netsky issue.

["Jamie Reid" <Jamie.Reid () mbs gov on ca>]

If you have a look at 

http://vil.nai.com/vil/content/v_101083.htm 

There is a list of IP addresses that are nameservers which 
are hard-coded into the worm. It spreads by e-mail (currently)
and thus it can be blocked using anti-virus filters. 

My concern is that these addrs are all for nameservers, which could 
be authoritative for other domains, and by blocking these servers
any domains they host could be effectively put out of commission. 

I am not aware of an easy way to find out all the domains registered
to a particular nameserver, and the trend of blocking addrs that appear
in worm code is starting to concern me a bit. 

It is not indicated how blocking these servers will have an appreciable
effect on the worm propagation (unless it gets a second stage from them), 
and I wonder if anyone else has similar concerns, or an opinion on whether
these IP addresses should actually be blocked. 

Regards, 

-j


--
Jamie.Reid, CISSP, jamie.reid () mbs gov on ca
Senior Security Specialist, Information Protection Centre 
Corporate Security, MBS  
416 327 2324

Attachment: TEXT.htm
Description: