Jim Toole
Jim Toole
adapt assumed author came exploit less number people worm
Simple. A new vulnerability came out. The number of IIS 4 servers out there is a lot less than the number of IIS 5 servers. So when the IIS 5 vulnerability was announced, it made sense for the author to adapt his worm for that. People assumed it was a new exploit and it was not.
attacks exploit five four hour knew machines morning run seeing seen sunday trying worm
By then, we had already seen the worm about four times and we knew which five IP addresses it was going to go after first. By Sunday morning we were seeing 3200 attacks an hour from machines trying to run the exploit on our box. That's a lot of attacks.
gave happened heard time
Each time it happened we gave a heads-up to CIAC and the FBI. We never heard anything back. We just make the reports; what they do with the info after that is up to them.
dangerous hope severity situation understand
I hope they understand the severity of (of the violations). This is a very dangerous situation they are in.