The Big Dig
January 2004. Email subjects alternate between test, hello, and Mail Delivery System. The attachment is a scrap of shrapnel, and it opens outbound TCP 3127 on millions of desktops.
Briefing
This reconstruction reads like 2004 help-desk radio. The worm mailed copies of itself and opened a listener designers used as a staged DDoS platform against SCO Group's site, history you can quote in the debrief, not execute here.
Your role
NOC analyst during the week Mydoom's SMTP traffic dwarfed legitimate mail at several universities.
Objective
Probe the Mydoom backdoor port from the NOC jump box, then read the CERT note and the deferred mail sample.
Terminal environment
- user
- noc
- host
- mx-ord-west
- cwd
- /var/spool/sohokiller-watch
- steps
- 5
Safety note. This is a safe reconstruction. All systems, files, hosts, credentials, and outputs are simulated. Do not use these techniques on systems you do not own or have explicit permission to test.