Re: [Full-Disclosure] Blaster: will it spread without tftp?
Valdis.Kletnieks_at_vt.edu
Date: 08/12/03
- Previous message: Valdis.Kletnieks_at_vt.edu: "Re: [Full-Disclosure] Microsoft urging users to buy Harware Firewalls"
- In reply to: Maarten: "[Full-Disclosure] Blaster: will it spread without tftp?"
- Next in thread: Ron DuFresne: "RE: [Full-Disclosure] ISS Security Brief: "MS Blast" MSRPC DCOM Worm Propagation (fwd)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: Maarten <subscriptions@hartsuijker.com> Date: Tue, 12 Aug 2003 17:12:36 -0400
On Tue, 12 Aug 2003 22:19:19 +0200, Maarten <subscriptions@hartsuijker.com> said:
> - since tftp servers can not be accessed, msblaster.exe can not be
> downloaded
> - since msblaster.exe can not be downloaded these other systems will not
> start to infect other systems...
>
> Am I correct on these last two points?
The tftp connection is made back to the machine that sent the original infection vector.
So if somebody brings in a contaminated laptop, that laptop will start attacking, and
any machines that get whacked will call that laptop for their tftp connection. Then
those machines will start scanning, and if THEY find any vulnerable machines they'll
whack them - and those just-whacked machines will call back to the one that whacked
them, not the original laptop, and so on..
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
- application/pgp-signature attachment: stored
- Previous message: Valdis.Kletnieks_at_vt.edu: "Re: [Full-Disclosure] Microsoft urging users to buy Harware Firewalls"
- In reply to: Maarten: "[Full-Disclosure] Blaster: will it spread without tftp?"
- Next in thread: Ron DuFresne: "RE: [Full-Disclosure] ISS Security Brief: "MS Blast" MSRPC DCOM Worm Propagation (fwd)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
