Hard data on network impact of the "Code Red" worm?

Mailman List Mirror (Read Only)
1

> I would agree those people may have been severely affected. But 350,000
> hosts isn't that big of a number any more. The Morris Internet Worm

That's 350K hosts that got infected *that we know about*. I'd not be
surprised if a lot of other hosts got infected during the 9 hours CRv2
was on its burn stage that didn't happen to ping any of the sensor boxes
used to identify infected hosts.

Do "we" have any information how many out here at the edges (besides the.mil
folk) disconnected while the cleanup was going on?

We dint, but small pockets that we supply did.

Alos, is it possible that the critter got through firewalls and "did harm",
but could not get back out again? I don't know of any cases like that.

2

Do "we" have any information how many out here at the edges (besides the.mil
folk) disconnected while the cleanup was going on?

I know from a colleague who works there that a good many of the USGS.GOV systems were disconnected. --Steve

3

Of course you don't know of those cases - they didn't get back out. Of
course, all it takes is one site that says "OK, Fred needs to surf the
web for JUST A MOMENT" for it to escape again.

And I'm sure there's more than one site out there that doesn't realize
they've got a problem inside their firewall...