Full Disclosure mailing list archives
Re: [Full-Disclosure] RE: Full-disclosure digest, Catching Sasser
From: Jordan Wiens <jwiens () nersp nerdc ufl edu>
Date: Wed, 5 May 2004 11:46:25 -0400 (EDT)
It's random, but doesn't matter what it is. So it'll work with any number; 7584 sounds just as good as any other 4 digit number. His script is meant to download from sasser, and it will, just fine. If the script was using that as a pattern to match on in some sort of ids then, yes, it wouldn't be very effective, but that's not what it's trying to do. -- Jordan Wiens, CISSP UF Network Security Engineer (352)392-2061 On Wed, 5 May 2004, Thomas Springer wrote:
RTFM - the 4digit-number mentioned is random. maybe it'll help to expand your script to try 9999 combinations or scan 10.000 infected hosts. It shouldn't be much of a problem to find them - we still experience >50 different sasser-ips per second hammering our firewall. tom RandallM wrote:<|>---------ftp_commands------ <|>open <infected m/c IP> 5554 <|>anonymous <|>user <|>bin <|>get 7584_up.exe_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- [Full-Disclosure] RE: Full-disclosure digest, Catching Sasser RandallM (May 04)
- Re: [Full-Disclosure] RE: Full-disclosure digest, Catching Sasser Thomas Springer (May 05)
- Re: [Full-Disclosure] RE: Full-disclosure digest, Catching Sasser Jordan Wiens (May 05)
- <Possible follow-ups>
- RE: [Full-Disclosure] RE: Full-disclosure digest, Catching Sasser Shashank Rai (May 05)
- Re: [Full-Disclosure] RE: Full-disclosure digest, Catching Sasser Thomas Springer (May 05)