Merit Network
Can't find what you're looking for? Search the Mail Archives.
  About Merit   Services   Network   Resources & Support   Network Research   News   Events   Home

Discussion Communities: Merit Network Email List Archives

North American Network Operators Group

Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: UDP port 4000 traffic: likely a new worm

  • From: Josh Richards
  • Date: Sat Mar 20 14:12:16 2004

Confirmed.  We had our first customer (colo) hit yesterday evening at 
20:43 PST.  Additionally, they experienced the hard drive corruption (which
was added to the ISC diary entry within the last several hours).  Traffic 
was 4000/udp.  Initial 90 Mbit/s peak which leveled out at a constant
60 Mbit/s before we took them off-line.

-jr

* Johannes B. Ullrich <jullrich@sans.org> [20040320 00:44]:
> Looks like there may be a worm going around hitting systems that run
> BlackIce. Common characteristics of the packets: Source port 4000 (but
> random target port) and the string 
> "insert witty message here".
> 
> details will be posted here:
> http://isc.sans.org/diary.html
> as I get them together.



-- 
Josh Richards            | Colocation   Web Hosting   Bandwidth
Digital West Networks    | +1 805 781-9378 / www.digitalwest.net
San Luis Obispo, CA      | AS14589 & AS29962
jrichard@digitalwest.net | DWNI - Making Internet Business Better




Discussion Communities


About Merit | Services | Network | Resources & Support | Network Research
News | Events | Contact | Site Map | Merit Network Home


Merit Network, Inc.