full-disclosure - DDos counter measures

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3F3CC080.13936.59D7D157@localhost>
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: DDos counter measures

Laurent LEVIER <llevier@...osnet.com> wrote:

> We found a simple solution to protect our IntraNet against the DDoS.

"simple" -- yes.

"solution" -- ???

> Since the msblast.exe will SYN flood windowsupdate.com (or 
> windowsupdate.microsoft.com) with 50 packets per second (according to our 
> tests).
> 
> Since our IntraNet solves all its DNS queries through internal caches 
> (mandatory bottleneck), we created windowsupdate.com & 
> windowsupdate.microsoft.com zones in this bottleneck DNS. These are 
> resolving to 127.0.0.1 with DNS wildcards.
> 
> After the Microsoft DNS TTL has expired (15 minutes is the worst TTL), we 
> got confirm all known windowsupdate domains hosts (www.windowsupdate.com, 
> windowsupdate.microsoft.com, v3.windowsupdate.microsoft.com & 
> v4.windowsupdate.microsoft.com) were resolved to localhost.
> 
> We expect now the worm to flood the box it is hosted on and so preserving 
> our IntraNet.
> 
> Hope this can help others.

This is moronic.

Unless you know of some variant the rest of us have not seen yet, the 
"Blaster" worm only attacks windowsupdate.com as resolved through the 
DNS.  Yes, normally plugging windowsupdate.com into your web browser 
redirects you to somewhere at windowsupdate.microsoft.com (which is 
probably a networkologically close Akamai box ??), but the worm simply 
does a DNS lookup for "windowsupdate.com".

Thus, blocking all those other domains is stupid, as those are needed 
for "normal" Windows Update to work (reputedly "windowsupdate.com" has 
not been used by the Windows Update tools for quite some time, if 
ever).

If network admins feel they really must do something like this, limit 
it to match the domains that the worm specifically asks the DNS to 
resolve.  To date (touch wood) that is "windowsupdate.com".

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854