v vendor sends an alert 
with the subject line

Also sprach Trend Micro Info Service um 14:29 Uhr +0100 am 27.09.2001:
> (...)
> Subject: SEVERE OUTBREAK: TROJ_VOTE.C

then I don't wait until their webmasters wake up but forward it to my 
readers who expect me to do just that and not wait until I have the 
first samples in our editorial mail boxes to check if it's real.

period!

Dre.

p.s. I'm aware that many a/v vendors sometimes create a hype but we 
have the policy better to warn to often but ASAP, rather than to warn 
when it's too late.

--

[  C  A  M  R  I  N    N  E  T  W  O  R  K  ]
the  jrpamc.com internet information services
[jrpamc () camrin net] : [http://www.camrin.net]


----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com