RE: [Full-Disclosure] Learn from history?

["Serge van Ginderachter (svgn)" <svgn@xxxxxxxx>]

> If wormX propogates using port Y, block any traffic with 
> source/destination port Y.  

Exactly. Note that those ports probably should have been blocked already.
Hen they are open, they should be open for servers/services that REALLY
needed them only and only if it's safe to do it.

Now that might probably have been the case on the border, but not on the
local LAN... (which was my initial intended remark)

> It doesn't solve the problem, it slows the spreading. If you
> get infected, we don't need to you spread it further.  Block the shit
> from going outbound.  

Totally agree, but IRL...
do you have any idea how much small businesses have just a NAT router
instead of a real firewall?



Serge

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html