Slashdot Mirror
HomeSec Warns Again About Microsoft's Insecurity
cbrandtbuffalo writes "The Department of Homeland Security has posted this advisory about an impending attack on MS systems. This RPC attack has already been seen in some localized systems, but may spread as unpatched computers are exploited. Some of the national news like CNN are running stories too."
My friend works at MIT's network security.
From wednesday to thursday they're compromise rate
went from 3 computers an hour to 30.
Right now they're just blocking the RPC port
but the routers are starting to take some heavy
traffic. Looks like this one is going to be pretty
bad.
ThunderBird. Nuff said.
Sounds more like The Department of Homeland in-security :)
Joking aside I find the US media's "fear hyping" to be outrageous.
"It could happen to you" Is a major catch phrase for the US media, and they are not talking about winning the lottery.
wonder how they (DoHS) are feeling about their OS investment already? :)
Sehr geehrter Toilettenbenutzer!
Along those lines, since most of the design flaws are downplayed for weeks/months/years after exploits are found. Apple, RedHat and SuSe have a good lead time to prepare switch campaigns.
I'm sure a dollar value can be put on the peace of mind and increase productivity that goes with moving to a better workstation platform.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Patch your stuff and for goodness sake put up a firewall! RPC port open to the word? Why?!
It's time the government started to realize its own linux version has been developed to preclude vulnerabilities such as these that are caused mostly by sloppy programming.
Of those to whom much is given, much is required.
A well engineered worm would:
Work on many different system.
Use more than one security flaw. (spread by email, + kazaa, + IE hole, + sendmail hole)
Patch that flaw once compromised, and open a separate hole
Have at least different attack modes (slow and quiet and local sub nets, fast and hard and whole internet)
Build up to critical mass before initiating fast attack mode.
Attempt to hide itself from scans. (maybe randomly stop functioning for a while to offer false sense of security)
Adjust its fingerprint so that it isn't simple to find computers which have the worm (use different ports, different protocols, send some different data when filling buffers etc)
Offer a payload that makes patching difficult, goes after security websites that often offer patches, targets financial institutions, etc.
Patch other programs on the system, back to previous insecure versions.
And that's just off the top of my head. If someone really is sitting down and thinking about this, Im sure they could come up with much more dangerous specifications.
I think someone should be writing a competing worm that patches all vulnerable systems, just in case this breaks out in to a chrisis.
Im not here now... Im out KILLING pepperoni
Perhaps ISP's should just block RPC at their routers that feed broadband users. I can't think of any good reason most people would want it to be exposed anyways, on a residential broadband account at least.
That, or ditch Windows entirely (novel idea, I know :-)
All I want is a kind word, a warm bed and unlimited power.
These days you can buy a computer for not much more than the price of Windows XP home (retail version).
They're not great machines, but they're better than a PII 266mhz.
Or as other people said, ditch windows entirely.
Think of it as "Homeland Security eats its own dog food..." In other words, they are using the same operating system that the vast majority of people use, so they will experience the same vulnerabilities. They'll be able to advise people about computer security from first-hand experience, not just from a few pristine 'test lab' machines.
That's a good spin on an incredibly incompetent IT decision, but at the end of the day, spin is all it is.
You want a testbed for vulerability? Fine. Set up a windows lab with its own dedicated internet connection and absolutely no way to talk to the rest of your internal network. Catalog, experience, and enjoy the chaos that ensues.
Do not, I repeat, do not deploy it as your platform for collecting, collating, analyzing, and addressing security threats. What good is Homeland INSecurity going to be when they need to address a real, meatspace threat and a Microsoft worm has taken down most of their IT infrastructure?
Some perhaps, but they certainly will be operating at a severely degraded effeciency level.
The Future of Human Evolution: Autonomy
I agree with you. But if you have 128megs of ram (or even 64), I would strongly recommend upgrading to Windows 2000, for the stability alone. A P2 266/300/350 with Win2K is a fine machine.
I'm a writer, a poet, a genius, I know it. I don't buy software, I grow it.
