The University’s internet connection was inoperable this morning from about 7 AM until about 10:30 AM. The problem was isolated to the PIX firewall. A number of logged outbound connection attemps (ca.<\/i> 97000) from forged class A source addresses to a destination in Northern California were discovered. The sheer number of such attempts constituted a denial of service situation for the firewall.<\/p>\n
The true source of the connection attempts was traced to a student computer in Todd\/Phibbs. The students network port was inactivated, and the firewall was rebooted. This restored internet service.
\n
\nThe student’s computer had been compromised by the installation of a version of the MyTunes application that had been infected by the W32\/Sdbot worm, although a complete analysis of the system was not possible because the student, upon notification, had deleted some components.<\/p>\n
The student’s computer, a Windows XP workstation, was patched with the latest MS Critical Updates, the existing misconfgured copy of Norton AV was disabled, and McAfee VirusScan 7 was installed and updated to the latest DAT and engine update.<\/p>\n
The student was advised not to install MyTues again.<\/p>\n","protected":false},"excerpt":{"rendered":"
The University’s internet connection was inoperable this morning from about 7 AM until about 10:30 AM. The problem was isolated to the PIX firewall. A number of logged outbound connection attemps (ca. 97000) from forged class A source addresses to … Continue reading