Printable View
Good Morning All!
I say good morning since it's 2AM here, and I assume many members won't read this until morning, and I think this is a wonderful way to start the day :)
Microsoft will be releasing a Out-of-Band Security Bulletin tomorrow.
I wonder what fun will await us.
Tyler.
Or an awful way to start the afternoon :D (6Pm here).Quote:
Originally Posted by HTRegz
Just took a quick read over the linked page and i guess we will need to wait a little longer to get the whole picture. :)
And here it is...
http://www.microsoft.com/technet/sec.../MS08-067.mspx
If you haven't patched yet... patch.
According to the MS Advisory it was only being used in targeted attacks. This has changed now... There's exploit code on a popular exploit website, and apparently there's a worm making the rounds.
Also, kudos to phernandez for the superb article. He manages to get quotes from some pretty incredible people :) heh.
Wouldnt a NAT router block this???Quote:
"We also have to consider what this could mean to smaller retailers focused on PCI compliance. I worked for a small business in the past where they had SBS [Small Business Server] 2000 directly connected to the internet, and traffic was being routed through that server. Setups like this do exist and they are vulnerable
MLF
Yes, it would.. And so does a firewall..Quote:
Originally Posted by morganlefay
phew....luckly I have both :)
who would have the server service pointing to the www anyway....you are just asking for trouble
MLF
No sane person would do that.. But then again if all computer users were sane I would be out of a job :DQuote:
Originally Posted by morganlefay
Good point Sir Dice....me too!
I guess the threat then would be infected laptops plugged in behind the firewall\router...so patching is still important.
MLF
You can find Snort sig's here:
http://www.emergingthreats.net/cgi-b...08-067?rev=1.1
Cheers
Just found out you are going to have to tweak these rules a bit, they must have been written in a hurry.
LOL, thanks!Quote:
Originally Posted by HTRegz
Agreed, patch and update those signatures. If MS is this concerned it should give you a clue as to the severity of the attacks they've been observing.
You'd be surprised at how many people just plug their computer into their cable modem still, or directly into their DSL. When I was home last christmas, I discovered that was how my sisters internet was setup... I unplugged it and went straight out and got a linksys router to put in between.Quote:
Originally Posted by morganlefay
One of my other quotes, which didn't make the article, was along the lines of hoping that a worm wouldn't spread to much because hopefully not to many people are using computers that are directly connected to the net. However I have seen it quite a bit.
I think one of the places that this will be a problem is college / university residences... many of them forbid NAT devices in front of your computer.
XP SP2 turns on the firewall and blocks this by default...no?
MLF
That it does... but you're thinking way to logically.Quote:
Originally Posted by morganlefay
People want to share files and run bittorrent clients (which test for them to have an open port in many cases). Disabling the windows firewall is extremely common.
I spent almost 2 years doing student support... and XP SP2 came out during that time... I'm willing to bet for every 100 students we saw, maybe 5 of them had the firewall turned on.
I tend to do that.... I ama 1 and 0 kinda girl.Quote:
That it does... but you're thinking way to logically.
specifically when assessing a threat...as to run around and apply patches untested to a production environment is risky to say the least and I like to see what the mitigating factors are before I patch.
I have seen some hasty patches totally fubar a server \application....
I err on the side of caution usually :)
MLF
Also, if you enable file and printer sharing the windows firewall will automagically poke a hole in itself to allow traffic in from the local network. Even third party (personal) firewalls usually "trust" the local network.Quote:
Originally Posted by HTRegz
Guess what that worm scans first?
Ports 138 139 and 445
MLF
You'll find a majority of college students using OSX these days (at least in the more prestigious universities)Quote:
Originally Posted by HTRegz
Its trendy dont ya know ;)
t34b4g5: Neg posted that on the third post.
SirDice: Good point
morganlefay: I believe SirDice was getting at the fact that your subnet is going to be scanned before it starts randomly scanning the internet, and your subnet is where it will find most of it's victims
C:\Saw: I doubt that it's a majority yet :), but either way I've found that most OS X users tend to be running Windows along side of it because OS X doesn't do everything they need it to do.
