Wednesday, November 09, 2005

XML RPC worm - New Variant - ELF_LUPPER.B,:

(Via SANS Internet Storm Center, InfoCON: green.)

Apparently this worm is no big deal!
I can't say that it's the most elegant worm ever, it's certainly not the fastest spreading, and I suspect that it is one of the easier ones for the Internet-Powers-That-Be to stop spreading completely -- turn off the IP address that the worm is downloading its code from. Sure, we end up with a cycle where the author moves to another IP and re-releases the worm. But eventually even the most stubborn virus author will get bored with that game.