full-disclosure - msblast DDos counter measures

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5.2.1.1.2.20030814200948.01e71130@wheresmymailserver.com>
From: B3r3n at argosnet.com (B3r3n)
Subject: msblast DDos counter measures

All,

We found a simple solution to protect our IntraNet against the DDoS.

Since the msblast.exe will SYN flood windowsupdate.com (or 
windowsupdate.microsoft.com) with 50 packets per second (according to our 
tests).

Since our IntraNet solves all its DNS queries through internal caches 
(mandatory bottleneck), we created windowsupdate.com & 
windowsupdate.microsoft.com zones in this bottleneck DNS. These are 
resolving to 127.0.0.1 with DNS wildcards.

After the Microsoft DNS TTL has expired (15 minutes is the worst TTL), we 
got confirm all known windowsupdate domains hosts (www.windowsupdate.com, 
windowsupdate.microsoft.com, v3.windowsupdate.microsoft.com & 
v4.windowsupdate.microsoft.com) were resolved to localhost.

We expect now the worm to flood the box it is hosted on and so preserving 
our IntraNet.

Hope this can help others.

Brgrds

Laurent LEVIER
Equant Information Technology & Systems - Equant Security Organization - 
Internal Network (WAN IntraNet) - Systems & Networks Security Expert
Tel. CVN : 7223-1912, ext. (+33) 4 92 38 19 12