[unisog] XP silently configuring ad-hoc wifi networks

Christopher Chow c-chow at md.northwestern.edu
Fri Sep 23 15:57:06 GMT 2005

check out the posting at SANS-ISC that may relate (it refers to AP 
networks, but who knows the activity of this yet to be identified 
pathogen -- could be also making its own adhoc networks to spread under 
the radar and avoid IDS systems


about 3/4 of the way down the page under the heading "Wi-Fi Worm Rumors"

speculation as of yet. they are awaiting packet captures and binaries. 
might be a good idea to contact a handler if this seems rampant on your 

Christopher Chow
c-chow at md.northwestern.edu

Frank Sweetser wrote:
> As all of the students wander onto campus this year, we've been noticing that a
> lot of them have common ad-hoc SSIDs configured as a preferred network.  So
> far, none of them admit to having any idea how those networks got configured or
> where they came from.  While it's quite possible that the users told Windows to
> connect without realizing or just without remembering, this has made me
> curious.
> Does anyone know of any circumstances under which an XP system might attempt to
> connect to a previously unconfigured ad-hoc SSID without any user interaction?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 5337 bytes
Desc: S/MIME Cryptographic Signature
Url : http://www.dshield.org/pipermail/unisog/attachments/20050923/3897afbe/smime.bin

More information about the unisog mailing list