Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Security Windows News

Symantec Reports Spate of Attacks Via Recent Windows Flaw 56

Posted by timothy from the sir-it-seems-to-be-the-windows-again dept.
Surprised Giraffe writes "Symantec is warning of a sharp jump in online attacks that appear to be targeting a recently patched bug in Microsoft's Windows operating system, an analysis that some other security companies disputed. Symantec raised its Threat Con security alert level from one to two because of the attacks, with two denoting 'increased alertness.' The attacks spotted by Symantec target a flaw in the Windows Server Service that Microsoft says could be exploited to create a self-copying worm attack."
This discussion has been archived. No new comments can be posted.

Symantec Reports Spate of Attacks Via Recent Windows Flaw More

Symantec Reports Spate of Attacks Via Recent Windows Flaw

Comments Filter:

  • first (Score:1, Funny)

    by Anonymous Coward
    First infection!

  • From TFA... (Score:5, Interesting)

    by TheNecromancer ( 179644 ) on Tuesday November 25, 2008 @09:52AM (#25885913)

    Arbor Networks disputed Symantec's interpretation, saying, "we're not seeing this rise, not on TCP port 445 and not on TCP port 139. Looking over the last month we don't see this rise in MS08-067 attacks that would raise any alarms for us," in a Friday blog posting.

    Both McAfee and Microsoft echoed those sentiments.

    Seems like a shameless plug for Symantec to "look better" than their competitors. Crying wolf here won't get them the additional sales they think they will get.

    • Re: (Score:2, Informative)

      by root777 ( 1354883 )
      Port 445 has already been used by so many other attacks, including the Sasser and Nimda worms, that even if a new worm were to be created, it would probably not change things. The people that have 445 exposed and therefore would be vulnerable to attack by last week's exploit, will likely already have been compromised by anything that's been going around for the last three years. People are desperate for something to happen in the security space because it has been so long (since a major attack)

      • Re:From TFA... (Score:4, Interesting)

        by yuna49 ( 905461 ) on Tuesday November 25, 2008 @02:17PM (#25889793)

        The data from SANS Internet Storm Center [sans.org] shows significant recent increases in traffic on port 445. From this graph [sans.org] of traffic since January, we see an decline in traffic until September with the exception of a very large bump in late spring (some early testing of the exploit?).

        Suddenly there was a big surge in port 445 traffic around September 1st. (The correlation between this event and the start of the school year is intriguing.) This surge looks suspiciously orchestrated to me. We also see a substantial, but short-lived decline in target traffic after Microsoft released its November 1st patch kit.

        What's much more disturbing is the trend in sources which has spiked to incredibly high levels in the past week. This could represent a concerted attack on unpatched machines by those already infected. It also shows how many machines could really be infected but slumbering until needed.

    • Re: (Score:1)

      by rysar ( 1144437 )
      Actually, if you think about it, Symantec has significantly more systems to look at, as there are over 40,000 sensors in over 200 countries, whcih are generating over 2 billion events a day, so yea, I think they can tell if there's an increase in port traffic. All the consumer products report back anonymous data on things the products are protecting against as well, so add those alerts too.

      • So you post a story about how Symantec are more on the ball then their competition and follow it up with comments about how their sensing capability is much more advanced than their competition without referencing any sources. This has to be the lamest astroturf I've ever seen.

        • Re: (Score:1)

          by rysar ( 1144437 )
          Actually, the story I submitted was around their detection of spam levels coming back up to the pre-McColo shutdown. I commented on this one since it seemed that someone thought that Symantec was trying to "look better" than their competitors.

          Statistics has taught me one thing: Having a larger sample set gives you better results.

          My source for numbers in my comment: http://www.symantec.com/about/profile/technology.jsp [symantec.com]

          "The Symantec Global Intelligence Network encompasses worldwide security intelligence

  • *GASP* Threat Con Level at TWO! (Score:5, Informative)

    by GogglesPisano ( 199483 ) on Tuesday November 25, 2008 @10:00AM (#25886007)

    What's the maximum? Maybe eleven, or perhaps over 9000?

