Vulnerability Development mailing list archives

a real way to stop an http based worm


From: Gert-Jan Hagenaars <blender () hagenaars com>
Date: Fri, 7 Sep 2001 17:00:26 -0400

Can this be done on the web-proxy boxes that the ISPs have on their
networks?  I.e. dunk anything that looks for "/default.ida?blah"?

This way the (in this case: minimal) cost _is_ deflected back to the ISPs,
and traffic doesn't even go onto their backbone to waste bandwidth.

_AND_ this would be a completely technical solution. 

CHeers,
Gert-Jan.

-- 
+++++++++++++ -------- +++++ --- ++ - +0+ + ++ +++ +++++ ++++++++ +++++++++++++
sed '/^[when][coders]/!d         G.J.W. Hagenaars -- gj at hagenaars dot com
    /^...[discover].$/d          Remembering Mike Carty 1968-1994
   /^..[real].[code]$/!d         UltrixIrixAIXHPUXSunOSLinuxBSD, nothing but nix
' /usr/dict/words                I'm Dutch, what's _your_ excuse?


Current thread: