NetSky.q Virus. Looking for more detailed information on how the DOS will be performed.

[Paul]

Hi, =


I work for one of the companies about to be hit with the dDOS attack 7-12 f=
rom the NetSky.Q virus. =

http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky.q@mm.htm=
l

I am looking for more detailed information on exactly how the dDOS attack w=
ill be performed, ports used, request
type, packet size, etc. In hopes of getting enough information to work with=
our providers for an adequate defense.

The online AV sites concentrate on the end user response (how to clean, wha=
t it does to their PC etc).



Does anyone have this information?
paul

[Joe Stewart]

On Tuesday 30 March 2004 1:18 pm, Paul wrote:
> I am looking for more detailed information on exactly how the dDOS
> attack will be performed, ports used, request type, packet size, etc.
> In hopes of getting enough information to work with our providers for
> an adequate defense.

Paul,
If the virus is started on one of the mentioned dates and the host is
connected to the Internet, the following steps will be taken by the
virus:

1) The hostnames of the sites to attack are decrypted and the IP
addresses resolved.

2) 80 threads are created for the attack - each thread picks from one of
the five victim hostnames at random. The following steps are performed
in each thread:

3) A connection is made on port 80 and only the following content is
sent (formatted for your site here and CR/LF escaped):

GET / HTTP/1.1\r\nHost: www.edonkey2000.com\r\n\r\n

4) The thread sleeps for 250 milliseconds.

5) The process repeats from step 3 until the virus exits.

-Joe

--
Joe Stewart, GCIH
Senior Security Researcher
LURHQ http://www.lurhq.com/

[Paul]

I just wanted to say thanks to all the people who responded, I think we hav=
e
enough information to build a decent set of firewall rules to drop the inco=
ming
packets at the access points.


Moving forward, I don't really understand why this information was so hard =
to get
in the first place, all of the A/V vendors make the virus client payload in=
formation
easily and freely accessible on their websites, why the detailed informatio=
n on
the actuall attack the virus was designed was left out is beyond me. I unde=
rstand
and sympathise that this would be conisdered extremely technical informatio=
n, but
making it available as a subtext or in a linked analysis document shouldn't=
be to
hard.


thank you all
paul


> ------------Original Message------------
> From: "Paul" <paul@edonkey2000.com>
> To: bugtraq@securityfocus.com
> Date: Tue, Mar-30-2004 1:52 PM
> Subject: NetSky.q Virus. Looking for more detailed information on how the=
DOS will be performed.
> =

> Hi, =

> =

> I work for one of the companies about to be hit with the dDOS attack 7-12=
from the NetSky.Q virus. =

> http://securityresponse.symantec.com/avcenter/venc/data/w32.netsky.q@mm.h=
tml
> =

> I am looking for more detailed information on exactly how the dDOS attack=
will be performed, ports used, request
> type, packet size, etc. In hopes of getting enough information to work wi=
th our providers for an adequate defense.
> =

> The online AV sites concentrate on the end user response (how to clean, w=
hat it does to their PC etc).
> =

> =

> =

> Does anyone have this information?
> paul
> =

> =