I've seen various references to this worm firing off and saturating
networks worldwide within 1 minute... if *that* isn't scary, I don't know
what is. It shows that someone, with the right tools and enough vulnerable
servers can take out a good portion of the Internet in seconds. And how
can we predict *every* possible issue and block it?
The good news with this worm was that the ports it used had low real utility
for inter-provider traffic. Compare and contrast to Code Red, where "block
TCP port 80" isn't such a great way to slow down the worm if you have any
customers who like to use "the web"
A combination of the speed at which this spread and a port nobody wants to
block will undoubtedly happen in the future, and be ugly, both.
Matthew Kaufman
matthew@eeph.com (home)
mkaufman@dsl.net (work)