Re: [Full-Disclosure] msblast is starting now

2003-08-15 Thread Vladimir Parkhaev
Quoting B3r3n ([EMAIL PROTECTED]): msblast start now on far eastern countries. We have a site in Auckland and so I'll know soon if our DNS to localhost protection is valuable. it is not. if you have infected boxes, you will have RST attack on your own nw. don't you get it?

Re: [Full-Disclosure] msblast is starting now

2003-08-15 Thread Jonathan Rickman
On Friday 15 August 2003 07:03, B3r3n wrote: msblast start now on far eastern countries. We have a site in Auckland and so I'll know soon if our DNS to localhost protection is valuable. It is irrelevant now. MS has removed the DNS entries for windowsupdate.com. -- Jonathan Rickman X Corps

Re: [Full-Disclosure] msblast is starting now

2003-08-15 Thread Bernie, CTA
Now I don't think that was such a smart move. It wouldn't take much to setup a bunch of bogus DNS servers to answer as windowsupdate.com with a pointer to a new A record, or better yet, round-robin to an infinite number of FQDN, or IP addresses. In fact, a new variant placed on compromised

Re: [Full-Disclosure] msblast is starting now

2003-08-15 Thread Bernie, CTA
On 15 Aug 2003 at 12:05, Jonathan Rickman wrote: On Friday 15 August 2003 07:03, B3r3n wrote: msblast start now on far eastern countries. We have a site in Auckland and so I'll know soon if our DNS to localhost protection is valuable. It is irrelevant now. MS has removed the DNS entries