Sobig's Friday 3 p.m. action

[Dave Farber <dave () farber net>]

> Date: Fri, 22 Aug 2003 15:29:50 -0400
> From: Rich Kulawiec <rsk () gsp org>
> Subject: Re: [IP] -- more on -- Sobig's Friday 3 p.m. action
> To: Dave Farber <dave () farber net>
>
>
> And -- completely predictably:
>
>         The existing list of 20 appears to list Windows PCs belonging
>         to home users and connected to the internet via always-on,
>         ADSL broadband connections, says Hypponen. "It is most likely
>         that the party behind SoBig.F has broken into these computers
>         and they are now being misused to be part of this attack."
>
>         -- excerpt from New Scientist
>
> Many of us in the anti-spam community have been reporting millions
> of apparently-hijacked Windows PCs to the ISPs which "manage" cable
> and DSL networks for months.  Those reports have, almost without
> exception, been completely ignored -- we can tell that because the same
> abuse comes from the same IP addresses with monotonous regularity.
> If we get a response it all, it's from an ignorebot -- or it's from
> the ISP's mail system telling us that the "abuse" mailbox is full.
>
> The spam emitted from these systems, as observed here, went up three
> orders of magnitude when an earlier variant of SoBig was released.
> It went up by another factor of 50 when the next version came
> out.  It remains to be seen what SoBig.F is up to -- or, if its
> author finds the countermeasures now being undertaken to be overly
> effective, when we'll see SoBig.G.
>
> ---Rsk

-------------------------------------
You are subscribed as interesting-people () lists elistx com
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/