[Dshield] RE: FriendGreetings Worm is back

Dragos Ruiu dr at kyx.net
Thu Oct 31 12:01:53 GMT 2002


On October 31, 2002 08:22 pm, John Hardin wrote:
> On Thu, 2002-10-31 at 10:06, Russell Washington wrote:
> > It sounds like they're moving the www sites around to avoid folks doing
> > exactly what we're trying to do.  With that in mind I'd say the best
> > blackholing strategy might just be to spoof authoritative DNS on your own
> > DNS server so that the thing just plain won't resolve.
>
> Does anybody know a quick and easy way to blackhole a domain in DNS
> (short of the entire process of setting up an authority file, etc.)



Use hogwash and filter out any dns queries to the offending domain.

--dr

-- 
dr at kyx.net   pgp: http://dragos.com/kyxpgp
Advance CanSecWest/03 registration available: http://cansecwest.com
"The question of whether computers can think is like the question
  of whether submarines can swim." --Edsger Wybe Dijkstra 1930-2002




More information about the list mailing list