TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to [EMAIL PROTECTED] Contact [EMAIL PROTECTED] for help with any problems! ---------------------------------------------------------------------------- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Note: I'm continuing to work through the electronic signature issues - please bear with me Copyright 2001 Internet Security Systems (tm) THE POWER TO PROTECT ======================================================================== =============== INTERNET THREAT UPDATE for August 22nd through August 24th 2001 ISS X-Force Special Operations Group ======================================================================== =============== August 22nd, 2001: ALERTCON 1 August 23rd and 24th: ALERTCON 1 ======================================================================== =============== NOTE 1: The web site is now available at www.iss.net <http://www.iss.net> then Click on the "Global Internet Threat Intelligence Service". NOTE 2: This update is not valid unless electronically signed. ======================================================================== =============== CURRENT THREAT ASSESSMENT & THREAT FORECAST ======================================================================== =============== - - We are holding at AlertCon 1 for today through Friday the 24th a normal vigilance condition but normal means open warfare on the Internet, reflecting the global, malicious, 24x7 attacks all networks face. - - We urge everyone to use this period between Internet emergencies to keep patching IIS software and continue pressing for the inclusion of home computers in the company's security program. Home-based computers continue to be the weak link in any network and should be considered hostile unless the current condition of the OS, anti-virus software, and personal firewall are known. - - Our customer sensors continue to detect traces of the Code Red worm circulating through the Internet. The back door installed by Code Red II on countless thousands of computers worldwide is a major concern. These back doors are Internet addressable and need to be cleaned out. A good way to check for Code Red I infestations is to watch outbound traffic for the White House web site, since CR I has entered that phase of its recurring life. - - We've received a report of a new variant of Code Red II that we are calling CR IIc. It has a more efficient buffer overflow script but otherwise nothing is remarkably different. The RealSecure <http://www.iss.net/customer_care/whats_new/index.php> signature contained in XPU 3.1 will detect this variant ======================================================================== ============== SOLUTIONS ======================================================================== ============== - - Regarding the continuing Code Red Worm Threat: - -- Patch your IIS machines from the links noted below: - --- Microsoft Windows 2000 Professional, Server and Advanced Server <http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30800> - --- Microsoft Windows NT version 4.0 <http://www.microsoft.com/Downloads/Release.asp?ReleaseID=30833> - -- Solutions provided by ISS and Black Ice include the following: - --- X-Force Advisory <http://xforce.iss.net/alerts/advise90.php> dated August 6th, 2001 with recommended RealSecure <http://www.iss.net/customer_care/whats_new/index.php> XPU 3.1 or user defined included. - --- ISS Internet Scanner <http://www.iss.net/securing_e-business/security_products/security_asse ssment/internet_scanner/index.php> with Flex Check <http://www.iss.net/eval/eval.php> - --- ISS Systems Scanner <http://www.iss.net/securing_e-business/security_products/security_asse ssment/system_scanner/> - --- Black Ice Sentry <http://www.networkice.com/products/blackice_sentry.html> - --- Trend Micro <http://www.trendmicro.com> also has a variety of solutions towards detection and isolation of the Code Red worm as well as its backdoor component. - - FREE VULNERABILITY SCAN: As a general solution to common computer security deficiencies, run the free security scanner provided by ISS and see how your own computer measures up for general security (not Code Red related). Try it from home too! Visit Online Scanner <https://onlinescanner.iss.net>. ======================================================================== ============== Attack Signatures ======================================================================== ============== Denial Of Service 32.18% Protocol Decode 22.89% Unauth Access Attempts 20.94% Suspicious Activity 19.81% Pre-Attack Probe 04.12% Back Doors 00.06% ======================================================================== ============== Top Ten Destination Ports 80 84.12% 25 07.50% 21 04.58% 123 01.25% 443 00.90% 139 00.61% 6768 00.31% 143 00.26% 2560 00.23% 137 00.23% ======================================================================== ============== VULNERABILITIES ======================================================================== ============== � Check out the web site at www.iss.net <http://www.iss.net> under Global Internet Threat Intelligence Service. ======================================================================== ============== MALICIOUS LOGIC ======================================================================== ============== � Check out the web site at www.iss.net <http://www.iss.net> under Global Internet Threat Intelligence Service. ======================================================================== ============== WEB SITE DEFACEMENTS ======================================================================== ============== - - Normal defacement activity. - -- Alldas.de reports 76 defacements on Tuesday, August 21st and up to now there have been 46 reported on Tuesday the 21st (11:30 AM GMT). - -- Alldas.de cites the most defaced web software remains Windows, with a total of 14,824 since April 2000, 66% of the total. Linux is in a distant second place with 3,675 defacements, for 16% of the total. ======================================================================== ============== BREAKING NEWS ======================================================================== ============== � No stories made the cut today. ======================================================================== ============== DISCLAIMER AND COPYRIGHT NOTICE ======================================================================== ============== We provide this information on Internet threat metrics, viruses, vulnerabilities, patches, and breaking news, in the spirit of PDD 63, to help security professionals wage the war against Internet threats more effectively. Information in this update derived primarily from global, real time, 24 x 7 IDS feeds, ISS X-Force R&D Team research, and professional liaison. Other sources as noted. AlertCon 1 reflects the global, malicious, determined, 24 x 7 attacks experienced by all networks. AlertCon 2 means increased vigilance/action recommended due to a specific threat or concern. AlertCon 3 means increased attacks against specific targets or vulnerabilities on a scale that is unusually high, action required. AlertCon 4 reflects an Internet emergency for a target or group of targets whose business continuity may depend on some sort of immediate, decisive action. All summaries cover 24 hours the previous workday, GMT. Monday summaries may cover some weekend activity. Copyright 2001 Internet Security Systems, Inc. Permission is granted for the redistribution of the Internet Threat Update electronically. It is not to be sold or edited in any way without express consent of ISS. Refer comments or questions to [EMAIL PROTECTED] <mailto:<mailto:[EMAIL PROTECTED]>>. Disclaimer: This information is subject to change without notice. Use of this information constitutes acceptance for use in an "as is" condition. There are no warranties with regard to this information. In no event shall the author be liable for any damages whatsoever arising out of or in connection with the use or spread of this information. Any use of this information is at the user's own risk. No other use authorized without written permission from ISS. Provided in MS Word with digital signature; invalid without this signature from the sender or InfraGard Atlanta. Dennis Dennis Treece Director, Global MSS Special Operations Group Internet Security Systems (ISS) 6303 Barfield Road Atlanta, Georgia 30328 404-236-4065 Cell 404-667-9345 Fax 404-236-2626 Internet Security Systems -- The Power to Protect Confidentiality Notice: This message is being sent by or on behalf of a network security professional. It is intended exclusively for the individual to whom it is addressed. This communication may contain information that is proprietary, privileged or confidential. -----BEGIN PGP SIGNATURE----- Version: PGP 6.5 iQA/AwUBO4P1c+OOe/7N9KJeEQIy6wCfckCRr9Kg1GBrlrYdpVAvOJv9aG4AoIXq OdV8sJhSRr8hDzAT1IAx/Anv =glaZ -----END PGP SIGNATURE-----
AlertCon 1/1 Internet Threat Update for 22-24 August 2001
Treece, Dennis (ISS Atlanta) Thu, 23 Aug 2001 11:32:56 -0700
