Blaster’s blast

By On August 13, 2003 · 6 Comments

While Blaster worm is discovering vulnerable windows machines as fast as possible, I did what I had to do very long time ago, and it was blocking NetBios in our network border:

edge#show access-list forbid
Extended IP access list forbid
deny tcp any any range 135 139 (8588631 matches)
deny udp any any range 135 netbios-ss (425993 matches)
deny tcp any any eq 4444 (45 matches)
deny udp any any eq tftp (4 matches)
permit ip any any (24505712 matches)

Oops! too many netbios requests for just two hours! And this is how we blocked all Blaster’s junk traffic in our network. A filter like the one shown above has been applied to borders, and done. In one case it just dropped more than 6mbps on a link. It’s horrible.

Enable internet connection firewall if you are using XP, and get this tool to check your system health and remove the worm if your workstation is infected. And then update your windows with all security patches available on Microsoft Window Update website.

Definite solution: Get FreeBSD and set your computer free! (Geeks Only)

Resolution: We don’t need NetBios, We don’t like Microsoft.

Tagged with: •
 
If you enjoyed this article, please consider sharing it!
Facebook Twitter

6 Responses to Blaster’s blast

  1. BOK says:
    August 13, 2003 at 1:28 pm

    Ehr… how about Samba?
    It uses NetBIOS. I use it ;-)

  2. Babak says:
    August 13, 2003 at 2:00 pm

    I guess you use it for your local network (as we do the same). So you won’t need it on internet edge. NetBios is good, but you I am sure more than 90% of our windows users didn’t install the patched and are all vulnerable. So for the meantime I guess we should all block netbios and ignore Samba ;)

  3. iraniancrawler says:
    August 16, 2003 at 10:45 am

    see here!
    a gift for u?
    http://www.tci.ir

  4. vgh says:
    August 17, 2003 at 2:30 pm

    how can i remove the blaster worm from my pc?

  5. Morshidi Saufi says:
    September 15, 2003 at 12:36 pm

    Port 135,137,139 are valid Microsoft in my network.Blocking them will make a lot of services like file sharing… not functioning anymore.
    Getting PC custodians to apply patches and Virus pattern takes times.
    Any other ideas is much appreciated.
    Thanks a lot.

  6. tierheim tierheime says:
    April 8, 2004 at 1:03 am

    Durch Zufall bin ich hier auf dieser Seite gelandet und bin wirklich begeistert. Dabei habe ich laengst nicht alles gesehen. Aber was ich sah, gefaellt mir ausnahmslos. Ein dickes Lob an den Webmaster! Weiter so… Liebe Gruesse, Dagmar (die sich jetzt noch ein wenig umsieht…)