If you have a look at
There is a list of IP addresses that are nameservers which
are hard-coded into the worm. It spreads by e-mail
(currently)
and thus it can be blocked using anti-virus filters.
My concern is that these addrs are all for nameservers, which
could
be authoritative for other domains, and by blocking these
servers
any domains they host could be effectively put out of
commission.
I am not aware of an easy way to find out all the domains
registered
to a particular nameserver, and the trend of blocking addrs
that appear
in worm code is starting to concern me a bit.
It is not indicated how blocking these servers will have an
appreciable
effect on the worm propagation (unless it gets a second stage
from them),
and I wonder if anyone else has similar concerns, or an
opinion on whether
these IP addresses should actually be blocked.
Regards,
-j
--
Jamie.Reid, CISSP,
jamie.reid@mbs.gov.on.caSenior
Security Specialist, Information Protection Centre
Corporate Security,
MBS
416 327 2324