Recent Microsoft patch useless

VOLE SEEMS TO HAVE BOTCHED its MS09-008 patch which was designed to fix the Man-In-The-Middles attacks on Windows DNS and WINS. While it works for machines that have never seen or heard of the exploit, it cannot help those which have already been infected.

Tyler Reguly, a researcher on nCircle's VERT team, pointed out that the patch checks to see which entries have been created in the DNS server and only adds block list entries for values not already being served.

Vole said the patch worked like it was supposed to, and was not meant to protect people who had already fallen to the exploit... so there. μ

L'Inq
Tech Herald