[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: New IIS worm

Karl E. Jorgensen <karl@jorgensen.com> wrote:
> Doesn't this leave you open to DOS attacks? I'm thinking that source IP
> addresses are relatively easy to forge, and hence an attacher can forge
> a nimda attach and cause you to block off legitimate IP addresses -
> ie. your DNS server our default gateway...

To forge a Nimda attack would require you to forge a TCP connection. That's
not easy, unless the attacker is on the network path to the forged address.
Sam Couter          |   Internet Engineer   |   http://www.topic.com.au/
sam@topic.com.au    |   tSA Consulting      |
OpenPGP key ID:       DE89C75C,  available on key servers
OpenPGP fingerprint:  A46B 9BB5 3148 7BEA 1F05  5BD5 8530 03AE DE89 C75C

Attachment: pgpAt31Yv6aLS.pgp
Description: PGP signature

Reply to: