[33504] in bugtraq
Re: Hysterical first technical alert from US-CERT
daemon@ATHENA.MIT.EDU (Valdis.Kletnieks@vt.edu)
Sat Feb 7 09:48:58 2004
Message-Id: <200402062207.i16M76NW023197@turing-police.cc.vt.edu>
To: Stephen Samuel <samuel@bcgreen.com>
Cc: Larry Seltzer <larry@larryseltzer.com>, bugtraq@securityfocus.com
In-Reply-To: Your message of "Thu, 05 Feb 2004 00:33:47 PST."
<4021FFEB.90102@bcgreen.com>
From: Valdis.Kletnieks@vt.edu
Mime-Version: 1.0
Content-Type: multipart/signed; boundary="==_Exmh_-1723342094P";
micalg=pgp-sha1; protocol="application/pgp-signature"
Content-Transfer-Encoding: 7bit
Date: Fri, 06 Feb 2004 17:07:06 -0500
--==_Exmh_-1723342094P
Content-Type: text/plain; charset=us-ascii
On Thu, 05 Feb 2004 00:33:47 PST, Stephen Samuel said:
> Most of the time, I'd expect that a copycat virus is going to be
> much smaller than the original, since that trick-space is now
> going to be saturated.If there's nothing different in the
> distribution of the virus, then I'd say they were silly to
> presume it was going to be anywhere near as big as MyDoom A.
In general, yes. However, in this case it was a copycat that
got loose *before* the general population got the meme for "this is
bad, don't click on it". And remember - they need to get a new
meme for each specific instance, as the average user can't seem to
generalize this. (Hmm.. didn't Stephenson's "Snow Crash" talk about
that? ;)
--==_Exmh_-1723342094P
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001
iD8DBQFAJBAKcC3lWbTT17ARAlRWAKCozW6egmO28FSBz4DNnrdwvYHvjwCgpPq6
cEmc+mhyi9J3W1djYfJsSHg=
=imkW
-----END PGP SIGNATURE-----
--==_Exmh_-1723342094P--
