Here's the latest on the Squid probe. It's been identified, isolated and
stopped for now. From the latest SANS newsletter:
In a fabulous example of networked community cooperation, more than 300
security practitioners isolated the behavior of the Internet-wide RingZero
Trojan proxy attack, found the Trojan, created defenses, and, as a
result, the Russian site that was using it to collect data shut down
and many sites improved their defenses against proxy attacks.
Congratulations to the 330 people who helped. The good guys won one!
See http://www.sans.org/newlook/resources/flashadv.htm for the latest
update. All this success flowed from Stephen Northcutt's note asking
about suspicious probes.
James Strompolis
Aleph Consultants, Inc.
[EMAIL PROTECTED], http://www.ribs.com
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
