Re: [Full-Disclosure] Blaster: will it spread without tftp?

[Valdis.Kletnieks@vt.edu]

On Tue, 12 Aug 2003 22:19:19 +0200, Maarten <subscriptions@hartsuijker.com>  said:

> - since tftp servers can not be accessed, msblaster.exe can not be
> downloaded
> - since msblaster.exe can not be downloaded these other systems will not
> start to infect other systems...
> 
> Am I correct on these last two points?

The tftp connection is made back to the machine that sent the original infection vector.

So if somebody brings in a contaminated laptop, that laptop will start attacking, and
any machines that get whacked will call that laptop for their tftp connection.  Then
those machines will start scanning, and if THEY find any vulnerable machines they'll
whack them - and those just-whacked machines will call back to the one that whacked
them, not the original laptop, and so on..

PGP signature