Symantec Reports Spate of Attacks Via Recent Windows Flaw

Surprised Giraffe writes "Symantec is warning of a sharp jump in online attacks that appear to be targeting a recently patched bug in Microsoft's Windows operating system, an analysis that some other security companies disputed. Symantec raised its Threat Con security alert level from one to two because of the attacks, with two denoting 'increased alertness.' The attacks spotted by Symantec target a flaw in the Windows Server Service that Microsoft says could be exploited to create a self-copying worm attack."

Comments

From TFA...

[TheNecromancer]

Arbor Networks disputed Symantec's interpretation, saying, "we're not seeing this rise, not on TCP port 445 and not on TCP port 139. Looking over the last month we don't see this rise in MS08-067 attacks that would raise any alarms for us," in a Friday blog posting.

Both McAfee and Microsoft echoed those sentiments.

Seems like a shameless plug for Symantec to "look better" than their competitors. Crying wolf here won't get them the additional sales they think they will get.

Re:From TFA...

[yuna49]

The data from SANS Internet Storm Center shows significant recent increases in traffic on port 445. From this graph of traffic since January, we see an decline in traffic until September with the exception of a very large bump in late spring (some early testing of the exploit?).

Suddenly there was a big surge in port 445 traffic around September 1st. (The correlation between this event and the start of the school year is intriguing.) This surge looks suspiciously orchestrated to me. We also see a substantial, but short-lived decline in target traffic after Microsoft released its November 1st patch kit.

What's much more disturbing is the trend in sources which has spiked to incredibly high levels in the past week. This could represent a concerted attack on unpatched machines by those already infected. It also shows how many machines could really be infected but slumbering until needed.

Missing analysis:

[Penguinisto]

Have any of these corps, in their pissing contest, ever think that maybe the problems could be compund (e.g. exploit one flaw after using another to deliver the exploit)?

Cripes - I'd be more worried about someone using a 0-day or undisclosed flaw to deliver that nasty little Vista Kernel exploit that MSFT has said it won't have patched for at least six months...

...bitching over something that was patched seems rather too academic by now, but then, London's hospital system was IIRC recently shut down completely due to a variant of the old Mytob worm - and how long has that one been out?

/P

Re:Missing analysis:

[zappepcs]

Now you've gone and done it. If Symantec et al were to try to cover such exploitable possibilities, they'd have to have sales and marketing information that explains them. Sounds reasonable until you think about it. Their business model is built on selling crap^H^H^H^Hsoftware to people who don't want to think and explaining it to them would only expose them to ridicule when people start asking why they need to pay for something that has better free alternatives? If it was not bundled in the system when purchased Symantec would be out of business by now.

There are hundreds of ways to compromise a computer system and then it's peers. Antivirus software can only hope to attempt to protect a machine from the most probable threats, not all threats, not even all types of threats.

You can play in a sandbox, in a park, away from the highway... or ... your can move your sandbox to the median of an eight lane highway. Your choice. No matter what you choose you will still find a dog turd in it sooner or later. Point being that anytime an anti-virus company blathers on about new attacks, it's likely to be FUD or worse, it's marketing.

All Garbage

[Cynic9]

Both anti-virus vendors are a joke. I mean I am glad that they are out there but I've seen so many different Trojans and spyware bust right through McAfee and Symantec that I've completely lost faith in both products.

I just wish the virus/spyware crafters would fill their crap with some better advertisements. Throw some gaming spam my way and I won't see too many differences between Anti-virus 2009 and Madden 2009.

ISC SANS

[Anonymous Coward]

Definitely showing up here: http://isc.sans.org/port.html?port=445

Re:Slashdot Homepage

[halcyon1234]

It's the result of either a virus, or some wiseass CSS "programmer" who thinks that I want to see Firehose by default-- and we're all out of viruses today.