full-disclosure - Sasser skips 10.x.x.x Why?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200405031724.30592.jstewart@lurhq.com>
From: jstewart at lurhq.com (Joe Stewart)
Subject: Sasser skips 10.x.x.x Why?

On Monday 03 May 2004 3:44 pm, Eric Chien wrote:
> Actually, it is all variants (.A - .D).  And more
> specifically, it iterates through all the host IP
> addresses looking for an address that does not match:
> 127.0.0.1
> 10.
> 172.16 - 172.31 (inclusive)
> 192.168.
> 169.254
>
> Then, using this address it creates a random address
> (sometimes changing all octets, sometimes just the
> last three, and sometimes just the last two).

That's not exactly how it works. It loops through every address returned 
by gethostbyname for the local hostname. It will prefer a non-RFC1918 
address, but if none are found it will use whatever address it finds. 
If no address is returned it will use 127.0.0.1. So, yes, it does scan 
and infect private network ranges.

-Joe

-- 
Joe Stewart, GCIH 
Senior Security Researcher
LURHQ http://www.lurhq.com/