full-disclosure - MSBlast DDoS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1060832602.2138.60.camel@syd0137.fujitsu.com.au>
From: kluge at fujitsu.com.au (Steffen Kluge)
Subject: MSBlast DDoS

On Thu, 2003-08-14 at 00:08, Benjamin M.A. Robson wrote:
> This is almost right.  The packets should go straight to the firewall 
> and out to the Internet, unless there is a device (such as the firewall 
> itself) performing some sort of NAT redirect for the purposes of a 
> transparent proxy.  If this is the case then the packets will be sent 
> via the proxy, and if they are not properly formed HTTP commands (GET, 
> HEAD, etc..) the proxy server should reject them as bogus.

According to eEye, the DOS attack is a SYN flood. Thus, it wouldn't even
get to the stage where HTTP is spoken. In a transparent proxy setup, the
proxy server will suffer the SYN flood and nothing will get out.

In a non-transparent proxy setup the proxy likely wouldn't see the
packets (since msblast.exe isn't looking for proxies). Hence it depends
on whether the Internet firewall mandates HTTP connections to be made
through a proxy, or whether it just allows anybody to make outbound
HTTP connections. In the former case, the firewall will drop the SYN's
(unless the proxy itself is infected), in the latter case you'll SYN
flood windowsupdate.com.

In short, it is a good idea to allow outbound HTTP connections from
proxy servers only (and always has been). It is an even better idea not
to run the proxies on top of Windows.

Cheers
Steffen.

-- 
Steffen Kluge				Tel: +61 2 9887 9449
Security Specialist			Mobile: 0413 486 390
Fujitsu Australia Ltd			Facsimile: +61 2 9887 9458
376 Lane Cove Rd			Email: steffen.kluge@...itsu.com.au
North Ryde NSW 2113			Website: www.fujitsu.com.au

This is an e-mail from Fujitsu Australia Ltd. It is confidential to the
ordinary user of the e-mail address to which it was addressed and may
contain copyright and/or legally privileged information. No one else may
read, print, store, copy or forward all or any of it or its attachments.
If you receive this e-mail in error, please return to sender. Thank you.

The recipient of this e-mail should be aware that this e-mail and any
attachments to it might not be free from viruses in their various forms.
Fujitsu Australia Ltd strongly recommends that the recipient uses
anti-virus software to screen all e-mails received externally.
Fujitsu does not accept any liability for any loss or damage that may
occur as a result of the transmission of this e-mail to the recipient.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030814/cfbf0839/attachment.bin