Slashdot Mirror
Symantec Reports Spate of Attacks Via Recent Windows Flaw
Surprised Giraffe writes "Symantec is warning of a sharp jump in online attacks that appear to be targeting a recently patched bug in Microsoft's Windows operating system, an analysis that some other security companies disputed. Symantec raised its Threat Con security alert level from one to two because of the attacks, with two denoting 'increased alertness.' The attacks spotted by Symantec target a flaw in the Windows Server Service that Microsoft says could be exploited to create a self-copying worm attack."
What's the maximum? Maybe eleven, or perhaps over 9000?
You mean the nasty little Vista Kernel exploit that requires that you be an administrator to exploit?
If I'm already an administrator, there are a lot more ways to gain root access than exploiting a kernel hole. Especially since I'm already running as root.
If an exploit requires that you run as root to exploit it, it's a reliability bug, not a security bug.
Yes, it's bad that someone running as root can crash a box. But there are LOTS of ways that someone running as root can cause a machine to crash.
Does any commercial add-on security software for Windows allow state-based checks yet?
Windows server services are fine inside your LAN, if you have a Linux, BSD or commercial Unix-based gateway. Otherwise, any online transaction is like running through a pickpocket convention with your money hanging out of your pockets.
"I can't imagine how things could get any worse!" (some guy) "That could just be failure of imaginatioÂn on your p
Port 445 has already been used by so many other attacks, including the Sasser and Nimda worms, that even if a new worm were to be created, it would probably not change things. The people that have 445 exposed and therefore would be vulnerable to attack by last week's exploit, will likely already have been compromised by anything that's been going around for the last three years. People are desperate for something to happen in the security space because it has been so long (since a major attack)
RTFA. it provides more useful information than Symantec's alert page. if you just want Symantec's Threatcon alerts then install their anti-virus or use their "DeepSight Threat Management System."
the article's not just "some random .au page" (as if a random .com domain would be any better) the article reports on not just Symantec's announcements, but also McAfee and Microsoft's responses that contradict Symantec's assessment. it also gives a link to a REN-ISAC report that supports Symantec's claims. it's good to have a little context when reading security alerts from AV software vendors.