Slashdot Mirror
HomeSec Warns Again About Microsoft's Insecurity
cbrandtbuffalo writes "The Department of Homeland Security has posted this advisory about an impending attack on MS systems. This RPC attack has already been seen in some localized systems, but may spread as unpatched computers are exploited. Some of the national news like CNN are running stories too."
The security people at my office were talking about this vulnerability yesterday in our monthly meeting, they were saying it is likely going to be worse than slammer/code red/etc (which the article seems to back up)... Do you guys think this is that serious of a threat? A lot of what they were saying sounded like worst case scenario kind of stuff, hopefully it will not be that large of an issue. One interesting thing that the security people mentioned, that the article doesn't, is that windows 98/windows 98se is vulnerable but Microsoft has not released a patch because they no longer support the product.
Visualize the world of wine
This is turning out to be a huge problem, we got the exploit a bit *cough*early*cough* and by simply joining a channel on IRC you get a handful of IPs, of which at least a few are exploitable. And then they wonder why there are a thousands of ddos zombie machines running windows!
But there's another problem, a lot of people are starting to distrust microsoft and are turning off the automatic update / not getting service packs instead of switching to another operating system.
2 years / millions of dollars and the Home Land Security people tell me that people like to attack Microsoft Products.
I'm glad I pay all those taxs!
-- Disclaimer: I can't really back up anything I post on
My friend works at MIT's network security.
From wednesday to thursday they're compromise rate
went from 3 computers an hour to 30.
Right now they're just blocking the RPC port
but the routers are starting to take some heavy
traffic. Looks like this one is going to be pretty
bad.
ThunderBird. Nuff said.
Could we not go around referring to The Department of Homeland Security as HomeSec? The last thing we need is /. popularizing a cool sounding name for this behemoth.
If we need to refer to it then use the initial letters of its name... DoHs.
Somehow appropriate when they put out warnings like the last one.
John.
Sounds more like The Department of Homeland in-security :)
Joking aside I find the US media's "fear hyping" to be outrageous.
"It could happen to you" Is a major catch phrase for the US media, and they are not talking about winning the lottery.
After all, they're giving Microsoft $90 million to run their computers.
wonder how they (DoHS) are feeling about their OS investment already? :)
Sehr geehrter Toilettenbenutzer!
The whole Microsoft staff end up in Gauntanamo bay without trail or legal representation :) Seems fair to me...
I love stacking my barbecues in the shed at the end of summer - you can't beat a bit of grill on grill action.
i could have sworn that 2 weeks ago, here on this very same slashdot....there was a story about HomeLand Security securing a very large purchase from Microsoft....aka 100 million, or some outrageous number like that..
isn't this a bit irresponsible of them, now that they are declaring Windows a vulnerability?
We're like rats, in some experiment! -- George Costanza
Microsoft is now officially a threat to Homeland Security. Maybe George should drop some bombs on Redmond! We know where they are and they keep putting out a product that threatens our security. Oh wait, the government saw fit to give them a slap on the wrist and turn around and contracted even more unsafe software from them. They'll undoubtedly be mentioned in future hindsight publications from congress but on blanked out pages for national security reasons. That's what we do for "friends".
Ugh.
Wilersh
On the DHS alert color code, blue means "guarded", just one notch lower than the alert level the USA have been living in for the last few months (with occasional orange flares). Should this color be reconsidered in sight of the well known Blue Screen of Death?
Along those lines, since most of the design flaws are downplayed for weeks/months/years after exploits are found. Apple, RedHat and SuSe have a good lead time to prepare switch campaigns.
I'm sure a dollar value can be put on the peace of mind and increase productivity that goes with moving to a better workstation platform.
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Patch your stuff and for goodness sake put up a firewall! RPC port open to the word? Why?!
It's time the government started to realize its own linux version has been developed to preclude vulnerabilities such as these that are caused mostly by sloppy programming.
Of those to whom much is given, much is required.
A well engineered worm would:
Work on many different system.
Use more than one security flaw. (spread by email, + kazaa, + IE hole, + sendmail hole)
Patch that flaw once compromised, and open a separate hole
Have at least different attack modes (slow and quiet and local sub nets, fast and hard and whole internet)
Build up to critical mass before initiating fast attack mode.
Attempt to hide itself from scans. (maybe randomly stop functioning for a while to offer false sense of security)
Adjust its fingerprint so that it isn't simple to find computers which have the worm (use different ports, different protocols, send some different data when filling buffers etc)
Offer a payload that makes patching difficult, goes after security websites that often offer patches, targets financial institutions, etc.
Patch other programs on the system, back to previous insecure versions.
And that's just off the top of my head. If someone really is sitting down and thinking about this, Im sure they could come up with much more dangerous specifications.
