Slashdot Mirror

← Back to Stories (view on slashdot.org)

Microsoft Bracing for Worm Attack

Posted by ryuzaki0 on from the red-alert dept.

10010010 writes "A network worm attack targeting a critical Microsoft Windows vulnerability appears inevitable. The flaw is easy to exploit, as evidenced by the quick release of an exploit module for HD Moore's Metasploit Framework. Within hours of the Patch Day release Tuesday, two pen testing companies (Immunity and Core) created and released 'reliable exploits' for the flaw, which was deemed wormable on all Windows versions, including Windows XP SP2 and Windows Server 2003 SP1."

7 of 256 comments (clear)

  1. So, an Exploit For a Patch? by Anonymous Coward · · Score: 5, Insightful
    This article mentions the 23 patches that Microsoft released. It then goes on to say:
    Just days after the Redmond, Wash., software maker issued the MS06-040 bulletin with patches for a "critical" Server Service flaw, Microsoft's security response unit is bracing for the worst after exploit code that offers a blueprint for attacks began circulating on the Internet.
    And mentions that
    Aitel's company was able to reverse-engineer Microsoft's patch and create a working exploit in less than 24 hours.
    So are they saying that Microsoft is preparing for fall out from a new exploit that utilizes hastily written code from the latest series of patches? Is that what the pen companies reverse engineered? Or is Microsoft waiting for all the people who didn't patch their systems to be hit with what the DHS warned about and Microsoft fixed?

    I'm confused and I'd like to know if my building's Window's administrator needs to be put on suicide watch. He was up all night last night. From what it sounds like, he spent all that time trying to increase the security of our machines when he was really just altering the application so that the virus that came out 24 hours later would be able to attack the machines ... there is one non-Windows machine in my lab. I think I'll use that one today.
    1. Re:So, an Exploit For a Patch? by Anonymous Coward · · Score: 5, Insightful

      The fix for MS06-040 is KB921883, which is part of the recent batch of critical updates from Microsoft.
      TFA is confusing because it makes it appear as though the latest MS updates *cause* this vulnerability, while in actual fact they *fix* it.

  2. Not really that serious by $RANDOMLUSER · · Score: 5, Insightful
    From TFA:
    In most enterprises, Pescatore said the use of firewalls and the automatic blocking of TCP ports 139 and 445 should help mitigate the risk. However, he cautioned against IT administrators letting their guards down.
    If you have 139 or 445 exposed to the Internet, you've already been infected with something.
    --
    No folly is more costly than the folly of intolerant idealism. - Winston Churchill
    1. Re:Not really that serious by 140Mandak262Jamuna · · Score: 5, Insightful
      Well, In almost all companies and most homes the ports 137-139 and 445 are blocked at the firewall. But internally these ports are open otherwise file sharing/printer sharing inside the network is impossible. True, it wont be serious as long as the firewall holds. But all it takes is one home user bringing an infected laptop to work and plug it in and all hell breaks loose. I had an old NT4.0 machine just to support old releases of our product and for debugging. A salesman from Taiwan came in plugged his laptop in and I was hosed. Worse, the worm was probing rest of the corporate network so seriously that network traffic slowed to crawl in the company. All the top management knew was that I had an unpatched old computer in the network and compromised the company intranet and lost half their work day.

      How easy it is to bring an infected laptop and plug it in behind the firewall? Our salesmen travel all over the world, plug into untold number of hotel intranets and wi-fi cafes. They leave these two ports open when plugged into company intranet. Do they always remember to close these ports when they work in an untrustable network connection? Chances of infection are great. Chances of them bringing the infection behind the firewall into the corporate network is great. I would not hastily dismiss it nonchalantly.

      --
      sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
  3. It's been a while by ronanbear · · Score: 5, Insightful
    Since there's been any worms attacking new exploits. I'd even begun hearing from some people that the days of Blaster style attacks are over.

    This should remind Windows users about complacency.

    --
    the more they over-think the plumbing the easier it is to stop up the pipe
  4. Ummm... by Anonymous Coward · · Score: 5, Insightful

    Tell your "neighbor" that if he doesn't want to pay for an OS, that he shouldn't be using Windows.

    But if he's too fucking cheap to get an OEM copy or something and too fucking stupid to bypass the WGA, he should be prepared to have his ass handed to him when this shit hits.

    I'd recommend him going to ubuntu.com, though.

  5. Looking for fame and fortune by brian23 · · Score: 5, Insightful

    So companies like Immunity reverse-engineer an identified Microsoft patched vulnerability, release an exploit and expect kudos? Impressive as it may sound, I would be more interested to hear of a company discovering a vulnerability and releasing it to Microsoft so it can be patched. If I can't create a virus/worm to wreak havoc on Windows machines, what makes these companies able to reverse-engineer and release the "0-day" exploit? It almost seems unethical. Also, it seems like Immunity and others are trying to make a name for themselves rather than being interested in user security.