full-disclosure - Windows Dcom Worm planned DDoS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <NDBBKKOCALIBPMFFNMEMAELGEIAA.cseagle@redshift.com>
From: cseagle at redshift.com (Chris Eagle)
Subject: Windows Dcom Worm planned DDoS

The code it uses to launch the DDoS looks like this:

   GetDateFormat(LANG_USER_DEFAULT, 0, NULL, "d", day, 3);
   GetDateFormat(LANG_USER_DEFAULT, 0, NULL, "M", mon, 3);
   if (atoi(day) > 15 || atoi(mon) > 8) {
      CreateThread(NULL, 0, SynFlood, NULL, 0, &temp);
   }

It only performs this test on startup, so if it happens to be running on a
machine on 8/14, it will not start a DDoS from that machine until the
machine is rebooted.

Chris

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Szappanos
G?bor (VBuster)
Sent: Tuesday, August 12, 2003 6:26 AM
To: Andrew Thomas; nick@...us-l.demon.co.uk;
full-disclosure@...ts.netsys.com
Subject: RE: [Full-Disclosure] Windows Dcom Worm planned DDoS

> > The examinations of the code so far indicate that the worm is
> > coded to DoS the windowsupdate site from the 15th of August
> > onwards through the end of the year.
>
> I'll ignore the sloppiness in that description, as several of the
> published descriptions have (or at least initially got) it confused
> through slightly wrong too...

>The examinations of the code *that I have read so far* indicate
>that...?

... the Dos takes place any month it the day is after the 15th, or any day
if the month is after August. So starting from August 15th it wil DoS
windowsupdate.com to the end of the year, but the attack is possible in
earlier months as well. And it will not stop at the end of the year, just
gets paused for 15 days.

Regards,
Gabor Szappanos
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html