[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-Disclosure] RE: Full-Disclosure digest, Catching Sasser

RTFM - the 4digit-number mentioned is random. maybe it'll help to expand your script to try 9999 combinations or scan 10.000 infected hosts. It shouldn't be much of a problem to find them - we still experience >50 different sasser-ips per second hammering our firewall.

tom

RandallM wrote:

<|>---------ftp_commands------
<|>open <infected m/c IP> 5554
<|>anonymous
<|>user
<|>bin
<|>get 7584_up.exe


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html