Flood of bad DNS queries

[Brett Glass <brett () lariat org>]

Our logs are filling with reports of bogus queries which ask machines to do reverse lookups on their own IP addresses 
(backwards, with .in-addr.arpa appended, as is the usual convention). The queries are being addressed to machines which 
are not domain name servers and/or are not intended to serve queries from the outside world.

We're also seeing large numbers of requests to resolve ".". 

Ironically, many of these requests are coming from addresses such as 207.46.49.152,
which belongs to MSN. (It's unclear whether machines at Microsoft have been
infected, or if the queries are coming from a user logged into MSN.)

What worm or Trojan is causing this? What vulnerability is being attacked here?

--Brett Glass


---------------------------------------------------------------------------
----------------------------------------------------------------------------