| |||||||||||
|
| |||||||||||
The MS-SQL worm: lessons for free softwareThe MS-SQL worm: lessons for free softwarePosted Feb 6, 2003 9:20 UTC (Thu) by AnswerGuy (subscriber, #1256)Parent article: The MS-SQL worm: lessons for free software
I've written a few thoughts on my MoinWiki pages on how the Internet can be substantially hardened from these sorts of attacks with minimal technical development. Egress filtering and connection rate limiting (at border ISP routers) could accomplish most of the work. Of course, it's not that simple, and the social issues overwhelm us immediately. JimD
(Log in to post comments)
The MS-SQL worm: lessons for free software Posted Feb 6, 2003 17:58 UTC (Thu) by pflugstad (subscriber, #224) [Link] Note that in order for connection rate limiting to have helped in the case of SQL Slammer, it would have had to limit UDP packets, as SQL Slammer used UDP. Not impossible, but unlikey.I totally agree with you otherwise. On a seperate note, the major reason SQL Slammer propagated as fast as it did was because it was UDP based. This let each infected host send probes to 100's or even 1000's of IP addresses each SECOND. It didn't have to wait for the normal TCL 3-way handshake to go on, dramatically increasing it's ability to spread. Pete
|
|||||||||||