full-disclosure - DDoS on the 16th - Fail if no DNS resolution?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <E989917C9FF25240A201E888E83DF32F7AA5A8@EXCHANGE5.corp.ptd.net>
From: keithp at corp.ptd.net (Keith Pachulski)
Subject: DDoS on the 16th - Fail if no DNS resolution?

if it is unable to resolve windowsupdate.com the DDOS part of the worm against microsoft ceases while the other scanning part continues in the background

-----Original Message-----
From: northern snowfall [mailto:dbailey27@...ritech.net]
Sent: Wednesday, August 13, 2003 10:10 PM
To: Jason Witty
Cc: full-disclosure@...ts.netsys.com
Subject: Re: [Full-Disclosure] DDoS on the 16th - Fail if no DNS
resolution?

> Has anyone tested this worm yet to see what it'll do if you set up an 
> internal DNS entry for windowsupdate.com to point to a black hole 
> address (127.0.0.1 for example) and then set the system clock to be 
> August 16th (this Saturday)?

Has anyone taken the time to read the assembly to see if
the worm exits if it can't find an IP? Rather than point
windowsupdate.com to 127.1, just force your dns to return
lookup failure.

If the worm sees an error when it performs a URL lookup,
maybe it dies. It wouldn't have *anything* to DoS.

Don

http://www.7f.no-ip.com/~north_

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html