Slashdot Mirror
Microsoft Bracing for Worm Attack
10010010 writes "A network worm attack targeting a critical Microsoft Windows vulnerability appears inevitable. The flaw is easy to exploit, as evidenced by the quick release of an exploit module for HD Moore's Metasploit Framework. Within hours of the Patch Day release Tuesday, two pen testing companies (Immunity and Core) created and released 'reliable exploits' for the flaw, which was deemed wormable on all Windows versions, including Windows XP SP2 and Windows Server 2003 SP1."
I'm confused and I'd like to know if my building's Window's administrator needs to be put on suicide watch. He was up all night last night. From what it sounds like, he spent all that time trying to increase the security of our machines when he was really just altering the application so that the virus that came out 24 hours later would be able to attack the machines
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
This should remind Windows users about complacency.
the more they over-think the plumbing the easier it is to stop up the pipe
I guess this must be what DHS was worried about when they started issuing press releases about running Windows Update right now.
Of course, I've got automatic updates turned on and set to download and install every night, and I leave the computer on all night, and it has yet to tell me it downloaded and installed this critical update. Way to go, Microsoft.
OK, maybe I'm just missing an acronym/typo somewhere, but "pen testing?" Will the worms come through my Mont Blanc?
What do you mean they cut the power? How can they cut the power, man? They're animals!
How will this effect my pirate... er my neighbor's pirated unpatched system?
Our enterprise file servers run w2k3sp1... Those ports are open on these machines. Basically we have to hope that noone brings infection inside.
there is no issue with my network
Penetration Testing. It's where you stick that mont-blanc through the case wall and if it damages something you need to get a patch (for the case) from microsoft.
/* TBD */
"Pen" is a commonly used short term for "penetration" so you could interchange "pen testing" with "penetration testing."
Or, in your case, you would request full pen videos when you go to video rental store.
"The Cyber Gnome here. Denouncer of computer myths. Who needs to download security patches? I don't, and I've never had any prob%$#@@@@#^_@_#@ NO CARRIER"
Where were you when the voynix came?
From TFA:
<blockquote>A spokesperson for Microsoft said it is difficult to predict the motives and actions of attackers but insisted the company is "watching round-the-clock" and actively encouraging customers to download the update immediately.
"We will mobilize if something does happen," the spokesperson said.
</blockquote>
They'll mobilize? Mobilize? As in "get the heck out of here"? Or are they calling the [GI]Joes?
As a Slashdot discussion grows longer, the probability of an analogy involving cars approaches one.
If there's anything I can do to help get a worm going for this baby, respond back here. I'd love to stir up some shit.
Tell your "neighbor" that if he doesn't want to pay for an OS, that he shouldn't be using Windows.
But if he's too fucking cheap to get an OEM copy or something and too fucking stupid to bypass the WGA, he should be prepared to have his ass handed to him when this shit hits.
I'd recommend him going to ubuntu.com, though.
Here is the actual patch page for every version of Windows and further information.
'He was a dreamer, a thinker, a speculative philosopher... or, as his wife would have it, an idiot.' - Douglas Adams
which was deemed wormable on all Windows versions, including Windows XP SP2 and Windows Server 2003 SP1
HD Moore posted a followup to the Daily Dave mailing list admitting defeat on those two platforms:
Time to eat my words. The wcscpy() destination pointer trick doesn't seem
doable on XP SP2 or 2003 SP1. I don't believe you can exploit this bug
for more than a DoS on 2003 SP2/XP SP1. If you have information to the
contrary, please share.
All other Windows platforms remain easily exploitable, though.
Your pirate neighbor should be ok. I'm pretty sure the green parrot on his shoulder will eat any worms. If not, the patch over his right eye is probably the most current out there.
I hope, when they die, cartoon characters have to answer for their sins.
Here's my suggestion for a new Microsoft Windows mascot. She's old enough to be public domain, she's tanned, she's rested, she's ready, and she's all patched to hell. All the better that Redmond is located in the vicinity of America's "Emerald City". Please, pay no attention to the borg behind the curtain.
Where were you when the voynix came?
Its funny that yesterday the Dept of Homeland Security (I can't say that name without laughing) was so concerned about patching Windows but -er- there was a plot to blow up ten planes. Misplaced priorities?
Your pirate neighbor (what, do you live on a WHARF???) should be able to get around this by launching his Windows in pirate mode. He has to boot to the command line, and then enter WIN.EXE -R -R -R. Also, has he considered the eyepatched system? It might be more useful to him than the "unpatched system" you mentioned.
Where were you when the voynix came?
FTFA it seems that my Windows 98 box is quite safe, thank you very much.
and developed a worm to exploit the vulnerability that was fixed, which will target systems who have not yet been patched. If you've applied the patch, you're safe from this worm. It's targetting unpatched systems.
