Comments on: The DNS Vuln http://www.computerdefense.org/2007/04/the-dns-vuln/ Sharing my thoughts with the world. Wed, 16 Nov 2011 02:58:20 +0000 hourly 1 http://wordpress.org/?v=3.2.1 By: LonerVamp http://www.computerdefense.org/2007/04/the-dns-vuln/comment-page-1/#comment-77452 LonerVamp Mon, 19 Jan 2009 14:20:06 +0000 http://www.computerdefense.org/?p=308#comment-77452 There could be an insider case made as well. I know our DCs double as our internal-only DNS servers. This vuln in the DNS means our DCs could be popped internally. The only real solution (for us, I think) is to migrate DNS off the DCs. But that's not something the team wants to do, so we'll just wait for a patch. My IPS should notice this attack, thankfully. I'd be curious if this turns into a worm. I think a worm that combines mass-mail along with internet/intranet scanning could be pretty damaging. Code Red, no. But I think the number of Windows DNS servers is underestimated. Externally, no, but internally, there's a lof of them...and they're likely all in the very soft underbelly of networks making them very juicy indeed... Post the damned VERT solution. And yes, while I got your email, I just haven't had time or luck with that challenge. : There could be an insider case made as well. I know our DCs double as our internal-only DNS servers. This vuln in the DNS means our DCs could be popped internally. The only real solution (for us, I think) is to migrate DNS off the DCs. But that's not something the team wants to do, so we'll just wait for a patch. My IPS should notice this attack, thankfully.

I'd be curious if this turns into a worm. I think a worm that combines mass-mail along with internet/intranet scanning could be pretty damaging.

Code Red, no. But I think the number of Windows DNS servers is underestimated. Externally, no, but internally, there's a lof of them…and they're likely all in the very soft underbelly of networks making them very juicy indeed…

Post the damned VERT solution. And yes, while I got your email, I just haven't had time or luck with that challenge. :

]]> By: .:Computer Defense:. » RPC DNS Worm http://www.computerdefense.org/2007/04/the-dns-vuln/comment-page-1/#comment-7033 .:Computer Defense:. » RPC DNS Worm Tue, 17 Apr 2007 14:59:15 +0000 http://www.computerdefense.org/?p=308#comment-7033 [...] Yesterday I questioned if we’d see a worm related to the RPC DNS Vuln… [...] [...] Yesterday I questioned if we’d see a worm related to the RPC DNS Vuln… [...]

]]> By: LonerVamp http://www.computerdefense.org/2007/04/the-dns-vuln/comment-page-1/#comment-6954 LonerVamp Mon, 16 Apr 2007 15:09:47 +0000 http://www.computerdefense.org/?p=308#comment-6954 There could be an insider case made as well. I know our DCs double as our internal-only DNS servers. This vuln in the DNS means our DCs could be popped internally. The only real solution (for us, I think) is to migrate DNS off the DCs. But that's not something the team wants to do, so we'll just wait for a patch. My IPS should notice this attack, thankfully. I'd be curious if this turns into a worm. I think a worm that combines mass-mail along with internet/intranet scanning could be pretty damaging. Code Red, no. But I think the number of Windows DNS servers is underestimated. Externally, no, but internally, there's a lof of them...and they're likely all in the very soft underbelly of networks making them very juicy indeed... Post the damned VERT solution. And yes, while I got your email, I just haven't had time or luck with that challenge. :\ There could be an insider case made as well. I know our DCs double as our internal-only DNS servers. This vuln in the DNS means our DCs could be popped internally. The only real solution (for us, I think) is to migrate DNS off the DCs. But that’s not something the team wants to do, so we’ll just wait for a patch. My IPS should notice this attack, thankfully.

I’d be curious if this turns into a worm. I think a worm that combines mass-mail along with internet/intranet scanning could be pretty damaging.

Code Red, no. But I think the number of Windows DNS servers is underestimated. Externally, no, but internally, there’s a lof of them…and they’re likely all in the very soft underbelly of networks making them very juicy indeed…

Post the damned VERT solution. And yes, while I got your email, I just haven’t had time or luck with that challenge. :\

]]>