Skip to Content.
Sympa Menu

internetworkers - Re: Query: DDoS virus possible?

internetworkers AT lists.ibiblio.org

Subject: Internetworkers: http://www.ibiblio.org/internetworkers/

List archive

Chronological Thread  
  • From: Steven Champeon <schampeo AT hesketh.com>
  • To: InterNetWorkers <internetworkers AT franklin.oit.unc.edu>
  • Subject: Re: Query: DDoS virus possible?
  • Date: Sat, 27 May 2000 13:14:26 -0400 (EDT)


On Sat, 27 May 2000, Thomas A. Beckett wrote:
> I note today yet another Microsoft Outlook virus:
> http://www.cnn.com/2000/TECH/computing/05/27/new.virus.resume/index.html

Oh, joy.

> And the other day, while perusing Steven Champeon's JaundicedEye site,
> I read his somewhat mossy essay on the potential for the "subscribe"
> function of Internet Explorer (ver. 4.0, that's what I mean by mossy) to
> be used in a conspiratorial fashion to mount a DoS campaign.
> http://a.jaundicedeye.com/dark_fiber/article.html (It appears that this
> was actually written by Greg DeKoenigsberg and not Mr. Champeon
> himself.)

You mean people still read a jaundiced eye? :)

> Putting 2 & 2 together and getting 5, I wonder if a Melissa or Love
> Bug
> style virus could be created which would do the following things:
>
> - When opened, start a VB script which would *slowly* mail itself to
> everyone in the victim's Outlook address book. Slowly so as to not
> overwhelm mail servers and make itself known.

I dunno - is there a "sleep" function in VB? The problem here is that if
the virus is discovered too early the virus writer loses out on a large
part of their distribution.

> - After accomplishing the foregoing, and perhaps after an additional
> time delay, "subscribe" the victim's Internet Explorer to a given Web
> site. Let's continue to use Steven's example of www.microsoft.com. Set
> the refresh rate for the subscription to once per minute.
>
> - Do nothing further to the victim's computer.

Ooh. Better still, instead of subscribing them to microsoft.com, just
have it set a bookmark - which fetches the favicon.ico file - only set
bookmarks to randomly generated files, so the requests are all bogus.
(I hate the default behavior of IE WRT favicon.ico, if it's not already
plainly obvious.)

> This would accomplish the delicious irony of Microsoft's entire
> installed base of Windows and Office engaging in a distributed denial of
> service attack on Microsoft's own Web site. My question is just, is
> this still possible in the current version of IE and with the
> "antivirus" patches recently promulgated by Microsoft?

I don't know whether the subscription stuff is exposed to external
scripting or not. The big question is whether it's exposed to the HTML
rendering control, and whether an HTML-formatted email with a VBScript
that (set the bogus bookmark|altered the subscription info) would work.

My guess, as a person who avoids both Outlook and VBScript, is yes. Any
informed people out there?

Steve

--
tired of being an underappreciated functionary in a soulless machine?
hesketh.com is hiring: <http://hesketh.com/careers/>




  • Query: DDoS virus possible?, Thomas A. Beckett, 05/27/2000
    • <Possible follow-up(s)>
    • Re: Query: DDoS virus possible?, Steven Champeon, 05/27/2000

Archive powered by MHonArc 2.6.24.

Top of Page