for those of you who have asked: the presentation i gave at CanSecWest is a preliminary dump of the data we'll be presenting at the FIRST conference next month. both the presentation and the updated research report will be made available from the Arbor website at that time. we will NOT, however, be publishing a comprehensive list of infected IPs (we have over 5 million of them, since September 2001). here are the reasons why: 1. such a list would be useless to the general public. NOBODY in their right mind would try to block all the individual IPs in such a list, for they change far too much, and are far too widely distributed to effect useful filters. these worm infection attempts are more of a nuisance than a threat to sites that would actually block them, anyway - so the ORBS/RBL analogy is pretty weak. 2. such a list would only benefit remote attackers. because Nimda is fairly localized (it only attempts a completely random jump 1/4 of the time), many of its infected hosts are actually out of the purview of many attackers (at least, those that aren't on cable modems themselves in 24/8). by publishing a list of Nimda hits you've seen, you're basically handing out a map of the vulnerable houses in your own neighborhood, inviting trouble (do you really want your local bandwidth to be wasted on massive DDoS floods?). 3. to clean things up, we (as a community) need to act in a coordinated fashion. if you have your own lists of infected hosts, please, send them to your local CERT to deal with. why bother with tracking down contacts for thousands of IPs yourself? let someone else deal with the bureaucracy, that's what they're there for. think community police, not lynch mob. :-) -d. --- http://www.monkey.org/~dugsong/
This archive was generated by hypermail 2b30 : Wed May 08 2002 - 18:38:38 PDT