 SteveI know your IP addressConsultant
join:2001-03-10
Yorba Linda, CA
kudos:5 | reply to NetWatchMan
Re: mNW Alert: 'IraqWorm' propagating via tcp/445 This has been a fun collaboration.
Lawrence's great myNetWatchman service detected this, and he's been able to see how it's spreading. Philip and Lawrence did dynamic analysis on a running system and are now probably sick of packet traced. I've been doing static analysis of the binary, reverse engineering it back to C++. I'm still working on the fine points of the code, but we're sure we know exactly what this worm does.
Steve
--
Stephen J. Friedl • Security Consultant • Tustin, California USA • my web site |
