-- more on -- Sobig's Friday 3 p.m. action MAY BE MORE COMING

[Dave Farber <dave () farber net>]

> Date: Sat, 23 Aug 2003 09:33:19 -0400
> From: Rich Kulawiec <rsk () gsp org>
> Subject: Re: [IP] -- more on -- Sobig's Friday 3 p.m. action
> To: Dave Farber <dave () farber net>
>
> The other shoe drops.  Recall this from yesterday:
>
> > >The list of ips that Sobig F will
> > >try to download its new payload from is hardcoded and known.
> > >This is a message from X-Force:
> > >
> > >Computers infected with the Sobig.F worm are programmed
> > >to automatically download an executable of unknown function
> > >from a hard-coded list of servers at 19:00 UTC (3:00pm EDT)
> > >X-Force is recommending wholesale outbound filtering of
> > >the following IP addresses:
>
> Now try this on for size:
>
> > From: "Jerry Heidtke" <jheidtke () fmlh edu>
> > Date: Fri, 22 Aug 2003 17:11:27 -0500
> > Subject: RE: [Full-Disclosure] Sobig has a surprise...
> >
> > All the experts were totally faked out. While everyone was concentrating
> > on getting the "magic 20" machines shut down, no one realized that
> > different copies of Sobig.f had different lists of servers to contact.
> >
> > We put a block of udp port 8998 on our firewall this morning. We had 3
> > previously undetected infected machines on our network, each of which
> > tried to contact a different list of 20 machines. One of the lists
> > corresponds to the one that Sophos and others have published. The other
> > two lists have no addresses in common with the published list, or with
> > each other.
> >
> > I wonder how many different sets of servers there were, how many
> > different variants of Sobig.f there were, and how many infected machines
> > now have some additional trojan, worm, or ddos code waiting for a
> > command to do something.
>
> ---Rsk

-------------------------------------
You are subscribed as interesting-people () lists elistx com
To manage your subscription, go to
 http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/