thursley
Joined 17 years ago
Karma
93
Submissions
8
Member since
Jan 22
Recent submissions
Comment · 2 years ago
In my experience this can be caused by a loadbalancer, for example not being able to route (properly) to servers in the pool or a difference in configuration/patch-level between them.
Comment · 12 years ago
Snort IDS rules to detect abuse can be found here:
http://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-liv...
Comment · 13 years ago
Writeup of the network monitoring service that discovered the infection: http://blog.fox-it.com/2013/02/21/writeup-on-nbc-com-distrib...
Comment · 14 years ago
This was/is an infamous modem vulnerability:
http://www.securityspace.com/smysecure/catid.html?id=10020
It could force a modem to hangup and redial a number.
Comment · 14 years ago
More technical details (pdf) on:
http://www.crysys.hu/skywiper/skywiper.pdf
Although the naming differs it has been noted on several blogs that it is the same malware.