Full Disclosure mailing list archives
Re: Windows Dcom Worm planned DDoS
From: Franky Van Liedekerke <liedekef () pandora be>
Date: Tue, 12 Aug 2003 15:40:05 +0200
On Tue, 12 Aug 2003 15:14:56 +0200 "Andrew Thomas" <andrew () generator co za> wrote:
From: Nick FitzGerald Sent: 12 August 2003 01:48 Subject: Re: [Full-disclosure] Windows Dcom Worm planned DDoS "Andrew Thomas" <andrewt () nmh co za> wrote:The examinations of the code so far indicate that the worm is coded to DoS the windowsupdate site from the 15th of August onwards through the end of the year.I'll ignore the sloppiness in that description, as several of the published descriptions have (or at least initially got) it confused through slightly wrong too...The examinations of the code *that I have read so far* indicate that...?And, of course, if MS started messing with the DNS entries for windowsupdate.com, it would be cutting an awful lot of users off frommuch needed updates. which could be as disturbing as the rest of the worm's effects...Still leaving large organisations and smaller ISP's free to make the decision themselves on whether the loss of Windows update is more or less important than the prevention of the additional spurious traffic. In countries/situations where bandwidth is paid for by traffic transferred, and is often quite expensive, I suspect that more decisions will be made to eliminate access to WindowsUpdate, at least for a period of time, rather than paying for excess traffic generated. It's more than a matter of degraded service.
I guess everybody can implement SUSserver (www.susserver.com): it's a local version of a windows update server. If you implement this, you can allow only this server access to the microsoft update sites, and let everybody else (from within the ISP his network) connect to the local update server. Then everybody still has access to the updates, while no excess traffix to the internet is made. Of course if you don't want your server to be DOS'sed ... Franky _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: Windows Dcom Worm planned DDoS, (continued)
- RE: Windows Dcom Worm planned DDoS Chris Eagle (Aug 12)
- RE: Windows Dcom Worm planned DDoS Andrew Thomas (Aug 12)
- Re: [normal] RE: Windows Dcom Worm planned DDoS opticfiber (Aug 12)
- Re: [normal] RE: Windows Dcom Worm planned DDoS martin f krafft (Aug 12)
- Re: [normal] RE: Windows Dcom Worm planned DDoS martin f krafft (Aug 12)
- RE: Re: [normal] RE: Windows Dcom Worm planned DDoS Marc Maiffret (Aug 12)
- RE: Windows Dcom Worm planned DDoS Andrew Thomas (Aug 12)
- Re: [normal] RE: Windows Dcom Worm planned DDoS James Greenhalgh (Aug 12)
- Re: [normal] RE: Windows Dcom Worm planned DDoS morning_wood (Aug 12)
- RE: Windows Dcom Worm planned DDoS Chris Eagle (Aug 12)
- RE: Windows Dcom Worm planned DDoS Andrew Thomas (Aug 12)
- Re: Windows Dcom Worm planned DDoS Franky Van Liedekerke (Aug 12)
- Re: Windows Dcom Worm planned DDoS Jeremiah Cornelius (Aug 12)
- RE: Windows Dcom Worm planned DDoS Nick FitzGerald (Aug 12)
- Re: Windows Dcom Worm planned DDoS Valdis . Kletnieks (Aug 13)
- Re: Windows Dcom Worm planned DDoS Max Valdez (Aug 15)
- Re: Windows Dcom Worm planned DDoS Valdis . Kletnieks (Aug 16)
- Re: Windows Dcom Worm planned DDoS martin f krafft (Aug 12)
- Re: Re: Windows Dcom Worm planned DDoS Sebastian Niehaus (Aug 13)