U.S. says Windows vulnerable to attack

CNET Tech News ^ | August 1, 2003 | Cnet.com Staff

[Sen Jack S. Fogbound]

U.S. says Windows vulnerable to attack

By

CNET News.com Staff

August 1, 2003, 7:46 AM PT

The federal government says there is new evidence that an attack is being planned on computers using Microsoft's Windows.

The Department of Homeland Security issued an updated advisory this week about possible hacker attacks on computers running Microsoft operating systems. The advisory warns that several working exploits are now in widespread distribution on the Internet.

"These exploits provide full remote system level access to vulnerable computers," the advisory states.

Microsoft issued a patch to plug the hole two weeks ago.

No worm code has been reported so far. But the Homeland Security Department said there is evidence to show an increase in searches for vulnerable computers on the Internet over the past week. This reinforces the urgency to install patches on computers that use Windows operating systems as soon as possible, the advisory said.

The warning comes after hackers from the Chinese X Focus Security Group forwarded source code to several public security lists. The code is designed to allow an intruder to enter Windows computers. Microsoft has also advised customers to protect their network with a firewall.

[Sen Jack S. Fogbound]

This is getting serious, folks!

[Excuse_My_Bellicosity]

Windows: just another pane in the glass.

[AntiGuv]

Windows vulnerable to attack

Hardly breaking news......

[dr_who_2]

Stupid is the word. You'd think that Microsoft would spend more of their profits on code audits so that they could head this stuff off at the pass. Or perhaps their bloated code is just so convoluted and poorly thought out that it would take an infinite number of highly skilled programmers to find the problems and fix things. Windows popularity is larger than anything else out there that you'd think they'd identify problems very quickly, but I guess lack of publicly available source code makes all the difference. One thing is for certain, Microsoft needs to read newspapers more.

[old-ager]

Windows popularity is larger than anything else out there that you'd think they'd identify problems very quickly, but I guess lack of publicly available source code makes all the difference.

I think you are full of it. They do identify problems quickly. Many past exploits have been based on a published FIX for a problem. Admins and users don't update their systems diligently. And anti-MS zealots are suspicious of auto-update, which deals with the lazy admin problem. Open source makes very little difference here. Holes are still being found in old open sourced code.

[Milwaukee_Guy]

My Fortune 500 company e-mailed us and told everyone to stand down and wait for their own IT brainiaks to review the situationn. No MS patch downloads permitted until there is a review.

Private industry apparently doesn't need to take heed of Tom Ridge's warnings.

Who's right?

[Crusader21stCentury]

Microsoft has also advised customers to protect their network with a firewall.

This is getting serious, folks!

I know of no legit company that connects to the internet without a firewall. This is just more blather, if you have a system or a network on the net it is vulnerable, no matter what OS you use. If you don't want it hacked unplug it from the net.

[Gorzaloon]

My Fortune 500 company e-mailed us and told everyone to stand down and wait for their own IT brainiaks to review the situationn. No MS patch downloads permitted until there is a review. Private industry apparently doesn't need to take heed of Tom Ridge's warnings. Who's right?

Probably not your IT department. Speaking for my Fortune 500, the IT department arrives in a short bus. As an overhead department, whose expense could entail a slight impact on a worthless VP's bonus, they buy CHEAP. They make a point of hiring brainiacs who have been picked over and left by everyone else, recent tech school grads who stay only long enough to gain some experience before being starved out and bolting. The ones who remain to become "Senior" are the ones who could not get hired for better positions elsewhere.

I locked them out of my BIOS last year, and have the only machine that always boots Monday Mornings. They whine, and say, "It's not your computer"...Well, it isn't theirs, either.

Your mileage may vary..there very well might be companies out there who demand the best employees..After all, ours are escaping SOMEWHERE!

[BeerSwillr]

I think I'd listen to your IS folks before Tom Ridge...

[EggsAckley]

Both of your links link to:

Document Not Found Sorry, the requested document does not exist on this server.

Are you SURE this article isn't perhaps a joke or malicious page just to scare people and/or sell software?

[ikka]

I know of no legit company that connects to the internet without a firewall.

The link to the info does not come up for me, at least at the moment.

However, many of the new viruses can tunnel through a firewall in ways that are difficult for a firewall to block, yet still pass legitimate traffic.

[TomServo]

The federal government says there is new evidence that an attack is being planned on computers using Microsoft's Windows.

Aren't these the same guys who try and grab our guns and leave our borders wide open? I'd think they'd have better things to do...

[Milwaukee_Guy]

I was holding back. You speak truth Kimosabee.

I too have the only network PC that actually works and won't let an IT guy touch it.

Not that I'm all that good. Our IT guys are unfortunatly pretty low on the food chain.

VP salaries are the reason we all exist now....

[Gorzaloon]

Not that I'm all that good. Our IT guys are unfortunatly pretty low on the food chain.

Oh, I figured all our good ones were going to YOUR place!

I do not consider myself a guru with computers, but in the land of the Blind, the One-Eyed Man is King.

[Jay D. Dyson]

U.S. says Windows vulnerable to attack

And gee, it only took Nimda, Code Red (I & II), Melissa, ILOVEYOU, the MS-SQL Slammer worm, and about an @$$load of other viruses, trojans and worms to recognize this.

Good call, guys. Next thing you know, you'll be telling us that rain is wet and sugar's sweet.

-Jay