HT...I know what Sir Dice was saying.....but if all the workstations are patched ...how does the worm get into the subnet...rogue laptops...dont have any. Unauthorized access to the network...not likely
All I am saying is there is now way in hell I will patch my server until I am confident it not going to break something.
Browsing the forums as we speak...looking to see if there are any issues with applying the patch in my environment.
All the workstation have had the update pushed on them ....
actually ....I had an issue with my laptop after the patch was applied...it knocked out both my nics....until I logged in with admin priviledges...and the patch was then fully incorporated....nics came back on line... Logged back in with the limited account...and voila..both nics worked again.
MLF
That's interesting regarding the NICs... I've read other reports of people stating that DHCP wasn't working for them on their wireless after installing the patch. I wonder if it's s trend..
As for how the servers get exploited... malware doesn't have to use a single attack vector.
A workstation may have the MS08-067 patch, but that doesn't mean it can't be infected by a worm that takes advantage of MS08-067 to spread. For example, a unpatched browser vuln could be used to drop the malware on the system, and it can then target unpatched systems on your network.
Maybe not a great amount of risk, but it's something to consider.
Quote:
Originally Posted by HTRegz
Yeah just spotted that now. Up late and not concentrating properly ::coffee::
deleted my post as neg's seems to have a lil more info then mine :p
There's a fairly low-key but worrying bit of malware exploiting this at the moment: http://voices.washingtonpost.com/sec...exploitin.html
Don't been fooled into thinking that a worm exploiting MS08-067 will be just like the ones we saw a few years ago - there are several different ways that a client could get infected with a dropper that will then go off to scan and exploit a network normally protected by a firewall. You could simply add the dropper as a module to a typical drive-by download attack, for example.
POC code has been around for a few days, it clearly is possible to exploit this and the patch has been pretty comprehensively reverse engineered by researchers (and presumably also the bad guys).
If you're running a corporate network, then you should assume that you will eventually get hit by an MS08-067 based worm despite any countermeasures that you have in place. So patch now.
I am not saying I am not going to patch....I am just saying there are alot of ways to slow down the spread.
and if the client is patched....how does it get infected??
MLF
Quote:
Originally Posted by morganlefay
The patch fixes against the vulnerability being exploited on the box. That doesn't mean that another piece of malware (a dropper as Dynamoo mentioned) couldn't drop malware on your system that scans your network and exploits unpatched systems.
You're system is protected against being attacked if you've patched, not against attacking other systems.
Yeap that is a possibility...although unlikely in this environment.
And after monitoring newsgroups\forums and application sites .......I applied the patch to the server.
My point was there was some time.....and the likelyhood of the threat getting past the existing barriers .... firewalls, NAT routers, AUPs etc...the threat to my network was minimal...allowing me time to research and ensure that applying the patch would not affect my network. and application.
Security is fine as long as it does not affect functionality.
MLF
We've applied this patch to a lot of systems (3000+) with no ill-effects so far that can be attributed to it.
The odd thing about these worms is that they can flare up again from time-to-time. We got hit by the old Code Red IIS worm two *years* after it was released, on an unpatched server. We have absolutely no idea how such an old worm managed to get onto our network, but it caused a significant amount of disruption.
Dragging this even more off topic... My honeypot is hit by slammer on a daily basis...Quote:
Originally Posted by dynamoo
Well, not really off-topic. It goes to prove that you *think* your safe from a worm attack because it's quite old, but the little buggers are persistent.Quote:
Originally Posted by HTRegz
Luckily, there doesn't seem to be a concerted effort to exploit this one at the moment.
I hear ya. We are patching our servers tonight. We have a ton of applications that have been broken by MS Patches and they had to be thoroughly tested by the apps teams.Quote:
Originally Posted by morganlefay
Workstations are showing any problems, they have already been patched.
Our environment has users on 24/7 -365, so it's a pain for them when we have to do this, but I like to remind people of this nasty virus outbreak we had a few years ago that brought a lot of our sites down for days.
A few hours is always better than a few days.;)