Re: [Full-Disclosure] msblast DDos counter measures (More Insight Maybe?)

[Vladimir Parkhaev <vladimir@arobas.net>]

Quoting Christopher Lyon (cslyon@netsvcs.com):
> 
> OK,
> Sorry that I didn't see that before but I see it now. Thanks.
> 


It is allright. I liked the idea of playing with DNS to avoid the DOS myself...
Looks like m$ killed windowsupdate.com and there will be no dDOS (booooring:)

Here is what Len forwarded to me, it was send to nanog:


----- Forwarded message from "Ingevaldson, Dan (ISS Atlanta)" <dsi@iss.net> -----

Delivered-To: nanog-outgoing@trapdoor.merit.edu
Delivered-To: nanog@trapdoor.merit.edu
Delivered-To: nanog@merit.edu
X-MimeOLE: Produced By Microsoft Exchange V6.0.6249.0
Subject: RE: microsoft.com - what happens when there is no DNS record
Date: Fri, 15 Aug 2003 11:14:03 -0400
X-MS-Has-Attach: 
X-MS-TNEF-Correlator: 
Thread-Topic: microsoft.com - what happens when there is no DNS record
Thread-Index: AcNjOP7QgiIqaiAWTHWs68yAsjZQywAACeZgAAGGo0A=
From: "Ingevaldson, Dan (ISS Atlanta)" <dsi@iss.net>
To: "McBurnett, Jim" <jmcburnett@msmgmt.com>, <Patrick_McAllister@WASHGAS.COM>,
   "Robbie Foust" <rfoust@duke.edu>
Cc: "Bryan Heitman" <bryan@bryanheitman.com>, <nanog@merit.edu>,
   <owner-nanog@merit.edu>, "Chris Horry" <zerbey@wibble.co.uk>
X-OriginalArrivalTime: 15 Aug 2003 15:14:06.0749 (UTC) FILETIME=[DEBC7CD0:01C3633F]
Precedence: bulk
Errors-To: owner-nanog-outgoing@merit.edu
X-Loop: nanog
X-MIME-Autoconverted: from quoted-printable to 8bit by netsys.com id h7FFGiQ23485


Our assessment of worm's behavior is below:

If windowsupdate.com fails to resolve, it will return a -1, which is not
interpreted because this routine has no error checking.  The worm then
attempts to send its SYN packets to 255.255.255.255, which may have done
some interesting things, but it looks like the Windows raw socket
implementation won't let that packet out.  So basically, nothing
happens.  

There might be some issues with cached DNS, but besides that it looks
like the majority of the infections won't be doing much of anything
besides eating CPU cycles on the infected hosts.

Regards,
===============================
Daniel Ingevaldson
Engineering Manager, X-Force R&D
dsi@iss.net 
404-236-3160
 
Internet Security Systems, Inc.
The Power to Protect
http://www.iss.net 
===============================
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html