Re(2): Increasing ICMP Echo Requests

From: Ken Eichman (keichman_at_cas.org)
Date: 08/18/03

  • Next message: Ken Dunham: "RE: Increasing ICMP Echo Requests" 
    Date: Mon, 18 Aug 2003 16:11:52 -0400 (EDT)
To: Dan Hanson <dhanson@securityfocus.com>

    > It might be my over-paranoid nature, but I think that labeling this, or
    > any other worm, as a good samaritan worm is dangerous. We have no way of
    > verifying or holding the author accountable, and it may be that some
    > hostile functionality exists in the worm and it is simply patching to
    > protect itself.

    Good point Dan. I was trying to paraphrase the basic description of
    the worm I got from various sources - in retrospect I should have left
    out my adjectives. Regards, Ken

    ---------------------------------------------------------------------------
    Captus Networks - Integrated Intrusion Prevention and Traffic Shaping
     - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
     - Automatically Control P2P, IM and Spam Traffic
     - Ensure Reliable Performance of Mission Critical Applications
     - Precisely Define and Implement Network Security and Performance Policies
    **FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo
    Visit us at:
    http://www.securityfocus.com/sponsor/CaptusNetworks_incidents_030814
    ----------------------------------------------------------------------------

  • Next message: Ken Dunham: "RE: Increasing ICMP Echo Requests"

    Relevant Pages

    • RE: mod to "killblast.vbs" script
      ... programming practices, but to copy the practices used by the worm. ... > - Ensure Reliable Performance of Mission Critical Applications ... Captus Networks - Integrated Intrusion Prevention and Traffic Shaping ...
      (Incidents)
    • RE: document_all.pif
      ... Standard Sobig Worm, ... Captus Networks - Integrated Intrusion Prevention and Traffic Shaping ... - Ensure Reliable Performance of Mission Critical Applications ...
      (Incidents)
    • Re: document_all.pif
      ... That sounds like the Sobig worm. ... > Captus Networks - Integrated Intrusion Prevention and Traffic Shaping ... > - Ensure Reliable Performance of Mission Critical Applications ...
      (Incidents)
    • RE: Increasing ICMP Echo Requests
      ... exploits the same vulnerability that the original MSBLAST worm did, ... serious vulnerability like this one, same thing happened with the SQL ... > - Ensure Reliable Performance of Mission Critical Applications ... > - Precisely Define and Implement Network Security and Performance ...
      (Incidents)
    • Re: MSBlast and other known exploits..
      ... I think what he's driving at is not the fact that the worm hit the machine ... Captus Networks - Integrated Intrusion Prevention and Traffic Shaping ... Ensure Reliable Performance of Mission Critical Applications ...
      (Incidents)