Microsoft Bracing for Worm Attack

10010010 writes "A network worm attack targeting a critical Microsoft Windows vulnerability appears inevitable. The flaw is easy to exploit, as evidenced by the quick release of an exploit module for HD Moore's Metasploit Framework. Within hours of the Patch Day release Tuesday, two pen testing companies (Immunity and Core) created and released 'reliable exploits' for the flaw, which was deemed wormable on all Windows versions, including Windows XP SP2 and Windows Server 2003 SP1."

So, an Exploit For a Patch?

[by Anonymous Coward]

This article mentions the 23 patches that Microsoft released. It then goes on to say:

Just days after the Redmond, Wash., software maker issued the MS06-040 bulletin with patches for a "critical" Server Service flaw, Microsoft's security response unit is bracing for the worst after exploit code that offers a blueprint for attacks began circulating on the Internet.

And mentions that

Aitel's company was able to reverse-engineer Microsoft's patch and create a working exploit in less than 24 hours.

So are they saying that Microsoft is preparing for fall out from a new exploit that utilizes hastily written code from the latest series of patches? Is that what the pen companies reverse engineered? Or is Microsoft waiting for all the people who didn't patch their systems to be hit with what the DHS warned about and Microsoft fixed?

I'm confused and I'd like to know if my building's Window's administrator needs to be put on suicide watch. He was up all night last night. From what it sounds like, he spent all that time trying to increase the security of our machines when he was really just altering the application so that the virus that came out 24 hours later would be able to attack the machines ... there is one non-Windows machine in my lab. I think I'll use that one today.

Re:So, an Exploit For a Patch?

[by Anonymous Coward]

you can get the patch for the patch here [ubuntu.com]

Re:So, an Exploit For a Patch?

[Foofoobar (318279)]

Damn straight Baby! I used to use Fedora but a co-worker turned me onto Kubuntu (a KDE version of Ubuntu). At first, getting used to a Debian based distro was tough but I quickly realized that I really didn't have to do my makes or check for dependencies and a ton of the other stuff that can just be a constant annoyance and reduces consumer uptake of Linux as a Desktop.

I have it installed on my Mom's computer and she loves it! Instantly detected her new digital camera my brother got her, her scanner, her pr

Re:So, an Exploit For a Patch?

[advocate_one (662832)]

I now run Ubuntu at home and at work. When all the windows systems are getting patched, updated crashing or just dying (my bosses computer needs a re-install this morning), I can just keep plugging away.

that's the real pisser though isn't it... everybody else can use the "my computer's playing up" excuse when they're late with some work... us Linux users can't

Re:So, an Exploit For a Patch?

[jrockway (229604)]

And you can get the patch for Ubuntu here [openbsd.org].

Re:So, an Exploit For a Patch?

[by Anonymous Coward]

It wasn't 23 patches: it was 12 patches that covered 23 vulnerabilities.

Yes, it's worms exploiting the MS06-040 vulnerability that they're worried about.

As long as you're properly firewalled from the rest of the world it can't get in but you should still get everything patched in case the worm gets inside your firewall e.g. as a trojan.

Re:So, an Exploit For a Patch?

[tomstdenis (446163)]

Sadly "properly firewalled" also means from your peers inside your network. When I was in College it was routine for viruses to spread almost instantly in the labs where we had our own system drives (e.g. not locked down). Similarly at any sufficiently large office there is bound to be at least one complete f'ing idiot who clicks on all email attachments and thinks "browsing the net commando style" is top shit.

Tom

Re:So, an Exploit For a Patch?

[LordSnooty (853791)]

Excuse me, I never browse the net without my pants on.

Re:So, an Exploit For a Patch?

[tomstdenis (446163)]

"going commando" means no underwear not no pants.

I was trying to morph it into "browsing the net without anything in between".

Tom
[ I still hate Jon Callas ]

Re:So, an Exploit For a Patch?

[bwcarty (660606)]

But to the British, pants are undergarments (worn under trousers.)

Re:So, an Exploit For a Patch?

[tomstdenis (446163)]

Damn you Brit, we have ways of making you speak English properly!

So what are pants in the UK? :-)

Next you'll tell me that a fanny has a different meaning there too...

Re:So, an Exploit For a Patch?

[D-Cypell (446534)]

So what are pants in the UK? :-)

Trousers.

Funny story, my wife is Canadian and some time ago while in Florida on holiday (read: vacation). She asked if we could stop as a shopping centre (read: mall) to look for some 'Cacky Pants'. To her, this phrase describes those lightweight, cotton, military styled 'trousers'.

