The 55808 Phenomenon

Published by

Apparently the internet currently suffers from a new species of 'virus' infection. Various security firms including Intrusec, Lancope and ISS have already issued warnings that this "attack" is of grander magnitude than experienced as of yet. Funny enough is that we have received mail from our ad content providers that their servers suffer from heavy DOS attacks. The mentioned security firms have not yet concluded if the threat to face is a trojan, a worm or maybe even a backdoor. The program or phenomenon was detected through rising net utilization where sent TCP packets had the Window Size of 55808. The "trojan" apparently made its first appearance around May 16 and began randomly scanning Internet-connected machines. The scanning was slow at first but has begun to pick up speed in recent days as more machines have become infected. Researchers at Internet Security Systems Inc. in Atlanta have been seeing nearly 3,000 scans an hour on Tuesday across the entire address space that the company monitors.