From the title, I wondered if they were harvesting spice. "Wormsign! Is that wormsign?"
So companies like Immunity reverse-engineer an identified Microsoft patched vulnerability, release an exploit and expect kudos? Impressive as it may sound, I would be more interested to hear of a company discovering a vulnerability and releasing it to Microsoft so it can be patched. If I can't create a virus/worm to wreak havoc on Windows machines, what makes these companies able to reverse-engineer and release the "0-day" exploit? It almost seems unethical. Also, it seems like Immunity and others are trying to make a name for themselves rather than being interested in user security.
Well, it's better than calling it "digital penetration".
I've had enough abrasive sigs. Kittens are cute and fuzzy.
I wonder what the DHS has to say about this, having just the other day told us all to patch all our Windows systems.
stuff |
The "pen test" is to see whether it much easier, faster, safer, and cheaper to create a document using a pen and paper compared to booting up the computer and doing it there.
Where were you when the voynix came?
Well, it's better than calling it "digital penetration".
Yes, that involves something entirely different... wink, wink, nudge, nudge, say no more!
GetOuttaMySpace - The Anti-Social Network
It's good you pointed that out, because NOBODY understood that the grandparent was making some sort of SEXUAL INNUENDO.
Since he probably fears Windows Update because there's an "important security update" called WGA waiting to bite him, he is not going to be protected from an upcoming worm, which will add his computer to a botnet. His computer will be somewhat slow sometimes and he may find his personal data used as anti-bayesian spam filler, but otherwise he won't notice a thing. You on the other hand will receive tons of spam and if you act up and try to hunt down spammers, you will also learn how much upstream bandwidth your friendly next door pirate can contribute to a DDoS attack against you.
When I saw the list of patches my machine had downloaded the other day, I thought "this one's going to be trouble. Maybe we'll see a blaster-style worm based on this one."
However, the vulnerability I was looking at was MS06-041 (remote buffer overflow in DNS client), not MS06-040 (remote buffer overflow in server) which I figured most people would have firewalled/disabled anyway.
I mean, DNS client? The best the "mitigation" section of the advisory can say is that an attacker would have to make your machine issue a DNS request to a domain they controlled in order to exploit it. Which wouldn't exactly be hard, would it?
Oh, so that's what those Intel case stickers are for. I always wondered!
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
Emperor Shaddam Gates IV admitted today that the high rock formations that ring the city of Arredmond might not be able to repel a full-on attack by the Frehax0rz and their giant worms. Story at 11.
Find environmentally and socially responsible products on http://buy-right.net
This would not have happened had Microsoft walked without rhythm.
Those who believe the Internet is private,
find their privates are on the Internet.
The troll side of the force is strong in this one.
Where were you when the voynix came?
... and the worms ate into his brain. (Pink Floyd)
try { do() || do_not(); } catch (JediException err) { yoda(err); }
So, everyone was saying "EEEEEvilllllllle Homeland Securtiy is telling us to do something with out releasing details! They must be up to something..."
Yep, they were telling us that something like this was about to happen.
Cliff Claven
K.E.G. Party Chairman
Founding Leader of: Koncerned for Egalitarin Governance
Personally, I'm partial to those nifty four-color pens.
Are there also "half penetrating videos"? I would imagine f***ing with the half-length of the dick would be very difficult to master.
its times like these im glad im using linux http://www.ubuntu.com/
Goddamn if only I had mod points.. this deserves a +5 insightful:
Try #hackers on irc.fbi.gov
At the very least...
Have mod points, but I refuse to mod a post (+Funny, in this case -- not Insightful) that includes the punchline but doesn't quote the context -- that still sits at Score: 0. How would it make any sense to someone who's surfing at, say, level 2?
The bulletin states that this is a buffer overflow vulnerability and that a firewall would protect against an exploit. It does not mention whether Data Execution Prevention (which is supposed to monitor for buffer overlows), included in XP SP2 and 2003 SP1, would prevent the exploit. Anybody know if it does?
Until after this theorectical worm takes over the planet?
There are a lot of things in place today which weren't in place back with Blaster that allow IT depts to respond to these events... beyond just patching I mean.
This makes me long for the good old days, with Windows 98SE, where most ports were closed and exploits mostly came in through Outlook and IE.
Running Thunderbird and Firefox would solve the Outlook and IE exploits today.
Any netadmin that allows VPN connected networks full access to their internal nets are idiots who need to get fired VERY soon.
The best admin I know says to treat VPN clients like neighbors from down the block... I'll let you in but watch you every second you're here. That means he sticks them on an untrusted nets with full IDS/APS setups. Additional, like all the well run sites I've worked, VPN (with two-piece auth) was only the gateway to allow access to a net with secured terminal services boxes (ssh/cytrix). You still had to hop networks once you logged in to get to email/messaging/intranet.
