> THIS IS AN INCREDIBLE GROUP !!!!!!!!! > DECLUDE IS AN INCREDIBLE PRODUCT !!!!!!! > KUDUS to you Scott. > Grateful THANKS to all the members who contributed yesterday !
Agreed! My users were protected even before receiving the updated DAT's due to banning the .pif's.
HERE HERE!
Thanks in large part to Declude we have had NO incursions of Sobig in the networks we manage! Hats Off!
> Blocking the port kept a PC somewhere in our network > from doing any damage. It made over 1200 attempts to > contact a server outside our network in the first hour. > We will hunt it down and make sure it gets cleaned up.
I've had only one user that attempted to make a request on UDP 8998. They were contacted immediately and taken care of. Interestingly enough, this user utilized the mail services of a different, and obviously unprotected system.
But now, one must wonder... what's next?
For a long time now we've had a "Black First" policy on all of our networks, further reinforced yesterday when we temporarily restricted outbound traffic to ONLY port 80 & 443 for all workstations (no IM, no music, nada - you can imagine the moaning that resulted from that).
We've got a lot of fire power invested in detecting and rejecting trouble from "the wild wired world"... but nobody can completely cure a DoS, or worse - something completely new... Sobig is definitely a scary customer... not as bad as it could be (I dare not speak of the full blown CCA type attacks we've simulated in our R&D)... but this one sure has us _AWAKE_ ...
_M
(CCA = Coordinated Cellular Automata. We develop self-supporting distributed systems so we have to play white-hat/black-hat games to ensure the designs are as secure as we can make them... This issue of Sobig is only a few critical pieces shy of being apocalyptically scary.)
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