To me, it describes, "Soiled underwear". There was a short moment of total confusion while we unravelled that one.

Living with someone from the opposite side of the atlantic really puts meaning to the phrase, "Two nations divided by a common language" :).

Re:So, an Exploit For a Patch?

[by Anonymous Coward]

They looked at the patch to find what is being patched, so now they know how to exploit the bug that is fixed by the patch. If your admin updated every Windows computer, you should be fine. The millions of unpatched systems on the internet however will most likely be wide open and added to botnets in a couple of days. Consequently even the users of well-administered Windows computers and other operating systems will feel the fallout of this vulnerability.

Re:So, an Exploit For a Patch?

[blowdart (31458)]

So are they saying that Microsoft is preparing for fall out from a new exploit that utilizes hastily written code from the latest series of patches? Is that what the pen companies reverse engineered?

Wrong conclusion I think. More likely the reverse engineering is comparing the patched and unpatched code and actually working out what the exploit is, then writing the code to use it. (this is why the behaviour of the Rails team holding back details of their exploit is rather weird; especially when the sourc

Re:So, an Exploit For a Patch?

[by Anonymous Coward]

The fix for MS06-040 is KB921883, which is part of the recent batch of critical updates from Microsoft.
TFA is confusing because it makes it appear as though the latest MS updates *cause* this vulnerability, while in actual fact they *fix* it.

Re:So, an Exploit For a Patch?

[IAmTheDave (746256)]

Look, whatever the article says, it probably makes sense to ban all liquid or gell substances from any building that has Windows PCs, make all people stand in rediculously long lines to have their pocket books and napsacks security-checked for 8.5" floppy disks carrying said exploit, and even perhaps start a secret list of people who are banned by name from actually accessing a PC at all. I recommend the first name be John Smith, that bastard.

Further, we should probably ban anyone that has dirt on their shoes, because I hear worms like dirt.

Saftey first people. It may be an inconvenience, but it's all about your saftey, and the saftey of democracy across the world. We will prevail over the security-exploiters.

Re:So, an Exploit For a Patch?

[venir (971650)]

Shooting soda out my nose wasn't exactly the way I planned to start my day, but thanks anyway.

Re:So, an Exploit For a Patch?

[by Anonymous Coward]

That's your own fault. You were supposed to stay away from liquids.

Re:So, an Exploit For a Patch?

[TheGhostOfDerrida (953992)]

I tried to read the article, but it got a little confusing... is this a worm for a patch? A patch for a worm? A patch for a patch? A worm for a patch for a patch? a patch for a worm for a patch for a patch? A worm that patches? A patch that worms? Patches for worms? Does my dog (patches) have worms? I lost interest. And I think the TV is on...

Re:So, an Exploit For a Patch?

[OriginalArlen (726444)]

Immunity RE'd the patch to find the original vulnerability. The exploit attacks unpatched machines. Sorry if you were being sarcastic or weird or something (I find it hard to tell the difference.) Anyway, CANVAS (which costs mucho dineros) is not the problem. I'd be more enclined to worry about the (Free) Metasploit Framework [metasploit.org] exploit, by H D Moore - it only works on XP SP1 , W2K3 SP0 and W2K, but there are probably still lots of machines out there in those categories. You may remember Mr Moore, he it was w

Not really that serious

[$RANDOMLUSER (804576)]

From TFA:

In most enterprises, Pescatore said the use of firewalls and the automatic blocking of TCP ports 139 and 445 should help mitigate the risk. However, he cautioned against IT administrators letting their guards down.

If you have 139 or 445 exposed to the Internet, you've already been infected with something.

Re:Not really that serious

[140Mandak262Jamuna (970587)]

Well, In almost all companies and most homes the ports 137-139 and 445 are blocked at the firewall. But internally these ports are open otherwise file sharing/printer sharing inside the network is impossible. True, it wont be serious as long as the firewall holds. But all it takes is one home user bringing an infected laptop to work and plug it in and all hell breaks loose. I had an old NT4.0 machine just to support old releases of our product and for debugging. A salesman from Taiwan came in plugged his laptop in and I was hosed. Worse, the worm was probing rest of the corporate network so seriously that network traffic slowed to crawl in the company. All the top management knew was that I had an unpatched old computer in the network and compromised the company intranet and lost half their work day.

How easy it is to bring an infected laptop and plug it in behind the firewall? Our salesmen travel all over the world, plug into untold number of hotel intranets and wi-fi cafes. They leave these two ports open when plugged into company intranet. Do they always remember to close these ports when they work in an untrustable network connection? Chances of infection are great. Chances of them bringing the infection behind the firewall into the corporate network is great. I would not hastily dismiss it nonchalantly.

