router worms and International Infrastructure

Tue Sep 20 06:57:03 UTC 2005

----- Original Message Follows -----
From: Gadi Evron <ge at linuxbox.org>
To: surfer at mauigateway.com
Cc: nanog at merit.edu
Subject: Re: router worms and International Infrastructure
Date: Tue, 20 Sep 2005 09:18:43 +0200
> > Subnetwork specific worms?  I only want to take down as1
> > , as2 and as3, for example, rather than a large-scale
> > 'internet killer' outage.
> 
> Almost a year ago we had a crisis in Israel where
> something caused ONLY  Israeli ISP clients to stop being
> able to use their DSL connections, and  on the SAME DAY.
> 
> We believe it was a targeted worm.
> 
> Who said this can't happen? It already did. The biggest
> impact was the  help desks being DDoS'd.

Do you mean to imply that it was a router code worm or a
normal worm?  A "Warhol Worm" in a logically localized area
(an AS or three) utilizing router exploitations would be
spectacularly fast.

scott