Is it me (insert tinfoil hat joke), or is anyone else disturbed by the increasing tendency of ISPs and vendors to say 'just block port xxx' on your network connection, as a response to problems? Is this one more step on the road of converting the Internet to simply an MSN-ified WWW? Where does the small, independent content creator turn as more and more barriers to market entry are enacted, either by FUDding ISPs, lobbying Congress, and blatant stupidity?
I want to delete my account but Slashdot doesn't allow it.
As far as DoHs getting in on the action - I think they'll cry wolf at anything to keep interest. The more afraid the public is on a daily basis, the more they are legitimized. I was appalled the other day to see this article on the front page a few days ago - no shit guys, thanks for the press release. Ya know what else? .COM stocks might not be the best investment if the company hasn't produced a product.
Obviously this hole is a major one, but we've kinda known that unfirewalled Windows boxen on the net are a Bad Thing (tm). This hasn't changed, and it's not much more likely now for a worm to run rampant through everything that it was in the past - it'll happen, it'll suck, and everyone will do the same fire drill as every other time it happened. And a few, bright IT departments will switch to FreeBSD or similar for their external machines or put up a bloody firewall.
I write code.
I'm very much pro-Linux. I switched from Microsoft to Linux years ago. It was kind of hard because so many "fun" programs could only be had in Windows. So I ran a dual boot for quite some time.
I finally removed Windows altogether. After a few months of running only Linux it struck me. My system had NEVER crashed after doing so. Programs would sometimes hang but the system stayed up, not requiring a reboot. It was like an epiphany. I just started laughing!
I was also relieved that I no longer had to worry so much about viruses. Or do I?
My question is: If Linux becomes the dominate desktop and virus writers switch their main focus onto my OS of choice, would we be in as bad a shape as Microsoft's XP, 2000, etc?
The race isn't always to the swift... but that's the way to bet!
And they also said Windows 95 would run on a 386 with 4MB of ram. Anyone ever try that? They also said Windows 98 will run on a 486-66 with 8MB of ram. I've seen that and it's not pretty.
It is possible, and it is useable, it certainly is not too responsive.
As there is a permanent terrorist alert going on, could it be possible that everybody is scared from going about and conducting their business? Can this explain USA's shitty economy while Canada's is better than ever and the CA$ is constantly going up?
[tasteless joke]
Go MiniHomeSec! Let us commie canadians get on top!
[/tasteless joke]
You're not old until regret takes the place of your dreams.
I see that to apply the Windows patch on the Win 2k machines you gotta have Service Pack 3 or higher. Question: Isn't that the Service Pack at which the wonderful new licensing scheme kicks in? How convienient.
Did anyone else notice that they equated scanning to cracking? While I know that's certainly one of the possible preludes to attacks, it's certainly not a definite. I've used scanners quite legitimately more than once (checking what was visible from outside a firewall for my father in law, and testing to see if a non-responding server that I myself was responsible for even had its services running, despite it not being at my present locality). The internet was built to be open initially, and while it's understandable that it now needs security, people need to realize there's more to the internet than ports 80 and 6667, (plus those ones that most users don't ever see, like their port 25 services or port , ). There is far more to networking than HTTP, and the internet is a network.
It's getting to where knowledge is a crime, and while I feel it would be prudent to learn more and more about computer security, I fear that merely knowing it might make me liable to be wrongly prosecuted. There's just come to be so many legal barriers or poltergeists that it just carries too great of risks for the curious to enter the field.
In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
Wow, a malicious worm. I'm completely bewildered by the fact that melissa, code red, etc didn't have a seriously nasty payload. It seems like the virus authors just wanted propagation for bragging rights. It wouldn't be so tough to write a function that will corrupt the registry or start formatting important parts of the disk after x amount of hours.
Windows has yet to see a serious threat by a popular worm and when it does there will be a lot of heat on Microsoft, whether they deserve it or not. "Wintel everywhere" is a classic eggs in one basket gambit and heads are going to roll if 1/3rd of all computers on the internet suddenly refuse to boot up again. Something like 40% (?) of all computers on the net are not behind a firewall and who knows how many are patched.
What I'm afraid of is that if something this bad and on this scale happens then DRM will go from controversial content protection to a Tom Ridge mandated upgrade. Your computer WILL download the newest patch and you will not rip MP3s from the newest Shania Twain CD or face the consequences (ISP banning you, fines, etc).