RE: msblast.exe worm FINDINGS (DDoS) ---> Can someone please confirm?

From: David Gillett <gillettdavid(at)fhda.edu>
Date: Thu Aug 14 2003 - 15:36:15 EDT

> I build a BIND server (10.10.10.1/24) with a forward AND

  This suggests that in addition to spoofing an address within the infected machine's /16, it ALSO assumes a /16 for purposes of routing the outbound attacks.

David Gillett

---

Captus Networks - Integrated Intrusion Prevention and Traffic Shaping

• Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
• Automatically Control P2P, IM and Spam Traffic
• Ensure Reliable Performance of Mission Critical Applications
• Precisely Define and Implement Network Security and Performance Policies **FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo Visit us at: http://www.securityfocus.com/sponsor/CaptusNetworks_incidents_030814

  ---

  • application/ms-tnef attachment: winmail.dat

Received on Fri Aug 15 18:02:44 2003