Re: new round of nimda on 9/28

["Jim Franz" <franz400@xxxxxxxxxxxx>]

> Are you participating in the DShield.org stuff from them ?
no - haven't signed up yet for DShield (you allow intrusion detection
software to be
installed in your network, to feed info back to incidents.org so they can
create
"global analysis" of what's going on).
I check www.incidents.org every morning & use it and www.sans.org reading
room
as resource pages to understand these exploits. Have been sending the NT
techs there
also (because they had no clue except "call Norton").
For those of you with network security responsibility, the reading room at
sans.org is
very helpful.
jim franz

----- Original Message -----
From: "Chuck Lewis" <clewis@iquest.net>
To: <midrange-l@midrange.com>
Sent: Friday, September 28, 2001 8:57 AM
Subject: Re: new round of nimda on 9/28


> Jim,
>
> Are you participating in the DShield.org stuff from them ? I'm green in
this
> stuff, but it appears that it could be something we should ALL be
participating
> and taking advantage of (?).
>
> Yes/No ?
>
> Thanks,
>
> Chuck
>
> Jim Franz wrote:
>
> > www.incidents.org has posted a new Nimda document (9/27), with much more
> > detail.
> > Also a warning that reports indicate the slowdown of activity was
planned
> > and will wake up every 10 days (Sept 28-Friday!!)
> > The document has several steps to verify a system is prepared or not
already
> > comprimised.
> >
> > Also the readme.exe has been found in spoofed emails from Microsoft.com
&
> > others.
> > jim franz
> >
> > _______________________________________________
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> > To post a message email: MIDRANGE-L@midrange.com
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> > or email: MIDRANGE-L-request@midrange.com
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/midrange-l.
>
> _______________________________________________
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
> To post a message email: MIDRANGE-L@midrange.com
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/cgi-bin/listinfo/midrange-l
> or email: MIDRANGE-L-request@midrange.com
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>