analysis of the Witty worm
Steven M. Bellovin
smb at cs.columbia.edu
Fri Jun 10 20:26:10 EDT 2005
In message <Pine.SOL.4.61.0506101841300.8962 at frame>, Jerrold Leichter writes:
>| | The paper itself (there's a link in the article) has several more items
>| | of interest to this list. Especially interesting is the effective
>| | cryptanalysis of the PRNG used by the worm. Implicit in many of the
>| | analyses, though not a focus of the paper, is the amount of information
>| | that the authors could gather about network configurations at different
>| | sites: as we all know, traffic analysis is a powerful technique.
>| The links in the paper no longer work - they go to restricted pages. The
>| (or an) HTML version is in the Google cache at:
>|
>| http://64.233.161.104/search?q=cache:oS94i-ojvIgJ:www.cc.gatech.edu/~akumar/
>witty.html+witty+worm+analysis+paxson&hl=en&start=1
>Oops. I should have read it more closely first. The only thing in Google's
>cache is the intro page, with an abstract. The paper (pdf and ps) and a slide
>
>show are inaccessible, and are not in Google's cache.
>
>Anyone saved a copy?
It's on Vern's web page:
http://www.icir.org/vern/papers/witty-draft.pdf or
http://www.icir.org/vern/papers/witty-draft.ps
--Steven M. Bellovin, http://www.cs.columbia.edu/~smb
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com
More information about the cryptography
mailing list