Re:Not really that serious

[walt-sjc (145127)]

IMHO, you should not be blocking those ports at the firewall, but rather redirect them to a responder that floods the return path with copies of the Ubuntu ISO. Run QOS on your outbound and set it at a lower(est) priority than your normal traffic so it doesn't impact you.

Re:Not really that serious

[g-san (93038)]

Nah.... tarpit. Put a listener on those ports (you windows users will have to reboot into linux for this. try it, you'll like it.) Open the connection, read from the channel, then just sit there until the remote end times out. If the worm is stupid enough it will connect back to your PC a few times. That slows them down, and doesn't cause any harm to the net. Or send back three bytes of data every 20 seconds or so... the remote end will buffer it expecting more to come and stretch the timeout even further.

Re:Not really that serious

[mdarksbane (587589)]

Yep, the company I used to work for made a product to stop just that.

One of the emerging areas in enterprise security is so-called "endpoint" security solutions, that will verify whether a user plugging into a corporate network has
1) approved virus software with updated definitions.
2) an approved firewall
3) Any software updates that the techies have deemed required.

If you don't, you get shunted off to a quarantined part of the network with instructions on how to obtain the software to make you compliant.

On the one hand, it sounds like a pain to set up and annoying for the users (and as it usually requires dhcp enforcement can be bypassed by someone who knows the network), and we didn't run in it at our own company, but on the other hand I bet that if they required it at the university I went to the virus problem there would have been much more controlled.

Re:Not really that serious

[telchine (719345)]

I'm a Windows user.

Can somebody please tell me what the hell a port is? :)

Re:Not really that serious

[Corbets (169101)]

Unfortunately, it's not that easy. You can (and most everyone does) block those ports at the firewall level. However, people that VPN in or connect via dialup, people who previously connected via the wireless at the local Panera, and either disabled their software firewall or just kept using their machine after that particular piece of software crashed.... they're infected, and when they VPN in, they go right through that precious firewall.

Every.layer.Every.step.Every.machine.Must.be.secur ed.and.patched.

It is, unfortunately, the only way.

maybe not so STUPID

[Gary W. Longsine (124661)]

Any netadmin that allows VPN connected networks full access to their internal nets are idiots who need to get fired VERY soon.

Your assertion seems obvious on the face of it, but it fails to consider the effects of bureaucracy and complexity, which are real and profound. Many systems administrators are restrained from improving the security posture of networks and systems in "obvious" ways because the business has "requirements" which prevent it. Many of these requirements are derived, in turn, from the tangled complexity of interlocking capability and limitations of various network, systems, and software. Suppose your VPN was established to allow 5000 employees scattered around the country access to hundreds of servers scattered around, too. You might say the architecture is flawed, and it might well be, but if you're the admin and you didn't get to make those decisions then you probably also don't get to just decide to shut down VPN access to Windows port 139, 445 and so forth.

It's been a while

[ronanbear (924575)]

Since there's been any worms attacking new exploits. I'd even begun hearing from some people that the days of Blaster style attacks are over.

This should remind Windows users about complacency.

Pen Testing?

[devnullkac (223246)]

OK, maybe I'm just missing an acronym/typo somewhere, but "pen testing?" Will the worms come through my Mont Blanc?

Re:Pen Testing?

[1_brown_mouse (160511)]

Ha Ha! I use a PaperMate and they have never been cracked due to superior design and stylishness. Its the simple interface.

Re:Penetration Testing?

[by Anonymous Coward]

"Pen" is a commonly used short term for "penetration" so you could interchange "pen testing" with "penetration testing."

Or, in your case, you would request full pen videos when you go to video rental store.

Re:Penetration Testing?

[Billosaur (927319)]

Well, it's better than calling it "digital penetration".

Yes, that involves something entirely different... wink, wink, nudge, nudge, say no more!

Pen Testing explained

[krell (896769)]

The "pen test" is to see whether it much easier, faster, safer, and cheaper to create a document using a pen and paper compared to booting up the computer and doing it there.

The Cyber Gnome, Denouncer of Computer Myths

[krell (896769)]

"The Cyber Gnome here. Denouncer of computer myths. Who needs to download security patches? I don't, and I've never had any prob%$#@@@@#^_@_#@ NO CARRIER"

Let's mobilize

[ericlondaits (32714)]

From TFA:<BR>
<blockquote>A spokesperson for Microsoft said it is difficult to predict the motives and actions of attackers but insisted the company is "watching round-the-clock" and actively encouraging customers to download the update immediately.

