RE: DDoS on the 16th - Fail if no DNS resolution?

["Chris Eagle" <cseagle () redshift com>]

Yes I have looked at the code, no it doesn't exit. It simply directs the SYN
packet at 255.255.255.255, i.e. it ignores the fact that the lookup failed
and returned -1 and uses -1 as the destination IP.

Chris

-----Original Message-----
From: full-disclosure-admin () lists netsys com
[mailto:full-disclosure-admin () lists netsys com]On Behalf Of northern
snowfall
Sent: Wednesday, August 13, 2003 7:10 PM
To: Jason Witty
Cc: full-disclosure () lists netsys com
Subject: Re: [Full-disclosure] DDoS on the 16th - Fail if no DNS
resolution?


> Has anyone tested this worm yet to see what it'll do if you set up an
> internal DNS entry for windowsupdate.com to point to a black hole
> address (127.0.0.1 for example) and then set the system clock to be
> August 16th (this Saturday)?

Has anyone taken the time to read the assembly to see if
the worm exits if it can't find an IP? Rather than point
windowsupdate.com to 127.1, just force your dns to return
lookup failure.

If the worm sees an error when it performs a URL lookup,
maybe it dies. It wouldn't have *anything* to DoS.

Don

http://www.7f.no-ip.com/~north_



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html