Hi

does anyone know how the Denial of service component works. ie does it grab the ip address from DNS and then blast away on port 80 or what ? (This is the MSBlast worm Im talking about)

Id like to try and protect the internal network as much as poss, where infected to hell becuase the admins havent patched and I want to mitigate the damage it could do to the internal network.

Only solution I can think of is to poison our DNS entries and point all quries to update.com to the loopback - should protect the internal site links, but means no one will get to the update site until we reenable it.

yours sincerely

Beleagured network guy

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/articles/6689/21422#21422