[Dshield] Suggestion to take the ISC Storm Alert to "Orange"

womber womber at gmail.com
Tue Aug 16 03:39:59 GMT 2005


How is this determining what IP ranges to scan?
Just from what I have seen hitting my personal firewall on verizon
dsl, is that most machines are verizon IP's, very few outside their
range yet.
I am wondering if the spread to different ranges is pretty slow due to
the algorithm it is using?
My two cents is that this will not spread as quickly as blaster did,
but will still do allot of damage in the long run.
Gene

On 8/15/05, David Taylor <ltr at isc.upenn.edu> wrote:
> Personally, I don't think it should be changed to Orange.  Blaster was only
> Yellow and it swept through the net pretty quick.  I have had a Windows 2000
> Server Honeypot setup for 36 hours and can't get it infected.
> 
> Just my thoughts.
> 
> 
> ==================================================
> David Taylor //Sr. Information Security Specialist
> University of Pennsylvania Information Security
> Philadelphia PA USA
> LTR at ISC.UPENN.EDU               (215) 898-1236
> http://www.upenn.edu/computing/security/
> ==================================================
> 
> SANS - The Twenty Most Critical Internet Security Vulnerabilities
> http://www.sans.org/top20/
> 
> SANS - Internet Storm Center
> http://isc.sans.org
> 
> 
> -----Original Message-----
> From: list-bounces at lists.dshield.org [mailto:list-bounces at lists.dshield.org]
> On Behalf Of Fergie (Paul Ferguson)
> Sent: Monday, August 15, 2005 6:25 PM
> To: list at lists.dshield.org
> Subject: [Dshield] Suggestion to take the ISC Storm Alert to "Orange"
> 
> 
> Peresonally, I see all kinds of reason to take the ISC Alert
> Level to "Orange" -- I see all kinds of problems.  :-/
> 
> Perhaps not in the Internet infrastructure, per se, but MAJOR
> disruption in enterprise networks today. MAJOR...
> 
> - ferg
> 
> 
> --
> "Fergie", a.k.a. Paul Ferguson
>  Engineering Architecture for the Internet
>  fergdawg at netzero.net or fergdawg at sbcglobal.net
>  ferg's tech blog: http://fergdawg.blogspot.com/
> 
> 
> _______________________________________________
> send all posts to list at lists.dshield.org
> To change your subscription options (or unsubscribe), see:
> http://www.dshield.org/mailman/listinfo/list
> 
> 
> 
> _______________________________________________
> send all posts to list at lists.dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
>



More information about the list mailing list