On Monday 03 May 2004 3:44 pm, Eric Chien wrote: > Actually, it is all variants (.A - .D). And more > specifically, it iterates through all the host IP > addresses looking for an address that does not match: > 127.0.0.1 > 10. > 172.16 - 172.31 (inclusive) > 192.168. > 169.254 > > Then, using this address it creates a random address > (sometimes changing all octets, sometimes just the > last three, and sometimes just the last two).
That's not exactly how it works. It loops through every address returned by gethostbyname for the local hostname. It will prefer a non-RFC1918 address, but if none are found it will use whatever address it finds. If no address is returned it will use 127.0.0.1. So, yes, it does scan and infect private network ranges. -Joe -- Joe Stewart, GCIH Senior Security Researcher LURHQ http://www.lurhq.com/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
