Security Incidents mailing list archives
RE: Possible variant of Blaster/Nachi/Welchia? (more)
From: "David Gillett" <gillettdavid () fhda edu>
Date: Mon, 29 Sep 2003 08:15:30 -0700
I haven't seen this phenomenon recently, but 3-4 years ago I was routinely seeing AOL IP addresses show up our corporate LAN, especially Monday morning. The MAC addresses would *usually* trace back to a laptop that someone had taken home over the weekend, but not always. David Gillett
-----Original Message----- From: Jeff Kell [mailto:jeff-kell () utc edu] Sent: September 26, 2003 16:05 To: Incidents Subject: Re: Possible variant of Blaster/Nachi/Welchia? (more) The best answer I have heard thus far came from Jon Lewis <jlewis () lewis org> who said:Dialup doesn't have to be involved. Apparently the AOLsoftware when usedacross the internet gives the user's PC an AOL IP address, and for whatever reason, packets sourced from that address willleak out the PC'sethernet without going through whatever sort of tunnel theAOL softwaresets up. On the private network where I helped track itdown, it wasupsetting their firewall, which thought the packets were spoofed.Since we haven't confirmed this yet on the affected systems here, can anyone lend any further credence or details on the AOL leakage theory? If true, it doesn't cast a very bright (pun?) light on AOL software. Jeff -------------------------------------------------------------- ------------- -------------------------------------------------------------- --------------
--------------------------------------------------------------------------- ----------------------------------------------------------------------------
Current thread:
- Re: Possible variant of Blaster/Nachi/Welchia? (more) Steven D. Smith (Sep 26)
- Re: Possible variant of Blaster/Nachi/Welchia? (more) Jean-Luc Cavey (Sep 26)
- Re: Possible variant of Blaster/Nachi/Welchia? (more) Bob Barron (Sep 26)
- Re: Possible variant of Blaster/Nachi/Welchia? (more) Jeff Kell (Sep 28)
- RE: Possible variant of Blaster/Nachi/Welchia? (more) David Gillett (Sep 29)
- Re: Possible variant of Blaster/Nachi/Welchia? (more) Bob Barron (Sep 26)
- Re: Possible variant of Blaster/Nachi/Welchia? (more) Jean-Luc Cavey (Sep 26)
- <Possible follow-ups>
- RE: Possible variant of Blaster/Nachi/Welchia? (more) Bassett, Mark (Sep 26)
- Re: Possible variant of Blaster/Nachi/Welchia? (more) Joe Stewart (Sep 26)
- Re: Possible variant of Blaster/Nachi/Welchia? (more) Jean-Luc Cavey (Sep 26)
- Re: Possible variant of Blaster/Nachi/Welchia? (more) Joe Stewart (Sep 26)