Re: msblast DDos counter measures (More Insight Maybe?)

[Vladimir Parkhaev <vladimir () arobas net>]

Quoting Christopher Lyon (cslyon () netsvcs com):
> OK,
> Sorry that I didn't see that before but I see it now. Thanks.


It is allright. I liked the idea of playing with DNS to avoid the DOS myself...
Looks like m$ killed windowsupdate.com and there will be no dDOS (booooring:)

Here is what Len forwarded to me, it was send to nanog:


----- Forwarded message from "Ingevaldson, Dan (ISS Atlanta)" <dsi () iss net> -----

Delivered-To: nanog-outgoing () trapdoor merit edu
Delivered-To: nanog () trapdoor merit edu
Delivered-To: nanog () merit edu
X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
Subject: RE: microsoft.com - what happens when there is no DNS record
Date: Fri, 15 Aug 2003 11:14:03 -0400
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: microsoft.com - what happens when there is no DNS record
Thread-Index: AcNjOP7QgiIqaiAWTHWs68yAsjZQywAACeZgAAGGo0A=
From: "Ingevaldson, Dan (ISS Atlanta)" <dsi () iss net>
To: "McBurnett, Jim" <jmcburnett () msmgmt com>, <Patrick_McAllister () WASHGAS COM>,
   "Robbie Foust" <rfoust () duke edu>
Cc: "Bryan Heitman" <bryan () bryanheitman com>, <nanog () merit edu>,
   <owner-nanog () merit edu>, "Chris Horry" <zerbey () wibble co uk>
X-OriginalArrivalTime: 15 Aug 2003 15:14:06.0749 (UTC) FILETIME=[DEBC7CD0:01C3633F]
Precedence: bulk
Errors-To: owner-nanog-outgoing () merit edu
X-Loop: nanog
X-MIME-Autoconverted: from quoted-printable to 8bit by netsys.com id h7FFGiQ23485


Our assessment of worm's behavior is below:

If windowsupdate.com fails to resolve, it will return a -1, which is not
interpreted because this routine has no error checking.  The worm then
attempts to send its SYN packets to 255.255.255.255, which may have done
some interesting things, but it looks like the Windows raw socket
implementation won't let that packet out.  So basically, nothing
happens.  

There might be some issues with cached DNS, but besides that it looks
like the majority of the infections won't be doing much of anything
besides eating CPU cycles on the infected hosts.

Regards,
===============================
Daniel Ingevaldson
Engineering Manager, X-Force R&D
dsi () iss net 
404-236-3160
 
Internet Security Systems, Inc.
The Power to Protect
http://www.iss.net 
===============================
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html