Security Incidents mailing list archives

code red timing in July


From: Thomas Roessler <roessler () does-not-exist org>
Date: Wed, 1 Aug 2001 23:10:45 +0200

I was just looking over Stuart's model and the actual figures on infections from the first CRv2 outbreak in July.

I find it quite amazing that the initial infection(s) were timed so "perfectly" - just hours after saturation is (more or less) reached, the worm stops propagating and starts attacking.

One may speculate that whoever started CRv2 has chosen the point of transition deliberately, and based it on a realistic estimate of K.

I'm really just speculating, but I do find this coincidence amazing.

--
Thomas Roessler                        http://log.does-not-exist.org/

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com


Current thread: