5 ms·
Many sandbox environments resolve whatever they're queried for with the same IP address. This is addressed in the article.
by 300bps 9y ago
Many sandbox environments resolve whatever they're queried for with the same IP address. This is addressed in the article.
- 13of40 9y agoHow many ISPs spoof failed DNS queries so they can feed you ads? That alone would make this useless as an evasion technique.
- lmm 9y agoIt means the malware would not execute for users on those ISPs because they false-positive for being a sandbox; that doesn't make it useless unless every ISP is doing that.
- yaur 9y agoOTOH it means that laptops won't activate until they are on a work network, for an SMB worm that's probably not a bad strategy.
- kalleboo 9y agoClearly not that many considering how well it did manage to spread.