Gadi, Please take a few moments to reflect on:
http://www.nanog.org/endsystem.html I'd appreciate it if you'd try and keep future off-topic postings like this to a minimum, as it makes the list difficult to wade through to get to what matters. Regards, Paul (not currently MLC, though I promise to put you in your place once the SC affords me the privlege :) On Thu, Aug 7, 2008 at 12:44 AM, Gadi Evron <[EMAIL PROTECTED]> wrote: > Hi all. You may want to be ready for a *possible* support lines flood today. > > Yesterday I discovered a fast-spreading facebook worm. It spreads by sending > messages to all your facebook friends, from your account, asking them to > click on a link in the .pl ccTLD. > > This worm is somewhat similar to zlob, here is a link to a kaspersky paper > on a previous iteration of it, they call it koobface: > http://www.kaspersky.com/news?id=207575670 > > The worm collects spam subject lines from, and then sends the users personal > data to the following C&C: > zzzping.com > > I spoke with DirectNIC last night and the Registrar Operations (reg-ops) > mailing list was updated that the domain is no longer reachable. That was > very fast response time from DirectNIC, which we appreciate. > > The worm is still fast-spreading, watch the statistics as they fly: > http://www.d9.pl/system/stats.php > > The facebook security team is working on this, and they are quite capable. > The security operations community has been doing analysis and take-downs, > but the worm seems to still be spreading. > > All anti virus vendors have been notified, and detection (if not removal) > should be added within a few hours to a few days. > > For now, while users may get infected, their information is safe (unless the > worm has a secondary contact C&C which I have not verified yet). > > It seems like some users may have learned not to click on links in email, > but any other medium does not compute. > > Gadi. > >
