RPC defended?

[sia]

As you know Blaster worms enters into a PC and tries to copy itself to others.
But because of protecting system of RPC you can't still online more than 30 seconds. So there is no time for Blaster to copy itself. If my conclusion is right, the shutdownt countdown was not the purpose of Blaster programer. The way we know Blaster is from the countdown screen that is a protection machanism of RPC service. Because of that worm is revealed so fast (that is not good for a worm or virus). There is also another benefit: Attacker can't intrude to a PC (that was the main purpose of blaster) because there is no time to attack (countdown)!
I don't know a lot about blaster and I'am not sure that I'am right or not.

[ErnieK]

As far as I know the idea of BLASTER was simply to shut down computers and create as much havoc as possible.

It is is possible to stop the shutdown if you are quick enough by re-setting the clock (on th etask bar) to a previous time and date (set the clock back 24 hrs and you will see the countdown giving that amount of time. This would give you all the time you required ot go on-line to download the fix if that is what you wanted.

[sia]

http://www.microsoft.com/technet/security/bulletin/MS03-026.mspx
http://securityresponse.symantec.com/avcenter/venc/data/w32.blaster.worm.html
They are good if you want to know blaster better.

[Paul Komski]

But because of protecting system of RPC you can't still online more than 30 seconds. So there is no time for Blaster to copy itself.

My understanding is that on first being infected blaster is latent until the next reboot. Whether or not that is the case and whether the shutdown occurs within 30 seconds or not - 30 seconds is a long time on a modern computer. If you've ever seen a LAN infected with it or a similar worm you will realise just how quickly all connected computers become infected.

If RPC was a self-protecting mechanism (if that's what you were suggesting) them that is obviously not the case or else blaster and naachi and similar exploits would never have got off the ground.

[sia]

Of course Blaster wasn't predicted when microsoft was creating RPC. And we know that more than 1000 PC's infected. But we don't know how much the protection mechanism prevented spreading of this worm. 30 seconds is fast for LAN and slow for Dial-Up. And when a user knows he can't be online more than 30 seconds he or she wouldn't try to come online.

[Paul Komski]

I really don't know what point you are trying to make. Blaster was a real PainInTheAss when it arrived and more than 1000 PCs infected doesnt even come close to "In just 24 hours, 'MSBlast' exploded onto some 120,000 computers around the world" ref http://news.com.com/2009-1002_3-5063226.html

If you go online with an unpatched/unfirewalled system even now I would not be surprised if were infected within minutes.

RPC over TCP and UDP may not have been designed for internet usage but the point is that MS has so neglected security for so long that even if Blaster (specifically) hadn't been "predicted" it was predictable that MS systems would and have become vulnerable to exploits again and again and again.