The Big Dig
January 2004. Email subjects alternate between test, hello, and Mail Delivery System. The attachment is a scrap of shrapnel, and it opens outbound TCP 3127 on millions of desktops.
Briefing
This reconstruction reads like 2004 help-desk radio. The worm mailed copies of itself and opened a listener designers used as a staged DDoS platform against SCO Group's site, history you can quote in the debrief, not execute here.
Your role
NOC analyst during the week Mydoom's SMTP traffic dwarfed legitimate mail at several universities.
Objective
From queue dumps and a stub CERT-style note, characterise the mail + backdoor footprint without touching live binaries.
Terminal environment
- user
- noc
- host
- mx-ord-west
- cwd
- /var/spool/sohokiller-watch
- steps
- 3
Safety note. This is a safe reconstruction. All systems, files, hosts, credentials, and outputs are simulated. Do not use these techniques on systems you do not own or have explicit permission to test.