On Thu, 2003-08-14 at 00:08, Benjamin M.A. Robson wrote: > This is almost right. The packets should go straight to the firewall > and out to the Internet, unless there is a device (such as the firewall > itself) performing some sort of NAT redirect for the purposes of a > transparent proxy. If this is the case then the packets will be sent > via the proxy, and if they are not properly formed HTTP commands (GET, > HEAD, etc..) the proxy server should reject them as bogus. According to eEye, the DOS attack is a SYN flood. Thus, it wouldn't even get to the stage where HTTP is spoken. In a transparent proxy setup, the proxy server will suffer the SYN flood and nothing will get out. In a non-transparent proxy setup the proxy likely wouldn't see the packets (since msblast.exe isn't looking for proxies). Hence it depends on whether the Internet firewall mandates HTTP connections to be made through a proxy, or whether it just allows anybody to make outbound HTTP connections. In the former case, the firewall will drop the SYN's (unless the proxy itself is infected), in the latter case you'll SYN flood windowsupdate.com. In short, it is a good idea to allow outbound HTTP connections from proxy servers only (and always has been). It is an even better idea not to run the proxies on top of Windows. Cheers Steffen. -- Steffen Kluge Tel: +61 2 9887 9449 Security Specialist Mobile: 0413 486 390 Fujitsu Australia Ltd Facsimile: +61 2 9887 9458 376 Lane Cove Rd Email: steffen.kluge@fujitsu.com.au North Ryde NSW 2113 Website: www.fujitsu.com.au This is an e-mail from Fujitsu Australia Ltd. It is confidential to the ordinary user of the e-mail address to which it was addressed and may contain copyright and/or legally privileged information. No one else may read, print, store, copy or forward all or any of it or its attachments. If you receive this e-mail in error, please return to sender. Thank you. The recipient of this e-mail should be aware that this e-mail and any attachments to it might not be free from viruses in their various forms. Fujitsu Australia Ltd strongly recommends that the recipient uses anti-virus software to screen all e-mails received externally. Fujitsu does not accept any liability for any loss or damage that may occur as a result of the transmission of this e-mail to the recipient.
This is a digitally signed message part