full-disclosure - DDoS on the 16th - Fail if no DNS resolution?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <NHECKAGIIGOLMOGPKBOOKEOCCHAA.dsoeder@eeye.com>
From: dsoeder at eeye.com (Derek Soeder)
Subject: DDoS on the 16th - Fail if no DNS resolution?

Hi Darren,

MSBlaster calls the API function GetDateFormat(), which uses the current
local time (what you see on the system tray clock), to get the month and day
when it starts executing.

So like you mentioned in your last post, starting at noon GMT on the 15th
(midnight of the 16th just to the west of the International Date Line, for
anyone there observing Daylight Savings Time anyway), one new slice of the
earth at a time is going to light up each hour and start participating in
the SYN flood.  Kind of a weird mental picture, huh?

Well, to be technical, only the machines that get freshly infected or
rebooted after the date changes in their time zone are going to start
spewing SYNs.  The rest will still be churning away in the infinite
propagation loop.

-- Derek

> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com
> [mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Darren Reed
> Sent: Wednesday, August 13, 2003 6:17 PM
> To: Jason Witty
> Cc: Full-Disclosure@...ts.netsys.com
> Subject: Re: [Full-Disclosure] DDoS on the 16th - Fail if no DNS
> resolution?
>
>
> In some mail from Jason Witty, sie said:
> >
> > All,
> >
> > Has anyone tested this worm yet to see what it'll do if you set up an
> > internal DNS entry for windowsupdate.com to point to a black
> hole address
> > (127.0.0.1 for example) and then set the system clock to be August 16th
> > (this Saturday)?
>
> Just to flip back to the 15th/16th thing, the significant thing here is
> if it is using localtime vs GMT time then it will be the 16th in some
> parts of the world before others...eg the West coast of USA is 7 hours
> ahead of the East coast of Australia, but a day behind, so come 00:01
> Saturday the 16th in Australia, it'll be 7:01am in Seattle on Friday the
> 15th...
>
> Darren
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>