--- Hoho <[EMAIL PROTECTED]> wrote: > On Fri, 2003-10-17 at 22:44, jkm wrote: > > Quote 2: > > "AT&T saw anomalies in its network three to four > weeks before that worm > > hit and was able to take certain precautions. > "When the worm actually > > happened, AT&T's network did not take a hit,'' > Eslambolchi said." > > > Doesn't it seem like they're trying to violate > causality? If the worm > doesn't exist yet, then its associated traffic > doesn't exist yet, hence > there's nothing to detect.
...unless they had insider information that a worm that exploits certain "anomalies" would be released in "three to four weeks" :). I didn't see the original article but maybe they are referring to the DCOM worm brigade which was anticipated and awaited weeks before it hit. -- S.G.Masood Hyderabad, India. __________________________________ Do you Yahoo!? The New Yahoo! Shopping - with improved product search http://shopping.yahoo.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
