1 In 3 Windows PCs Still Vulnerable To Worm Attack

CWmike writes "The worm that has infected several million Windows PCs, Downadup or 'Conficker,' is having a field day because nearly a third of all systems remain unpatched 80 days after Microsoft rolled out an emergency fix, security firm Qualys said. Downadup surged dramatically this week and has infected an estimated 3.5 million PCs so far, according to Finnish security company F-Secure Corp. The worm exploits a bug in the Windows Server service used in Windows 2000, XP, Vista, Server 2003, and Server 2008. Qualys' CTO said, 'These slow [corporate] patch cycles are simply not acceptable. They lead directly to these high infection rates.'" This is indicative of why some are calling for Microsoft to rethink Patch Tuesday, as reader buzzardsbay pointed out.

Comments

router

[TheSHAD0W]

This is why I recommend everyone have a router installed on their internet connection, even if they have only one PC. Routers inherently block almost all worms.

Re:router

[Trevelyan]

You assume that the router has a some firewall, acl or nat set, ie its not inherent. Also this is more for home users. However this worm is doing well in corporate networks, spreading from one co. to another via latops, and so negating any external firewall.

Re:router

[corsec67]

The very nature of a router is to use NAT.

No, the very nature of a router is to... route.
Or do the core internet routers also NAT?
Is China behind a large NAT? (This will probably be true in 2015, so hello people from then)

Re:router

[jrumney]

All routers need to do some type of NAT period, it is how a router works.

There are 14 routers between me and slashdot.org, not one of them is doing any type of NAT.

Re:router

[Muad'Dave]

In recent parlance "router" implies a consumer level router/NAT appliance, but that's not necessarily so. Routers predated NAT by a zillion years, and routing is distinctly separate from any NAT functionality. There are plenty of routers using in large IT shops where requiring NAT would be a serious handicap.

Re:router

[jrumney]

My ISP has a router installed on my internet connection, so I must be safe right?

Re:router

[Xelios]

Along with a router a software firewall is a handy thing to have. A router won't alert you when a program or service tries to access your connection, but a software firewall will. If something on my PC is trying to access the internet without me telling it to, I want to know about it.

And it's great for all those annoying programs that try to phone home or check for updates at random times. What's that Acrobat Reader? You want to look for an update? No, I think I'll decide for myself when it's time to update you rather than have you nag me about it every time you're opened. Tick "create rule", hit "block". Enjoy your stay in the blacklist.

ESET Smart Security. Best $50 I've ever spent on software (except maybe The Orange Box).

Re:router

[Opportunist]

That works well in home scenarios where the router is the only possible entry point of a worm. In office environments, you have laptop users that travel. They may or may not connect from home, often with mobile access or from their private line. Something you cannot shield, and more often than not is not shielded.

I've been lobbying in various consulting sessions that laptops from traveling workers are to be seen as "semi-trustworthy", if that. Because they can and do connect not only from within the trusted and firewalled network, but because of this very reason, they can connect in insecure scenarios and may be infected when they connect to the company networks. I have been lobbying to put them in a separate network ("separate but equal" has such a bad ring, but in this case it's pretty much what the idea is). If the worst case happens, it would at least only infect a usually very manageable number of computers instead of the whole corporate network.

Well, I guess I finally have a real life example of what happens when you don't heed it. Companies are like little kids, you have to let them touch the stove once before they believe you it's hot. But fortunately, some companies are willing to learn from the mistake of others...

Re:router

[YouWantFriesWithThat]

yes, yes, and yes.

when something malicious got through AVG, spybot, and adaware i was clued in when fdsb423.exe started trying to connect with the internet. a software firewall is not a defense, but it is a good way to tell that you have something going on. i also agree it is fun to turn off the dial-home on software that doesn't need to talk to it's mommy. HP printer drivers, i am looking at you.

Re:router

[Ephemeriis]

This is why I recommend everyone have a router installed on their internet connection, even if they have only one PC. Routers inherently block almost all worms.

I think, what you're trying to say, is that it is important for everyone to have a firewall on their Internet connection... Not a router. Routers don't inherently offer any protection at all. Many home-grade routers come pre-configured with NAT, which does get you some basic protection... But not all routers do NAT, and not all of them give you any protection.

And an external firewall on your Internet connection only protects you so far. It might keep a worm from crawling in through your Internet connection... But it won't stop a worm from spreading once it is inside your network.

That's why it is important to control the traffic inside your network, as well as traffic to/from the Internet. Maybe it isn't necessary to run a firewall on each and every PC, but you sure as hell better be monitoring your traffic and keeping your machines patched.

Re:router

[toleraen]

A router won't alert you when a program or service tries to access your connection, but a software firewall will.

Turn on logging and your router can notify your PC, your email, your blackberry, etc etc.

Genuine Advantage Validation

[RichMan]

I know a lot of people who are afraid of updates because of the genuine advantage validation. They got student priced versions of the software 5 years ago and are no longer students. They don't want to risk losing Visio/Word/PowerPoint or having some other software disabled on their computer.

The fear factor of automated reporting/validation is stopping a lot of people from running the updates.

