Projects / Worm Warner / Releases

All releases of Worm Warner

  •  03 May 2004 21:25
Avatar

    Release Notes: A test mode and the option to specify the mail server to use were added. This release also limits the size of an email message when the included log files make it to large. The patterns to detect a worm are now stored in a file, which makes it easier to add patterns. Some new patterns were added.

    •  17 Jul 2003 18:23
    Avatar

      Release Notes: The scripts now use a GDBM database to keep statistics about the warnings that were sent. This database is also used for rate control to avoid sending too many warnings for the same IP. The ATD-Mass exploiter was added to the recognized attacks. The IP and timezone of the host which runs the script are included in messages to the ISP. Some small bugs were fixed.

      •  29 Apr 2003 17:41
      Avatar

        Release Notes: A conflict with newer versions of the Mail::Sender module was fixed. A bug which caused wormwarner not to log for some specific email server problems was fixed.

        •  26 Apr 2003 16:44
        Avatar

          Release Notes: Wormwarner now runs as a daemon which lets it respond within minutes after an infection attempt. The abuse.net database is queried before starting whois queries to find the email address of the ISP to warn. Code cleanups were also made.

          •  18 Jan 2003 11:02
          Avatar

            Release Notes: This release features improved whois lookup functionality, and can now execute commands (which could be used to modify adaptive firewalls).

            •  09 Jan 2003 12:31
            Avatar

              Release Notes: warnisp.pl has now the --attack option which will report scans with sfind.exe to the ISP of the scanning host. The SSL log file is no longer used. The whois lookup function was improved. There are also some bugfixes.

              •  31 Dec 2002 13:49
              Avatar

                Release Notes: A script which parses the log file of wormwarner to warn the ISPs of the hosts that could not be reached was added. Support for the sadmin worm was added. The Scalper worm is now recognized by parsing the error log, and is no longer mentioned as the FreeBSD Scalper worm, but just as the Scalper worm. The logline is now added to the logfile for the warnisp.pl script.

                •  09 Dec 2002 21:34
                Avatar

                  Release Notes: The documentation was improved. Some command line features were added, and the program now uses a configuration file. Some minor bugs were fixed.

                  •  10 Nov 2002 11:21
                  Avatar

                    Release Notes: Some Apache servers write the date as [9/Nov/2002 instead of [09/Nov/2002. The script is now able to recognize this date format.

                    •  07 Oct 2002 16:01
                    Avatar

                      Release Notes: The Linux Slapper worm is now detected by parsing the Error log file instead of the ssl log file. This should improve recognition.

                      Screenshot

                      Project Spotlight

                      episoder

                      A tool to tell you about new episodes of your favourite TV shows.

                      Screenshot

                      Project Spotlight

                      BalanceNG

                      A modern software IP load balancer.