Full Disclosure mailing list archives
Re: The witty worm
From: Michal Zalewski <lcamtuf () ghettot org>
Date: Sun, 21 Mar 2004 00:39:12 +0100 (CET)
On Sat, 20 Mar 2004, Gadi Evron wrote:
Note that this worm is only 909 bytes, but as a friend of mine mentioned, slammer was only 376.
There seem to be many self-contradictory reports on the payload size and destination ports used by the worm. Both the payload length and destination port are a function of the destination address. A specific target will only observe a specific length and a specific destination port (for the most widespread variant of the worm, at least), but two different targets will observe different parameters. Cheers, -- ------------------------- bash$ :(){ :|:&};: -- Michal Zalewski * [http://lcamtuf.coredump.cx] Did you know that clones never use mirrors? --------------------------- 2004-03-21 00:37 -- http://lcamtuf.coredump.cx/photo/current/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- The witty worm Gadi Evron (Mar 20)
- Re: The witty worm Gadi Evron (Mar 20)
- Re: Re: The witty worm Paul Schmehl (Mar 20)
- Re: The witty worm Michal Zalewski (Mar 20)
- Re: The witty worm Gadi Evron (Mar 20)
- <Possible follow-ups>
- Re: The witty worm http-equiv () excite com (Mar 20)
- Re: Re: The witty worm Mike Barushok (Mar 20)
- Re: Re: The witty worm http-equiv () excite com (Mar 20)
- Re: Re: The witty worm Mike Barushok (Mar 20)
- Re: The witty worm Gadi Evron (Mar 20)