"We will mobilize if something does happen," the spokesperson said.
</blockquote>
They'll mobilize? Mobilize? As in "get the heck out of here"? Or are they calling the [GI]Joes?

Re:Let's mobilize

[TheRaven64 (641858)]

"launch all vista"

I think you mean:

Take off all Vista! For great profit!

There should probably be a 'We get worm! Main firewall turn on!' in there somewhere too.

The Patch

[nherc (530930)]

Here is the actual patch page for every version of Windows and further information. [microsoft.com]

Not quite

[jackmama (34455)]

which was deemed wormable on all Windows versions, including Windows XP SP2 and Windows Server 2003 SP1

HD Moore posted a followup to the Daily Dave mailing list admitting defeat on those two platforms:

Time to eat my words. The wcscpy() destination pointer trick doesn't seem
doable on XP SP2 or 2003 SP1. I don't believe you can exploit this bug
for more than a DoS on 2003 SP2/XP SP1. If you have information to the
contrary, please share.

All other Windows platforms remain easily exploitable, though.

Re:Not quite

[jackmama (34455)]

Windows XP SP2 is the current version of Windows. Has been for almost two years. Aside from Windows XP SP1 all other versions of Windows are no longer supported by Microsoft.

Well, that's a relief. I was worried that millions of PCs and servers might still be out there running Windows 2000 and NT, and might help propagate some sort of worm. As long as all computers are magically running the currently-supported versions of Windows, I guess we're OK.

New Microsoft Windows mascot suggestion.

[krell (896769)]

Here's my suggestion for a new Microsoft Windows mascot [halcyon.com]. She's old enough to be public domain, she's tanned, she's rested, she's ready, and she's all patched to hell. All the better that Redmond is located in the vicinity of America's "Emerald City". Please, pay no attention to the borg behind the curtain.

Looking for fame and fortune

[brian23 (962399)]

So companies like Immunity reverse-engineer an identified Microsoft patched vulnerability, release an exploit and expect kudos? Impressive as it may sound, I would be more interested to hear of a company discovering a vulnerability and releasing it to Microsoft so it can be patched. If I can't create a virus/worm to wreak havoc on Windows machines, what makes these companies able to reverse-engineer and release the "0-day" exploit? It almost seems unethical. Also, it seems like Immunity and others are trying to make a name for themselves rather than being interested in user security.

Re:Looking for fame and fortune

[OriginalArlen (726444)]

So companies like Immunity reverse-engineer an identified Microsoft patched vulnerability, release an exploit and expect kudos?

Nope, they do it to make money from selling the superb CANVAS product to penetration testers and other security professionals. They couldn't give a rat's ass what some random fucko on Slashdot thinks of it. Sorry to be the bearer of bad news... ;p

Microsoft Bracing for (Giant) Worm Attack

[geobeck (924637)]

Emperor Shaddam Gates IV admitted today that the high rock formations that ring the city of Arredmond might not be able to repel a full-on attack by the Frehax0rz and their giant worms. Story at 11.

Re:The power of Homeland Security compels you!

[skoaldipper (752281)]

I have a red shield and X in my systray so I'm safe. I think it's a warning symbol for anyone trying to hack my box, like a medieaval coat of arms or something saying my computer is stronger than them.

Ummm...

[by Anonymous Coward]

Tell your "neighbor" that if he doesn't want to pay for an OS, that he shouldn't be using Windows.

But if he's too fucking cheap to get an OEM copy or something and too fucking stupid to bypass the WGA, he should be prepared to have his ass handed to him when this shit hits.

I'd recommend him going to ubuntu.com, though.

Re:How will this effect unpatched pirated versions

[skoaldipper (752281)]

Your pirate neighbor should be ok. I'm pretty sure the green parrot on his shoulder will eat any worms. If not, the patch over his right eye is probably the most current out there.

Pirate loading windows.

[krell (896769)]

Your pirate neighbor (what, do you live on a WHARF???) should be able to get around this by launching his Windows in pirate mode. He has to boot to the command line, and then enter WIN.EXE -R -R -R. Also, has he considered the eyepatched system? It might be more useful to him than the "unpatched system" you mentioned.

Re:File Servers

[Professor_UNIX (867045)]

Our enterprise file servers run w2k3sp1... Those ports are open on these machines. Basically we have to hope that noone brings infection inside.

That would be impossible unless you have users that have laptops that they take outside the office or users that browse the web or receive e-mail to their desktops or users that connect remotely from their homes via dialup or VPNs. All very unlikely scenarios in any modern business environment.

Re:Any comment from DHS?

[DimGeo (694000)]

Actually, the article is misleading. The patch *fixes* the bug, it doesn't introduce it.