-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Jason wrote: > > Javier Fernandez-Sanguino wrote: > > [...] > >> >> [1] Approaching the record of worms in other OS, which, I >> believe, is held by Scalper (10 days from patch to worm). But >> hey, they could browse the source changes for that one. >> > > It did not attack an OS directly but I believe the witty worm [1] > holds the record to date. A 1 day window from advisory to release, > it attacked and destroyed a security component that was supposed to > protect against these issues...
You're right. I forgot about witty, I read CAIDA's analysis of the worm just yesterday.
Still, the infected population of witty was pretty small (I believe ~12,000 machines in a day?) compared to SQLexp (~200,000 [1]), Slammer (~75,000-100,000 [2]), CodeRed (~360,000 in 12 hours [3]), Nimda (around 1.6 times CodeRed, maybe over 500,000 systems? [4]). I don't find data for Blaster, but I presume it infected many more systems than Nimda. So I believe we might be facing a worm that will infect over 1,000,000 systems.
Probably anti-virus vendors will have more accurate data. But I haven't seen it, not even in Symantec's (excellent) Threat Report V (December 2003) [5]. In any case, this worm was "predicted" by that same report. I would like to suggest everyone to read it thouroughly (Disclaimer: I don't work at Symantec).
Regards
Javier
[1] http://securityresponse.symantec.com/avcenter/Analysis-SQLExp.pdf [2] http://www.caida.org/analysis/security/sapphire/ [3] http://www.caida.org/analysis/security/code-red/ [4] http://www.first.org/events/progconf/2002/d5-02-song-slides.pdf [5] http://enterprisesecurity.symantec.com/content.cfm?articleid=1539&EID= 0
-----BEGIN PGP SIGNATURE----- Version: PGP 8.0.3
iQA/AwUBQJdUO6O1I0N5hzVfEQI+agCg3bZ9mm3JdKZpb2EL/z7rqRtlYs8AoKT3 10ew7+BsihlP//bdpD06yTzJ =FCNK -----END PGP SIGNATURE-----
