OK.. Seems to me that under the circumstances, since they're willing to disconnect that host from the internet (any rational ISP would be), that replacing it with a /32 route to a honeypot created by the ISP would not be that difficult. Sure, it's unlikely that 100% of the ISPs could do it in the time required, but, even if you gust got the top 3 or so on the worm's hit list, it would have a significant impact. If you got 10, then the surprise would be no more than 50% effective.
Sure, it won't happen in 30 minutes, but, I don't understand why this wasn't started when F-Secure first noticed the situation.
Owen
--On Friday, August 22, 2003 1:39 PM -0500 "Beprojects.com" <[EMAIL PROTECTED]> wrote:
So who's going to do that? There are 20 machines on 20 different networks covering the US, Canada and parts of Asia (from what I've read). Each network would have to contact the individual user and ask permission to put a honeypot on their IP and that's not going to happen in the next 30 minutes.
----- Original Message ----- From: "Owen DeLong" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> Sent: Friday, August 22, 2003 1:27 PM Subject: Re: Sobig.f surprise attack today
OK... Maybe I'm smoking crack here, but, if they have the list of 20 machines, wouldn't it make more sense to replace them with honey-pots that download code to remove SOBIG instead of just disabling them?
Let's use the virus against itself. At this point, I think that's a legitimate countermeasure.
Owen
--On Friday, August 22, 2003 11:01 AM -0700 Jim Dawson <[EMAIL PROTECTED]> wrote:
> > F-Secure Corporation is warning about a new level of attack to be > unleashed by the Sobig.F worm today. Supposed to take place at 1900 > UTC. > > http://www.f-secure.com/news/items/news_2003082200.shtml > > Jim > -- > > See what ISP-Planet is saying about us! > http://isp-planet.com/services/wholesalers/flexpop.html > __________________________________________________________________ > Jim Dawson [EMAIL PROTECTED] > Flexpop/Navi.Net http://www.flexpop.net > 618 NW Glisan St. Ste. 101 v. +1.503.517.8866 > Portland, Or 97209 USA f. +1.503.517.8868 > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >
