Article View: comp.security.firewalls
Article #245Re: Warning: ShareSniffer Released
From: Lawrence Baldwin
Date: Fri, 23 Feb 2001 14:47
Date: Fri, 23 Feb 2001 14:47
33 lines
2745 bytes
2745 bytes
Joe King wrote: > > The up side of it (if there is one) is that it just might start > publicly pointing the finger at people who refuse to RTFM and take > reasonable precautions to secure their systems, and others who plain > just don't give a damn about what is going in or out of their > system/connection. I was thinking that too...I suspect Qaz (Summer 2000) helped that. Our estimates (Aug 2000) was that nearly 3% of broadband connections have open shares. This was based on detecting 2600+ QaZ infected ADSL users within a single provider that had approx ~100,000 subs. I had originally thought it was much higher, but then remembered that at least File & Print sharing is NOT on by default. > As opposed to what... being banged 50 times a day with RPC port > probes, Sub 7/2 port probes?..LOL Hey you have the *advantage* of being in a netblock of the best known broadband providers...enjoy. I'm suprised though, even our @Home sensors don't report that kind of volume (usually 5-10 scans/day each)....I suspect that ShareSniffer could easily bring the scan level even higher than it was during QaZ...esp. since it's technically not a worm but a "commercial product". lb. ------------------------- Lawrence Baldwin Protocol Scientist 678-624-0924 http://www.mynetwatchman.com/about.htm - I'm under attack, now what?
Technical Details
Message-ID:
<3A967818.C26F323D@mynetwatchman.com>Path:
arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!cyclone-sf.pbi.net!63.208.208.143!feed2.onemain.com!feed1.onemain.com!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsfeed.atl.bellsouth.net.MISMATCH!newsfeed.atl!news3.atl.POSTED!not-for-mailReferences:
<3A966412.9336DCD8@mynetwatchman.com> <1orc9t0dblf72e35c9vvjj562kfff17vmm@can.gov>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: f922c,b3c453f70036b961 X-Google-Attributes: gidf922c,public X-Google-Thread: f5dc1,b3c453f70036b961 X-Google-Attributes: gidf5dc1,public X-Google-Thread: 113850,b3c453f70036b961 X-Google-Attributes: gid113850,public X-Google-Thread: 10090f,b3c453f70036b961 X-Google-Attributes: gid10090f,public X-Google-ArrivalTime: 2001-02-23 06:48:11 PST Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!cyclone-sf.pbi.net!63.208.208.143!feed2.onemain.com!feed1.onemain.com!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsfeed.atl.bellsouth.net.MISMATCH!newsfeed.atl!news3.atl.POSTED!not-for-mail Message-ID: <3A967818.C26F323D@mynetwatchman.com> From: Lawrence Baldwin <baldwinlSPAMMENOT@mynetwatchman.com> X-Mailer: Mozilla 4.7 [en] (WinNT; U) X-Accept-Language: en MIME-Version: 1.0 Newsgroups: comp.security.firewalls,bellsouth.net.security,comp.dcom.xdsl,comp.dcom.modems.cable Subject: Re: Warning: ShareSniffer Released References: <3A966412.9336DCD8@mynetwatchman.com> <1orc9t0dblf72e35c9vvjj562kfff17vmm@can.gov> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Lines: 33 Date: Fri, 23 Feb 2001 09:47:52 -0500 NNTP-Posting-Host: 208.61.64.72 X-Trace: news3.atl 982939673 208.61.64.72 (Fri, 23 Feb 2001 09:47:53 EST) NNTP-Posting-Date: Fri, 23 Feb 2001 09:47:53 EST