full-disclosure - Windows Dcom Worm planned DDoS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: liedekef at pandora.be (Franky Van Liedekerke)
Subject: Windows Dcom Worm planned DDoS

On Tue, 12 Aug 2003 15:14:56 +0200
"Andrew Thomas" <andrew@...erator.co.za> wrote:

> > From: Nick FitzGerald
> > Sent: 12 August 2003 01:48
> > Subject: Re: [Full-Disclosure] Windows Dcom Worm planned DDoS
> > 
> > 
> > "Andrew Thomas" <andrewt@....co.za> wrote:
> > 
> > > The examinations of the code so far indicate that the worm is
> > > coded to DoS the windowsupdate site from the 15th of August 
> > > onwards through the end of the year.
> > 
> > I'll ignore the sloppiness in that description, as several of the 
> > published descriptions have (or at least initially got) it confused 
> > through slightly wrong too...
> 
> The examinations of the code *that I have read so far* indicate 
> that...?
> 
> >And, of course, if MS started messing with the DNS entries for 
> >windowsupdate.com, it would be cutting an awful lot of users off from
> 
> >much needed updates. which could be as disturbing as the rest of the 
> >worm's effects...
> 
> Still leaving large organisations and smaller ISP's free to make
> the decision themselves on whether the loss of Windows update
> is more or less important than the prevention of the additional
> spurious traffic.
> 
> In countries/situations where bandwidth is paid for by traffic 
> transferred, and is often quite expensive, I suspect that more 
> decisions will be made to eliminate access to WindowsUpdate, 
> at least for a period of time, rather than paying for excess
> traffic generated. 
> 
> It's more than a matter of degraded service.

I guess everybody can implement SUSserver (www.susserver.com): it's a
local version of a windows update server.
If you implement this, you can allow only this server access to the
microsoft update sites, and let everybody else (from within the
ISP his network) connect to the local update server.
Then everybody still has access to the updates, while no excess traffix
to the internet is made.
Of course if you don't want your server to be DOS'sed ...

Franky