MESSAGE
| DATE | 2004-06-28 |
| FROM | Ruben Safir Secretary NYLXS
|
| SUBJECT | Subject: [hangout] MS - Security built inside:
|
http://www.crn.com/sections/breakingnews/dailyarchives.jhtml?articleId=22102320
Most Web Users Safe As Major Net Attack Slows
E-mail this article E-mail this article Print
this article Print this article E-mail this
article Link/reprint this article HOT LINKS
ARROW Experts Warn That 'Scob' Virus Could
Lead To Keyboard Logging Breaking News ARROW
Most Web Users Safe As Major Net Attack Slows
ARROW EU Lifts Microsoft Sanctions Pending
Appeal ARROW Experts Warn That 'Scob' Virus
Could Lead To Keyboard Logging ARROW Gateway
Hires 'Channel Advocate' Tiffani Bova ARROW
Is EMC Investment In VAR A Conflict With
Other Partners? ARROW New HP Desktops To
Offer 15-Month Lifecycle Guarantee ARROW CRN
Interview: SAP's Chief Of Cross Applications
Division ARROW HP Says Notebook Memory Problem
Affects 900,000 Of Its Models SEARCH Search
for more news about... ARROW Microsoft
By Gregg Keizer, Techweb News 9:00 PM EDT
Sun. Jun. 27, 2004
A widespread attack on Web servers and
sites continued Friday, but the Russian
hacker site that was delivering malicious
code to client machines has been shut down,
removing - at least temporarily - the danger
to users of Internet Explorer.
Although the site was up as late as early
Friday morning, later in the day it was
inaccessible. Multiple security firms
confirmed that the site was down, and TechWeb
was also unable to reach the site.
The attack, considered to be among the most
sophisticated to date, first compromises
Microsoft IIS servers, then appends malicious
JavaScript code onto each page served by the
infected site. End users who simply view an
infected page are invisibly redirected to
the Russian hacker site, which then loads
one of several backdoor components and a
key logger to the PC.
"The [hacker] domain is no longer available,"
said Ken Dunham, director of malicious code
research at iDefense. "Although it could be
due to high levels of traffic to the site,
it's more likely it's been made unavailable
because of the malicious content it was
hosting." McAfee's virus research manager,
Craig Schmugar, also confirmed that the site
was down.
While that eliminates the immediate threat
to Internet Explorer users - with the
site offline, nothing can be downloaded to
compromised machines - this is nowhere near
the end of the story, said security experts.
"This [attack] is only in the early stages,"
said Dunham, "and the IP address [for the
Russian site] could easily be changed in
future variants. Even as these hacker sites
rise up and fall down, we still have the
attack issue to deal with."
More attacks are probably in the offing
because of the group behind the attack. "It
looks like the HangUP Team out of Russia is
doing this," he said. F-Secure, a Finnish
anti-virus firm that's been aggressively
analyzing the attack, also pegged HangUP as
the most likely culprit.
HangUP, a for-profit malicious code-cutting
group out of Russia, developed the backdoor
Trojan horses that were uploaded to client
systems exploited by Friday's attack. Those
Trojans "are designed to steal credit card
and other information that is then marketed
to organized identity theft markets,"
said Dunham.
The reason why Dunham and others expect
additional attacks is because of HangUP's
past practice with the Korgo worm, which the
group is also suspected of writing. Korgo,
now in its eighteenth variation, exploits
the LSASS vulnerability in Windows which
was made public several months ago.
"It's highly likely that we'll see additional
attacks, if, in fact, HangUP is behind this,
because of the number of Korgo variants it's
put out," said Dunham.
Other reasons why hackers will continue
to exploit the situation are the ongoing
confusion about how the servers -- and the
sites hosted on them -- became infected in
the first place, and the ongoing vulnerability
of Internet Explorer.
"That's the biggest mystery," said Mikko
Hyppnen, F-Secure's director of anti-virus
research. "Nobody seems to know how they
were initially infected." Security firms
are still trying to puzzle out whether
the servers were exploited through a known
vulnerability -- the most likely culprit
is one patched by Microsoft in April-- or a
so-called "zero-day" vulnerability. Exploits
of zero-day vulnerabilities attack flaws
for which no patch is available, and are
considered worst-case by security experts.
Internet Explorer also remains vulnerable,
said Dunham, contrary to Microsoft's
claim. The client can be infected by such
attacks through two vulnerabilities. One was
patched in April but the second is a zero-day
vulnerability called ADODB. (A patch against
ADODB was issued in November 2003, but it
doesn't protect against this newest exploit.)
"Microsoft has said if you're fully patched
you're okay," said Dunham, "but we took live
exploit code and ran it on a fully-patched
client, and the code ran just fine."
In a document classified as "Critical,"
Microsoft tells users to visit Windows Update,
the company's security update service,
to protect themselves against the attack.
The stakes are high. End-users' systems not
only were infected by backdoors, but also by a
key logger. Early Friday morning, F-Secure's
Hyppnen said, "[The key logger] is stealing
confidential information from thousands
or tens of thousands of machines. That
information can be passwords, usernames,
credit card numbers, bank account numbers,
anything really."
According to Symantec, the key logger trapped
and transmitted authentication info --
usernames and passwords -- used to log in
to major Web sites, including eBay, PayPal,
EarthLink, Juno, and Yahoo.
"The key logger is stealing credentials of
those going to those sites," said Alfred
Huger, vice president of engineering for
Symantec's virus watch group, "but that
doesn't mean the sites themselves are
infected."
With such stakes -- high volume identity
theft -- in play, it's increasingly clear
that Friday's attack will be only the first
of many.
"It looks like this is something that we'll
have to learn to live with," said Symantec's
Huger. "The JavaScript is out there, the
exploit is out there. Hopefully, we'll never
be put in the position of having to walk away
from the Web because we don't know which sites
are safe, and what aren't. If that happens,
we've lost."
Until a solid patch is available, some
experts are advising users to disable
JavaScript in Internet Explorer, or switch
to a non-IE browser.
"You can configure IE to be more secure,
and disable the funationalty of JavaScript,"
said McAfee's Schmugar. "But that puts users
between a rock and a hard place."
Huger of Symantec took a different tack. "At
this point, I think it's totally appropriate
to have two browsers," he said.
-- __________________________ Brooklyn Linux Solutions
So many immigrant groups have swept through our town that Brooklyn, like
Atlantis, reaches mythological proportions in the mind of the world -
RI Safir 1998
DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002
http://fairuse.nylxs.com
http://www.mrbrklyn.com - Consulting http://www.inns.net <-- Happy
Clients http://www.nylxs.com - Leadership Development in Free Software
http://www2.mrbrklyn.com/resources - Unpublished Archive or stories and
articles from around the net http://www2.mrbrklyn.com/downtown.html -
See the New Downtown Brooklyn....
1-718-382-0585
____________________________
NYLXS: New Yorker Free Software Users Scene
Fair Use -
because it's either fair use or useless....
NYLXS is a trademark of NYLXS, Inc
|
|
