Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: [Full-Disclosure] Re: New LSASS-based worm finally here (Sasser)
From: insecure (insecureameritech.net)
Date: Tue May 04 2004 - 07:27:04 CDT
Microsoft added detection for Blaster and variants to Windows Update, I
believe in November. About a month ago, they said that 16 million
computers had been detected as infected. Single computers may be counted
multiple times, but their cleaning tool was downloaded and run 8 million
times on unique computers.
I know of a couple hundred computers that were infected with Blaster or
some variant, that were not cleaned through Windows update, but I'm not
aware of a single infected computer that used Windows update for
cleaning. This would indicate that the number of Blaster-infected
computers was likely to be significantly higher than 8 million. Maybe
ten times as much (just guessing here).
Over the past month, Windows update detected another 1.5 million
infected computers. How many were new infections? How many were the
first time the user went to Windows update? How many other new
infections were there that didn't visit Windows update? Don't know, but
it is possible that Blaster is still infecting 100,000 or more new
victims every day. Close to half a million new computers are put into
service every day, so there's an ample supply of new victims.
The total number of Blaster victims to date is probably more like 50-100
million than one million.
One AV company said that by Sunday night Sasser had infected 3 million
computers. I don't know how they came up with that number, but it seems
reasonable, if not low. With the start of business Monday (and today, as
Monday was a holiday in much of the world), the number of systems that
have been infected with Sasser so far might easily exceed 10 million.
Javier Fernandez-Sanguino wrote:
> You're right. I forgot about witty, I read CAIDA's analysis of the
> worm just yesterday.
> Still, the infected population of witty was pretty small (I believe
> ~12,000 machines in a day?) compared to SQLexp (~200,000 ),
> (~75,000-100,000 ), CodeRed (~360,000 in 12 hours ), Nimda
> (around 1.6 times CodeRed, maybe over 500,000 systems? ). I don't
> find data for Blaster, but I presume it infected many more systems
> than Nimda. So I believe we might be facing a worm that will infect
> over 1,000,000 systems.
> Probably anti-virus vendors will have more accurate data. But I
> haven't seen it, not even in Symantec's (excellent) Threat Report V
> (December 2003) . In any case, this worm was "predicted" by that
> same report. I would like to suggest everyone to read it thouroughly
> (Disclaimer: I don't work at Symantec).
>  http://securityresponse.symantec.com/avcenter/Analysis-SQLExp.pdf
>  http://www.caida.org/analysis/security/sapphire/
>  http://www.caida.org/analysis/security/code-red/
>  http://www.first.org/events/progconf/2002/d5-02-song-slides.pdf
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 8.0.3
> -----END PGP SIGNATURE-----
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
Full-Disclosure - We believe in it.