Heck, I don't even think the production guys had any access to the production server via network, I only saw them modify production by opening up the iris & passcard door then dragging out the com cart. All the site/status monitors were IN the production room pointed out the the monitoring center behind the shot proof glass.
Perhaps it would be useful for you to consider haveing those laptops on XP SP2, and configuring them through GPOs so that when they're not at work, they close those ports, and then some.
I believe you meant to say "every *supported* version of Windows", as I see no patch for Windows 98 users. I'm not one of them, but unfortunately, some family members still are.
Of course, these family members are also firewalled, so I'm not particularly frightened.
I'll create an amusing sig when I have something meaningful to post.
If you walk without rhythm, you never learn
After calming me down with some orange slices and some fetal spooning, E.T. revealed to me his singular purpose.
It's true, pirated software is the most secure, they either have no patches or just one. Sure, you may get scurvy, but hey, it was free!
If you mod me down, I shall become more powerful than you could possibly imagine.
This signature was going to be a lot nicer but I had to cut a lot of features in order to get this post out without any further delays.
I shudder at the thought of a horse pen.
True confidence comes not from realising you are as good as your peers, but that your peers are as bad as you are.
Todays Microsoft Update menu
KB666123456 - Patch, Worm, Worm and Patch
KB666456789 - Patch, Worm, Worm, Worm, Worm and Patch
KB666666666* - Worm, Worm, Worm, Worm, Worm, Patch, Worm and Worm
* May not contain patch
Last night, I tried pen testing with my wife, but her firewall blocked all access attempts...
Security updates are still available even if you're not "genuine". Your "neighbor" should be fine as long as he patches.
It's also worth noting that according to the reports, the now "un-supported" Win98/ME OS is not vulnerable to these exploits.
"I'm a Windows user.
:)"
Can somebody please tell me what the hell a port is?
A port is where software pirates come to collect their booty. In this case your pron. They sail in by using special software to "surf the web" and come into your port. Once in your port they have to fight with swords in order to capture the port (just like in the game Pirates by Sid Myers... it looks just like that.)
Once they are in your port you're screwed, all the walls in the world wont stop them.
How many exploits should there be before dumping C alltogether? use Cyclone, for Christ's sake.
(Idiot's yearly salary) - (Hours IT works to correct problem) × (Avg IT hourly salary) - (Productive hours lost) × (Avg hourly production in dollars) < 0? ==> Fire that asshole.
blarg.
There's usually a backdoor somewhere, often unprotected.
Man, you really need that seminar!
Just got an IS alert:
Network and Internet performance for [...] is currently being impacted a virus outbreak.
The IT Network team is working to identify the systems that have been affected by a virus outbreak at the [...] site. We hope to have everything back up and running as soon as possible.
to look for some 'Cacky Pants'. [...] To me, it describes, "Soiled underwear".
This is strange, since "khaki" is a British term.
Although it reminds me of a similar anecdote I heard in Jamaica, where khaki in American pronunciation ("kacky") comes across as "shitty", and in British pronunciation ("kah-ky") comes across as "penis-like". Endless hilarity, unless you're the hapless foreigner.
A port is something you sail a ship into.
:-)
Like, duh!
I suppose I should be more positive and describe this as the "least useful" article I've read in some time. The writers have found eighteen ways to say "Ooooh, it's going to be terrible. Apply the patch!" without saying anything substantive about the threat.
What's the penetration vector? How is it transmitted? How is it initialized? Is the patch the only protection, or is it enough to make sure no one executes mail attachments? Can it get through firewall NAT and SPI? Etc.?
There are a lot of questions that could have been answered in the last seventeen paragraphs of the article instead of finding seventeen alternative ways of repeating the same message.
If, as is likely, there is nothing of substance in the article because there is nothing of substance in the threat, it would seem that this is just another attention-getting device by a organization whose revenue depends on FUD. Isn't "Y2K" a verb yet?
I'm a Programmer. That's one level above Software Engineer and one level below Engineer.
I resent your remarks.
My "parrot" is grey, not green. She doesn't eat worms, she eats seeds, pasta, rice, and leafy green vegtables. NO, I don't have a patch over my right eye. (http://tielair.blogspot.com).
I have, however, patched my Windows machine at home.
"Penetration Testing."
How many times have I to say you Must Stay Away From Intarnet Pr0n???
(you dirty guy...)
So much fuss is about worms. Yes, they're a problem, but they're rathr late on the scene.
Vulnerabilities get exploited against hand-picked targets (financial and business data) for weeks or months all the while the PR team spouts off about no known exploits "in the wild". What a crock.
In the TCP/IP protocol suite, each computer with an interface to the network is considered a "host". Each host can have programs running that listen on a specific "port" (consider it a po box). When a packet arrives over the network for that port, the program wakes up and gets the data.
Regards, Douglas W. Goodall