Date: Thu, 26 Jan 2006 01:08:14 +0200
From: Gadi Evron <ge@linuxbox.org.>
To: [email protected]Subject: BlackWorm: 2 million infected? ISP notifications.
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 8bit
X-Greylist: Sender succeded SMTP AUTH authentication, not delayed by milter-greylist-1.7.5 (linuxbox.org [24.155.83.21]); Wed, 25 Jan 2006 17:09:27 -0600 (CST)
X-Virus-Scanned: antivirus-gw at tyumen.ru
2 million hits:
The counter is now at 2 million. Check out Sunbelt▓s blog on this:
http://sunbeltblog.blogspot.com/2006/01/blackworm-worm-over-18-million.html
From past experience the 2 million hits probably mean a little over a
million users infected.
ISP notification:
In cooperation with many (US-CERT, FBI, SANS ISC, many in the industry,
etc.) and with special thanks to:
Dr. Johannes Ullrich (SANS ISC) and Prof. Randal Vaughn (Randy ≈
Baylor.edu), an attempt to contact all the ISP▓s who have infected users
has been made.
A new list of IP▓s that hit the (still secret) counter address is being
compiled, so we can make another run of ISP notifications.
The reporting emails are sent from Baylor.edu and contain a URL to the
SANS ISC with a time-limited specially crafted URL for the respective
ISP authorities to get their infected users▓ information from.
I'll update here when possible if there is anything to update.
Check out:
http://www.lurhq.com/blackworm.html
Regular updates at:
http://isc.sans.org/blackworm
http://blogs.securiteam.com
Gadi.
