I was talking to a guy today who said that they had had an infected
win2k machine on their network, which, when turned on and logged in,
cased the loss of the entire network's internet connectivity!

I was a bit puzzled by this, and checked the machine myself to find it
had got MS Blaster in Norton qaurantine...the idiots hadn't actually
virus checked it prior to adding it to their network incidentally.

The network is connected to the net via a router, and i'm more than
intrigued to know how the Blaster virus on one machine can take down a
whole network this way, when none of the other machines became infected.

On that special day, Tx2, (tx2newscollection-invalid-@hotmail.com)
said...

> The network is connected to the net via a router, and i'm more than
> intrigued to know how the Blaster virus on one machine can take down a
> whole network this way, when none of the other machines became infected.


Blaster or Sasser?
It is probably not a broken router, but a network overload. See this
link:

> http://securityresponse.symantec.com...er.c.worm.html (one line)


Gabriele Neukam

(E-Mail Removed)


--
Ah, Information. A good, too valuable these days, to give it away, just
so, at no cost.

Tx2 <tx2newscollection-invalid-@hotmail.com> wrote in
news:(E-Mail Removed):

>
> I was talking to a guy today who said that they had had an infected
> win2k machine on their network, which, when turned on and logged in,
> cased the loss of the entire network's internet connectivity!
>
> I was a bit puzzled by this, and checked the machine myself to find it
> had got MS Blaster in Norton qaurantine...the idiots hadn't actually
> virus checked it prior to adding it to their network incidentally.
>
> The network is connected to the net via a router, and i'm more than
> intrigued to know how the Blaster virus on one machine can take down a
> whole network this way, when none of the other machines became
infected.

A NAT router can be attacked. But I don't think what you're explaining I
consider an attack on the router. I have heard of a worm infecting a
machine and that machine caused the network to be adversely affected, as
the machine with the worm sucked-up the bandwidth.

Duane

On Sat, 26 Jun 2004 15:40:38 -0500, Duane Arnold wrote:

> A NAT router can be attacked. But I don't think what you're explaining I
> consider an attack on the router. I have heard of a worm infecting a
> machine and that machine caused the network to be adversely affected, as
> the machine with the worm sucked-up the bandwidth.
>
> Duane

Perhaps the nat router was a windows machine and got infected with
blaster (which was released on the inside of the network).

If blaster caused the router to crash, the network would go down. Right?

--
Stop probing me on port 135.

Jason Wade <jw.strawberry.yogurt+(E-Mail Removed)> wrote in
news(E-Mail Removed):

> On Sat, 26 Jun 2004 15:40:38 -0500, Duane Arnold wrote:
>
>> A NAT router can be attacked. But I don't think what you're
>> explaining I consider an attack on the router. I have heard of a worm
>> infecting a machine and that machine caused the network to be
>> adversely affected, as the machine with the worm sucked-up the
>> bandwidth.
>>
>> Duane
>
> Perhaps the nat router was a windows machine and got infected with
> blaster (which was released on the inside of the network).
>
> If blaster caused the router to crash, the network would go down.
> Right?
>

You're most likely correct. However, one could set the machine to be kind
of like a Bastion Host situation I think stripping all vulnerable
applications and services off the machine and the O/S so that it couldn't
be attacked so easily.

The situation I speak on above was on a wireless router setup when the
infected machine logged on the network, it took over the bandwidth on the
LAN.

Duane

On Sat, 26 Jun 2004 23:34:42 -0500, Duane Arnold wrote:

> [ snippedy do-dah ]
> However, one could set the machine to be kind
> of like a Bastion Host situation I think stripping all vulnerable
> applications and services off the machine and the O/S so that it couldn't
> be attacked so easily.
> [ chomp ]

Or they could use linux, solaris or cisco routers instead of windows.
Stuff that "really needs to work" should not be done under windows

Jason Wade <jw.strawberry.yogurt+(E-Mail Removed)> wrote in
news(E-Mail Removed):

> On Sat, 26 Jun 2004 23:34:42 -0500, Duane Arnold wrote:
>
>> [ snippedy do-dah ]
>> However, one could set the machine to be kind
>> of like a Bastion Host situation I think stripping all vulnerable
>> applications and services off the machine and the O/S so that it
>> couldn't be attacked so easily.
>> [ chomp ]
>
> Or they could use linux, solaris or cisco routers instead of windows.
> Stuff that "really needs to work" should not be done under windows
>

That's why I have a WatchGuard.

Duane

In article <Xns95149F78C22A2notmenotmecoml@216.148.227.77>,
Duane Arnold <(E-Mail Removed)> wrote:
>Tx2 <tx2newscollection-invalid-@hotmail.com> wrote in
>news:(E-Mail Removed):
>
>>
>> I was talking to a guy today who said that they had had an infected
>> win2k machine on their network, which, when turned on and logged in,
>> cased the loss of the entire network's internet connectivity!
>>
>> I was a bit puzzled by this, and checked the machine myself to find it
>> had got MS Blaster in Norton qaurantine...the idiots hadn't actually
>> virus checked it prior to adding it to their network incidentally.
>>
>> The network is connected to the net via a router, and i'm more than
>> intrigued to know how the Blaster virus on one machine can take down a
>> whole network this way, when none of the other machines became
>infected.
>
>A NAT router can be attacked. But I don't think what you're explaining I
>consider an attack on the router. I have heard of a worm infecting a
>machine and that machine caused the network to be adversely affected, as
>the machine with the worm sucked-up the bandwidth.
>
>Duane
>


If the service is ADSL (slow upstream, fast downstream) a blaster
virus on one of the machines can cause very strange symptoms.
If you ping an outside numeric address it will look like
nothing is wrong but if you try to ping the DNS name it fails,
so you start troubleshooting it as a DNS problem......

you get the idea.

been there.


--
Al Dykes
-----------
adykes at p a n i x . c o m