full-disclosure - msblast DDos counter measures (More Insight Maybe?)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20030815182739.GA16895@arobas.net>
From: vladimir at arobas.net (Vladimir Parkhaev)
Subject: msblast DDos counter measures (More Insight Maybe?)

Quoting Christopher Lyon (cslyon@...svcs.com):
> 
> OK,
> Sorry that I didn't see that before but I see it now. Thanks.
> 

It is allright. I liked the idea of playing with DNS to avoid the DOS myself...
Looks like m$ killed windowsupdate.com and there will be no dDOS (booooring:)

Here is what Len forwarded to me, it was send to nanog:

----- Forwarded message from "Ingevaldson, Dan (ISS Atlanta)" <dsi@....net> -----

Delivered-To: nanog-outgoing@...pdoor.merit.edu
Delivered-To: nanog@...pdoor.merit.edu
Delivered-To: nanog@...it.edu
X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
Subject: RE: microsoft.com - what happens when there is no DNS record
Date: Fri, 15 Aug 2003 11:14:03 -0400
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: microsoft.com - what happens when there is no DNS record
Thread-Index: AcNjOP7QgiIqaiAWTHWs68yAsjZQywAACeZgAAGGo0A=
From: "Ingevaldson, Dan (ISS Atlanta)" <dsi@....net>
To: "McBurnett, Jim" <jmcburnett@...gmt.com>, <Patrick_McAllister@...HGAS.COM>,
   "Robbie Foust" <rfoust@...e.edu>
Cc: "Bryan Heitman" <bryan@...anheitman.com>, <nanog@...it.edu>,
   <owner-nanog@...it.edu>, "Chris Horry" <zerbey@...ble.co.uk>
X-OriginalArrivalTime: 15 Aug 2003 15:14:06.0749 (UTC) FILETIME=[DEBC7CD0:01C3633F]
Precedence: bulk
Errors-To: owner-nanog-outgoing@...it.edu
X-Loop: nanog
X-MIME-Autoconverted: from quoted-printable to 8bit by netsys.com id h7FFGiQ23485

Our assessment of worm's behavior is below:

If windowsupdate.com fails to resolve, it will return a -1, which is not
interpreted because this routine has no error checking.  The worm then
attempts to send its SYN packets to 255.255.255.255, which may have done
some interesting things, but it looks like the Windows raw socket
implementation won't let that packet out.  So basically, nothing
happens.  

There might be some issues with cached DNS, but besides that it looks
like the majority of the infections won't be doing much of anything
besides eating CPU cycles on the infected hosts.

Regards,
===============================
Daniel Ingevaldson
Engineering Manager, X-Force R&D
dsi@....net 
404-236-3160

Internet Security Systems, Inc.
The Power to Protect
http://www.iss.net 
===============================