[40104] in North American Network Operators' Group
Re: Code Red growth stats
daemon@ATHENA.MIT.EDU (Christopher A. Woodfield)
Wed Aug 1 17:31:45 2001
Date: Wed, 1 Aug 2001 17:30:38 -0400
To: michael@aplatform.com
Cc: Dave Stewart <dbs@ntrnet.net>, nanog@nanog.org
Message-ID: <20010801173038.B19936@semihuman.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <Pine.LNX.4.33.0108011349340.8129-100000@aplatform.com>
From: "Christopher A. Woodfield" <rekoil@semihuman.com>
Errors-To: owner-nanog-outgoing@merit.edu
heh, maybe someone can take the worm code and use it to apply the IIS
patch instead of DoS'ing the White House... :)
-C
On Wed, Aug 01, 2001 at 01:50:28PM -0700, michael@aplatform.com wrote:
>
> Hello,
>
> Over the course of the last 1.5 hours some hits from @home but most all
> others are not US while before most were within the US.
>
> Michael...
>
> On Wed, 1 Aug 2001, Dave Stewart wrote:
>
> >
> > At 04:28 PM 8/1/2001, Stephen J. Wilcox wrote:
> >
> > >Does anyone have any theories as to why its tailing, are the thousands of
> > >vulnerable machines being patched all of a sudden? If not then why is
> > >traffic decreasing so fast when the worm just keeps searching?
> >
> > I suspect we'll see it begin to pick up a little bit... it looks like
> > Billybob is just starting to get home from work and fire up his whizbang
> > Windows 2000 machine, which he put IIS on so he can share kewl warez and
> > mp3z with his leet friends...
> >
> > I'm seeing more probes from Roadrunner and @Home hosts in the last little
> > while.
> >
>
--
---------------------------
Christopher A. Woodfield rekoil@semihuman.com
PGP Public Key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xB887618B
