TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ---------------------------------------------------------------------------- Copyright 2001 Internet Security Systems (tm) THE POWER TO PROTECT ============================================================================ =========== INTERNET THREAT UPDATE for August 23rd through August 26th 2001 ISS X-Force Special Operations Group ============================================================================ =========== August 23rd, 2001: ALERTCON 1 August 24th thru 26th: ALERTCON 1 ============================================================================ =========== NOTE 1: The web site is now available at www.iss.net <http://www.iss.net> then Click on the "Global Internet Threat Intelligence Service". NOTE 2: This update is not valid unless electronically signed. ============================================================================ =========== CURRENT THREAT ASSESSMENT & THREAT FORECAST ============================================================================ =========== - We continue to hold at AlertCon 1 for today through the weekend. - Assumed at this AlertCon state is Code Red in all its forms, all virus activity, all web defacement activity, all internal threat activity, all vulnerabilities and their exploits, misconfigured of software, weak passwords (or no passwords) and weak permissions. In short, all the elements of general warfare against network weaknesses we see 24 x 7. That's AlertCon 1. - We urge everyone to use this period between Internet emergencies to keep patching IIS software and continue pressing for the inclusion of home computers in the company's security program. Home-based computers continue to be the weak link in any network and should be considered hostile unless the current condition of the OS, anti-virus software, and personal firewall are known. - The back door installed by Code Red II on countless thousands of computers worldwide is still a major concern. These back doors are Internet addressable and need to be cleaned out immediately. - We've received a report of a new variant of Code Red II that we are calling CR IIc. It has a more efficient buffer overflow script but otherwise nothing is remarkably different. The RealSecure <http://www.iss.net/customer_care/whats_new/index.php> signature contained in XPU 3.1 will detect this variant ============================================================================ ========== SOLUTIONS ============================================================================ ========== - Regarding the continuing Code Red Worm Threat: -- Patch your IIS machines from the links noted below: --- Microsoft Windows 2000 Professional, Server and Advanced Server <http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30800> --- Microsoft Windows NT version 4.0 <http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30833> -- Solutions provided by ISS and Black Ice include the following: --- X-Force Advisory <http://xforce.iss.net/alerts/advise90.php> dated August 6th, 2001 with recommended RealSecure <http://www.iss.net/customer_care/whats_new/index.php> XPU 3.1 or user defined included. --- ISS Internet Scanner <http://www.iss.net/securing_e-business/security_products/security_assessmen t/internet_scanner/index.php> with Flex Check <http://www.iss.net/eval/eval.php> --- ISS Systems Scanner <http://www.iss.net/securing_e-business/security_products/security_assessmen t/system_scanner/> --- Black Ice Sentry <http://www.networkice.com/products/blackice_sentry.html> --- Trend Micro <http://www.trendmicro.com> also has a variety of solutions towards detection and isolation of the Code Red worm as well as its backdoor component. - FREE VULNERABILITY SCAN: As a general solution to common computer security deficiencies, run the free security scanner provided by ISS and see how your own computer measures up for general security (not Code Red related). Try it from home too! Visit Online Scanner <https://onlinescanner.iss.net>. ============================================================================ ========== Attack Signatures ============================================================================ ========== Denial Of Service 32.18% Protocol Decode 22.89% Unauth Access Attempts 20.94% Suspicious Activity 19.81% Pre-Attack Probe 04.12% Back Doors 00.06% ============================================================================ ========== Top Ten Destination Ports 80 84.12% 25 07.50% 21 04.58% 123 01.25% 443 00.90% 139 00.61% 6768 00.31% 143 00.26% 2560 00.23% 137 00.23% ============================================================================ ========== VULNERABILITIES ============================================================================ ========== � Check out the web site at www.iss.net <http://www.iss.net> under Global Internet Threat Intelligence Service. ============================================================================ ========== MALICIOUS LOGIC ============================================================================ ========== � Check out the web site at www.iss.net <http://www.iss.net> under Global Internet Threat Intelligence Service. ============================================================================ ========== WEB SITE DEFACEMENTS ============================================================================ ========== - Normal defacement reporting. -- Alldas.de reports 82 defacements on Wednesday, August 22nd and up to now there have been 25 reported on Thursday the 23rd (11:20 AM GMT). -- Alldas.de cites the most defaced web software remains Windows, with a total of 14,851 since April 2000, 66% of the total. Linux is in a distant second place with 3,680 defacements, for 16% of the total. ============================================================================ ========== BREAKING NEWS ============================================================================ ========== � No stories made the cut today. ============================================================================ ========== DISCLAIMER AND COPYRIGHT NOTICE ============================================================================ ========== We provide this information on Internet threat metrics, viruses, vulnerabilities, patches, and breaking news, in the spirit of PDD 63, to help security professionals wage the war against Internet threats more effectively. Information in this update derived primarily from global, real time, 24 x 7 IDS feeds, ISS X-Force R&D Team research, and professional liaison. Other sources as noted. AlertCon 1 reflects the global, malicious, determined, 24 x 7 attacks experienced by all networks. AlertCon 2 means increased vigilance/action recommended due to a specific threat or concern. AlertCon 3 means increased attacks against specific targets or vulnerabilities on a scale that is unusually high, action required. AlertCon 4 reflects an Internet emergency for a target or group of targets whose business continuity may depend on some sort of immediate, decisive action. All summaries cover 24 hours the previous workday, GMT. Monday summaries may cover some weekend activity. Copyright 2001 Internet Security Systems, Inc. Permission is granted for the redistribution of the Internet Threat Update electronically. It is not to be sold or edited in any way without express consent of ISS. Refer comments or questions to [EMAIL PROTECTED] <mailto:<mailto:[EMAIL PROTECTED]>>. Disclaimer: This information is subject to change without notice. Use of this information constitutes acceptance for use in an "as is" condition. There are no warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. No other use authorized without written permission from ISS. Provided in MS Word with digital signature; invalid without this signature from the sender or InfraGard Atlanta. Dennis Dennis Treece Director, Global MSS Special Operations Group Internet Security Systems (ISS) 6303 Barfield Road Atlanta, Georgia 30328 404-236-4065 Cell 404-667-9345 Fax 404-236-2626 Internet Security Systems -- The Power to Protect Confidentiality Notice: This message is being sent by or on behalf of a network security professional. It is intended exclusively for the individual to whom it is addressed. This communication may contain information that is proprietary, privileged or confidential.
AlertCon 1/1 Internet Threat Update for 23-26 Aug 2001
Treece, Dennis (ISS Atlanta) Thu, 23 Aug 2001 11:25:37 -0700