  • Missing analysis: (Score:3, Interesting)

    by Penguinisto ( 415985 ) on Tuesday November 25, 2008 @10:03AM (#25886041) Journal

    Have any of these corps, in their pissing contest, ever think that maybe the problems could be compund (e.g. exploit one flaw after using another to deliver the exploit)?

    Cripes - I'd be more worried about someone using a 0-day or undisclosed flaw to deliver that nasty little Vista Kernel exploit that MSFT has said it won't have patched for at least six months...

    ...bitching over something that was patched seems rather too academic by now, but then, London's hospital system was IIRC recently shut down completely due to a variant of the old Mytob worm - and how long has that one been out?

    /P

    • Re: (Score:1, Informative)

      by Anonymous Coward

      You mean the nasty little Vista Kernel exploit that requires that you be an administrator to exploit?

      If I'm already an administrator, there are a lot more ways to gain root access than exploiting a kernel hole. Especially since I'm already running as root.

      If an exploit requires that you run as root to exploit it, it's a reliability bug, not a security bug.

      Yes, it's bad that someone running as root can crash a box. But there are LOTS of ways that someone running as root can cause a machine to crash.

    • Re:Missing analysis: (Score:4, Interesting)

      by zappepcs ( 820751 ) on Tuesday November 25, 2008 @10:29AM (#25886415) Journal

      Now you've gone and done it. If Symantec et al were to try to cover such exploitable possibilities, they'd have to have sales and marketing information that explains them. Sounds reasonable until you think about it. Their business model is built on selling crap^H^H^H^Hsoftware to people who don't want to think and explaining it to them would only expose them to ridicule when people start asking why they need to pay for something that has better free alternatives? If it was not bundled in the system when purchased Symantec would be out of business by now.

      There are hundreds of ways to compromise a computer system and then it's peers. Antivirus software can only hope to attempt to protect a machine from the most probable threats, not all threats, not even all types of threats.

      You can play in a sandbox, in a park, away from the highway... or ... your can move your sandbox to the median of an eight lane highway. Your choice. No matter what you choose you will still find a dog turd in it sooner or later. Point being that anytime an anti-virus company blathers on about new attacks, it's likely to be FUD or worse, it's marketing.

    • Re: (Score:2)

      by arth1 ( 260657 )

      Cripes - I'd be more worried about someone using a 0-day or undisclosed flaw to deliver that nasty little Vista Kernel exploit that MSFT has said it won't have patched for at least six months...

      Niggle: You repeat yourself. A zero day exploit is an undisclosed exploit. Once it's disclosed, it becomes a first-day exploit. I know media has fallen in love with the term "zero day" and use it indiscriminately and most often wrong, but this is slashdot, where we are allowed to be pedantic about these things :-

  • According to a leaked internal Symantec memo (Score:5, Funny)

    by neonux ( 1000992 ) on Tuesday November 25, 2008 @10:06AM (#25886089) Homepage

    The 'levels' are :

    1 - Normal alertness
    2 - Increased alertness
    3 - ???
    4 - PROFIT !!!

  • All Garbage (Score:2, Interesting)

    by Cynic9 ( 842597 )
    Both anti-virus vendors are a joke. I mean I am glad that they are out there but I've seen so many different Trojans and spyware bust right through McAfee and Symantec that I've completely lost faith in both products.

    I just wish the virus/spyware crafters would fill their crap with some better advertisements. Throw some gaming spam my way and I won't see too many differences between Anti-virus 2009 and Madden 2009.

  • I can also report a spate of recent frustration via the recent Slashdot homepage changes. I can't find anything, links and blockquotes are impossible to read in some section colour schemes and there's no way to turn it off!!

    • Re: (Score:3, Interesting)

      by halcyon1234 ( 834388 )
      It's the result of either a virus, or some wiseass CSS "programmer" who thinks that I want to see Firehose by default-- and we're all out of viruses today.

  • -m --state NEW DROP (Score:2, Informative)

    by ReedYoung ( 1282222 )
    Does any commercial add-on security software for Windows allow state-based checks yet?

    Windows server services are fine inside your LAN, if you have a Linux, BSD or commercial Unix-based gateway. Otherwise, any online transaction is like running through a pickpocket convention with your money hanging out of your pockets.