Re:Genuine Advantage Validation

[0prime]

Uhhh as a former student, this seems pretty silly. I haven't had any problems with XP or the Office 2003 Suite at all. What are these people expecting Windows to do, pull their personal info, poll it to Microsoft through WGA, and have Microsoft check College enrollment records?

I do know of one other reason why people would be afraid of WGA, though.

Not that bad considering it's Windows

[jerep]

If my years of tech support taught me anything it's that 9 out of 10 Windows users are more damaging to computers than anything else.

Re:Not that bad considering it's Windows

[ColdWetDog]

Worse than that... It's OPEN SOURCE's fault:

"By using the exploit from the Metasploit module as the code base, a virus/worm programmer only needs to implement functions for automatic downloading and spreading," said Xiao Chen, a McAfee security researcher, in an entry to the company's blog. "We believe that this can be accomplished by an average programmer who understands the basics of exploitation and has decent programming skills.

"It's obvious that worm writers are abusing open-source tools to their advantage to make their work easier," Chen added.

You all ought to be ashamed of yourselves...

blackhat thoughts

[Kartoffel]

With all this talk of Microsoft losing money, maybe they should get into the botnet business for themselves. Vertical integration!

Patches are good, not bad!

[Anonymous Coward]

What drives me absolutely nuts is how people who are not computer professionals talk about patches with contempt. In any magazine article about an operating system, whether it be from the Windows family, Mac OS X, or Linux, when the subject of patches comes up, the writer will usually say something to the effect that a downside of using this operating system is the high frequency of patches.
 
In a perfect world, software would have zero bugs (security holes are bugs, too, if you think about it). No product would have any problems. Everything would be perfect. There would be no need for patches.
 
But unfortunately we do not live in a perfect world, and software does have bugs. When patches are available at a frequency such as daily (as is sometimes the case if you use Ubuntu, patches not only for the OS but for any programs you have installed too), or every few weeks as is the case with Mac OS X, you know that people behind the product are responsible, are continuing to develop and refine the software, and you benefit from those refinements at the frequency of the patches.
 
We all know this, yet because many people feel contempt toward software patches, and because magazines and newspapers write inaccurately about this subject, many boxes out there are vulnerable to many types of attack, and this won't change any time soon. I think some effort needs to be expended by the marketing departments of various software companies to convince people that patches are good, not bad.
 
I just had one additional thought about this Windows patch. Perhaps some of these boxes are using illegitimate copies of Windows and are therefore ineligible for the patch?

Immune

[Alsee]

I'm immune to the worm. I'm still running Windows98 and it doesn't have "Windows Server service" and all that other wormbait crap.

Oh, hold on.... I'll be right back. I've been online 40 minutes and I need to reboot.

-

Not Acceptable?

[PolyDwarf]

Qualys' CTO said, 'These slow [corporate] patch cycles are simply not acceptable. They lead directly to these high infection rates.'"

It's also not acceptable that corporate desktops become useless because of an update that MS rolled out that broke mission-critical software.

There's a reason there's an IT vetting process with patches (fool me once, shame on you... fool me twice, three times, every patch tuesday, shame on me). There's also a reason why those processes take a while. If you disagree with IT workers doing their jobs and making sure that an update won't screw up the network/application/productivity/company, take it up with software vendors and MS, not with the people who are trying to make sure their company stays functioning. Or will you be willing to pay for their time in fixing problems if they apply patches that break things?

How about installing updates?

[HerculesMO]

The update was issued in October.

If you haven't patched, there's no fault of anybody but your own.

If your car has a recall for a safety belt problem, and you don't get it fixed and get into an accident, is it suddenly the car manufacturer's fault? No.

And likewise it's not MS's fault if you can't install patches on your OS.

Re:Weekly updates? Still not enough.

[cavtroop]

Have you ever tried managing 17,000 desktops? No, didn't think so.

Most large corps run WSUS, with updates on a weekly schedule, at most. To do otherwise would cripple the network, or require such an investment in equipment and manpower as to be nearly impossible to pull off.

Having said that, most large companies also have a mechanism for quick-release of highly critical patches. I know we rolled out the MS08-067 patch to our desktops immediately, and had a 98% acceptance rate within 3 days.

Re:Get any work done?

[Ephemeriis]

Jeez, with virus scanners, several types of automatic updates, and other gadgety things polluting the standard corporate desktop, it is a wonder that people can get any work done on their PCs anyway. Six Inches of Air.

Corporate desktops aren't that bad. I mean, they can be... But usually there's at least a little oversight. You don't typically see people with eleven different smiley-toolbars in a business... It happens, but not so much.

Home users, on the other hand, can be a true nightmare. Plugins for various web pages... Piles of downloaded crapware games... IncrediMail... Several different media players and a pile of music or movies... A couple different P2P programs... A couple different malware scanners... I cringe just thinking about it.

You're right though. Entirely too many different bits of software want to do their own updates. Windows Updates, Office Updates, anti-malware updates, updates for Adobe Reader, updates for Flash, updates for Java, updates for Real Player, updates for HP's drivers and suites, updates for QuickTime and iTunes...

It's ridiculous. I'll routinely see at least a half-dozen updaters running in the background.

That's one of the things I really like about most Linux distributions... Generally you've got a single package manager that takes care of everything for you.