I've scanned my Netflow logs for activity associated with the 20
machines that SoBig was targeting and I found some very curious
activity.
I routed traffic to these 20 ips to Null0.
At 3:09 I started getting traffic from 10 of the 20 machines to a
Halflife server on my network. This continued u
On 8/22/03 8:50 PM, "Matt Martini" <[EMAIL PROTECTED]> wrote:
> I've scanned my Netflow logs for activity associated with the 20
> machines that SoBig was targeting and I found some very curious
> activity.
If what you claim is correct, this could be very bad. The virus is already
there on many
> -Original Message-
> From: Matt Martini
> Sent: Friday, 22 August, 2003 20:51
> To: North American Network Operators Group
> Subject: W32/Sobig-F - Halflife correlation ???
>
> Are there any halflife vunerabilies that the virus writers
> are using?
There are
n Smith
Game Digital Ltd
- Original Message -
From: "Robert Blayzor" <[EMAIL PROTECTED]>
To: "Matthew E. Martini" <[EMAIL PROTECTED]>; "North American Network
Operators Group" <[EMAIL PROTECTED]>
Sent: Saturday, August 23, 2003 3:05 AM
Sub
On 8/23/03 7:17 AM, "Darren Smith" <[EMAIL PROTECTED]> wrote:
> They were trying to hit servers in multiple subnets, all on ports 270XX.
I'm not sure on this. Lots of gaming servers use the 270XX UDP range.
Quake3, HL, etc.
It may be possible it's just probing for other HL servers running on
d
ust 23, 2003 1:05 PM
Subject: Re: W32/Sobig-F - Halflife correlation ???
>
> On 8/23/03 7:17 AM, "Darren Smith" <[EMAIL PROTECTED]> wrote:
>
> > They were trying to hit servers in multiple subnets, all on ports 270XX.
>
> I'm not sure on this. Lots o
TED]>
Sent: Saturday, August 23, 2003 1:22 PM
Subject: Re: W32/Sobig-F - Halflife correlation ???
>
> Hi
>
> Just a quick look at my syslog file, where MOO is the name of my ACL.
>
> fgrep MOO /var/log/cisco/.log | grep 27015 -c
> 2383
>
> fgrep MOO /var/log/cisco/.
; From: "Darren Smith" <[EMAIL PROTECTED]>
> To: "Robert Blayzor" <[EMAIL PROTECTED]>; "North American Network Operators Group"
> <[EMAIL PROTECTED]>
> Sent: Saturday, August 23, 2003 1:22 PM
> Subject: Re: W32/Sobig-F - Halflife correlation ???
One possibility is that half-life servers are inherently directory services.
The list of connected players could be used to encode directory data for
the worm to attack.
Owen
--On Friday, August 22, 2003 8:50 PM -0400 Matt Martini
<[EMAIL PROTECTED]> wrote:
I've scanned my Netflow logs for act
erfaces.
>
> Best Regards
>
> Darren Smith
>
> - Original Message -----
> From: "Robert Blayzor" <[EMAIL PROTECTED]>
> To: "North American Network Operators Group" <[EMAIL PROTECTED]>
> Sent: Saturday, August 23, 2003 1:05 PM
> Subject: R
10 matches
Mail list logo