Current Blackworm numbers

Gadi Evron ge at linuxbox.org
Fri Jan 27 03:23:26 UTC 2006


Fergie wrote:
> Given all the noise that this issue has caused on the list, I
> thought I'd take a moment this afternoon and forward a URL that
> good folks over at LURHQ have made available with more realistic,
> and current, statistics on the BlackWorm cruft:
> 
>  http://www.lurhq.com/blackworm-stats.html
> 
> Thanks to Joe Stewart at LURHQ.

Indeed! Joe Stewart (at LURHQ) and his work are both amazing.

He took the information we at the TISF BlackWorm task force got from RCN 
(.com/.net - I have never seen a more whitehat ISP in my life) with the 
FBI's help, and spent days working on the worm and the data, de-duping, 
removing the hosts trying to poison the logs data or DDoS, etc.

He deserves the credit!

There are so many other people working day and night on this:

The incredible Johannes Ullrich at SANS ISC and tireless Prof. Randy 
Vaughn at Baylor EDU, as well as many others...

Many from the net-ops community.
The SANS handlers (ALL OF THEM), who are always there when called.

The FBI, US-CERT, DoD-CERT, REN-ISAC, KrCERT, FortiNet, MessageLabs... 
... .. and many many others around the globe who still work on this and 
invest a ton of effort. They deserve the credit.

Like Joe wrote:
"Even so, 300,000 infected users worldwide is not a terribly large 
amount when compared to previous worms like Sober or Mydoom. However, 
with this worm it isn't the quantity of infected users, it is the 
destructive payload which is most concerning."

	Gadi.



More information about the NANOG mailing list