Full Disclosure mailing list archives
RE: DDoS on the 16th - Fail if no DNS resolution?
From: "gml" <gml () phrick net>
Date: Wed, 13 Aug 2003 22:41:38 -0400
_data:004047EC aWindowsupdate_com db 'windowsupdate.com',0 that's what I have. -----Original Message----- From: full-disclosure-admin () lists netsys com [mailto:full-disclosure-admin () lists netsys com] On Behalf Of northern snowfall Sent: Wednesday, August 13, 2003 10:10 PM To: Jason Witty Cc: full-disclosure () lists netsys com Subject: Re: [Full-disclosure] DDoS on the 16th - Fail if no DNS resolution?
Has anyone tested this worm yet to see what it'll do if you set up an internal DNS entry for windowsupdate.com to point to a black hole address (127.0.0.1 for example) and then set the system clock to be August 16th (this Saturday)?
Has anyone taken the time to read the assembly to see if the worm exits if it can't find an IP? Rather than point windowsupdate.com to 127.1, just force your dns to return lookup failure. If the worm sees an error when it performs a URL lookup, maybe it dies. It wouldn't have *anything* to DoS. Don http://www.7f.no-ip.com/~north_ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- DDoS on the 16th - Fail if no DNS resolution? Jason Witty (Aug 13)
- Re: DDoS on the 16th - Fail if no DNS resolution? northern snowfall (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? gml (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? Chris Eagle (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? Nick FitzGerald (Aug 13)
- Re: DDoS on the 16th - Fail if no DNS resolution? northern snowfall (Aug 13)
- Re: DDoS on the 16th - Fail if no DNS resolution? Darren Reed (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? Chris Eagle (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? Derek Soeder (Aug 14)
- Re: DDoS on the 16th - Fail if no DNS resolution? Laurent LEVIER (Aug 14)
- <Possible follow-ups>
- RE: DDoS on the 16th - Fail if no DNS resolution? Keith Pachulski (Aug 14)
- Re: DDoS on the 16th - Fail if no DNS resolution? northern snowfall (Aug 13)