Posted on 08/11/2003 2:33:46 PM PDT by STFrancis
All,
Here a scoop to Freepers which is just now hitting us security pro's.
There is a first vulnerability that uses the MS Bug that MS addressed with MS 03-026 two weeks ago.
It is calling itself MSBLAST.exe and is spreading in the wild unbelievably fast. http://isc.sans.org/diary.html?date=2003-08-11
A first advisory from McAffee has just been published: http://us.mcafee.com/virusInfo/defa...&virus_k=100547 Once it finds a vulnerable system, it will spawn a shell on port 4444 and use it to download the actual worm via tftp. The exploit itself is very close to 'dcom.c' and so far appears to use the "universal Win2k" offset only.
In other words we need to make sure port 4444 is blocked inbound AND outbound.
Of course this is in addition to the MS03-026 patch being installed which Microsoft released two weeks ago (more info regarding the patch here: http://www.microsoft.com/technet/tr...n/MS03-026.asp.
Another advisory was JUST posted by Symantec: http://www.symantec.com/avcenter/ve...aster.worm.html
Just thought everyone ought to know.
Thanks...
Conceptual mixing/matching. B3 is a feature set available within a certain environment. It gives you a description of security features in a perfect world. It doesn't tell you dick about how secure it is in the real world. There is something fishy about this in that any environment that would meet that classification would necessarily bludgeon the Windows APIs to death, meaning that you either 1) can't run your old XP software on Longhorn, or 2) one of the conditions for B3 constrains the core APIs you are allowed to use and probably invents new ones.
And as anyone can tell you, the BSD variants are among the most bullet-proof and hack-proof network server OSes in common use, and they don't even have a certification. What they do have is incredibly well-engineered and thoroughly reviewed/tested code. This is why so many of the major Internet sites run on FreeBSD even though it is not a common desktop OS.
I've managed all manner of OS on the Internet, and I for one would put my money on FreeBSD versus Longhorn for real-world security. And even though we have tons of Linux boxes running around here, they never have the security problems that the Windows boxes have in practice. If Windows ever became even AS secure as Linux (or even better, FreeBSD), it would really make the NOC guys happy because it would eliminate a lot of pain.
You out-nerd me. ;)
No Google, just long-infected nerd.
My old C-64 -- my first computer -- along with a pair of 8514 drives, a cassette drive, and a 14" 40x25 monitor, are up in the attic to this day. I wrote just enough 6510 code to get the bug, badly enough to give up practicing law for writing code as soon as I got good enough to get a job at it -- one Kaypro and one Compaq later.
That was really cool, and I made a lot of money at it, until last December. I got canned right before Christmas, after nearly a decade with the company :-).
Of course, there aren't a lot of lawyer jobs available, either...
No fair. You were already included in the original count.
Look at the comments when Apple releases a security update: http://www.versiontracker.com/dyn/moreinfo/macosx/15934&page=16
What you need to bear in mind, all CERT advisories for UNIX (BSD) need to be considered for Apple OS X. Apple repeatedly will answer: "Does Not apply". Then 6 months or so will go by, before Apple will quietly release an "update" that will address the security issue they've previously claimed: "does not apply". That’s how Jaguar came out. Also, Apple, even though they technically "don't support" OS9, still has OS 9 elements in Mac OS X and therefore there are ways to break into a system that way too.
The particular flaw discussed in http://www.pcw.vnunet.com/News/1133364 was in the OS X since the beginning and finally addressed by Apple about a year later. (Could Microsoft get away with ignoring an open security flaw for a year?) I’ve had personal experience with Apple ignoring flaws in the TCP/IP layer for more than a year – the OS was mis-negotiating the packet size.
It is possible to hijack an Apple system (its just UNIX underneath). And if Mac users are conditioned not to administer their system, and get sloppy, and Apple denies that there is anything wrong, when great flaws were there, then Apple will stay at 3% or less of the market.
No system is perfect. Windows is a big target. And the biggest problem with windows is not so much the weird ways people can figure out malicious attacks against the systems, but the sloppy administration habits of Windows Administrators. A fix was available for the Code Red worm, for example very early when the vulnerability was found, but not enough people applied the update that was available for them. I guess I’d rather be with a company that makes updates available than with one that denies there is a problem. Macs have their uses, but not for serious administration given the current attitude of the Apple management.
By all means. Get the latest windows and still find yourself being hacked.
Or, next time your PC needs to be reloaded, (Which should be NOW btw, if you got infected, because there is no way to tell how much damage was done.) Why not download a copy of RedHat, Mandrake, Debian, or SUSE Linux and install it instead of windows. Use it for a few days to a week. If you find it doesn't suit the way you like to work with a computer, you can always simply reload windows, and you're no worse off than you were before, but you will at least have tried to get off the windows treadmill.
Excellent advise. The default policy on any firewall should be DENY ALL. Then, if you find you really need a specific port, you can open it up. It's even better if you can open up a specific port to a specific computer.
True, but post 9/11 it's been a lot harder to get plutonium...
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.