Quoting Christopher Lyon ([EMAIL PROTECTED]): > > OK, > Sorry that I didn't see that before but I see it now. Thanks. >
It is allright. I liked the idea of playing with DNS to avoid the DOS myself... Looks like m$ killed windowsupdate.com and there will be no dDOS (booooring:) Here is what Len forwarded to me, it was send to nanog: ----- Forwarded message from "Ingevaldson, Dan (ISS Atlanta)" <[EMAIL PROTECTED]> ----- Delivered-To: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED] Delivered-To: [EMAIL PROTECTED] X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0 Subject: RE: microsoft.com - what happens when there is no DNS record Date: Fri, 15 Aug 2003 11:14:03 -0400 X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: microsoft.com - what happens when there is no DNS record Thread-Index: AcNjOP7QgiIqaiAWTHWs68yAsjZQywAACeZgAAGGo0A= From: "Ingevaldson, Dan (ISS Atlanta)" <[EMAIL PROTECTED]> To: "McBurnett, Jim" <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, "Robbie Foust" <[EMAIL PROTECTED]> Cc: "Bryan Heitman" <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, <[EMAIL PROTECTED]>, "Chris Horry" <[EMAIL PROTECTED]> X-OriginalArrivalTime: 15 Aug 2003 15:14:06.0749 (UTC) FILETIME=[DEBC7CD0:01C3633F] Precedence: bulk Errors-To: [EMAIL PROTECTED] X-Loop: nanog X-MIME-Autoconverted: from quoted-printable to 8bit by netsys.com id h7FFGiQ23485 Our assessment of worm's behavior is below: If windowsupdate.com fails to resolve, it will return a -1, which is not interpreted because this routine has no error checking. The worm then attempts to send its SYN packets to 255.255.255.255, which may have done some interesting things, but it looks like the Windows raw socket implementation won't let that packet out. So basically, nothing happens. There might be some issues with cached DNS, but besides that it looks like the majority of the infections won't be doing much of anything besides eating CPU cycles on the infected hosts. Regards, =============================== Daniel Ingevaldson Engineering Manager, X-Force R&D [EMAIL PROTECTED] 404-236-3160 Internet Security Systems, Inc. The Power to Protect http://www.iss.net =============================== _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html