SANS ISC: Power Outage Impact - Nachia Worm - Sobig F - SANS Internet Storm Center

• SANS Site Network
  • Current Site
  • SANS Internet Storm Center
  • Other SANS Sites Help
  • Graduate Degree Programs
  • Security Training
  • Security Certification
  • Security Awareness Training
  • Penetration Testing
  • Industrial Control Systems
  • Cyber Defense Foundations
  • DFIR
  • Software Security
  • Government OnSite Training

SANS ISC InfoSec Forums

Power Outage

Renesys published a very interesting paper detailing the impact of the power outage on connectivity in the North East.

http://www.renesys.com/news/index.html

Nachia Worm

The Nachia worm is still spreading fast. While this worm is frequently refered to as a 'good worm', it should be noted that the impact of this worm is worse than 'Blaster'. While this worm cleans up blaster infected machines, it causes network disrubtion due to its agressive pinging. Also, note that this virus will install a back door and it will scan for machines that are vulnerable to the WebDav IIS exploit. In so far, this worm may just remove the Blaster virus to protect itself, like many 'auto rooters' do.

Sobig F

Despite the best efforts of system admins world wide, users are still clicking on e-mail attachments. We strongly recommend attachment stripping on mail gateways. Please note, that the 'From' address is spoofed. Do not send auto replies to senders, as this will just worsen the email flood caused by Sobig F. As other Sobig variants, this one includes the ability to update the worm remotely, backdoors and a full set of other evilness.