Re: Sasser skips 10.x.x.x Why?

[Joe Stewart <jstewart () lurhq com>]

On Monday 03 May 2004 3:44 pm, Eric Chien wrote:
> Actually, it is all variants (.A - .D).  And more
> specifically, it iterates through all the host IP
> addresses looking for an address that does not match:
> 127.0.0.1
> 10.
> 172.16 - 172.31 (inclusive)
> 192.168.
> 169.254
>
> Then, using this address it creates a random address
> (sometimes changing all octets, sometimes just the
> last three, and sometimes just the last two).

That's not exactly how it works. It loops through every address returned 
by gethostbyname for the local hostname. It will prefer a non-RFC1918 
address, but if none are found it will use whatever address it finds. 
If no address is returned it will use 127.0.0.1. So, yes, it does scan 
and infect private network ranges.
 
-Joe

-- 
Joe Stewart, GCIH 
Senior Security Researcher
LURHQ http://www.lurhq.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html