Re:Accidentally Stopping a Global Cyber Attack
by 13of40 on Saturday May 13, 2017 @04:45PM
(#14332913)
How many ISPs spoof failed DNS queries so they can feed you ads? That alone would make this useless as an evasion technique.
[ Parent
| on HN ]
It means the malware would not execute for users on those ISPs because they false-positive for being a sandbox; that doesn't make it useless unless every ISP is doing that.
OTOH it means that laptops won't activate until they are on a work network, for an SMB worm that's probably not a bad strategy.