Re: [Full-Disclosure] Red Bull Worm

[Valdis.Kletnieks@vt.edu]

On Thu, 07 Aug 2003 11:47:48 CDT, Brian Eckman <eckman@umn.edu>  said:

> Pardon me if I am just plain ignorant, but where is this worm, and how 
> on earth is it "more effective than Code Red ever was" already if nobody 
> is talking about it? The only evidence of a worm I have seen is one 
> person showing comments supposedly from source code of some program 
> calling itself a worm...

The monitors at www.dshield.org *are* showing a slight rise in port 445 and 135
events, and there's been a lot of chatter about widespread exploits.  On the
other hand, I've not seen any firm evidence it's made the jump from "scanner/
exploit tool" to worm - there's certainly no CodeRed-sized spike in the
monitors (*YET* - if the worm has a slow first-phase deployment, things could
get interesting later this week)..

PGP signature