I think someone should be writing a competing worm that patches all vulnerable systems, just in case this breaks out in to a chrisis.
Im not here now... Im out KILLING pepperoni
Most government departments actually are designed to achieve the opposite of their names. For example, the "Department of Homeland Security" is in fact designed to control the level of insecurity that people feel. Likewise, the ministry of defence is really about offence, and in 1984 the Ministry of Information is about disinformation and so on.
In the book, the language was controlled to the point of creating new terms like IngSoc, MiniPax (ministry of peace, really designed to perpetuate war), and Double-plus good.
The whole point here is to justify the actions of the government. Because it becomes alot easier to justify removing civil rights when there is the perceived threat of some common enemy.
-- the only thing we have to fear is really scary things
This suggests a new marketing slogan:
"If you don't upgrade to Windows XP, then the terrorists have already won!"
"Which port is it that you need to block?"
:-D
To make windows secure?
All of them.
You only have to block the port where the power cord goes into the computer.
--- I wish I could hear the soundtrack to my life. That way I'd know when to duck.
I'm a tech on a Windows network for the local government here and we immediately disable Automatic updates on machines now. Lord knows it's not because we're Linux users (I'm the only one) but because the updates all too often BREAK things that were already working.
Maxim: People cannot follow directions.
Increases in truth directly with the length of time spent explaining them
Concidence or not? google news' primary link to this story points to the register's article about this vulnerability. In their best sour Brit register tradition theyre none too congratulatory about "free patches". Does bandwidth cost money?
Of those to whom much is given, much is required.
Windows of Mass Destruction?
A clever person solves a problem. A wise person avoids it. -- Einstein
Jeez, you Microserf zealots are getting irrational and touchy. Back off man, that's our shtick. ;-P
If you were blocking sigs, you wouldn't have to read this.
To make your computer truely secure, follow these simple steps:
Should be truely secure... But for the overtly paranoid, concider dropping the planet into your local black hole. Please note that there may be information leakage as any entropy is represented on the black hole's event horizon.
Not practical... But fun.
-- The universe began. Life started on a billion worlds...
-- Except on one where stupidity was there first.
"Based on this notification, no change to the Homeland Security Advisory System (HSAS) is anticipated; the current HSAS level is YELLOW."
Hasn't it been yellow for like ever? I think they just can't figure out how to change the bulb.
Slightly more seriously, are we all comfortable with the idea that the Vaterland Security Advisory System is now here to stay, and that it's now featured in contexts where the words "external" or "terrorists" don't appear? That Homeland Security bulletins, much like the "troops killed in Iraq" daily scorecard, are now routine routine occurances?
I've just had a kid. When he starts asking what the HSAS is, what do I tell him? "We're at War, junior. We've always been at War. Terrorists, drug barons, organized criminals, religious extremists, crackers, hackers, commies, arabs, they're all out to get us, and it's important to know just how scared the government wants us to be that we're going to die today."
Nice world he's going to grow up in.
If you were blocking sigs, you wouldn't have to read this.
Is it me (insert tinfoil hat joke), or is anyone else disturbed by the increasing tendency of ISPs and vendors to say 'just block port xxx' on your network connection, as a response to problems? Is this one more step on the road of converting the Internet to simply an MSN-ified WWW? Where does the small, independent content creator turn as more and more barriers to market entry are enacted, either by FUDding ISPs, lobbying Congress, and blatant stupidity?
I want to delete my account but Slashdot doesn't allow it.
If I understand right, 4444 is the port the exploit for the DCOM bug connects to.
/* port 4444 bindshell */
I updated all my systems,and firewalled 135/139/445(UDP and TCP) and 4444(TCP).
I know I am gonna get modded down for this,but if you dont have already, I suggest you fix this ASAP.
You can get the fix from here for windows 2000, and here for windows xp.
The exploit has it in the code:
target_ip.sin_port = htons(4444);
Also, notice the comment about the shell code:
Dan
Security consultant
ClickNews
As far as DoHs getting in on the action - I think they'll cry wolf at anything to keep interest. The more afraid the public is on a daily basis, the more they are legitimized. I was appalled the other day to see this article on the front page a few days ago - no shit guys, thanks for the press release. Ya know what else? .COM stocks might not be the best investment if the company hasn't produced a product.
Obviously this hole is a major one, but we've kinda known that unfirewalled Windows boxen on the net are a Bad Thing (tm). This hasn't changed, and it's not much more likely now for a worm to run rampant through everything that it was in the past - it'll happen, it'll suck, and everyone will do the same fire drill as every other time it happened. And a few, bright IT departments will switch to FreeBSD or similar for their external machines or put up a bloody firewall.
I write code.
But you can get an idea about what ports are sitting out there either listening or actively transferring.