RE: [Full-Disclosure] Windows Dcom Worm planned DDoS

From: Andrew Thomas (andrew_at_generator.co.za)
Date: 08/12/03

  • Next message: Mike.Keighley_at_lexicon.co.uk: "Re: [Full-Disclosure] MSblast worm" 
    To: <nick@virus-l.demon.co.uk>, <full-disclosure@lists.netsys.com>
Date: Tue, 12 Aug 2003 15:14:56 +0200

    > From: Nick FitzGerald
    > Sent: 12 August 2003 01:48
    > Subject: Re: [Full-Disclosure] Windows Dcom Worm planned DDoS
    >
    >
    > "Andrew Thomas" <andrewt@nmh.co.za> wrote:
    >
    > > The examinations of the code so far indicate that the worm is
    > > coded to DoS the windowsupdate site from the 15th of August
    > > onwards through the end of the year.
    >
    > I'll ignore the sloppiness in that description, as several of the
    > published descriptions have (or at least initially got) it confused
    > through slightly wrong too...

    The examinations of the code *that I have read so far* indicate
    that...?

    >And, of course, if MS started messing with the DNS entries for
    >windowsupdate.com, it would be cutting an awful lot of users off from

    >much needed updates. which could be as disturbing as the rest of the
    >worm's effects...

    Still leaving large organisations and smaller ISP's free to make
    the decision themselves on whether the loss of Windows update
    is more or less important than the prevention of the additional
    spurious traffic.

    In countries/situations where bandwidth is paid for by traffic
    transferred, and is often quite expensive, I suspect that more
    decisions will be made to eliminate access to WindowsUpdate,
    at least for a period of time, rather than paying for excess
    traffic generated.

    It's more than a matter of degraded service. 

    --
Andrew G. Thomas
Hobbs & Associates Chartered Accountants (SA)
(o) +27-(0)21-683-0500
(f) +27-(0)21-683-0577
(m) +27-(0)83-318-4070 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: Mike.Keighley_at_lexicon.co.uk: "Re: [Full-Disclosure] MSblast worm"
    Loading