nanog mailing list archives
Re: facebook worm
From: Gadi Evron <ge () linuxbox org>
Date: Thu, 7 Aug 2008 20:35:26 -0500 (CDT)
[top-posting]Now that this worm has been somewhat balked, I'd like to thank the membership for your patience with this off-topic post. I realize it is probably as annoying to some as it was useful to others.
My thinking was that on the rare occasion when we can anticipate *possible* and *serious* floods and bottle-necks at ISP tech-support lines, across multiple providers and regions, we should share that information. NANOG remains the best place for such information sharing.
While I realize this mailing list is mostly about network operations and less about ISP operations, we had a discussion in the past where we have seen some in our community do use this information effectively and find it useful.
This is a rare occasion indeed, but an explanation and an apology were in order.
Thank you, Gadi. On Wed, 6 Aug 2008, Gadi Evron wrote:
Hi all. You may want to be ready for a *possible* support lines flood today.Yesterday I discovered a fast-spreading facebook worm. It spreads by sending messages to all your facebook friends, from your account, asking them to click on a link in the .pl ccTLD.This worm is somewhat similar to zlob, here is a link to a kaspersky paper on a previous iteration of it, they call it koobface:http://www.kaspersky.com/news?id=207575670The worm collects spam subject lines from, and then sends the users personal data to the following C&C:zzzping.comI spoke with DirectNIC last night and the Registrar Operations (reg-ops) mailing list was updated that the domain is no longer reachable. That was very fast response time from DirectNIC, which we appreciate.The worm is still fast-spreading, watch the statistics as they fly: http://www.d9.pl/system/stats.phpThe facebook security team is working on this, and they are quite capable. The security operations community has been doing analysis and take-downs, but the worm seems to still be spreading.All anti virus vendors have been notified, and detection (if not removal) should be added within a few hours to a few days.For now, while users may get infected, their information is safe (unless the worm has a secondary contact C&C which I have not verified yet).It seems like some users may have learned not to click on links in email, but any other medium does not compute.Gadi.
Current thread:
- facebook worm Gadi Evron (Aug 06)
- Re: facebook worm Paul Wall (Aug 07)
- Re: facebook worm Gadi Evron (Aug 07)
- Re: facebook worm William Allen Simpson (Aug 08)
- Re: facebook worm Patrick Giagnocavo (Aug 08)
- Re: facebook worm Laurence F. Sheldon, Jr. (Aug 08)
- Re: facebook worm brett watson (Aug 08)
- Re: facebook worm Martin Hannigan (Aug 08)
- Re: facebook worm Gadi Evron (Aug 08)
- Re: facebook worm n3td3v (Aug 08)
- Re: facebook worm Jay R. Ashworth (Aug 15)
- Re: facebook worm Kelvin Chu (Aug 12)
- <Possible follow-ups>
- Re: facebook worm MTormey (Aug 08)