  • Huh? (Score:1)

    by mortonda ( 5175 )

    create a self-copying worm attack.

    *Jack Nicholson voice*

    Is there any other kind????

  • Start up (Score:3, Funny)

    by Wiarumas ( 919682 ) on Tuesday November 25, 2008 @10:43AM (#25886651)
    Anybody want to join my AntiVirus start up? We are at Threat Con Three currently and the sales are pouring in.
  • I haven't had a problem with viruses. I run XP pro at work, with AVG, and although i have had a few viruses, from d/ling stuff, AVG finds them, and no problems. now i might ask, Where can i find thses viruses? I know that warez sites from russia care them, but how can i contract them from legit sites? I seems to me, if you doing what your suppsoed to do with a computer (pr0n browsing) you shouldnt have these problems

    • You want viruses? Visit mininova and start downloading some cracked commercial software. Pick anything. You'll get infected. This is how people I know get infected. Its not a windows exploit, its not a firewall setting, its not activex, its not a lack of warnings, its not ignorance, its not the fabled zero-day exploits, its not bad security engineering, its malware predators taking advantage of greedy people who dont want to pay for commercial software.

      Cant afford it? There's probably an OSS or freeware cl

      • mayb thats why i dont get viruses .. either my employer pays for it, or I run Linux :)
        And i always though my system stayed clean because i put a condom over my mouse ... maybe i should also stop injecting AstroGlide into my HardDrive
      • Comment removed based on user account deletion

        • >t, because I haven't actually seen a warez bug cross my desk in years.

          Psst. Download the torrent for Quicktime Full Version at mininova. Install it. Welcome to trojan land.

      • You can also pick up some stuff by visiting various web sites. Places that carry.. umm. less than proper material (warez, porn) I don't know how many carry them but some do and visiting them with an unprotected web browser is an invitation to getting infected. With an up to date browser and tools like Noscript and anti-virus, anti-spyware programs it's hard to get infected unless you go out of your way to do something you shouldn't do like run some executable software without checking it out first.
      1. Fire up IE
      2. Visit any site with ads that seep through from doubleclick or burstnet or any of those others
      3. You now have a non-zero chance of one of those ads containing something that will exploit something in IE and autodownload&run some malware
      4. Repeat from steps 2, and it's just a matter of time until the law of averages catches up to you

      Alternatively, take that XP machine of yours and plug it directly into your DSL/Cable modem (not via a router). Go get a sandwich. Millions of random port-scanners will

      • This is true. I forget how much a firewall protects you. I would not dare plugging a unpatched windows box (or even patch!) up to the internet. I have ran Linux as a firewall/router (iptables) and its unbelivable all of the port scans that happen. I would get over 1000 tries on SSH getting in with users such as 'root' 'sally' 'mike' coming from hundreds of different IPs. Also there will be attempts on any port that they can see (normally 80, and ftp, and ssh) are all i have open, and thank god i drop any tr
  • Anyone else misread that as a "shark jump in online attacks?" I was beginning to wonder if the Simpsons writers had turned to malware writing.

  • ISC SANS (Score:2, Interesting)

    by Anonymous Coward

    Definitely showing up here: http://isc.sans.org/port.html?port=445

  • Save slashdot space.... (Score:4, Funny)

    by The Real Tachyon ( 1332153 ) on Tuesday November 25, 2008 @01:28PM (#25889131)
    Why don't we just have a running headline banner that says something like...

    {someone} discovered a serious security flaw in Microsoft's {product} and {offered to sell a solution|berated Microsoft}. They say the flaw should be {ignored|taken seriously} and that if it wasn't that there was a strong possibility of {not much|major|catastrophic|universe collapsing} repercussions.

    {Mac|Linux} users were reported to gloat and tell everyone they were idiots for not switching to {Mac|Linux}. BSD users were running around naked, covered in crayon scribbling, and jabbering "definitely time for BSD, definitely....or Wopner"

    Microsoft responded today by {downplaying|ignoring|finally patching after months but breaking something else with the patch} the threat.

Slashdot Top Deals

C'est magnifique, mais ce n'est pas l'Informatique. -- Bosquet [on seeing the IBM 4341]

Close