Re: [Full-Disclosure] Windows Dcom Worm planned DDoS

[Sebastian Niehaus <killedbythoughts@mindcrime.net>]

Nick FitzGerald <nick@virus-l.demon.co.uk> writes:
> "Andrew Thomas" <andrewt@nmh.co.za> wrote:

[...]
 
> And, of course, if MS started messing with the DNS entries for 
> windowsupdate.com, it would be cutting an awful lot of users off from 
> much needed updates. which could be as disturbing as the rest of the 
> worm's effects...

Could be a nice feature of a worm to modify the "hosts" file and
prevent infected maschines to do DNS lookups.

Users typing "www.microsoft.com" into their browsers could be tricked
into downloading stuff from hostile servers and the "windows update"
could be disabeled easily.

This probably istn't a new concept, eh?



Sebastian
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html