The increased traffic is the effect of ICMP being used which does less handshaking than SYN packets. So, Nachi ends up sending more probes/attacks in a specified amount of time. -----Original Message----- From: Kuo, Jimmy [mailto:Jimmy_Kuo@private] Sent: Monday, August 18, 2003 10:37 AM To: 'crime@private ' Subject: CRIME New version of similar attack going on http://vil.nai.com/vil/content/v_100559.htm We're calling it Nachi. It looks like it's creating far more traffic, possibly because it's smaller. And the traffic itself is the problem this time. The target circumstances are exactly the same as Blaster. Note, the effect from what it's trying to do (clean up Blaster) is ineffective. It does not patch the hole correctly (or so we're told by MS). But, if you do get infections and see that it does patch correctly, please tell me your circumstances. Jimmy
This archive was generated by hypermail 2b30 : Mon Aug 18 2003 - 15:01:07 PDT