(AUSCERT#49484) Re: lovethingy spread analyses

[luci () AUSCERT ORG AU (David Conran)]

-----BEGIN PGP SIGNED MESSAGE-----

> Not using the word "love" in subject, because then all the patched mailers wi
> ll
> shit on me because i am trying to spread the lovebug virus...hehehe
>
> Just a quick, short note:
>
> I was thinking about "the virus originated in South East Asia" statement.
> Hmmm.. if you look at the spread of the virus, you will find that it coincide
> with sunlight. Really. It uses people to spread - to read the email and execu
> te
> the attachment, right? And most people need to be awake to read their email
> (there's the exception...:)) So if you look at the spread of the virus, you
> will see it hitting South EAST Asia, EASTERN Euope, Africa and Europe, and th
> en
> the States - thus is travels with the sun. If the reports are coming in from
> Australia tomorrow, then we know the *main* spread has travel around the
> globe...and it suggests that it all started in the East..It will spin around
> the world with the sun..secondary infection in +- 24h?
>
> Just an interesting observation. Maybe someone like the CERTs could provide
> very usefull information on reports etc? Anyone on here that has done analyse
> s
> of this kind before?
>
> Regards,
> Roelof.
>
> ------------------------------------------------------
> Roelof W Temmingh             SensePost IT security
> roelof () sensepost com               +27 83 448 6996
>               http://www.sensepost.com                

AusCERT (ie. Australia) received its first report of the worm at approx. 9pm
on the 4th of May 2000 (GMT+1000), we received reports from the US just
before midnight on the 4th (again GMT+1000) and then the excrement really
hit the airator within Australia at approx. 8:30am on 5th of May 2000
(GMT+1000). We pushed our Alert on the topic around 10:30am on 5th of May 2000
(GMT+1000). Since then ... well, lets just say it been a heavy day in both
incidents and press activity.

David

- --
Australian Computer Emergency Response Team  Hotline: +61 7 3365 4417
(AusCERT)                                    Fax:     +61 7 3365 7031
The University of Queensland                 WWW:     www.auscert.org.au
Qld 4072 Australia                           Email:   auscert () auscert org au

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv
Comment: ftp://ftp.auscert.org.au/pub/auscert/AUSCERT_PGP.key

iQCVAwUBORL9xih9+71yA2DNAQFH5wP/Y5pnMGJDbqEHcpZcXfuDujlq7dIR/vvI
8pizwNBtSg91WgE65Er+d+cpSanDfBXccjm1tOPqrt+S+TfqDmKywhMHuZiLlYUC
iCVYCHeuTdfX/rPJeG7I8vg1E2odSAvFdScXcIy40k7hzx4rVxaHKjdDrTMjEOkq
OMbTA+9L4vU=
=WQFD
-----END PGP SIGNATURE-----