Full Disclosure mailing list archives
RE: DDoS on the 16th - Fail if no DNS resolution?
From: "Derek Soeder" <dsoeder () eeye com>
Date: Wed, 13 Aug 2003 20:20:30 -0700
Hi Darren, MSBlaster calls the API function GetDateFormat(), which uses the current local time (what you see on the system tray clock), to get the month and day when it starts executing. So like you mentioned in your last post, starting at noon GMT on the 15th (midnight of the 16th just to the west of the International Date Line, for anyone there observing Daylight Savings Time anyway), one new slice of the earth at a time is going to light up each hour and start participating in the SYN flood. Kind of a weird mental picture, huh? Well, to be technical, only the machines that get freshly infected or rebooted after the date changes in their time zone are going to start spewing SYNs. The rest will still be churning away in the infinite propagation loop. -- Derek
-----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com]On Behalf Of Darren Reed Sent: Wednesday, August 13, 2003 6:17 PM To: Jason Witty Cc: Full-Disclosure () lists netsys com Subject: Re: [Full-disclosure] DDoS on the 16th - Fail if no DNS resolution? In some mail from Jason Witty, sie said:All, Has anyone tested this worm yet to see what it'll do if you set up an internal DNS entry for windowsupdate.com to point to a blackhole address(127.0.0.1 for example) and then set the system clock to be August 16th (this Saturday)?Just to flip back to the 15th/16th thing, the significant thing here is if it is using localtime vs GMT time then it will be the 16th in some parts of the world before others...eg the West coast of USA is 7 hours ahead of the East coast of Australia, but a day behind, so come 00:01 Saturday the 16th in Australia, it'll be 7:01am in Seattle on Friday the 15th... Darren _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- DDoS on the 16th - Fail if no DNS resolution? Jason Witty (Aug 13)
- Re: DDoS on the 16th - Fail if no DNS resolution? northern snowfall (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? gml (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? Chris Eagle (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? Nick FitzGerald (Aug 13)
- Re: DDoS on the 16th - Fail if no DNS resolution? northern snowfall (Aug 13)
- Re: DDoS on the 16th - Fail if no DNS resolution? Darren Reed (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? Chris Eagle (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? Derek Soeder (Aug 14)
- Re: DDoS on the 16th - Fail if no DNS resolution? Laurent LEVIER (Aug 14)
- <Possible follow-ups>
- RE: DDoS on the 16th - Fail if no DNS resolution? Keith Pachulski (Aug 14)
- Re: DDoS on the 16th - Fail if no DNS resolution? northern snowfall (Aug 13)